"Risk" and "issue" get used as if they mean the same thing at work. On the PMP exam they don't, and many questions hinge on spotting which one you're dealing with. Get this right and a whole group of questions becomes easy.
The one-line difference
- A risk is an uncertain event that might happen and would affect the project if it did. It's in the future.
- An issue is something that has already happened and is affecting the project now.
A simple test: "Has it happened yet?" If no, it's a risk. If yes, it's an issue. When a risk actually happens, it becomes an issue.
Where each one is recorded
| Risk register | Issue log | |
|---|---|---|
| What goes in it | Identified risks (threats and opportunities) | Current problems, gaps and conflicts |
| Typical fields | Description, cause, probability, impact, owner, planned response, trigger | Description, priority, owner, target date, status, resolution |
| Main question | "What could happen, and what's our plan?" | "What's wrong now, and who is fixing it by when?" |
| Response | Avoid, transfer, mitigate, accept, escalate (threats) or exploit, share, enhance, accept, escalate (opportunities) | Workaround now, then a fix, often through a change request |
Two more logs often appear alongside them. The assumption log records things you're treating as true without proof, and the constraints you must work within. The change log tracks every change request and its decision.
What happens when a risk occurs
- Check the risk register. If you planned a response, carry it out. That's what the plan is for.
- Record the event in the issue log and assign an owner.
- Update the risk register: the risk has occurred, and there may be new secondary risks caused by your response.
- If the event was never identified, you have no planned response. Use a workaround, then add what you learned to the risk register and lessons learned.
How the exam tests it
Example: During testing, the team discovers that a supplier's component has failed safety certification. The project manager had identified this as a risk and planned a backup supplier. What should the project manager do first?
Best answer: implement the planned risk response and switch to the backup supplier. The risk has occurred, and a response was already agreed. Calling a meeting to brainstorm options, or escalating to the sponsor first, wastes the planning you already did.
Now change one detail: the failure was never identified as a risk. The best first step becomes a workaround to keep the project moving, then logging the issue and updating the risk register.
Quick memory tricks
- Risk = future, issue = now.
- Planned response? Use it. No plan? Workaround.
- Risks can be good (opportunities). Issues are always problems.
Practise it
Read the PMP chapter on planning and managing risk, then try the free PMP practice questions. If you're aiming higher, the PMI-RMP prep covers risk management in depth.