There are two ways to fail to meet the risk management goal.
You did not spend enough. That is: You could have reduced expected losses by $X amount by spending $Y on defense, where $X is more than $Y, but you didn't spend the money on defense.
You spent too much. That is: You spent $Y on defense thereby reducing expected losses by $X amount, where $X is less than $Y.