Defect vs risk
A defect has happened. A risk might.
In short
A defect is a present gap between what was agreed and what the software does. A risk is a possible future event that would hurt the project.
Side by side
| Defect | Risk | |
|---|---|---|
| Time | Now | Maybe, later |
| Measured by | Severity | Probability × impact |
| Answered by | A fix, proven by a test | A response: avoid, mitigate, transfer, accept |
| Tied to | A broken criterion or requirement | Objectives, requirements or delivery it threatens |
How to tell them apart
- Can you reproduce it today? Defect.
- Is it something that could go wrong? Risk.
- When a risk happens and breaks a criterion, it produces a defect.
Example: Clinic Booking
Defect: "A move 1 hour 59 minutes before the appointment is accepted."
Risk: "The calendar API may throttle us during the Monday morning rush."
Why the difference matters to an agent
An agent that finds a failing behaviour should report a defect with the criterion it breaks. An agent that sees a danger in the docs should raise a risk. Both are more useful than a remark in a chat that nobody reads again.