Naming it while it is cheap

A risk is something that might happen. An issue is something that has. Managing risks costs an hour; managing issues costs weeks, and that difference is the entire argument.

Most organisations do this badly in one of two ways. They do not do it at all, and every problem arrives as a surprise. Or they produce a risk register as a formality, filed and never opened, which is the same outcome with more paperwork.

What useful risk management actually is. A short list of what could go wrong, reviewed regularly, with something actually done about the ones that matter. It is not a document, it is a habit.

Where the risks come from. People, where somebody leaving takes knowledge with them. Dependencies, where you rely on something you do not control. Technical, where something might not work. Commercial, where a client might not pay or a cost might rise. External, where regulation, currency or infrastructure changes. And the unknown, which you handle with contingency rather than with a plan.

In Pakistan specifically, several are worth naming explicitly because they are routine here and are frequently omitted from plans copied from elsewhere: power and connectivity interruptions, currency movement on anything priced in dollars, import delays, and regulatory change arriving with little notice.

Five minutes of listing produces most of the value. The exercise is not difficult and the reason it is skipped is that nothing appears to be wrong today.