Risks vs Issues

Risk and issue management are essential components of successful project delivery. While both can influence project performance, they require different mindsets, tools and responses.

A risk is an uncertain event or condition that may have a positive or negative effect on project objectives if it occurs (APM, 2023; PMI, 2021). Risks are future-focused and are assessed according to their likelihood and potential impact. For example, a project team may identify a risk that a key supplier could experience delays. The delay has not yet occurred, but if it does, it could affect schedule, cost or quality.

An issue, by contrast, is an event or condition that has already occurred and is affecting the project. Using the same example, if the supplier misses a delivery date, the risk has now materialised and become an issue requiring immediate action (Kerzner, 2022).

One of the simplest ways to remember the difference is:

• Risks refer to potential future events.
• Issues represent realised events.

Because risks focus on uncertainty, they are managed proactively. Project teams identify potential risks, assess their significance, and develop appropriate responses before problems arise (Chapman and Ward, 2003). Common responses to negative risks include:

• Transfer – shift responsibility to a third party.
• Avoid – change the plan to eliminate the risk.
• Reduce (Mitigate) – lower the likelihood or impact.
• Accept – acknowledge the risk and monitor it.

Not all risks are negative. Some risks present opportunities that could benefit the project. Positive risk responses include (PMI, 2021):

• Share – involve another party to maximise the opportunity.
• Exploit – ensure the opportunity occurs.
• Enhance – increase the likelihood or benefit.
• Reject – do nothing and take advantage if it occurs.

Issues require a different approach because they already exist. Instead of prevention, the focus is on resolution. Effective issue management typically involves:

• Identifying and documenting the issue.
• Assessing its impact and urgency.
• Assigning ownership.
• Developing and implementing a solution.
• Monitoring progress until closure.
• Capturing lessons learned.

Risks and issues are closely linked. Many issues begin life as risks that were identified earlier in the project. For example, the risk of a specialist resource leaving the organisation becomes an issue when that individual submits their resignation (Heldman, 2005). This relationship highlights the importance of maintaining both a risk register and an issue log throughout the project lifecycle.

A risk register is used to record identified risks, their probability, impact, owners and planned responses. An issue log records current issues, actions, owners and target resolution dates (PRINCE2, 2017). Together, these tools provide visibility and support effective governance.

Good governance also relies on understanding when escalation is required. Some risks and issues can be managed by the project team, while others exceed the project’s authority or tolerance levels. In these situations, they should be escalated to the sponsor, steering group or governance body for decision-making (APM, 2023).

Organisations may also define a risk appetite, which describes the amount of uncertainty they are willing to accept in pursuit of objectives. Understanding risk appetite helps project managers determine appropriate responses and make balanced decisions (Hillson, 2017).

Whether using predictive, Agile or hybrid approaches, risks and issues should be reviewed regularly. Proactive risk management can reduce the likelihood of problems occurring, while effective issue management helps minimise disruption when challenges arise (PMI, 2021).

Ultimately, successful project managers do not wait for risks to become issues. They identify, assess and manage uncertainty early, while maintaining robust processes for resolving problems when they occur. This balance helps keep projects on track and supports successful delivery.