Quantitative risk analysis and Monte Carlo simulation

0:00 One date, or a range with confidence?

A deterministic schedule says: finish on the thirtieth of June. It sounds precise. It's also almost certainly wrong, because every duration and every cost in that plan is uncertain, and some risks will happen and others won't. The real question isn't 'when will we finish?' It's 'how confident are we of finishing by any given date?' In this lecture you'll learn how Monte Carlo simulation answers that question, how to build a sound model with three-point estimates, discrete risks and correlation, and how to read the results: P50, P80, the probability of meeting the plan, tornado charts and criticality. By the end you'll be able to interpret a quantitative risk analysis and translate it into three statements a board can act on.

0:53 Why it matters

Why does this matter? Because when you run a proper analysis, it's very common to find the deterministic plan sits at a low confidence level. The plan isn't the most likely outcome. It's an optimistic one. Quantitative risk analysis makes that visible and lets leaders choose a confidence level deliberately. An organisation with a low appetite for risk might fund to P80. Another might accept P50 with specific mitigations. Either can be a sound choice, as long as it's made knowingly. It also replaces habit with evidence in sizing contingency. Instead of 'we always add ten per cent', you can say 'reaching eighty per cent confidence requires this much time and this much money, driven by these three risks'.

1:45 The concept: rolling the dice thousands of times

Here's how it works. Imagine rolling dice for every uncertain activity, recalculating the whole schedule, writing down the finish date, and doing it again. Thousands of times. That's Monte Carlo. First, start from a sound model: a logic-linked schedule for schedule risk, a cost model tied to the WBS for cost risk. Poor logic gives meaningless results. Second, define ranges: minimum, most likely and maximum for key activities or cost items. Third, choose distributions. Triangular and PERT are common; PERT puts more weight on the most likely value. Fourth, add discrete risks from the register, each with a probability of occurring and an impact range, mapped to activities. Fifth, model correlation: related items tend to move together, and ignoring that narrows the range unrealistically. Then the software samples everything thousands of times and gives you a distribution of outcomes.

2:45 Reading the results

Now reading the results. P50 means half the simulated outcomes finish at or before this value. P80 means eighty per cent do. Neither is a guarantee; P80 still leaves a one in five chance of doing worse. The probability of meeting the plan tells you the share of outcomes at or below the deterministic date or cost. The tornado, or sensitivity, chart ranks which inputs drive the most variation, and that's where your mitigation effort should go. And the criticality index shows how often each activity appeared on the critical path across all the iterations. An activity that's critical in sixty per cent of runs deserves attention, even if it isn't on the deterministic critical path at all.

3:36 Worked example one: merge bias

Here's a simple example that shows why Monte Carlo sees things a deterministic schedule can't. You have three independent workstreams running in parallel, and commissioning can't start until all three are finished. Suppose each workstream, on its own, has a fifty per cent chance of finishing on time. What's the chance commissioning starts on time? It's not fifty per cent. All three must be on time. So it's a half, times a half, times a half. Twelve and a half per cent. That's merge bias. Wherever parallel paths converge, the merge point is less likely to be on time than any single path feeding it. The critical path method can't show this. Monte Carlo can. It's one reason projects with many parallel streams slip more than people expect.

4:32 Worked example two: Manchester hospital extension

Now the realistic example from the lesson. A fictional hospital extension in Manchester. Deterministic finish: week seventy. Base cost: twenty-four million pounds. After modelling ranges and twelve discrete risks, the results are sobering. The chance of meeting the plan is about fifteen per cent for time and twenty per cent for cost. P50 is week seventy-five and twenty-five point three million. P80 is week eighty and twenty-six point four million. The top drivers: the risk of discovering asbestos, productivity on building services, and discharging planning conditions. So the contingency needed to reach P80 cost is twenty-six point four minus twenty-four. Two point four million pounds. Now the board can choose its confidence level knowingly, and target mitigation at the three drivers, instead of discovering the gap in eighteen months' time.

5:29 Watch me do it: a Monte Carlo in a few lines

Let me show you the core idea in a Jupyter notebook, so it stops being a black box. I import NumPy and create a random generator with a fixed seed, so results are reproducible. For each of three activities, I draw ten thousand durations from a triangular distribution: minimum, most likely, maximum. Then I add a discrete risk: thirty per cent chance of happening, and if it happens, it adds between ten and twenty days. For a simple chain, the finish is the sum; for parallel paths, I take the maximum, which is exactly how merge bias appears. Then P50 and P80 are just the fiftieth and eightieth percentiles of the results. The full notebook, with correlation, a tornado and criticality, is in the hands-on lab lesson that follows. Dedicated schedule risk tools, such as Safran Risk or Deltek Acumen Risk, do this on full schedules, and Excel add-ins such as @RISK do it on spreadsheet models.

6:37 Good practice and common mistakes

Good practice, briefly. The schedule passes quality checks before you simulate. Ranges come from structured interviews and historical data, with evidence, not a blanket plus or minus ten per cent on everything. Discrete risks come from the register and aren't double-counted in activity ranges. Correlation is considered. Time-dependent costs, like site overheads and equipment hire, are linked to duration so schedule risk flows into cost risk; otherwise cost contingency is usually underestimated. And results are re-run at key decisions. The mistakes are the mirror image: simulating a schedule with missing logic, identical percentage ranges everywhere, treating P80 as a guarantee, and presenting a histogram without explaining what drives it.

7:24 Recap and try this now

Let's recap. Monte Carlo simulation samples every uncertain input thousands of times to give you a distribution of outcomes, not a single date. Build it on a sound schedule, with evidenced ranges, discrete risks from the register and sensible correlation. Read P50, P80, the probability of meeting the plan, the tornado and the criticality index. AI can help calibrate ranges from historical actual-versus-plan data and draft result narratives, but the analyst owns the assumptions. When you present, translate the results into three statements: the probability of meeting the current plan, the time and money needed to reach the organisation's chosen confidence level, and the top three drivers with the actions that would narrow the range. Your try-this-now: list the five most uncertain activities or cost items on a project you know, with minimum, most likely and maximum values and the evidence behind each.