Not everyone finds the difference between risk management and incident management (relevant issues or issues). The English term "issue" is widely used. Many people with great experience in projects, fail to distinguish these two concepts, much less give them adequate treatment to achieve the goals of their project. According to the PMBOK Guide version 6, the definitions are:
Risk: Uncertain event or condition that will occur will have a positive or negative effect on the objectives of the project.
Issue: Issue or issue that is questioned or disputed, or issue that is not resolved and is being analyzed or on which there are opposing views or disagreements.
The main difference is that risk is a future, potential issue that has not yet happened; for which we can ask for example, prevent it from happening. While the incident (issue) is present and we must resolve it.
The risk can have positive or negative consequences, the issue is that it is something that will go in the opposite direction to what was planned and if it occurs, it should be addressed so as not to risk the objectives of the project. We are talking about the future.
The risks are associated with a probability of happening, while the incidents have already occurred are made.
To manage risks, different strategies are defined: avoid them by changing the plan, accept them because it is not possible or desirable to change, mitigate them by performing actions to reduce the probability or impact of the event, or transfer them to who has more knowledge in their treatment.
Some examples of risk are: the possibility of not finding an experienced supplier, we may not have the raw materials on time, or the potential lack of data validation in the migration of a system.
On the other hand, the incident (issue) is a relevant issue that requires immediate attention because there is already something going on; It can be a problem that is generating unwanted consequences.
Examples are: the database expert has resigned, the provider's staff went on strike, holidays in the client's country were not considered in the schedule.In both cases there is an impact, only that the risk is a possibility that still does not materialize, in the incident it is already affecting.
Some recommendations for the treatment of risks and incidents are:
Manage them separately. They are different lists since the treatment is different.In both cases it is important to prioritize to allocate time and resources in the best way. In the case of risk, the probability and impact of the possible risk are usually considered in the prioritization. In the case of the incident (issue), the impact and urgency are common characteristics to use as criteria.
These criteria can be very subjective. What for the finance manager can have a great impact, for the operations manager no. To avoid conflicts, define and formally agree criteria to assign them a degree.
This method must be approved by the management and communicated to those responsible for the management of incidents (issues) and risks.Once tested, check the method frequently and adjust it to continuously improve its handling.In both cases, it defines actions and those responsible for carrying them out, as well as a way of following up on what was agreed upon.
The management of risks and incidents (issues) is a business issue, it should be more convenient to invest time and effort in its management because the savings we achieve are greater than the resources invested.
Lic. Cr. Nicolas Liso Fabbri
TECHNIC ingenieria & construcción