It must be timely because there are risks associated with acting either too early or too late and it must be gradual because the situation is only improving progressively. The process of withdrawal is facilitated by the fact that many of the non-standard measures were designed to phase out naturally over time unless renewed by explicit policy decisions.
In the public sector, my list of vulnerabilities would include gaps in the regulatory structure that allowed systemically important firms and markets to escape comprehensive supervision; failures of supervisors to effectively apply some existing authorities; and insufficient attention to threats to the stability of the system as a whole (that is, the lack of a macroprudential focus in regulation and supervision).