As an auditor, perhaps strangely, I came late to the realisation that risks and issues are different. Like most management terms I used the words ‘risk’ and ‘issue’ loosely. If you want evidence of the looseness of management terms think about words such as ‘marketing’, ‘profit’ ‘governance’, ‘strategic’ and the word itself, ‘management’. So back to issue versus risk. Well risk is clearly linked to uncertainty. Issue is not. Issue is here, now, immediate.
So is an issue just a proximate risk? I don’t think so. It is true that if one thinks of risk management in linear terms, based on a timeline, that unmanaged issues become, after time, proximate risks and then issues. Take changes to the external environment. All companies that ignore the external world and the changes that come with it will eventually fail and die. If you want examples look at Woolworths, Rumbelows, Borders and other high street businesses of yesteryear. Similarly think about falling profitability or sales, ignore both issues long enough and eventually a mountain of debt will ensue and will, eventually, not be able to be restructured. Think Thomas Cook, HMV, Waterstones. So if you leave all risks long enough they become issues. Issues, in my view, represent to a greater or less degree, a failure of risk management. Better risk management should create fewer issues.
Here’s the real problem. Boards, managers, staff, much prefer to deal with issues. Issues are tangible. One can be seen to be busy dealing with things. Bonuses are paid on the short term here and now. Just like share prices. Whilst shared prices are meant to be a long term valuation of business discounted to the here and now, they are not. In fact they are rewards for the effective management of the here and now.
The whole management structure and capitalist system is fundamentally designed to train managers to manage the here and now. Even the word management from the latin ‘manu‘ ‘hands’ is about doing. No board or senior manager will be rewarded for ensuring that something may not happen at some point in the future. Risk management is the cinderella activity which is forced on managers by auditors and regulators.
So it is important to differentiate between issues and risks because they are two fundamentally different tasks. One is about prevention the other about cure. I for one would always seek the former.