PM FPX 5334 Assessment 5 Risk Management Plan

Risk Management Plan

Project Name: Vodafone GLAN Network Project

Learner Name: Student Name

Course Name: 5334

Date: July, 2026

Table of Contents

Section 1 – Introduction to the Plan_ 3

1.1 Benefits of Risk Management 3

1.2 Project Goals and Objectives_ 3

1.3 Company Background_ 4

1.4 Risk Identification_ 5

Section 2 – Risk Scope, Components, and Value_ 5

2.1 Scope of the Risk Management Plan_ 5

2.2 Risk Management Plan Components_ 5

2.3 Expected Monetary Value_ 5

2.4 Determine the Risks_ 6

2.5 Evaluate and Assess the Risks_ 6

2.6 Qualitative and Quantitative Processes_ 6

Section 3 – Risk Analysis and Assessment 6

3.1 Major and Minor Risks_ 6

3.2 Risk Probability_ 7

3.3 Risk Matrix Template_ 7

3.4 Risk Data Quality Strategy_ 7

3.5 Risk Reviews_ 7

Section 4 – Corrective Action and Monitoring_ 7

4.1 Risk Tolerance_ 7

4.2 Risk Mitigation_ 7

4.3 Corrective Risk Management Strategy_ 8

4.4 Corrective Action Plan_ 8

Section 5 – Postmortem Plan_ 8

5.1 Results_ 8

5.2 Follow Up_ 8

Section 6 – References_ 9

6.1 References_ 9

Templates_ 10

Risk Matrix Legend Example_ 10

Risk Matrix Example_ 10

Risk Monitoring and Control Example_ 11

Section 1 – Introduction to the Plan

1.1 Benefits of Risk Management

An integral component of any successful project is effective risk management. Risk management assists project managers in anticipating threats, mitigating uncertainty, and preserving organizational resources. Project Risk Management increases the likelihood of success and reduces anxiety and provides the ability to better predict project outcomes (Kallow et al., 2022). When utilized in a structured manner, risk management provides a proactive environment that enables project teams to address issues before they escalate to become expensive failures.

The advantages of applying structured risk management processes to complex technology projects are even more significant than in projects of less complexity. The Vodafone Global Local Area Network (GLAN) project provided an excellent example of how conducting risk assessment workshops early in the project allowed the project team to identify a high-priority risk of potentially millions of euros in cost due to network failure during implementation (Project Management Institute [PMI], 2021). By addressing this risk at the beginning of the project, the project team developed mitigation strategies, recorded the risk in an issue log, and tracked the project’s dependencies throughout the duration of the project. Through this proactive method, the project team received a Net Promoter Score of 10/10 from the customer when the project was completed.

Risk management supports global project cost efficiency and schedule compliance, two critical criteria for successful global projects. According to Testorelli et al (2024), organizations that implement PRM efficiently throughout the entire project lifecycle experience verifiable advantages in terms of cost, time, and quality. Dedicating funds to visit the most important project locations and establishing a formal change control process helped Vodafone avoid cost overruns and protect project resources from scope creep. Through structured risk management, organizations can reduce uncertainty through planned, actionable processes, positively aligning project outcomes with organizational goals.

1.2 Project Goals and Objectives

The foundation for identifying and evaluating risks is a clearly articulated set of project goals and objectives. Vodafone’s Global Local Area Network (GLAN) project began in late 2017 at the request of a strategic customer that wanted to replace the existing legacy network with a fully managed Global Local Area Network (GLAN) that spanned 42 sites across 28 countries (PMI, 2021). The key goal for this project was to finish migrating the full network by November 2019 under a five-year managed services agreement and any and all identified risks throughout the project were evaluated against this overarching goal which meant any risk decisions directly supported project success.

The four objectives of the project were developed on the four aspects of performance which included time, cost, quality and customer satisfaction. Ullah et al. (2026) observed that mapping, balancing and prioritising risks can be critical in maintaining the stability of the project and in accomplishing the project’s objectives. Vodafone operationalised this principle by categorising the 42 customer sites into four categories of priority – Low, Medium, High and Top – each of which required a standardised method of delivery (PMI, 2021). Through this structured approach to prioritisation of risks, any risk at a higher complexity/priority level would be evaluated and addressed with a greater level of detail than would risks at lower complexity levels (such as a customer’s headquarters combining both an office and factory).

Risk evaluation for this project aligned directly with fulfilling contractual obligations and protecting the customer’s production operations. One of the key objectives of the project was to keep the customer’s manufacturing production lines running without interruption as the network was migrated, since any failure would potentially cost millions of euros (PMI, 2021). Therefore, risk tolerance levels (thresholds) were established at a very low level for high severity implementation risks, which drove how much of the project team’s resources to commit to and how to schedule the project’s migration activities. In this way, clear and concise objectives gave the lens through which all project risk identification and response planning efforts were accomplished during the project.

1.3 Company Background

To identify risks and manage stakeholders effectively, one must understand the organisational context of the project. Vodafone is one of the largest telecommunication companies in the globe and operates its wireless network across 24 countries, in addition to having network partnerships in 42 other countries and fixed broadband services provided in 19 markets. There are over 500 million total customers using Vodafone services worldwide (PMI, 2021). Vodafone’s size and international presence facilitate its ability to manage complex, multi-location technology-based projects; however, they also create significant challenges for coordinating work and managing risk across geographically dispersed teams. Vodafone’s project management practices utilise PMI-style project management standards, demonstrating the company’s commitment to following structured processes for delivering in high complexity environments.

One of the first steps to understanding how a project will impact the enterprise is to identify the stakeholders. Siems et al. (2022) note that identifying risks involving stakeholders improves communication between those stakeholders as it requires the sharing of risks and how to mitigate them. The GLAN project will have as stakeholders the strategic customer (a global enterprise that operates factories and offices at 42 different locations) as well as Vodafone’s customer program delivery project team, technical solution architects and third-party suppliers involved in the rollout of the network (PMI, 2021). Each of these groups of stakeholders has different functions and affect the decisions made on the project and risk outcomes based on their role.

In the case of this project, each stakeholder group’s role was integral to establishing the risk management structure for the project. The project management team at Vodafone, which is led by Ahmed ElGedwany, the Senior Customer Portfolio Lead, had responsibility for the delivery approach and ensuring that the agreed-to PMI standards were used throughout the execution of the project (PMI, 2021). The customer had the authority and responsibility to approve the site designs, confirm the migration plan(s) are appropriate, and assess the project’s overall performance, which is exemplified by the 10/10 Net Promoter Score awarded to the project at close. Suppliers to the Vodafone GLAN project also played an important role in the management of resources through their participation in the resource management workshops and had a direct operational impact on how to execute the migrations; therefore, their support was crucial to effectively managing the risks to the schedule and quality.

1.4 Risk Identification

The first and most important component of the risk management process is identifying risks (i.e., identifying and assessing all potential threats to project scope, schedule, cost, and quality) using both qualitative and quantitative methods in order to understand the full range of uncertainty associated with a particular project. As noted by Huzooree and Yadav (2025), professional, effective risk management practices are designed to limit the uncertainties experienced, increase the level of resilience to withstand future adversity, and allow for change and adaptation as project needs change. Vodafone began identifying risks immediately after initiating the GLAN project and conducted structured risk assessment workshops led by technical and project management subject matter experts.

Qualitative risk analysis was primarily used to categorize and prioritize risks on this project (i.e., experts facilitated workshops as an acceptable qualitative technique for assessing the likelihood of occurrence and potential impact (severity); an example of this was a severe network failure during implementation (PMI, 2021). The project team then used a site-priority matrix to classify all identified risks as being Low, Medium, High, or Top priority, based on site complexity; this allowed them to direct their mitigation efforts to the sites with the highest risk first. This type of qualitative prioritization of risks is consistent with PMI’s recommendation that probability-impact assessments be used as the determining factor in assessing which risks should have further analysis or an immediate response.

Quantitative risk analysis complemented the qualitative risk analysis process in that it provided estimates of the financial implications of certain key risk events. For example, the project team was able to quantify the risk associated with network failure as it was estimated that significant disruption(s) to the customer’s production lines could cost millions of euros. this amount was used to prepare the risk response plan and budget (PMI, 2021). As such, the tailored risk management plan and issue log were used to capture all identified risks, assess all dependencies, and document all impact assessments for the respective project throughout the entire lifecycle. In total, both qualitative and quantitative risk identification strategies resulted in the identification, prioritization, and overall risk management of all major risk areas for all 42 global project sites.

Section 2 – Risk Scope, Components, and Value

2.1 Scope of the Risk Management Plan

The scope of project identification that will be concerned with the project Life cycle will be part of Vodafone Global Local Area Network (GLAN) project risk management plan, which will identify the risks that will be evaluated in the project life cycle and resolved. The plan provides all risks factors that can characterize the successful implementation of the network migration of 42 foreign locations that constitute cost, schedule, technical performance and the period of operations.

GLAN project is an intricate and global project, project scope shall contain dangers that will be incorporated in the cross boundary coordination, reliance on suppliers, inconsistency of the infrastructures and any detailed customer production landscape. The topmost risks like the network failure in the implementation process are given priority because the possibility of such an occurrence may lead to the loss of colossal sums of money and downtimes (Pescaroli et al., 2025). The justification of the priority of these risks is that they directly affect the key success factors in the projects in terms of customer satisfaction and sustainability of the services. It will entail both the qualitative and quantitative risk assessment in a bid to have a complete analysis.

The priorities of the risks are stipulated as per the qualitative methodology that involves the probability-impact assessment, the cost implications, on the other hand, are determined as per the quantitative methodology that involves the estimate of the financial implications. It will also evaluate with regards to the place, place and time likelihood. The coverage however does not cover the risks that cannot be directly controlled in the firm like the economic stability of the world or other geo political disasters.

2.2 Risk Management Plan Components

Vodafone GLAN project risk management plan is scheduled on the basis of key areas which can be incorporated to provide the systematic application of risk identification, assessment and management. The risk identification, risk analysis, risk response planning, and risk monitoring and control are among the recommended practices in the project management process that are appropriate and aligned (Project Management Institute [PMI], 2021).

Such means as expert workshops or consulting stakeholders, the analysis of the past data are the systematic means of recognizing the potential threats and opportunities (Hadjigeorgiou et al., 2022). This is because the risks are early identified and represented in a form that they are expounded. This is followed by the identification phase as the qualitative and quantitative analysis to determine the risk analysis. The qualitative analysis will weigh heavily on the risks based on the likelihood of occurrence and waning effect, as compared to the quantitative analysis that considers the losses that are incurred in both financial and operation terms of the significant risks.

The risk response planning is a development issue that is observed to be keen in the development of the relevant plans to address the identified risks. The measures include the risk avoidance, sharing and transfer of risks of risk acceptance depending on the worth and form of risks. The high priority risks like network failure might have mitigation plan which may involve the redundancy plan, gradual upgrading of the system with upgrades and monitoring. The risk management should have short roles and responsibilities. Risk management plan is one of the most important tasks that the project manager should establish and control where an individual would set up and manage the risk management plan in such a way that the overall undertakings can be executed in an effective way. The risk identification and risk analysis in the various arenas is considered, regarding the technical teams and the subject matter experts, and the control and realignment of the same provided by the stakeholders and the top management. In addition, a number of tools and methods will be employed in helping the process of risk management plan.

They consist of prioritization risk matrix, SWOT analysis to analyze the strategy, Gantt charts to track the schedule, decision tree to analyze the response that would be realized by the use of alternatives. Risk of the new risks is constantly monitored and reviewed periodically in order to monitor the risk status, implementation of the new risks and effectiveness of the mitigation strategies. All this would lead to the creation of proactive and systematic risk management process that would help the project team to avoid uncertainty and maximize risk of project success.

2.3 Expected Monetary Value

EMV is a qualitative analysis process, this is an approximation of the financial effects of the risks and the cost of the risk not identified under a risk management plan. EMV can be calculated as the product of the probability of occurrence of risk and the probable economic impact of such an occurrence to provide a practical approximation of expected loss.

Among the biggest risks that have been identified in the Vodafone GLAN project, the network failure during the implementation stage would leave a distraction in the production process of customers. The probability of this risk to take place according to the project estimates is approximately 20 percent and that the level of financial impact could be approximated to be 5,000,000 euros due to the downtime in its production and associated loss of business.

EMV = Probability × Impact
EMV = 0.20 × €5,000,000 = €1,000,000

This computation indicates that the financial loss of this single risk would have been projected to 1,000,000 euros in case there would be no risk mitigation strategies implemented. Having multiple risks to be considered in 42 locations all over the world, the financial exposure can be a tremendous amount and thus, the development of risks is of paramount importance.

Formal risk management strategy lessens the risk occurrence and impact by recognizing the risk and mitigating measures at an initial point, and observing the risks. As a result, organizations will be in a position to save a lot of costs and improved allocation of resources. According to PMI (2021), the correct risk management practices not only reduce the potential loss but also enhance the decision making and project performance. Moreover, risk management plan can have other advantages besides financial saving.

It makes the project more predictable, gives the stakeholders more confidence and the project is made aligned to the organizational goals (Alshukri et al., 2024). Risk management assists in achieving project objectives within the set scope, time and budget by reducing uncertainty as well as making informed decisions.

2.4 Determine the Risks

In that regard, the second step/activity involved risk identification, as previously developed brainstorming with the project managers along with the technical individuals and the primary stakeholders of the Vodafone Global Local Area Network (GLAN) project (Ranasinghe et al., 2025). The planning brainstorming: the risks of the project performance were not only identified in a fair way on the dimension aspect of the cost and time quality, but also on the dimension aspect of the customer satisfaction and quality. The project staff members have also been given by the methodology an opportunity to gauge the magnitude of the dangers the project staff is responding to, as none of the 42 posts of the planet can be traced to the unpredictable management.

The identified sessions of the major risks are the technical risk, operational risk, and financial risk and external risks. The threat of system failure and irrelevance to a cybersecurity threat is one of such risks that can be related to the technical aspect (PMI, 2021). Some of these operational risks encompass the long process of the deployment process, lapsing an issue of coordinating the different countries, and depending on the third party suppliers. Such financial risk will be incurred basing on the inability to predict the delay or limitations that the resources suffer. The change of the regulations, the geo political instabilities and the replacement of the infrastructures in the regions are the alterations in the regulations which are the external risk.

The effects that the risks would have on the project outputs are immense. As an illustration, the process of implementation can also lead to disintegration of networks that lead to interruption of customer production processes and could lead to immense financial losses. Similarly, migration process can also lead to a delay in the project schedule and project contractual deliverables, which alters the level of customer satisfaction. This would make the digitalisation of the entire project group easier with the assistance of brainstorm and the assurance that all the critical unpredictability would be pursued.

2.5 Evaluate and Assess the Risks

The risk Breakdown Structure (RBS) has been presented in a manner that makes it seem real as an alternative to the project risk at the hierarchies levels of developing the risk. RBS makes an attempt to classify the risks in four broad categories that include the technical risks, the operational risks, the financial risks and the external risks. All the categories are then further split up into individual risk components, and allow a structured procedure of risk assessment and prioritization.

The RBS would involve the use of risk analysis techniques to provide a vivid picture of the impact that the various risks would have on the project outcome. The technical risks including the network failure can be envisaged to have happy endings in the quality and sustainability of the project. The effects of the functional blockages in the project schedules encompass the hiccuping of the grouping of the international team predominantly (PMI, 2021). This risk which is related to the budget will ensure that the budget will be stable and the external risk will potentially result in changes to the schedule and feasibility generally.

The at-discussion risks have been addressed, basing on probabilities of occurrence, and possible impacts, in impacting a probability impact model. In this respect, the high probability and the high-impact have been made to be proclaimed as the most significant and addressed as an urgent issue (Zhao et al., 2022). To elaborate on the foregoing the risk of network failure was identified to be the smallest risk within the severe spectrum of risks since the risk was the risk within the category of loss of colossal amount of money and business loss.

The qualitative assessment instruments and the RBS enabled the project team to consider the priorities of the risks to a certain extent and devote resources to the most prioritized threats. Such a systemic assessment would put the project under the highest risks that would be taken by the best practices in the management of the project risks.

2.6 Qualitative and Quantitative Processes

Vodafone GLAN project incorporates the qualitative risk analysis method and quantitative risk analysis method to facilitate the creation of a comprehensive information regarding the project using risks.

The qualitative analysis was carried out considering the classification of the risks that was achieved based on the probability impact matrix as Low/Medium/High/Very High. This plan helped the project team in establishing priorities depending on the risk basing on the likelihood of occurrence of the risk and the severity of the anticipated risk to be incurred. Other network failure risks that were also modeled as medium-high during the implementation process due to the drastic nature of the implementations were delays on the part of suppliers. Such preference assists in the narrowing of the focus on risk of the most severe nature that can have a substantial impact to the success of the project.

Quantitative Analysis consisted of Expended Monetary Value (EMV) and analysis of decision tree. EMV was used to determine the financial effects of the risks with the highest priority in which the probability of the occurrence of the risk is multiplied by the potential cost impact (Ioannou et al., 2022). The probability of the threat of a network collapse should be equal to 1 in 5, in 20 percent, which is the anticipated effect of 5,000,000,000 and that the threat is of monetary influence (PMI, 2021).

The different response measures of the risks have also been analyzed using the decision tree analysis and the strategy that was most compatible identified. The process enabled comparisons of the remaining options that are available such as implementations of mitigation measures that are to be implemented by the project team in consonance with the risk impact to be incurred.

It is a medium form of risk analysis like such combination of the qualitative and the quantitative process. The quantitative processes will help in decision making with regards to quantifiable attributes of financial and of operation implication on the other hand the qualitative processes will be highly convenient in prioritization and decision making. All these will enhance the extent of risk evaluation and effectiveness of the risk management plan, in general.

Section 3 – Risk Analysis and Assessment

3.1 Major and Minor Risks

The implementation of an effective risk management plan for all projects begins with identifying key and minor risks. Major risks for the Vodafone GLAN project were defined as having high/very high probability/impact ratings that directly threaten the successful delivery of the main project objectives; i.e., on-time delivery, providing uninterrupted service and customer satisfaction. According to Senić et al. (2025), in order to establish an acceptable risk prioritisation, major risks that threaten the viability of the project must be distinguished from minor risks that only need to be monitored. Each risk was determined by using a combination of probability-impact assessment, expert facilitated workshops and quantitative EMV analysis completed at the project’s onset.

Examples of major risks identified for the project include: migration-related network failure; contract sign-off and design freeze delays; delivery failures by third-party suppliers; and variations in cross-border regulations. The implementation of a project-related network failure was deemed to be the most severe among major risks due to potential financial losses of millions of euros and would have direct impacts on customer production operations (PMI, 2021). Similarly, a pre-baseline period that resulted from contract and/or design freeze delays has posed significant risk due to scope variability increasing and creating schedule pressure to have been present from the start of the project. Qualitative and quantitative methodologies were used to ascertain these risks which ensured that all factors (e.g. probability, financial impact and operational consequence) were used in determining each risk’s classification.

Minor risks are defined as those with either low probability or low/moderate impact that do not pose an imminent danger to the project objectives. For Vodafone’s GLAN project, minor risks include: communication coordination challenges across geographical boundaries and cybersecurity vulnerabilities during the network transition period. Although each of these risks is classified as a minor risk in isolation, both will be continuously monitored, as their interactions with major risks could create additional project exposure (Sun et al., 2024). By using both qualitative prioritisation methods and quantitative financial assessments, an effective method to identify and classify the severity of risks across all 42 sites has been developed.

3.2 Risk Probability

An essential part of deciding how to allocate project resources and how to mitigate risks is assessing the likelihood of each of the risks. To assign probability of risk the Vodafone GLAN project used a qualitative evaluation (i.e., low, medium, high, and very high) as determined by the results of expert-led risk workshops conducted at the start of the project (PMI). Ellermann et al. (2022) indicate that hybrid (qualitative/quantitative) risk assessment approaches enable users to generate more precise and dependable probability estimates than the applications alone. Quantitative probabilities will be applied only to the most critical/highest priority risks (e.g., 20% for network failure) to facilitate calculation of Expected Monetary Value and contingency planning.

The degree of trust in the probability estimation for this project is strong to very strong because the estimates are based on a combination of structured expert opinion and technical evaluations from each site’s perspective. Based on the documented history of extended negotiations for similar multi-site technology projects, the estimate for occurrence rates of delay due to contract and/or design freeze is 35%. The estimate for occurrence rates of supplier delivery failure is 25%, based on the operational difficulty of managing third-party resources at 42 geographically-distributed global locations. The structured nature of the workshops supports the accuracy of these probabilities; however, additional collection methods will increase accuracy.

There are multiple approaches that could be used to enhance the probability estimates utilized in this strategy. First, conducting interviews with the technical leads and the regional site coordinators for each site would give valuable site-specific insight to complement the general output of the workshops conducted. Conducting Monte Carlo simulation on the high-impact risks would create probability distributions for each estimate based on thousands of scenarios creating a probabilistic confidence range. An additional means of improving the accuracy of probability estimates over the life cycle of the project would be to combine the Monte Carlo simulation results with the history of performance data on similar Vodafone GLAN deployments.

3.3 Risk Matrix Template

The Vodafone Global LAN Risk Assessment uses a risk matrix to create a visual representation of the likelihood of occurrence & impact of a potentially harmful event, and assesses these against the project objectives. The following document defines all of the risk matrix legend components (probability and impact codes, colours) according to both Project Management Institute (PMI) guidelines and the course template guidelines.

Table 1

Risk Matrix Legend

The risk matrix for the Vodafone GLAN project is displayed for reference purposes in Table 2. This table includes all risks that have been identified (both major & minor), the likeliness/probability of them occurring, their potential impacts, planned response, project plan of action, individual responsible for implementing and status of risk.

Table 2

Vodafone GLAN Project Risk Matrix

3.4 Risk Data Quality Strategy

Reliability and defensibility of all decisions about risk management depend on the data used to perform risk assessment. For example, Vodafone implemented a multi-sourced strategy to maintain quality of risk data for their GLAN project. This multi-sourced strategy consisted of the use of three different data types: expert workshop results, historical project performance data, and documented lessons learned from previous GLAN deployments. Rammo et al. (2025) explain that reliable risk data must have consistent processes for collecting within a systematic manner, structured tools for analyzing the data collected, and having change management specifications implemented to significantly reduce the chances of data gaps or biases affecting decision-making concerning either the over- or under-estimation of the risk severity being assessed.

There are many strong indicators that demonstrate the reliability of the risk data for this project. The risk data was gathered through structured workshops with both technical architects for the solution and project management professionals; therefore, both operational and strategic views were incorporated. The custom risk management plan and issue log that were used for the duration of the project also provided an ongoing, reliable, auditable record of all risk data inputs, changes and decisions made regarding that data (Prasad, 2024). Furthermore, the documented 90% first-attempt migration success rate and 10/10 Net Promoter Score from customers provide empirical evidence that the quality of the risk data was sufficient to support good decision making.

To ensure the data’s quality continued to be maintained throughout the life of the project, different tools and processes were used. For example, the project team maintained a centralised risk register throughout the whole project. After each migration phase, the team would update the risk register in real-time, capturing changes regarding changes in risk probability, risk impact and mitigation status. Throughout the project, lessons learned sessions were held regularly; these sessions provided a mechanism to build emerging risk data into the plan promptly and prevent information decay (Mu et al., 2025). The combination of structured data collection, continuous updating and formal documentation, therefore provides a reliable and defensible base for the entire project for which risk assessments were made.

3.5 Risk Reviews

To keep improving the risk management plan based on the status of the project, the project should hold risk reviews throughout the entire project life cycle. The Vodafone GLAN risk review process established continuous risk reviews based upon project phase gates. Formal risk reviews were conducted prior to each batch of site migrations and there were monthly interim reviews between phases. Zwikael et al. (2022) indicate that communication of project risks must be direct, objective and consistent: risk information should be communicated regularly to all stakeholders to support continued project stability. Because of the structured risk review process, the team was able to assess and communicate timely about changes in probability of risk occurrence, the introduction of new risks, and the effectiveness of existing risk mitigation strategies.

Several deliberate strategies for proactive risk reduction were established as part of the risk review process. First, lessons learned from completed sites were documented continuously throughout the project rather than waiting until after the project was finished. This provided the opportunity for lessons learned from sites already migrated to be applied to upcoming site migrations, thereby eliminating the possibility of repeating the same mistakes (Buschhaus et al., 2023). Second, regular governance model reviews were conducted with senior stakeholders to reassess the level of risk tolerance for the project and make sure that the risk mitigation strategies were aligned with changes in the project environment. By taking a forward-looking approach to the risk reviews, the project team was able to maintain schedule and cost performance across all 42 sites globally during the entire migration program.

A documented communication plan was developed during the project phase to provide formalized means by which risk communication occurred throughout the project and defined the channels, formats, and frequency of all reporting related to risk. Each of the Risk Status Reports provided key stakeholders with an overview of the project’s current RRA, changes in probability/impact, actions taken on risks, and decisions required following each of the risk formal review cycles. Immediate ad hoc communications were sent to project managers, Senior Customer Portfolio Leads and appropriate technical teams for risks that were rated High or Very High in the risk matrix. The Risk Monitoring and Control table below summarizes how the risk review, risk monitoring and risk communication were structured during the Vodafone GLAN project lifecycle. (Senić et al., 2025).

Table 3

Risk Monitoring and Control, Vodafone GLAN Project

Section 4 – Corrective Action and Monitoring

4.1 Risk Tolerance

An essential prerequisite to building an efficient corrective action and monitoring system is knowing how much risk an organization or department will accept. The level of risk tolerance indicates the level of risk or uncertainty that an organization will tolerate in its pursuit of achieving its objectives. Risk tolerance affects the prioritization of risks and triggers for initiating corrective actions (ISACA 2022). As a global telecommunications organization, Vodafone has an overall corporate level of risk tolerance that can be described as “moderate,” which provides Vodafone with the ability to balance its need for innovation and competitive delivery while meeting its contractual obligations to both enterprise customers and the availability of production services. This specific level of organizational risk tolerance was used by the GLAN project team to create its definition of risk thresholds, identify response triggers and allocate resources across all 42 global sites.

Across departments within the Vodafone Global LAN (GLAN) project, there was a great variation in risk tolerance levels based upon the various responsibilities and levels of risk associated with each team. The project management team had an extremely low tolerance for risks associated with schedule delays and network outages, since any delay or outage would have a direct impact on the customer’s production operations and contractual obligations (PMI, 2021). Anderson et al. (2023) indicate that the definition of risk tolerance must encompass two key areas, as it takes into account factors such as the probability of a risk occurrence and the resulting impact of that risk occurrence; therefore, the definition of tolerance must occur at both the organizational level and at the team/departmental level. The teams responsible for procurement and supplier management had a moderate level of tolerance associated with supplier delivery risks due to the existence of alternative suppliers; however, the finance department had a low level of tolerance associated with expenses that exceeded the established limit of contingency dollars.

All departments defining clear risk tolerance thresholds allows for more effective and consistent action when responding to risks throughout a project’s life cycle. An example is the Vodafone Global LAN Project that issued a risk threshold of zero network failures; meaning any time there was a network disruption confirmed during the migration event an immediate escalation to the project manager to trigger the rollback plan was required (PMI, 2021). For schedule related risks, variance from the approved schedule by greater than 5 business days required a formal review by the Senior Customer Portfolio Lead and determination of the affected site’s migration strategy. Well defined tolerance level and threshold on the risk across all departments assisted the Project Team in responding to risk in an orderly manner, with pre-approval rather than ad hoc decision making under duress.

4.2 Risk Mitigation

A project manager is responsible for identifying and implementing effective risk mitigation strategies in any complex, multi-site technology projects. The main mitigation strategy applied to all key risks in the Vodafone GLAN project was to actively reduce each risk through changes to the project plan, resources or methods used to execute the project. Goni et al. (2024) indicate that both proactive risk mitigation planning and ongoing monitoring of project progress are critical to successfully managing risk in high complexity and geographically distributed projects. Based on their probability of occurrence, financial impact and operational consequences outlined in the risk matrix in Section 3, each identified risk received a selected mitigation option.

Various risk mitigation strategies were designed according to the nature of the major project risk identified through the Vodafone GLAN Project. For the highest-impact risk associated with failing to deliver the network during migration, the mitigation strategy involved having duplicate network links at every site, performing pre-migration testing, having a rollback plan documented and planned for every cutover event, and monitoring network performance continuously throughout all cutover events (PMI, 2021). Mitigation strategies for delays in contract and design freezes included setting up an official change management process, escalating unresolved design items weekly to project management, and having a firm baseline delivery date through customer signature. To mitigate the risk of utility supplier failure, the project management group held utility supplier workshop sessions, maintained an approved supplier list and found backup suppliers for each critical part of the network, minimizing the reliance of any third party as the sole source of supply.

Triggers have been developed for many of the mitigation strategies to ensure prompt and consistent action is taken when a risk threshold is crossed. The trigger for the network failure mitigation strategy was defined as an instance where connectivity at a migration site was lost and confirmed to be out during the cutover window of time. Upon confirmation of the disconnection, the rollback procedure would automatically be initiated, and the project manager and technical lead would be notified (PMI, 2021). For schedule risk, the trigger was defined as being five or more business days behind the approved migration schedule, and the achievement of the trigger would lead to initiation of a formal assessment of the project and a reassessment of resources. The clarity and well-defined nature of the triggers have changed the risk mitigation strategy from a passive document to an operational framework that allows the project team to have a rapid, consistent, and pre-established authority for making decisions for the 42 global sites.

4.3 Corrective Risk Management Strategy

To define how to deal with risks that have happened and need escalating (i.e., not dealt with by the original planned mitigation), a corrective risk management strategy will include the different processes, tools, responsibilities, etc., that have been created as part of the corrective risk management framework. For the Vodafone Global Landline and ADSL Network (GLAN) Project, the corrective risk management strategy is a combination of strategic planning as well as structured auditing, where both planning and auditing were used to identify gaps in existing mitigation and used to assist with making decisions on how to resolve the identified gaps during the life of the GLAN Project. According to the Institute of Internal Auditors (2024), corrective action plans that are specific, measurable, achievable, risk-based, and time-bound are more effective than corrective action plans that are not developed in a structured way. Therefore, the GLAN Project used the SMART framework to ensure that all corrective action plans were scoped, assigned to an accountable owner, and completed within a defined, reasonable timeframe.

The process of corrective actions for the Vodafone GLAN project was designed in three stages; firstly as identifying risk from the event or crossing a threshold of risk, secondly as responding with a mitigation, and thirdly as confirming your response is effective. If an incident or event happens, the Project Manager has the responsibility to document the event in their issue log and activate the mitigation trigger that had been pre-defined as well as the obligation to notify the Senior Customer Portfolio Lead if the classification of risk is rated as high or very high (PMI, 2021). Once the Project Manager has conducted their initial response; the designated Technical Lead(s) and the applicable Regional Site Coordinator(s) have the obligation to perform the corrective action, confirm that the corrective action is working, and report the outcome, and any lessons learned, to the risk register created for the project. The method of implementing a Three-Step Corrective Action Process provided the opportunity for consistent, transparent and accountable handling of all risk events for each of the parties involved in the project.

Upon finalizing all 42 site relocations for global LAN solutions, a formal risk post-mortem will take place for the Vodafone GLAN project. During this process, all risks encountered will be evaluated, as will the relative efficiency of each mitigation action taken. Any deficiencies in the original risk management plan will also be identified, and findings will be published so that lessons learned can guide future GLAN deployments (PMI, 2021). Schmidt (2024) states that project postmortems conducted using a structured methodology within complicated IT projects result in the creation of long-term best practice documentation that improves the success rate of succeeding similar projects. Given the considerable size and difficulty of this project and Vodafone’s determination to constantly improve its global project delivery capabilities, the formalized risk postmortem is not optional; rather, it is a strategic requirement.

4.4 Corrective Action Plan

A comprehensive Corrective Action Plan captures and makes available the results of all risk response actions in one location and accessible to the entire project team over the life of the project. In the Vodafone GLAN project, the corrective action plan resides on a centrally available Project Management Platform that all team members use, allowing the Project Manager, Technical Lead, Regional Site Coordinators, Procurement Lead and IT Security Lead to have access to documentation in real-time (PMI, 2021). Regulatory compliance and effective risk management are all contingent upon having accessible, up-to-date records that can be reviewed and audited by stakeholders and upper management during the life of the project (Björnsdóttir et al., 2021). By centralizing documentation related to corrective actions, information silos are eliminated; there is decreased risk for outdated response plans to be implemented and all team members have available to them the most current version of the plan.

The project team’s corrective action plan is reviewed by formal project team members during each project phase gate and after a significant risk event. The Project Manager will be performing the formal review together with the Sr. Customer Portfolio Lead; and will have representatives from the technical lead, purchasing lead and the relevant regional site coordinators as it pertains to the risks being reviewed (Alvarado, 2023). The project team will confirm the active corrective actions have been implemented within their respective timeframes; the new risks that are emerging from the review of the risks that require corrective planning; and whether the approved triggers from the mitigation plan for existing risks are still appropriate based on current conditions of the project. By utilizing an organized process with multiple stakeholders to review the corrective action plan, this structured process will help ensure that the corrective action plan is an active document that changes with the project rather than an outdated document.

Essential to the effective use of the corrective action plan as a risk management tool is its accessibility and transparency. The corrective action entries assigned in the Vodafone GLAN project detail the risk, what triggered the response, what corrective action was taken, who was responsible for completing the action, the date on which the action was completed, and whether or not the planned outcome was achieved, providing a full audit trail for each risk event (PMI, 2021). Lewis et al. (2023) state that multi-site projects executed over a long period of time will benefit tremendously from having a shared way to keep track of corrective actions and share lessons learned among teams working in different locations. The corrective action plan used in the Vodafone GLAN project is both an operational tool used to respond to events as they happen and a strategic tool that Vodafone can use to develop its future migration strategies for future global network migration projects.

Section 5 – Postmortem Plan

5.1 Results

Identify and describe how results data will be collected and reviewed to determine corrective actions.

• Did your postmortem results lead to any concrete changes? Explain.

5.2 Follow Up

Evaluate the organization’s view of risk management and approach, resulting from project outcomes.

• Did this project change the organization’s approach and management of risk?

Describe the impact of postmortem results on the organization.

Recommend corrective plan procedures to effectively manage risk.

• What recommendations would you make for future risk management projects?
• What resources did you use to support your assertions?