Quick Verdict
A risk is an uncertain event that may or may not occur and would affect the project positively or negatively if it does. An issue is a current condition or problem that is already impacting the project and requires resolution. Risks are forward looking (they might happen). Issues are present tense (they are happening). Risks are tracked in a risk register with probability and impact assessments. Issues are tracked in an issue log with resolution owners and target dates. When a risk event occurs, it transitions from a risk to an issue.
Quick Verdict
A risk is something that might happen. An issue is something that has already happened. Risks are managed proactively through the risk register with probability assessments and response plans. Issues are managed reactively through the issue log with resolution actions and deadlines. Treating risks as issues means waiting for problems to occur before responding. Treating issues as risks means assessing probability for events that have already happened, which is a waste of time.
Frequently Asked Questions
What happens when a risk becomes an issue?
When a risk event actually occurs, it transitions from the risk register to the issue log. The pre planned response strategy (if one exists) is activated. The issue gets a resolution owner, an action plan, and a target resolution date. The risk entry is closed with a note that it materialized.
Why is it important to separate risks from issues?
Mixing them creates confusion about whether the team is managing future uncertainty or solving current problems. Risk registers filled with issues skip probability assessment and response planning. Issue logs filled with risks waste time assessing probability for events that have not happened. Separation enables proactive risk management and efficient issue resolution.
Can something be both a risk and an issue?
Not at the same time. A risk is uncertain (it might happen). An issue is certain (it has happened). However, a risk can partially materialize: the risk of vendor delay is a risk until the vendor misses the first deadline (now an issue), while the risk of further delays on remaining deliverables remains a risk.
