Issue management is a natural and essential part of project management. But if it is not set up correctly, it will compromise or even completely undermine your risk management.

Defining issues and risks is not as easy as it looks

On the surface, it’s quite clear: an issue is a problem today and a risk may become a problem in the future. In practice it’s not that simple and I have watched many organisations struggle with the question of “is it an issue or is it a risk?”

One reason for this confusion is that most risks will require actions and the first step is often urgent. Therefore “Risk Owners” tend to interpret any problems with getting the first step in the risk action plan as an “issue” and consequently raise a formal issue for virtually every risk with a risk plan. The result is effectively duplication of the same “concern” as both an issue and a risk and more data for the Project Manager to review leading to potential information overload.


Whilst dealing with the “issue” of crossing the snow-bridge, we had to consider the “risk” that we wouldn’t reach the summit and get down before dark.


When does a risk really become an issue?

Again it’s not as simple as it seems. The definitive answer is  – “when you can no longer stop the risk impacting, it is an issue”. This means that it doesn’t actually have to impact to become an issue. But who can determine this? Let’s look an analogy.

A missile coming over the horizon should be managed as a risk as we need to work out how to stop it impacting us. Once it has impacted, the resulting crater is an issue and then we need to work out how to clear up the mess.

At some point, an observing soldier may view that the missile is now too close to do anything to avoid impact. The soldier therefore declares the threat to now be an issue. However, the soldier is not aware that his commanding officer has access to the latest in anti-missile technology that could be used to knock out the missile just before impact. If the soldier had communicated the threat as a risk, albeit a very urgent one, then the missile could have been destroyed before impact rather than just accepting that impact was inevitable.

This is of course very much a state of mind, but a very important one that is fully exploited in the ABCD risk management process. ABCD forces people to capture and escalate risks in the form of assumptions even if the impact is close. It is surprising how much senior management can be motivated when things become Important and Urgent, as Stephen Covey once said…

Get the balance right

One of Stephen Covey’s insights from his excellent book, “The 7 habits of highly effective people” can be used to explain the balance required between issue and risk management. As Covey describes time management; everything we do can be categorised as Important and/or Urgent. We have to deal with the Important andUrgent things first but after that we tend get drawn into the Urgent but Not Important stuff i.e. we allow ourselves to get distracted (interuptions, phone calls, emails etc). The effect of this is we don’t spend much time on the Important and Not Urgent stuff. As Covey puts it – we need to spend more time on the Important and Not Urgent tasks and we will then have to spend less time on fixing the Important and Urgent things.

Transposing this to project management; the Important and Urgent things are “Issues”. Whereas “risks” are clearly Important (if not fixed they will become issues) but are not urgent as they are in the future. Applying Covey’s logic again, we need to spend more time on risk management and we will then need to spend less time on issue management.


In practice this simply means getting the balance right and making sure that a focussed risk management process is not overwhelmed by the demands of issue management. In other words, if you have too many issues, then you are not spending enough time on risk management.