In your experience where do risk management plans fallshort? What are the types

In your experience where do risk management plans fallshort? What are the types of risks that an organization might faceand how could it mitigate those risks?