Issues and risks are often mistaken for having the same meaning by some Project Managers. In reality, they are not.
So what exactly is the difference between an issue and a risk?
- An issue is something happening currently, a risk is something that might happen in the future.
- An issue is not risky, it is just something unfavorable. It has little or no effect on the scope, the budget, and the schedule of the project. A risk, on the other hand, can have drastic effects on the triple constraints if not managed properly.
- An example of an issue is: “Tom isn’t very good with stored procedures and we need to write a significant logic of the application in stored procedures”. The solution to the previous is trivial, we can just have someone else write those stored procedures. On the other hand, an example of a risk would be: “The client might not honor the next payment for the project”. Clearly, the latter case has a much bigger impact than the former, a client not honoring the payment can have very negative effects on the project (the project might be killed).
In short, the main difference between an issue and a risk is the time and the level of impact on the project: Issues are current events that have little effect on the project and solving them is usually easy, risks are future events that may have severe effects on the project and solving them requires ingenuity.
Note that both issues and risks should be documented in any project for future references.
© 2009 Project Management Learning – Reproduction of this material is strictly prohibited without the written consent of Project Management Learning.
I strongly disagree that an issue can be easily resolved. An issue is also a risk that has already happened and needs to be mitigated. An issue can either be big or small, negative or positive, just like a risk. The only real difference being that a risk is an event of unknown certainty and an issue is an event that has already occured.
Hi Sadaf,
Issues are not risks, that’s why you have Issue Management and Risk Management, they’re totally separate things. What you’re stating is that the only difference between issues and risks is the timing, which is not enough.
Feel free to provide an example of an issue that has a similar impact to a risk, and we’ll debate it!
Not sure if I understand this. If we use the example “The client might not honour the next payment for the project” and assume that this happens (i.e. the client does not honour the next payment), this clearly is no longer a risk as it has occurred. Is it not now an issue?
And if issues are “current events that have little effect on the project and solving them is usually easy”, what do we call current events that have severe effects on the project and solving them requires ingenuity?
Hi Leonard,
Again, there is Risk Management and Issue Management for a reason, the difference between an issue and a risk is not restricted to the timing, in other words, issues are not risks that have already happened. An issue is a small hiccup that already occurred in the project, and is handled by the Issue Management Process.
Going back to the example of the client not honoring the payment, this is a risk that is managed by the Risk Management Plan. If you’re saying is correct then there would be no such thing as Risk Management, it’d be only Issue Management.
Think about it…
Hi Admin,
What would you then call a Risk that has been realized?
I understand Risk Management as the process of managing the risk (i.e. through mitigation, prevention, acceptance) to prevent it from becoming an issue, while Issue Management is the process of managing the issue (a risk that has been realized).
I don’t have time for small hiccups – don’t sweat the small stuff.
Thanks.
S.
What would you call an ‘Unidentified Risk that has realized’…? An Issue!
In my view the most appropriate differentiation is:
An event (current or future) when realized, will impact the Project (objectives/ estimates etc), is a RISK.
An event (only current) if is not addressed, will impact the Project, is an ISSUE. i.e. if an Issue does not get addressed timely and appropriately, may turn into a Risk.
So, my take is a risk is a risk, if it happens or not. Most people think that an issue is a risk that has happened. No, this is not correct. We do not have ‘issue’ action plans… we have risk action plans. If a risk occurs, we execute the risk action plan.
I think it is just sloppiness and a lack of understanding what RISK is. If you want to consider an ‘issue’ to be something small then you probably have not identified it yet. If you have identified it through the risk identification process, you have determined that the probability times the potential is so low, you can accept it. Therefore, it is a risk that has been accepted because it will not affect the project.
If you have not identified it and it happens and it will not affect the project, calling it an issue is okay. If it happens and does affect the project, it should be placed on the risk register as an ‘unknown’ risk for future projects.
So, the easiest thing to do in project management is to only have risks. If some things are risks and some things are issues, then they will not be tracked, identified, prepared for and or corrected properly.
C Franzoso, MBA, PMP