The short answer
A risk is something that might happen. An issue is something that has happened, or a request, that needs managing now. An off-specification is a particular kind of issue: something the project is delivering doesn't, or won't, meet what was agreed. The difference matters because each one leads to a different action and is decided by a different person.
The three in plain English
- Risk. An uncertain event that would affect the project if it happened. It hasn't happened yet. In PRINCE2, risks can be threats or opportunities. Example: a supplier may deliver late.
- Issue. Something that has happened, or been raised, and needs attention. PRINCE2 7 groups issues into five types: a problem or concern, an external event, a business opportunity, a request for change, and an off-specification. Example: the supplier has told you delivery will be two weeks late.
- Off-specification. Something the project should deliver that doesn't, or is forecast not to, meet its agreed description. Example: the new report has been built without the agreed regional breakdown.
A simple test
Ask these questions in order:
- Has it happened yet? If no, it's a risk. Record it in the risk register or RAID log with an owner and a response.
- Does something the project is delivering fall short of what was agreed? If yes, it's an off-specification.
- Is someone asking to change what was agreed? If yes, it's a request for change.
- Otherwise, it's a problem or concern, an external event or an opportunity. The project manager deals with it within their agreed limits, or escalates it if they can't.
How they compare
| Risk | Issue | Off-specification | |
|---|---|---|---|
| Has it happened? | Not yet | Yes | Yes, or it's forecast |
| Where it's recorded | Risk register or RAID log | Issue register or RAID log | Issue register or RAID log |
| Typical action | Reduce, avoid or prepare for it | Resolve it or escalate it | Fix it, or formally accept it as it is |
| Who decides | Project manager, with the board for major risks | Project manager within limits, otherwise the board | Change authority or project board |
Has it happened?
- Risk
- Not yet
- Issue
- Yes
- Off-specification
- Yes, or it's forecast
Where it's recorded
- Risk
- Risk register or RAID log
- Issue
- Issue register or RAID log
- Off-specification
- Issue register or RAID log
Typical action
- Risk
- Reduce, avoid or prepare for it
- Issue
- Resolve it or escalate it
- Off-specification
- Fix it, or formally accept it as it is
Who decides
- Risk
- Project manager, with the board for major risks
- Issue
- Project manager within limits, otherwise the board
- Off-specification
- Change authority or project board
Why getting it right matters
“I regularly see the same item sitting in both the risk log and the issue log, with two different owners. Getting the distinction right is really about deciding who acts, and when.”
Common mistakes:
- Logging issues as risks. If it's already happened, calling it a risk delays the action.
- Keeping both entries open. When a risk happens, close the risk, raise an issue and link the two.
- Treating every issue as a change. Many issues can be resolved within the plan without changing what was agreed.
- Accepting an off-specification informally. If the business agrees to accept something that doesn't meet its specification, record that decision. PRINCE2 calls this a concession.
About the author
Martin Brodie-Lynch
COO and Co-founder
Reviewed by Stuart Lester