I think we see a benefit in having a plan outline and expected timelines for broad categories of activities, but also in providing an expected time frame within which the overall plan might need to be revisited and renewed.
The main concern we have is with respect to any obligation to specify timelines for discrete activities, such as an individual risk assessment.