Project Log Mixing Supplier Failure, Opportunity and Ownership
A project manager for a public-sector records digitisation project maintains a risk log with 40 items. Item 7 is 'supplier may fail to deliver scanning equipment'; the supplier has already missed two delivery dates and has told the project that the equipment is unavailable for at least eight weeks. Item 12 is 'opportunity to reduce storage costs by 15% if departments adopt digital workflow' and is scored as likelihood 4, impact 4 on a negative scale. Item 19 is 'data protection breach during migration', owned by the project manager, with a treatment action assigned to the IT security team. The steering committee reviews only items with a score above 15. The project manager says the log is 'a risk register and issue log combined' to save time. An auditor asks how the project distinguishes risk from issue and how opportunities are handled.
1. Classify items 7, 12 and 19, and explain the consequences of the current treatment.
Read the worked answer
Item 7 is an issue, not a risk: the supplier has already missed two dates and has declared an eight-week unavailability. The uncertainty is now about the consequence and recovery, not whether the event may happen. Keeping it as a risk distorts likelihood and impact scoring, and may delay issue management because the steering committee sees a probability rather than an actual constraint.
Item 12 is an opportunity, a positive effect of uncertainty on objectives. It should be assessed for potential benefit and for the risks created by pursuing it, using criteria suited to opportunity. Scoring it on a negative impact scale conflates benefit with harm and makes prioritization meaningless.
Item 19 is a genuine risk: a breach may occur during migration. The project manager is recorded as owner, but the treatment action sits with IT security. That separation is acceptable only if the project manager has authority and accountability for the risk, and the security team owns the action. The steering committee's score-only filter may hide issues and opportunities that cannot be scored on the same scale.
2. What does ISO 31000 imply about combining a risk register and an issue log?
Read the worked answer
ISO 31000 does not forbid a combined log, but it requires clear concepts. A risk is the effect of uncertainty on objectives; it may be positive or negative and refers to something that may happen. An issue is a problem or event that has already occurred or is certain to occur and now requires management. Combining them can save administrative effort, but only if the record types, fields and escalation rules remain distinct.
A combined log should mark each item as risk, issue or opportunity; use separate criteria for likelihood/impact versus issue severity; record issue owner, due date and resolution status; and preserve the link to objectives. It should also show treatment actions separately from risk ownership. The danger in this project is that the combined log has become a single undifferentiated list with one score threshold. That weakens reporting and may cause the steering committee to overlook live issues. If the organization keeps one log, it should design views and filters so each audience sees the right items.
3. Advise on ownership for item 19 and on escalation.
Read the worked answer
For item 19, the risk owner should be the person accountable for managing the data protection risk at the level where it arises. The project manager may be appropriate if they control migration decisions, but only if they have authority to require security controls and accept residual risk within delegated limits. The IT security team is an action owner for specific treatments, such as access controls or encryption testing. It should not be recorded as risk owner unless it genuinely owns the risk.
Escalation should follow defined criteria, not just a score above 15. A potential data protection breach affecting citizens' records is likely to meet a mandatory escalation trigger because of legal, reputational and regulatory consequences. The project manager should escalate item 19 to the steering committee or senior responsible owner with an assessment of likelihood, impact, treatment status and residual risk. Item 7 should also be escalated as an issue because it affects schedule and contract performance. The committee needs a short decision paper, not a register line.