Vulnerability Assessment is analyzing, documenting and reporting the probable loopholes and other weakness of a system or the network. All the work is carried out just to "assess". On the other hand Penetration Testing is actually trying to exploit a vulnerability using tools and softwares. It may also happen that a particular system or network is vulnerable but not risky to negatively affect the organization.