Managing Risks and Issues: Control the Controllables
In any project management framework — whether PRINCE2, Agile, or a hybrid approach — one of the simplest yet most powerful tools is the Risk and Issues Log.
At its core, it’s a list of things that might go wrong (risks) or have already gone wrong (issues), alongside how we plan to deal with them.
Simple in theory.
Complex in practice.
The Basics — What’s a Risk, What’s an Issue?
 A risk is something that might happen — a potential threat to delivery, budget, quality, or safety.
 An issue is a risk that has happened — it’s now a certainty, a 100% probability event that needs active management.
Both should be logged in the same place because they are part of the same story: how we keep control and deliver outcomes.
What Risks and Issues Really Affect
Most risks and issues ultimately impact one or more of these areas:
 Time — delays to milestones or dependencies
 Cost — overruns or financial exposure
 Quality — products or services not meeting expectations
 Accessibility — users can’t access or benefit as intended
 Safety — harm to people, data, or reputation
Your job isn’t to log everything that could go wrong.
It’s to focus on what actually matters — the things that could stop you from delivering on time, on budget, and to specification.
The Practical Reality — Less is More
A good risk and issues log is not a 50-page spreadsheet with 1,000 entries.
If it is, no one will read it, and no one will act on it.
Instead, keep your list focused on the top handful of risks and issues — those that require decisions or attention.
The goal is to maintain clarity, not to document every theoretical possibility.
If something can’t be controlled, influenced, or mitigated, then note it, but don’t waste energy trying to manage it.
Focus on what you can control — the controllables.
Own It — And Act
For each item on your log, make sure you’re clear on ownership and approach.
In PRINCE2 terms, we typically choose one of four strategies:
1. Treat – take action to reduce the risk.
2. Tolerate – accept it, but monitor closely.
3. Transfer – pass it to someone better equipped (e.g. insurance, supplier).
4. Terminate – remove the risk altogether (e.g. change the plan).
Whatever the approach, ownership is key.
If no one owns it, it won’t move.
In Summary
 Keep the log short, sharp, and actionable.
 Focus on the top priorities that affect delivery.
 Recognize the difference between what you can control and what you can’t.
 Don’t confuse documentation with management — the goal is control and communication, not admin for admin’s sake.
Final Thought
A risk log is not a bureaucratic burden — it’s a decision-making tool.
Used well, it provides focus, foresight, and confidence.
Used poorly, it becomes noise.
So, control the controllables, stay aware of the rest, and keep your eyes on the outcomes that matter.
 What about you?
How do you keep your risk and issues log lean but effective?
Do you use a “Top 5” approach, or do you prefer a full register with prioritisation built in?

