A risk or issue may be in one of four states. These are:
- The risk or issue has been created but does not yet have any actions or controls. In other words, there is no plan to mitigate it.
- In Progress
- The risk or issue has been created and has a mitigation plan but there are outstanding actions or controls which are not yet established.
- The mitigation plan has been completed but the risk or issue still remains a threat.
- The risk or issue is no longer a threat.
Generally speaking, a risk or issue will progress through the states in the order shown above. However it is quite common for a risk/issue to move backwards and forwards between being In Progress and Controlled as it is reviewed and new mitigation steps are identified. It is also likely that a risk or issue will remain in the Controlled state for a significant amount of time and may never move to being Closed.