When weaknesses are discovered, the business managers are expected to either improve compliance with existing policies or consult with the corporation's security experts regarding the feasibility of implementing new policies or control techniques.
Weaknesses can be discovered at any stage, but they can also be reinforced at any stage.