Whenever you find yourself in an introductory presentation on risk management, you can expect to hear a question like: “What’s the difference between an issue and a risk?” The expected answer seems to be always: “A risk is something that may or may happen, while an issue is something that has already happened.”
Correct enough, but this description falls short of conveying any relationship between the two.
Here’s one I coined, I like, and plan to use and re-use: “Issues are the risks you failed to manage, now come to haunt you.”
The sentence makes clear that many of the issues that you face could have been mitigated if only you had done proper risk management. The assertion is not always true of course. Some issues just come from unpredictable circumstances, and no risk management is that perfect. So surely, there are exceptions, but the strong assertion of the sentence emphasises just that – that exceptions are the exception.
I believe I originally picked up this relationship from Bill Duncan. A few years ago he quoted someone he knew who said that in a good risk management process, all the issues that arise will have been previously identified in the risk register. So it’s not my original idea, but I like the “now come to haunt you” bit, which is mine.
