AI in Project Controls: Governed Forecasting and Risk

AI has arrived in project controls faster than most governance frameworks have. Schedulers use it to draft logic, cost engineers use it to classify thousands of cost lines, and project managers paste monthly reports into chat assistants to "summarise the risks". Some of this is transformative. Some of it quietly puts unreliable numbers in front of decision-makers.

This article sets out where AI genuinely adds value in project controls, a practical governance framework, a worked forecasting example, and the checks every AI-assisted output should pass before anyone makes a decision on it.

Where AI adds real value

Grouped by the control cycle, the strongest use cases today are:

Planning and scheduling

• Drafting a first-cut work breakdown structure from a scope document.
• Checking schedules for missing logic, open ends, excessive lags and constraint misuse.
• Suggesting activity durations from historical projects, with the source data shown.

Measurement

• Reconciling cost transactions to control accounts and flagging mismatches.
• Extracting progress evidence from site diaries, inspection records and photos.
• Detecting anomalies such as a work package reporting progress with no associated labour hours.

Analysis and forecasting

• Generating forecast ranges from historical performance rather than single points.
• Drafting variance narratives that a human then edits and signs.
• Identifying which activities most often drive slippage across a portfolio.

Risk

• Scanning contract correspondence and meeting notes for emerging risks.
• Proposing risk descriptions in a consistent cause–event–effect format.
• Supporting quantitative schedule and cost risk analysis by preparing input distributions for review.

What these have in common: AI accelerates preparation and pattern-finding. Humans still own definitions, assumptions and decisions.

Where AI should not be trusted on its own

• Inferring progress that should come from agreed rules of credit.
• Changing baselines or approving scope changes.
• Final forecasts presented to boards, lenders or regulators without a documented human review.
• Contractual interpretations — a model's summary of a claim is not legal advice.
• Anything using confidential data in tools not approved for that data.

The GUARD framework for governed AI use

A simple framework we use to structure AI governance in controls teams:

• G — Grant permission deliberately. Keep a register of approved tools and the data classifications each may process. "Can I paste this into a chatbot?" should have a written answer.
• U — Use documented inputs. Every AI-assisted analysis records which data it used, from which system, as of which date.
• A — Assess outputs against a baseline. Compare AI results with a simple, explainable method (for example a CPI-based EAC). If they diverge sharply, the AI must be explained, not trusted.
• R — Review by a named person. Every AI-assisted output that will inform a decision has a human reviewer who signs off, and the review is recorded.
• D — Disclose in the report. Reports state where AI was used and how it was checked. This builds trust rather than undermining it.

GUARD is deliberately lightweight. A controls team can adopt it in a week and refine it as tools mature.

A worked example: AI-assisted forecast ranges

A 30-month infrastructure project is at month 14. Budget at completion is 80 million; earned value is 32 million; actual cost is 36 million. The explainable baseline forecast is:

CPI = 32 / 36 = 0.889
EAC (CPI method) = 80 / 0.889 = 90.0 million

The team uses an AI tool to analyse performance on the organisation's twelve most similar completed projects. The tool reports that projects with a CPI near 0.89 at the 45% complete point finished with a final cost overrun of between 8% and 20%, with a median of about 13%. Applied to the 80 million budget, that suggests a range of roughly 86 to 96 million, median around 90 million.

Now apply the GUARD checks:

1. Inputs documented? Yes — the twelve reference projects are listed, with their final cost reports.
2. Assessed against the baseline? The AI median (about 90 million) agrees with the CPI method, which is reassuring. The range adds information the single point lacked.
3. Challenge the reference class. The reviewer notices that three reference projects were in a different contracting model with the owner carrying ground risk. Removing them narrows the range to about 87 to 94 million.
4. Named review. The controls lead signs off the adjusted range with a note on the exclusions.
5. Disclosed. The board report says: "Forecast range 87–94 million (median 90 million), based on CPI trend and analysis of nine comparable completed projects, AI-assisted and reviewed by the controls lead."

The board now has a forecast with a basis, a range, and a clear audit trail — far more useful than either a raw AI answer or a single-point CPI calculation.

Using AI for risk without creating noise

AI can generate a hundred plausible risks in seconds. That is the problem: a risk register is valuable because it is prioritised, not because it is long. Good practice:

• Ask the model to classify each suggested risk as new, duplicate or already mitigated against your existing register.
• Require every accepted risk to have an owner and a response, exactly as for human-identified risks.
• Use AI to check wording consistency (cause, event, effect) rather than to score probability and impact on its own.
• For quantitative risk analysis, let AI help prepare distributions from history, but have estimators challenge the tails — rare, high-impact outcomes are exactly where historical data is thinnest.

Prompting for controls work

Well-structured prompts make outputs more reliable and easier to review. A good pattern for variance narratives:

Role: project controls analyst.
Data: [paste the variance table with source and as-of date].
Task: draft a variance narrative for each control account with CV beyond
plus or minus 5%. For each, state the variance, the likely cause (only from
the evidence provided), and one option for recovery.
Rules: do not invent causes; write "cause not evidenced" where the data does
not support one. Keep each narrative under 80 words.

Two instructions matter most: restrict the model to the evidence provided, and tell it what to say when it does not know. If you want to build this skill systematically, Optimize All's free courses Prompt Engineering Foundations and AI for Data Analysis and Decision-Making cover it in depth.

Building the skills

Governed AI is becoming part of what a controls professional is expected to know, not an optional extra. The PCI AI (opens in a new tab) PCL-AI certification (PCI AI Project Controls Leader) is built around this idea: planning, cost engineering, earned value, forecasting, risk and project finance with the governed use of AI, assessed by a scenario-based online exam. Our PCI AI partner page summarises the credentials, and the free course Project Controls with AI is a good starting point before any exam.

If you are new to the fundamentals, read What is project controls? and Earned value management explained first — AI amplifies whatever method sits underneath it.

Frequently asked questions

Is it safe to paste project data into public AI tools?

Only if your organisation's policy says that data classification is allowed in that tool. Commercial, contractual and personal data often is not. Keep an approved-tools register and follow it.

Can AI produce the estimate at completion for me?

It can propose one, and it is often useful for ranges. But the forecast presented to decision-makers should be compared with an explainable method, reviewed by a named person and disclosed as AI-assisted.

How do I explain an AI-generated forecast to a board?

Present the basis (data and method), the range, how it compares with a conventional calculation, and who reviewed it. Boards trust transparency; they distrust black boxes.

What skills do controls professionals need for AI?

Strong fundamentals in scheduling, cost and earned value; data literacy; structured prompting; and governance thinking — knowing what should and should not be automated.

Optimize All is the official marketing partner of PCI AI and Certuvo.