What’s the difference between an issue and a risk? A lot of times people use these terms synonymously when, from a quality assurance perspective, they are quite different:
- A risk is an event that may occur on a project that will have a negative impact (for example increase the time or cost to complete a project). Note that a risk may occur. It is not a certainty (it has a less than 100% probability of occurring). From a theoretical standpoint it is possible to have a risk that will have a positive impact on the project (shorten the time or cost of a project) but in quality assurance we typically don’t assess risks that could have a positive impact. Optimizing project outcomes are left to project management.
- An issue is an event that the project will or currently faces that will/does have a negative impact. That is, an issue has a 100% probability of occurring.
The key differentiator here is risks are something that have some likelihood (probability) of occurring in the future. An issue is something that will occur or is occurring. Issues “will happen or are happening” and risks “may happen”.
A concrete example:
- There is a risk a project may lose staff. We may even be able to assign a probability this risk will occur based on expert opinion or past experience. We can build a plan to address this risk should it occur. The plan might dictate by staff position what we will do if a staff member leaves the project. For example if we lose the project manager we will temporarily promote the deputy project manager to manager and begin the search for a replacement. We can also do some things to lessen the likelihood a risk will occur. In the “loss of staff” risk example above we might offer project completion bonuses to increase staff motivation to stay with a project through completion.
- There is an issue if a staff member leaves the project and we have to act now to replace her.
Obviously identifying risks before they become issues and having plans in place to address them is preferable to having an issue arise for which we are not prepared. In some cases it is even possible to lower the probability a risk will occur or even completely avoid the risk.