PM FPX 5334 Assessment 4 Risk Management Plan

Risk Management Plan

Project Name: Vodafone GLAN Network Project

Learner Name: Student Name

Course Name: 5334

Date:July, 2026

Table of Contents

Section 1 – Introduction to the Plan_ 3

1.1 Benefits of Risk Management 3

1.2 Project Goals and Objectives_ 3

1.3 Company Background_ 4

1.4 Risk Identification_ 5

Section 2 – Risk Scope, Components, and Value_ 5

2.1 Scope of the Risk Management Plan_ 5

2.2 Risk Management Plan Components_ 5

2.3 Expected Monetary Value_ 5

2.4 Determine the Risks_ 6

2.5 Evaluate and Assess the Risks_ 6

2.6 Qualitative and Quantitative Processes_ 6

Section 3 – Risk Analysis and Assessment 6

3.1 Major and Minor Risks_ 6

3.2 Risk Probability_ 7

3.3 Risk Matrix Template_ 7

3.4 Risk Data Quality Strategy_ 7

3.5 Risk Reviews_ 7

Section 4 – Corrective Action and Monitoring_ 7

4.1 Risk Tolerance_ 7

4.2 Risk Mitigation_ 7

4.3 Corrective Risk Management Strategy_ 8

4.4 Corrective Action Plan_ 8

Section 5 – Postmortem Plan_ 8

5.1 Results_ 8

5.2 Follow Up_ 8

Section 6 – References_ 9

6.1 References_ 9

Templates_ 10

Risk Matrix Legend Example_ 10

Risk Matrix Example_ 10

Risk Monitoring and Control Example_ 11

Section 1 – Introduction to the Plan

1.1 Benefits of Risk Management

An integral component of any successful project is effective risk management. Risk management assists project managers in anticipating threats, mitigating uncertainty, and preserving organizational resources. Project Risk Management increases the likelihood of success and reduces anxiety and provides the ability to better predict project outcomes (Kallow et al., 2022). When utilized in a structured manner, risk management provides a proactive environment that enables project teams to address issues before they escalate to become expensive failures.

The advantages of applying structured risk management processes to complex technology projects are even more significant than in projects of less complexity. The Vodafone Global Local Area Network (GLAN) project provided an excellent example of how conducting risk assessment workshops early in the project allowed the project team to identify a high-priority risk of potentially millions of euros in cost due to network failure during implementation (Project Management Institute [PMI], 2021). By addressing this risk at the beginning of the project, the project team developed mitigation strategies, recorded the risk in an issue log, and tracked the project’s dependencies throughout the duration of the project. Through this proactive method, the project team received a Net Promoter Score of 10/10 from the customer when the project was completed.

Risk management supports global project cost efficiency and schedule compliance, two critical criteria for successful global projects. According to Testorelli et al (2024), organizations that implement PRM efficiently throughout the entire project lifecycle experience verifiable advantages in terms of cost, time, and quality. Dedicating funds to visit the most important project locations and establishing a formal change control process helped Vodafone avoid cost overruns and protect project resources from scope creep. Through structured risk management, organizations can reduce uncertainty through planned, actionable processes, positively aligning project outcomes with organizational goals.

1.2 Project Goals and Objectives

The foundation for identifying and evaluating risks is a clearly articulated set of project goals and objectives. Vodafone’s Global Local Area Network (GLAN) project began in late 2017 at the request of a strategic customer that wanted to replace the existing legacy network with a fully managed Global Local Area Network (GLAN) that spanned 42 sites across 28 countries (PMI, 2021). The key goal for this project was to finish migrating the full network by November 2019 under a five-year managed services agreement and any and all identified risks throughout the project were evaluated against this overarching goal which meant any risk decisions directly supported project success.

The four objectives of the project were developed on the four aspects of performance which included time, cost, quality and customer satisfaction. Ullah et al. (2026) observed that mapping, balancing and prioritising risks can be critical in maintaining the stability of the project and in accomplishing the project’s objectives. Vodafone operationalised this principle by categorising the 42 customer sites into four categories of priority – Low, Medium, High and Top – each of which required a standardised method of delivery (PMI, 2021). Through this structured approach to prioritisation of risks, any risk at a higher complexity/priority level would be evaluated and addressed with a greater level of detail than would risks at lower complexity levels (such as a customer’s headquarters combining both an office and factory).

Risk evaluation for this project aligned directly with fulfilling contractual obligations and protecting the customer’s production operations. One of the key objectives of the project was to keep the customer’s manufacturing production lines running without interruption as the network was migrated, since any failure would potentially cost millions of euros (PMI, 2021). Therefore, risk tolerance levels (thresholds) were established at a very low level for high severity implementation risks, which drove how much of the project team’s resources to commit to and how to schedule the project’s migration activities. In this way, clear and concise objectives gave the lens through which all project risk identification and response planning efforts were accomplished during the project.

1.3 Company Background

To identify risks and manage stakeholders effectively, one must understand the organisational context of the project. Vodafone is one of the largest telecommunication companies in the globe and operates its wireless network across 24 countries, in addition to having network partnerships in 42 other countries and fixed broadband services provided in 19 markets. There are over 500 million total customers using Vodafone services worldwide (PMI, 2021). Vodafone’s size and international presence facilitate its ability to manage complex, multi-location technology-based projects; however, they also create significant challenges for coordinating work and managing risk across geographically dispersed teams. Vodafone’s project management practices utilise PMI-style project management standards, demonstrating the company’s commitment to following structured processes for delivering in high complexity environments.

One of the first steps to understanding how a project will impact the enterprise is to identify the stakeholders. Siems et al. (2022) note that identifying risks involving stakeholders improves communication between those stakeholders as it requires the sharing of risks and how to mitigate them. The GLAN project will have as stakeholders the strategic customer (a global enterprise that operates factories and offices at 42 different locations) as well as Vodafone’s customer program delivery project team, technical solution architects and third-party suppliers involved in the rollout of the network (PMI, 2021). Each of these groups of stakeholders has different functions and affect the decisions made on the project and risk outcomes based on their role.

In the case of this project, each stakeholder group’s role was integral to establishing the risk management structure for the project. The project management team at Vodafone, which is led by Ahmed ElGedwany, the Senior Customer Portfolio Lead, had responsibility for the delivery approach and ensuring that the agreed-to PMI standards were used throughout the execution of the project (PMI, 2021). The customer had the authority and responsibility to approve the site designs, confirm the migration plan(s) are appropriate, and assess the project’s overall performance, which is exemplified by the 10/10 Net Promoter Score awarded to the project at close. Suppliers to the Vodafone GLAN project also played an important role in the management of resources through their participation in the resource management workshops and had a direct operational impact on how to execute the migrations; therefore, their support was crucial to effectively managing the risks to the schedule and quality.

1.4 Risk Identification

The first and most important component of the risk management process is identifying risks (i.e., identifying and assessing all potential threats to project scope, schedule, cost, and quality) using both qualitative and quantitative methods in order to understand the full range of uncertainty associated with a particular project. As noted by Huzooree and Yadav (2025), professional, effective risk management practices are designed to limit the uncertainties experienced, increase the level of resilience to withstand future adversity, and allow for change and adaptation as project needs change. Vodafone began identifying risks immediately after initiating the GLAN project and conducted structured risk assessment workshops led by technical and project management subject matter experts.

Qualitative risk analysis was primarily used to categorize and prioritize risks on this project (i.e., experts facilitated workshops as an acceptable qualitative technique for assessing the likelihood of occurrence and potential impact (severity); an example of this was a severe network failure during implementation (PMI, 2021). The project team then used a site-priority matrix to classify all identified risks as being Low, Medium, High, or Top priority, based on site complexity; this allowed them to direct their mitigation efforts to the sites with the highest risk first. This type of qualitative prioritization of risks is consistent with PMI’s recommendation that probability-impact assessments be used as the determining factor in assessing which risks should have further analysis or an immediate response.

Quantitative risk analysis complemented the qualitative risk analysis process in that it provided estimates of the financial implications of certain key risk events. For example, the project team was able to quantify the risk associated with network failure as it was estimated that significant disruption(s) to the customer’s production lines could cost millions of euros. this amount was used to prepare the risk response plan and budget (PMI, 2021). As such, the tailored risk management plan and issue log were used to capture all identified risks, assess all dependencies, and document all impact assessments for the respective project throughout the entire lifecycle. In total, both qualitative and quantitative risk identification strategies resulted in the identification, prioritization, and overall risk management of all major risk areas for all 42 global project sites.

Section 2 – Risk Scope, Components, and Value

2.1 Scope of the Risk Management Plan

The scope of project identification that will be concerned with the project Life cycle will be part of Vodafone Global Local Area Network (GLAN) project risk management plan, which will identify the risks that will be evaluated in the project life cycle and resolved. The plan provides all risks factors that can characterize the successful implementation of the network migration of 42 foreign locations that constitute cost, schedule, technical performance and the period of operations.

GLAN project is an intricate and global project, project scope shall contain dangers that will be incorporated in the cross boundary coordination, reliance on suppliers, inconsistency of the infrastructures and any detailed customer production landscape. The topmost risks like the network failure in the implementation process are given priority because the possibility of such an occurrence may lead to the loss of colossal sums of money and downtimes (Pescaroli et al., 2025). The justification of the priority of these risks is that they directly affect the key success factors in the projects in terms of customer satisfaction and sustainability of the services. It will entail both the qualitative and quantitative risk assessment in a bid to have a complete analysis.

The priorities of the risks are stipulated as per the qualitative methodology that involves the probability-impact assessment, the cost implications, on the other hand, are determined as per the quantitative methodology that involves the estimate of the financial implications. It will also evaluate with regards to the place, place and time likelihood. The coverage however does not cover the risks that cannot be directly controlled in the firm like the economic stability of the world or other geo political disasters.

2.2 Risk Management Plan Components

Vodafone GLAN project risk management plan is scheduled on the basis of key areas which can be incorporated to provide the systematic application of risk identification, assessment and management. The risk identification, risk analysis, risk response planning, and risk monitoring and control are among the recommended practices in the project management process that are appropriate and aligned (Project Management Institute [PMI], 2021).

Such means as expert workshops or consulting stakeholders, the analysis of the past data are the systematic means of recognizing the potential threats and opportunities (Hadjigeorgiou et al., 2022). This is because the risks are early identified and represented in a form that they are expounded. This is followed by the identification phase as the qualitative and quantitative analysis to determine the risk analysis. The qualitative analysis will weigh heavily on the risks based on the likelihood of occurrence and waning effect, as compared to the quantitative analysis that considers the losses that are incurred in both financial and operation terms of the significant risks.

The risk response planning is a development issue that is observed to be keen in the development of the relevant plans to address the identified risks. The measures include the risk avoidance, sharing and transfer of risks of risk acceptance depending on the worth and form of risks. The high priority risks like network failure might have mitigation plan which may involve the redundancy plan, gradual upgrading of the system with upgrades and monitoring. The risk management should have short roles and responsibilities. Risk management plan is one of the most important tasks that the project manager should establish and control where an individual would set up and manage the risk management plan in such a way that the overall undertakings can be executed in an effective way. The risk identification and risk analysis in the various arenas is considered, regarding the technical teams and the subject matter experts, and the control and realignment of the same provided by the stakeholders and the top management. In addition, a number of tools and methods will be employed in helping the process of risk management plan.

They consist of prioritization risk matrix, SWOT analysis to analyze the strategy, Gantt charts to track the schedule, decision tree to analyze the response that would be realized by the use of alternatives. Risk of the new risks is constantly monitored and reviewed periodically in order to monitor the risk status, implementation of the new risks and effectiveness of the mitigation strategies. All this would lead to the creation of proactive and systematic risk management process that would help the project team to avoid uncertainty and maximize risk of project success.

2.3 Expected Monetary Value

EMV is a qualitative analysis process, this is an approximation of the financial effects of the risks and the cost of the risk not identified under a risk management plan. EMV can be calculated as the product of the probability of occurrence of risk and the probable economic impact of such an occurrence to provide a practical approximation of expected loss.

Among the biggest risks that have been identified in the Vodafone GLAN project, the network failure during the implementation stage would leave a distraction in the production process of customers. The probability of this risk to take place according to the project estimates is approximately 20 percent and that the level of financial impact could be approximated to be 5,000,000 euros due to the downtime in its production and associated loss of business.

EMV = Probability × Impact
EMV = 0.20 × €5,000,000 = €1,000,000

This computation indicates that the financial loss of this single risk would have been projected to 1,000,000 euros in case there would be no risk mitigation strategies implemented. Having multiple risks to be considered in 42 locations all over the world, the financial exposure can be a tremendous amount and thus, the development of risks is of paramount importance.

Formal risk management strategy lessens the risk occurrence and impact by recognizing the risk and mitigating measures at an initial point, and observing the risks. As a result, organizations will be in a position to save a lot of costs and improved allocation of resources. According to PMI (2021), the correct risk management practices not only reduce the potential loss but also enhance the decision making and project performance. Moreover, risk management plan can have other advantages besides financial saving.

It makes the project more predictable, gives the stakeholders more confidence and the project is made aligned to the organizational goals (Alshukri et al., 2024). Risk management assists in achieving project objectives within the set scope, time and budget by reducing uncertainty as well as making informed decisions.

2.4 Determine the Risks

In that regard, the second step/activity involved risk identification, as previously developed brainstorming with the project managers along with the technical individuals and the primary stakeholders of the Vodafone Global Local Area Network (GLAN) project (Ranasinghe et al., 2025). The planning brainstorming: the risks of the project performance were not only identified in a fair way on the dimension aspect of the cost and time quality, but also on the dimension aspect of the customer satisfaction and quality. The project staff members have also been given by the methodology an opportunity to gauge the magnitude of the dangers the project staff is responding to, as none of the 42 posts of the planet can be traced to the unpredictable management.

The identified sessions of the major risks are the technical risk, operational risk, and financial risk and external risks. The threat of system failure and irrelevance to a cybersecurity threat is one of such risks that can be related to the technical aspect (PMI, 2021). Some of these operational risks encompass the long process of the deployment process, lapsing an issue of coordinating the different countries, and depending on the third party suppliers. Such financial risk will be incurred basing on the inability to predict the delay or limitations that the resources suffer. The change of the regulations, the geo political instabilities and the replacement of the infrastructures in the regions are the alterations in the regulations which are the external risk.

The effects that the risks would have on the project outputs are immense. As an illustration, the process of implementation can also lead to disintegration of networks that lead to interruption of customer production processes and could lead to immense financial losses. Similarly, migration process can also lead to a delay in the project schedule and project contractual deliverables, which alters the level of customer satisfaction. This would make the digitalisation of the entire project group easier with the assistance of brainstorm and the assurance that all the critical unpredictability would be pursued.

2.5 Evaluate and Assess the Risks

The risk Breakdown Structure (RBS) has been presented in a manner that makes it seem real as an alternative to the project risk at the hierarchies levels of developing the risk. RBS makes an attempt to classify the risks in four broad categories that include the technical risks, the operational risks, the financial risks and the external risks. All the categories are then further split up into individual risk components, and allow a structured procedure of risk assessment and prioritization.

The RBS would involve the use of risk analysis techniques to provide a vivid picture of the impact that the various risks would have on the project outcome. The technical risks including the network failure can be envisaged to have happy endings in the quality and sustainability of the project. The effects of the functional blockages in the project schedules encompass the hiccuping of the grouping of the international team predominantly (PMI, 2021). This risk which is related to the budget will ensure that the budget will be stable and the external risk will potentially result in changes to the schedule and feasibility generally.

The at-discussion risks have been addressed, basing on probabilities of occurrence, and possible impacts, in impacting a probability impact model. In this respect, the high probability and the high-impact have been made to be proclaimed as the most significant and addressed as an urgent issue (Zhao et al., 2022). To elaborate on the foregoing the risk of network failure was identified to be the smallest risk within the severe spectrum of risks since the risk was the risk within the category of loss of colossal amount of money and business loss.

The qualitative assessment instruments and the RBS enabled the project team to consider the priorities of the risks to a certain extent and devote resources to the most prioritized threats. Such a systemic assessment would put the project under the highest risks that would be taken by the best practices in the management of the project risks.

2.6 Qualitative and Quantitative Processes

Vodafone GLAN project incorporates the qualitative risk analysis method and quantitative risk analysis method to facilitate the creation of a comprehensive information regarding the project using risks.

The qualitative analysis was carried out considering the classification of the risks that was achieved based on the probability impact matrix as Low/Medium/High/Very High. This plan helped the project team in establishing priorities depending on the risk basing on the likelihood of occurrence of the risk and the severity of the anticipated risk to be incurred. Other network failure risks that were also modeled as medium-high during the implementation process due to the drastic nature of the implementations were delays on the part of suppliers. Such preference assists in the narrowing of the focus on risk of the most severe nature that can have a substantial impact to the success of the project.

Quantitative Analysis consisted of Expended Monetary Value (EMV) and analysis of decision tree. EMV was used to determine the financial effects of the risks with the highest priority in which the probability of the occurrence of the risk is multiplied by the potential cost impact (Ioannou et al., 2022). The probability of the threat of a network collapse should be equal to 1 in 5, in 20 percent, which is the anticipated effect of 5,000,000,000 and that the threat is of monetary influence (PMI, 2021).

The different response measures of the risks have also been analyzed using the decision tree analysis and the strategy that was most compatible identified. The process enabled comparisons of the remaining options that are available such as implementations of mitigation measures that are to be implemented by the project team in consonance with the risk impact to be incurred.

It is a medium form of risk analysis like such combination of the qualitative and the quantitative process. The quantitative processes will help in decision making with regards to quantifiable attributes of financial and of operation implication on the other hand the qualitative processes will be highly convenient in prioritization and decision making. All these will enhance the extent of risk evaluation and effectiveness of the risk management plan, in general.

Section 3 – Risk Analysis and Assessment

3.1 Major and Minor Risks

The implementation of an effective risk management plan for all projects begins with identifying key and minor risks. Major risks for the Vodafone GLAN project were defined as having high/very high probability/impact ratings that directly threaten the successful delivery of the main project objectives; i.e., on-time delivery, providing uninterrupted service and customer satisfaction. According to Senić et al. (2025), in order to establish an acceptable risk prioritisation, major risks that threaten the viability of the project must be distinguished from minor risks that only need to be monitored. Each risk was determined by using a combination of probability-impact assessment, expert facilitated workshops and quantitative EMV analysis completed at the project’s onset.

Examples of major risks identified for the project include: migration-related network failure; contract sign-off and design freeze delays; delivery failures by third-party suppliers; and variations in cross-border regulations. The implementation of a project-related network failure was deemed to be the most severe among major risks due to potential financial losses of millions of euros and would have direct impacts on customer production operations (PMI, 2021). Similarly, a pre-baseline period that resulted from contract and/or design freeze delays has posed significant risk due to scope variability increasing and creating schedule pressure to have been present from the start of the project. Qualitative and quantitative methodologies were used to ascertain these risks which ensured that all factors (e.g. probability, financial impact and operational consequence) were used in determining each risk’s classification.

Minor risks are defined as those with either low probability or low/moderate impact that do not pose an imminent danger to the project objectives. For Vodafone’s GLAN project, minor risks include: communication coordination challenges across geographical boundaries and cybersecurity vulnerabilities during the network transition period. Although each of these risks is classified as a minor risk in isolation, both will be continuously monitored, as their interactions with major risks could create additional project exposure (Sun et al., 2024). By using both qualitative prioritisation methods and quantitative financial assessments, an effective method to identify and classify the severity of risks across all 42 sites has been developed.

3.2 Risk Probability

An essential part of deciding how to allocate project resources and how to mitigate risks is assessing the likelihood of each of the risks. To assign probability of risk the Vodafone GLAN project used a qualitative evaluation (i.e., low, medium, high, and very high) as determined by the results of expert-led risk workshops conducted at the start of the project (PMI). Ellermann et al. (2022) indicate that hybrid (qualitative/quantitative) risk assessment approaches enable users to generate more precise and dependable probability estimates than the applications alone. Quantitative probabilities will be applied only to the most critical/highest priority risks (e.g., 20% for network failure) to facilitate calculation of Expected Monetary Value and contingency planning.

The degree of trust in the probability estimation for this project is strong to very strong because the estimates are based on a combination of structured expert opinion and technical evaluations from each site’s perspective. Based on the documented history of extended negotiations for similar multi-site technology projects, the estimate for occurrence rates of delay due to contract and/or design freeze is 35%. The estimate for occurrence rates of supplier delivery failure is 25%, based on the operational difficulty of managing third-party resources at 42 geographically-distributed global locations. The structured nature of the workshops supports the accuracy of these probabilities; however, additional collection methods will increase accuracy.

There are multiple approaches that could be used to enhance the probability estimates utilized in this strategy. First, conducting interviews with the technical leads and the regional site coordinators for each site would give valuable site-specific insight to complement the general output of the workshops conducted. Conducting Monte Carlo simulation on the high-impact risks would create probability distributions for each estimate based on thousands of scenarios creating a probabilistic confidence range. An additional means of improving the accuracy of probability estimates over the life cycle of the project would be to combine the Monte Carlo simulation results with the history of performance data on similar Vodafone GLAN deployments.

3.3 Risk Matrix Template

The Vodafone Global LAN Risk Assessment uses a risk matrix to create a visual representation of the likelihood of occurrence & impact of a potentially harmful event, and assesses these against the project objectives. The following document defines all of the risk matrix legend components (probability and impact codes, colours) according to both Project Management Institute (PMI) guidelines and the course template guidelines.

Table 1

Risk Matrix Legend

The risk matrix for the Vodafone GLAN project is displayed for reference purposes in Table 2. This table includes all risks that have been identified (both major & minor), the likeliness/probability of them occurring, their potential impacts, planned response, project plan of action, individual responsible for implementing and status of risk.

Table 2

Vodafone GLAN Project Risk Matrix

3.4 Risk Data Quality Strategy

Reliability and defensibility of all decisions about risk management depend on the data used to perform risk assessment. For example, Vodafone implemented a multi-sourced strategy to maintain quality of risk data for their GLAN project. This multi-sourced strategy consisted of the use of three different data types: expert workshop results, historical project performance data, and documented lessons learned from previous GLAN deployments. Rammo et al. (2025) explain that reliable risk data must have consistent processes for collecting within a systematic manner, structured tools for analyzing the data collected, and having change management specifications implemented to significantly reduce the chances of data gaps or biases affecting decision-making concerning either the over- or under-estimation of the risk severity being assessed.

There are many strong indicators that demonstrate the reliability of the risk data for this project. The risk data was gathered through structured workshops with both technical architects for the solution and project management professionals; therefore, both operational and strategic views were incorporated. The custom risk management plan and issue log that were used for the duration of the project also provided an ongoing, reliable, auditable record of all risk data inputs, changes and decisions made regarding that data (Prasad, 2024). Furthermore, the documented 90% first-attempt migration success rate and 10/10 Net Promoter Score from customers provide empirical evidence that the quality of the risk data was sufficient to support good decision making.

To ensure the data’s quality continued to be maintained throughout the life of the project, different tools and processes were used. For example, the project team maintained a centralised risk register throughout the whole project. After each migration phase, the team would update the risk register in real-time, capturing changes regarding changes in risk probability, risk impact and mitigation status. Throughout the project, lessons learned sessions were held regularly; these sessions provided a mechanism to build emerging risk data into the plan promptly and prevent information decay (Mu et al., 2025). The combination of structured data collection, continuous updating and formal documentation, therefore provides a reliable and defensible base for the entire project for which risk assessments were made.

3.5 Risk Reviews

To keep improving the risk management plan based on the status of the project, the project should hold risk reviews throughout the entire project life cycle. The Vodafone GLAN risk review process established continuous risk reviews based upon project phase gates. Formal risk reviews were conducted prior to each batch of site migrations and there were monthly interim reviews between phases. Zwikael et al. (2022) indicate that communication of project risks must be direct, objective and consistent: risk information should be communicated regularly to all stakeholders to support continued project stability. Because of the structured risk review process, the team was able to assess and communicate timely about changes in probability of risk occurrence, the introduction of new risks, and the effectiveness of existing risk mitigation strategies.

Several deliberate strategies for proactive risk reduction were established as part of the risk review process. First, lessons learned from completed sites were documented continuously throughout the project rather than waiting until after the project was finished. This provided the opportunity for lessons learned from sites already migrated to be applied to upcoming site migrations, thereby eliminating the possibility of repeating the same mistakes (Buschhaus et al., 2023). Second, regular governance model reviews were conducted with senior stakeholders to reassess the level of risk tolerance for the project and make sure that the risk mitigation strategies were aligned with changes in the project environment. By taking a forward-looking approach to the risk reviews, the project team was able to maintain schedule and cost performance across all 42 sites globally during the entire migration program.

A documented communication plan was developed during the project phase to provide formalized means by which risk communication occurred throughout the project and defined the channels, formats, and frequency of all reporting related to risk. Each of the Risk Status Reports provided key stakeholders with an overview of the project’s current RRA, changes in probability/impact, actions taken on risks, and decisions required following each of the risk formal review cycles. Immediate ad hoc communications were sent to project managers, Senior Customer Portfolio Leads and appropriate technical teams for risks that were rated High or Very High in the risk matrix. The Risk Monitoring and Control table below summarizes how the risk review, risk monitoring and risk communication were structured during the Vodafone GLAN project lifecycle. (Senić et al., 2025).

Table 3

Risk Monitoring and Control, Vodafone GLAN Project

Section 4 – Corrective Action and Monitoring

4.1 Risk Tolerance

Evaluate the organizational and departmental tolerance for risk.

• Discuss the different risk tolerances within the organization.)

4.2 Risk Mitigation

Identify risk mitigation approaches in support of the project.

• How will you implement the mitigation approaches?
• Have you identified specific triggers to initiate mitigation?

4.3 Corrective Risk Management Strategy

Describe your strategy for corrective risk management.

• Explain whether you will use auditing, strategic planning, or another type.
• Describe the corrective action process and responsibilities.
• Will you be performing a risk postmortem? If not, why not?)

4.4 Corrective Action Plan

Assess corrective plan procedures in support of the project.

• Is your documentation available to others?
• Is it reviewed by the team or others?

Section 5 – Postmortem Plan

5.1 Results

Identify and describe how results data will be collected and reviewed to determine corrective actions.

• Did your postmortem results lead to any concrete changes? Explain.

5.2 Follow Up

Evaluate the organization’s view of risk management and approach, resulting from project outcomes.

• Did this project change the organization’s approach and management of risk?

Describe the impact of postmortem results on the organization.

Recommend corrective plan procedures to effectively manage risk.

• What recommendations would you make for future risk management projects?
• What resources did you use to support your assertions?