• Risk management considers future events that may happen
• Issue management considers events that are happening or are unavoidable.
• Issue management should be straightforward.
Traditional risk (and issue) management tools (such as ARM) do not handle the urgency or timescale well (also called proximity). This is more important in issues than in risks.
If we have a non-reoccurring risk (a classic risk) that impacts then it is moved directly to the impact register and changed to an issue. This will maintain all the history of the risk/issue in one place. It will be appropriate to review the description and impact to show how the issue was manifested.
A previously unknown risk that emerges as an issue should go directly to the issues register without appearing on the risk register. Care must be taken to distinguish new changes in requirements from genuine issues within the existing scope of work.
We will also have risks that have the potential to reoccur. When the risk impacts, the new issue will be copied from the existing risk and moved to the issue register. It will be appropriate to tailor the description and impact to the specific issue. The remaining risk will also be reviewed to evaluate the probability and impacts of any future occurrence of the risk.