When weaknesses are discovered, the business managers are expected to either improve compliance with existing policies or consult with the corporation's security experts regarding the feasibility of implementing new policies or control techniques.
There is nothing a business manager can do if weaknesses are discovered, but to watch the business fail.