QCRA (Quantitative Cost Risk Analysis)

Quantitative Cost Risk Analysis (QCRA) applies Monte Carlo simulation to a project cost estimate to produce a range of possible outturn costs with associated probabilities. The output is typically an S-curve showing the probability of coming in on or under any given cost, with reference points at P50 (median), P80 and P95. The technique tells sponsors what level of contingency is required to achieve a specified confidence of not exceeding a budget, rather than relying on a deterministic point estimate plus an arbitrary percentage uplift.

A QCRA requires three-point estimates on cost line items (modelling estimating uncertainty), discrete risk events with probability and cost impact distributions (modelling risks that might materialise), and escalation assumptions modelled with their own uncertainty for long-duration projects. The analysis separates base estimate uncertainty from discrete risk events so that the client can see how much of the P80 position is driven by "the estimate is rough" versus "these specific risks might hit." Both contribute to contingency sizing but require different management approaches.

QCRA exists because deterministic cost estimates systematically understate the real cost distribution. A point estimate is the most-likely figure; the actual outturn distribution is right-skewed (more upside exposure than downside), which means the mean outturn cost is typically higher than the most-likely figure and the P80 is significantly higher than both. A traditional approach of taking the base estimate and adding a fixed percentage contingency (often 10% or 15%) loses sight of where the risk actually sits in the estimate, and produces a contingency figure that is either too low when the risk is genuinely material or unnecessarily high when the estimate is well-bounded. QCRA replaces the fixed-percentage convention with a distribution-aware contingency position.

The shape of the three-point distribution matters. Triangular and beta-pert are the most common choices on UK capital projects, with the choice reflecting how informative the most-likely figure is relative to the bounds. Correlation between cost elements that move together must be specified explicitly: materials inflation affects every materials-based line item, regulatory cost adders affect every related work package, and the default of zero correlation almost always understates the spread. The output is an S-curve plus a tornado chart of variance drivers. The S-curve gives the sponsor the confidence position at P50, P80 and P95. The tornado tells the project team which line items and discrete risks drive the variance. A QCRA without a tornado is delivering only half its value because sponsors want a contingency number but the project team needs to know what is driving it.

AACE Recommended Practice 57R-09 (Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model), 113R-20 (Integrated Cost and Schedule Risk Analysis and Contingency Determination Using Combined Parametric and Expected Value), and 123R-22 (Determining Project Cost and Schedule Contingencies Using Expected Value and Statistical Methods) are the methodology references that UK programmes typically align to. The leading tools are @Risk by Palisade (Excel-based, dominant in UK cost-focused QCRA work, handles probabilistic dependencies cleanly), Oracle Crystal Ball (also Excel-based, less common in UK practice), Acumen Risk by Deltek (handles cost and schedule in one workbench when integrated QCSRA is needed), and Safran Risk (typically schedule-led but capable of cost work). Tool choice is far less important than the calibration of the inputs and the discipline of the methodology.

A worked example clarifies the mechanics. Take a £250m water-treatment-works upgrade. The deterministic base estimate is built up from material quantities (£90m), labour (£60m), preliminaries (£25m), design and supervision (£15m), commissioning (£10m), and contractor profit (£50m). The QCRA inputs: three-point estimates per WBS line (e.g. materials 80/90/110, capturing commodity-price uncertainty over the build period); discrete risks including a 40% probability of contaminated-ground discovery costing £8-20m, a 25% probability of a tender-market shift adding £15-30m to materials and labour combined, a 20% probability of a regulatory consenting delay adding £3-8m in preliminaries; correlation between materials and contractor profit (shared exposure to commodity prices and overhead margins). Running 50,000 Monte Carlo iterations produces an S-curve with P50 = £262m, P80 = £288m, P95 = £315m. The deterministic £250m has a 38% probability of being met. Contingency at P80 is £38m (15.2% of base estimate), of which £14m is from estimating uncertainty in the base lines and £24m is from the three discrete risks, a level of decomposition that lets the project team manage contingency drawdown by category rather than as a single bucket.

Common QCRA failures cluster around three problems. First, no separation of base estimate uncertainty from discrete risk events, so the analysis double-counts where line items already have contingency baked into rates that is then duplicated in the three-point distribution. Second, zero correlation across the board for convenience, which understates the spread because real projects bunch risks around common causes. Third, a risk register copy-pasted from a template with generic risks that produce generic results, which the discriminating reader recognises in seconds. A defensible QCRA separates base estimate uncertainty from discrete risks cleanly, specifies correlation explicitly with reasoning, and uses a risk register built from this specific programme's delivery experience.

QCRA is most useful when the sponsor needs to make a funding decision that must stand up to scrutiny — HM Treasury Green Book business cases, IPA gate submissions, investment committee papers, and board-level capital approval. A QCRA that produces a P80 cost position the client can defend is worth considerably more than a QCRA that produces a number the investment team finds uncomfortable and therefore ignores. The discipline of the method — AACE-standard three-point estimates, transparent assumptions, explicit correlation — is what makes the output defensible.