This was a real conversation. We were meeting with some of the staff in the PMO and they had brought their Risk Management Plan for review. It was an impressive document with 65 pages of everything you ever needed to know about risk management. This was the culmination of weeks and weeks of effort and many meetings. The sad thing is that in the time they had spent documenting the process they could have collected, analyzed and responded to all the program's risks and been in a much better position to ensure program success.
You don't need to spend weeks and weeks defining a risk management process, it has already been documented to the finest level of detail and there's not a lot of options to ponder. Likewise, you don't need to spend hundreds of thousands of dollars to be told that you need a change control board (sadly another true story).
As real process engineers will tell you, a process definition is not a process. Instead of spending months and months documenting processes it is far more effective to reference existing documentation. Keep the process simple and transparent so that it can be easily implemented and iterate often in the early stages to right size the process to fit the team. Remember a process definition is not read but referenced, so make sure it is small, online and referenceable.