In the event the third line of defense determines that an action plan must be established to mitigate an identified risk or operational issue, the first and second lines of defense are tasked with developing such a plan and executing it within a given time-frame.