TOPIC: Question about Risks that do occur

I understand that a risk is something that hasn't happened but might, and that an issue is something that has happened. But in terms of test questions, what are we supposed to do "first/next" if a risk materializes? If a risk materializes, it becomes an issue. So do you update the risk register? Update the issue log?

If a known risk materializes (triggered) it has been realized. Review the risk register to identify the risk owner, risk response (if planned) is then implemented by the risk owner.
If a new risk is identified (during monitoring/controlling), risk register updated and subsequent risk processes conducted.
As you mentioned, an issue has already happened and is something that requires a resolution. The issue log is updated, not the risk register.

Thanks Brian. Can you help to differentiate between a risk and an issue ?

Risks (threats and opportunities) may or may not occur.

Issues have already happened (are current), impact project performance, and need resolution.

Thanks Brian