What are the controls and the gaps of the following from an IT audit perspective:

Windows servers are used for all server types (application, web, and database delivery). Windows patch updates comply with the change management policy. Windows patches are downloaded to a central patch server. All patches are reviewed and tested prior to deployment to production servers. All approved patches are first deployed to the development servers, then to the test servers and finally to production servers. Although patches occur on Wednesday evening, if a system reboot is required these are not perform until the weekend downtime window. Approval is not required for patch updates for these are considered a normal standard process for ABC. Additionally, prior to deployment all patches are reviewed to ensure they will function with current systems.