In the event the third line of defense determines that an action plan must be established to mitigate an identified risk or operational issue, the first and second lines of defense are tasked with developing and executing the plan within a given timeframe.