Risk vs. issue: the distinction that changes how the board reads

A risk is something that may happen but has not yet occurred. An issue is something that has already happened and requires handling now. The distinction sounds trivial. It is not. Mixing the two is one of the most common failures in CEO reporting — and it leads the board to deal with the wrong thing first.

The two definitions in practice

Risk: Probability × impact. Has not yet occurred. Can be mitigated, accepted or transferred. Example: "Risk of losing our largest customer when their contract expires in Q4."

Issue: An event that has occurred. Requires decision and action. Can no longer be prevented — only handled. Example: "We have lost our largest customer. EBITDA impact: €240K."

What happens when you mix them up

Two classic failures:

• Issue reported as risk: The board under-reacts. "Risk" signals "maybe". If the customer is already gone, this is not a risk — it is an issue that requires a response now.
• Risk reported as issue: The board launches crisis work over something that may never happen. It creates false urgency and pulls attention from real priorities.

They belong in different places

Risks and issues do not sit on the same agenda item:

• Risks go in the risk section of the CEO report. Top five, probability, plan, owner.
• Issues go on the agenda as decision items. What happened, what are we doing now, what approval do we need?

When an issue gets filed under risk, it ends up in the risk section where it gets 30 seconds of attention along with five other risks. That is not enough time for something that has already happened.

The grey zone

Some events sit on the line. A customer has not yet cancelled but has written a formal complaint. Risk or issue? Rule of thumb: if it requires action you would not otherwise take, it is already an issue. If it is still only monitoring, it is a risk.

Use the language consistently

Treat "risks" and "issues" as distinct categories in the CEO report — and hold the line every time. The board then learns to read the language correctly. If you mix them, or use a catch-all like "challenges" that covers both, the communication loses precision.

The honest test

Ask yourself: "If this had happened yesterday, would it still belong under risks?" If the answer is no, you are reporting an issue as a risk. It needs to move — and the attention has to move with it.