Risk and Issue Management
Risk management is proactive; issue management is reactive. Candidates must know the risk process: plan risk management, identify risks, perform qualitative and quantitative analysis, plan risk responses, implement responses, and monitor risks. Understand the risk register, probability and impact matrix, risk appetite and thresholds, and the response strategies: for threats - avoid, transfer, mitigate, escalate, accept; for opportunities - exploit, share, enhance, escalate, accept. Know the difference between a risk (uncertain future event) and an issue (a realized problem requiring action now).
Traps: confusing risk response with issue resolution - if it has already happened, it is an issue, not a risk to be mitigated. Transfer does not eliminate risk; it shifts financial ownership (e.g., insurance). Avoidance changes the plan to eliminate the threat entirely. Another trap is treating acceptance as doing nothing; active acceptance includes a contingency reserve. Also watch for questions confusing a secondary risk (arising from a response) with a residual risk (remaining after response).
Rule of thumb: if the event is uncertain and in the future, manage it as a risk; if it has occurred, log and resolve it as an issue and update the risk register.
Worked example: A supplier may miss a delivery date (risk). When the supplier confirms a late shipment (realized), it becomes an issue logged and assigned an owner, with a response plan executed.