Risk and issue management
Risk versus issue
A risk is an uncertain event that, if it occurs, will affect objectives; it has not happened yet. An issue is a problem that has already occurred and needs action now. Opportunities are positive risks and should be managed too. Risk appetite is the amount of risk the organisation is willing to seek or accept; tolerance is the acceptable range around objectives.
The process
Identify risks (cause, event, effect), assess probability and impact, and calculate a rating, often probability times impact. Plan responses: for threats, avoid, reduce, transfer or accept; for opportunities, exploit, enhance, share or accept. Assign a risk owner (accountable for managing the risk) and action owners, record in the risk register, implement responses and review regularly. Escalate risks beyond tolerance. Issues go on an issue log with an owner and resolution date.
Traps
Examiners test whether you can tell a risk from an issue: 'the supplier might deliver late' is a risk; 'the supplier delivered late' is an issue. Transferring a risk does not eliminate it, because reputational or schedule impact may remain. Accepting a risk is a valid response, not a failure. Do not confuse the risk owner with the person performing the mitigation action.
Worked example
A key supplier may miss a delivery date: probability 30 percent, impact £50,000, so expected exposure is £15,000. If the project's risk tolerance is £10,000, escalate. A mitigation might be qualifying a second supplier. Rule of thumb: describe each risk as cause, event and effect so responses target the right part.