In this chapter
4.1 A gap is relative to an agreed outcome
A missing tool is not automatically a gap. If the institution cannot establish that execution matches the authorized request, the gap is decision integrity. A workflow engine might help implement a remedy, but naming one does not establish the problem or its priority. For every gap, connect the current evidence to the institutional promise, describe a plausible failure and identify an accountable risk owner. Distinguish a weakness from a realized incident. “Could allow an unauthorized change” and “has caused unauthorized changes” are different claims.
4.2 Prioritize consequences and uncertainty
| Gap | Plausible consequence | Priority in this scenario | Required response |
|---|---|---|---|
| G-01: approval version is not authoritative | Fulfilment differs from authorization | P1 | Define version-bound transitions and prove rejection of stale updates |
| G-02: restore has not been demonstrated | Service cannot resume within the agreed window | P1 | Establish objectives and perform a restore exercise |
| G-03: reporting cut-offs differ | Managers compare incompatible totals | P2 | Agree one reporting contract and reconcile a known period |
| G-04: retry semantics are undefined | An ambiguous timeout creates duplicate work | P2 | Define command identity and replay tests |
P1 and P2 are ordering labels for this constructed example. They are not a calibrated institutional risk rating. Actual likelihood, financial impact and legal consequence need local evidence and authorized interpretation.
4.3 Follow the dependency chain
Fixing reporting before agreeing the authoritative approval state may encode an unstable definition. Replicating an unrecoverable system to more offices increases exposure. The sequence therefore begins with authority and recovery requirements, then validates one journey, then expands coverage. A high-risk unknown can justify discovery before implementation. For example, data placement may change the feasible hosting design; branch continuity requirements may change the consistency model. Record the decision blocked by each unknown and what evidence would release it.
4.4 Remediation options
For G-01, compare retaining the current application with a controlled versioned approval extension against replacing the workflow completely. The narrower extension may reduce migration risk if the existing system can support the required invariants. Replacement becomes more plausible when ownership, testing or integration constraints make that extension unsafe. For G-02, a backup product purchase alone is insufficient. The remedy includes protected backup access, a known recovery point, an isolated restoration procedure and a responsible person able to demonstrate it. The institution must accept residual risks such as recovery delay and manual reconciliation.
4.5 Risk acceptance and closure
- Record the finding, evidence reference, consequence and owner.
- Compare feasible treatment options and their operating costs.
- Define an observable closure test and the evidence to retain.
- Record residual risk, exception authority and the next review trigger.
A gap is closed when the agreed evidence supports closure, not when a ticket is marked done. The architect recommends treatment; the authorized institutional owner accepts residual risk.