Risk Strategy

Your Risk Mitigation Plans Need the Same People

Three credible mitigation plans can become one impossible commitment when they need the same people. Make the capacity tradeoff visible before the dates slip.

By Eric Kennedy · Thu Oct 08 2026 · 8 min read

A risk mitigation plan is not credible just because every action has an owner, funding and a due date. If several actions need the same scarce people during the same period, management has approved competing claims on capacity. The risk report should expose that conflict before it becomes an overdue-action report.

For a CFO or audit committee, the question is specific: Which commitments depend on the same constrained resource, and who has decided what gives way?

Consider the controller who must improve access controls, repair reconciliations and support a recovery test while still closing the books. Each action can look reasonable in its own review. Together, they may be impossible within the dates promised. Asking the controller to confirm all three deadlines does not resolve the conflict.

This is a risk response problem that requires an operating decision. The executive team has to choose a feasible sequence, provide usable capacity, change the work or explicitly address the exposure that remains while it waits.

An owner is not a reservation of capacity

Assigning an action owner establishes accountability for a deliverable. It does not establish that the people needed to deliver it are available. The named owner may depend on a systems administrator, a plant engineer, a legal reviewer or a finance specialist whose time is already committed elsewhere.

Funding has a similar limitation. Budget approval can pay for an outside specialist. It cannot make that specialist familiar with your systems on arrival, give them approval authority or eliminate the internal review their work requires.

There is a useful distinction in established guidance. HM Treasury's Orange Book, section D8 says a risk treatment plan should identify resources, constraints and timing alongside responsibilities. The UK's GovS 002 project delivery standard, section 7.4 calls for future resource needs to be understood and work to be replanned when resources are insufficient. Both documents concern UK government organizations. They are useful management references here, not requirements imposed on a US mid-market company.

The implication for an executive risk review is straightforward. A due date supported by a staffing assumption should be reported as conditional until the resource owner confirms the allocation and competing commitments are reconciled.

The shortfall sits between the plans

Illustrative scenario. A finance systems lead has 60 hours available for mitigation work during a four-week window, after normal operations, planned leave and an explicit operating contingency. Three separate plans each require that person's input in the same window:

• Access remediation: 30 hours.
• Reconciliation redesign: 25 hours.
• Recovery testing: 20 hours.

Combined demand is 75 hours. The shortfall is 15 hours: 75 required minus 60 available. All figures are constructed for this example. They are not a KRG client result, a staffing benchmark or a measured loss estimate.

No action owner needs to have made a bad estimate for this to happen. The conflict appears only when the demands are combined. Nor does the calculation tell you which action should move. That requires a judgment about exposure, obligations, dependencies and the consequences of delay.

Even the 60-hour figure needs scrutiny. Hours available in the first week cannot automatically replace specialist time required during a production cutover in the fourth. A coarse total is a useful first check; the dates, skills and access requirements still have to work.

What the capacity numbers do and do not establish

This example assumes the estimates cover different tasks. If two projects include the same configuration change, remove the double count before escalating. Equally, do not omit the handoffs, approvals and testing that turn a technical change into an operating control.

Review the scarce skill, not everyone's timesheet

The answer is not a company-wide exercise assigning every employee to every risk. Start with the people or capabilities on which the most important near-term responses depend. Ask their functional managers to reconcile demand across risk actions, operating work and other approved changes.

The Project Management Institute's third-edition portfolio standard, section 6.2, pages 92–93 describes aggregating resource demand across initiatives and matching it to organizational supply. It also discusses operational workload and bottleneck skills. This is a 2013 portfolio-management reference, not evidence about how frequently mid-market mitigation plans fail.

For each material dependency, establish what work is required, who has the necessary skill, when their contribution is needed and what capacity their manager can actually release. An estimate range is more honest than a precise number nobody has tested. Identify the assumption most likely to change the answer.

Finance can bring the approved commitments together. Functional leaders must validate the availability and sequencing. The risk owner must explain what remains exposed if the work slips. Where the tradeoff crosses functions, an executive with authority across those functions must settle it.

Internal audit can challenge the evidence supporting the plan and report an unresolved conflict. It should not quietly become the allocator of management's staff just because its finding created one of the actions.

Choose what changes before accepting the date

When the combined plan exceeds capacity, there are several legitimate responses. Each has a condition that needs to be made explicit.

Sequence the work. Move a lower-priority activity to a later window after assessing what remains exposed. A revised date is not itself authorization to carry that exposure. Use the company's risk acceptance process where required by its governance arrangements.

Add usable capacity. Bring in support or release someone from other duties, but name the skill needed and allow for onboarding and supervision. Count only the work the additional person can actually perform. An external specialist who still needs substantial time from the constrained lead may resolve less of the gap than the purchase order suggests.

Reduce or redesign the work. Separate the essential control outcome from optional improvements. Combining related work can remove duplication. It can also create a larger change that is harder to test. Confirm that the reduced scope still addresses the failure mechanism that justified the action.

Defer with explicit risk handling. State the remaining exposure, interim measures, review date and decision authority. Some deadlines and obligations cannot be waived internally. Escalate those constraints instead of presenting deferral as an unrestricted choice.

The point of this review is to make a decision the action owners cannot make individually. In the illustrative scenario, telling all three owners to stay on schedule leaves the 15-hour gap intact. Management has to change an input or acknowledge that the combined delivery forecast is unsupported.

Keep delivery confidence separate from risk reduction

A feasible staffing plan improves confidence that work can be completed. It does not prove that the resulting control will work.

Keep those judgments separate in the risk report. Explain the current exposure, the response that is planned and the evidence needed before the assessment can give that response credit. The distinction between current and target residual risk still applies after capacity has been secured.

For the board or audit committee, the useful update is not a list of every allocation. It is the material constraint, the affected exposures, management's recommendation and the decision required. The existing board-ready reporting deck can carry that discussion without creating another reporting format.

A constructed example of the message is: “Three mitigation commitments require the same finance systems lead in the next four weeks. They need 75 hours; confirmed availability is 60. Management must resolve a 15-hour shortfall before we can support the combined delivery dates. The current risk assessments remain based on controls operating today.”

That message does not claim a loss will occur. It identifies which promise management cannot yet support.

Do not turn this into another approval queue

There is a fair objection: estimates are uncertain, people adapt and some tasks take less effort than expected. Requiring a detailed resource model for every small action can cost more than the insight is worth.

Use the review where a shared constraint could materially delay a response or where the deadline has consequences. A low-effort policy clarification may need only a quick confirmation. A system change dependent on scarce technical knowledge deserves a closer look. Escalate an unresolved conflict, not every movement in an estimate.

Do not plan every available hour as though operational surprises have stopped. Have the functional owner explain the contingency allowance and revisit it as conditions change. There is no universal utilization percentage that makes every mitigation portfolio safe.

At your next executive review, pick the most important mitigation commitments due soon and ask whether they rely on the same people. If nobody has reconciled those demands, the dates are still assumptions. The KRG scorecard is a useful place to start assessing whether your reporting brings unresolved decisions to leadership clearly enough to act.

Take the Board-Reporting Scorecard