If, after considering the notification and supporting documentation contemplated in sub-regulation (3), the issuing authority is unconvinced of compliance with regulation 15 of these Regulations by the person carrying out the risk assessment, the issuing authority must, in writing, inform the applicant and such person accordingly and may-
(a) refuse to accept any further reports or input from such person in respect of the application in question; and
(b) request the applicant to-
(i) commission, at own cost, an external review by an independent person or persons of any reports prepared or processes conducted by the person who carried out the risk assessment in connection with the application;
(ii) redo any specific aspects of the work done by the previous person who carried out the risk assessment in connection with the application; and
(iii) complete any unfinished work in connection with the application or take such action as the issuing authority requires remedying the defects.