whats at risk if no incident plan