Quantitative Risk Analysis

Definition

Quantitative Risk Analysis (QRA) takes the project's risk register and turns it into numbers — probability distributions for cost and schedule outcomes, P-values (P50, P80, P90), and sensitivity rankings. Where qualitative analysis sorts risks into red/amber/green, QRA estimates how much money and how many weeks the risk landscape actually represents.

Why It Matters

Senior stakeholders do not approve "amber" — they approve numbers. QRA produces the contingency, the reserve, the P80 schedule date, and the sensitivity ranking that survives boardroom scrutiny. Without QRA, contingency is a percentage pulled from habit; with QRA, it is a defensible figure tied to identified risks.

Inputs

• A clean, deduplicated risk register with probability and impact ranges per risk.
• A risk-ready schedule and cost model — typically the baseline with duration and cost uncertainty ranges added.
• Honest correlation assumptions; risks that move together must be modelled together.
• Defined P-targets (e.g. P80 cost, P90 schedule) agreed with governance.

Common Techniques

• Monte Carlo simulation — the dominant technique; thousands of iterations sample probability distributions to produce outcome distributions.
• Decision-tree analysis — for staged decisions with conditional probabilities (build vs buy, test vs ship).
• Expected monetary value (EMV) — quick triage of binary risk events.
• Sensitivity analysis (tornado diagrams) — identifies which inputs drive the most variance.
• Schedule risk analysis (SRA) — applies probabilistic durations to a critical-path network.

Real-World Construction Example

A combined-cycle gas turbine project ran QRA at FEED. The baseline cost was $680m and the baseline schedule was 32 months. The Monte Carlo simulation produced a P50 of $724m / 34 months and a P80 of $761m / 36 months. The owner approved a contingency to the P80 cost figure and a schedule reserve to the P80 date. The tornado diagram identified gas-turbine delivery, civil ground conditions, and grid-connection approvals as the top three drivers. Each of those three got named owners and active mitigation. Two years later, the project landed at $758m and 35.5 months — within the P80 envelope and inside the contingency.

Real-World IT / Agile Example

A platform-migration programme used QRA on the cutover. Each cutover risk — data-migration failure, performance regression, vendor-license clash, regulatory-approval slip — had probability and impact ranges. The Monte Carlo produced a P80 cutover window of 14 working days versus a base plan of 8. The programme adopted the 14-day window as the published commitment, and shipped at day 11. The qualitative register alone had said "high risk." The QRA said "two extra weeks." The first did not change behaviour; the second did.

Best Practices

• Clean the qualitative register first. Numerical analysis of dirty inputs is wasted effort.
• Use ranges, not single points. A risk's impact is rarely a single number.
• Model correlations explicitly. Independence assumptions almost always under-state tail risk.
• Triangulate distributions with reference-class data, not just expert judgement.
• Report P-values with the assumption set; numbers without traceability are easy to dismiss.
• Re-run QRA at every gate and after any major change.

Common Mistakes

• Treating QRA as a one-off baseline exercise rather than a live tool.
• Modelling every risk as independent; correlation is the difference between a flat tail and a fat one.
• Ranges generated by one person without challenge; expert anchoring is rampant.
• Confusing the model output with truth. QRA is a structured opinion, not a forecast.
• Choosing P-values for comfort rather than for risk appetite.
• No sensitivity output — the team learns nothing about where to act.

Expert Tips

• Calibrate the experts before the workshop. People are systematically over-confident about ranges; calibration training cuts this by half.
• Publish the tornado with the headline P-values. The drivers matter more than the totals.
• Hold the workshop separately from baseline-defence meetings. Risk ranges should not be negotiated to make the cost number look better.
• Use reference-class forecasting alongside expert ranges where prior project data is available.
• Re-run after baseline changes. A change in scope reshapes the entire risk landscape; the previous QRA is no longer valid.

Practical Lessons Learned

• QRA pays for itself the first time it stops a project being approved with under-funded contingency.
• Boards prefer P80 numbers with assumption traceability over P50 numbers with no defence.
• The sensitivity ranking is more valuable than the headline P-value, because it tells the team what to mitigate.

Key Takeaways

• QRA turns risk into numbers leadership can act on.
• Monte Carlo is the workhorse; decision trees and EMV handle special cases.
• Ranges, correlations, and calibration matter more than software choice.
• Publish sensitivity rankings; they drive mitigation.
• QRA is a live tool, re-run at every gate and material change.

Related Encyclopedia Entries

• Monte Carlo Simulation
• Uncertainty Analysis
• Risk Management
• Contingency Reserve
• Management Reserve
• Near-Critical Path

Related Research Articles, Case Studies & Tools

• Project Controls Academy: Risk Modelling
• QRA Workshop Toolkit
• Learning Tracks: Risk Analysis
• CCGT contingency-setting case study
• Reference-class forecasting in capital projects