Any control gaps/weaknesses are captured in the Sourcing Risk Log which is submitted to the relevant subject matter expert who will opine on the appropriate course of action, based on the level of risk associated with the control gap(s).