Security Risk Management: Building an Information Security Risk Management Program

Think of a time where someone (or yourself) mitigated a risk that should not have been mitigated? Why was it completed and what was the result? I look forward to the engagement.