Schedule Risk Analysis: The Construction Guide to QSRA, Monte Carlo and Contingency Planning

Your project programme shows a completion date of 15 March 2027. But how likely is that date? If you ran the schedule 1,000 times with different durations reflecting real-world uncertainty, would it finish by 15 March even half the time? That’s the question schedule risk analysis answers.

Deterministic CPM schedules produce a single completion date. Schedule risk analysis produces a probability distribution: the likelihood of finishing by any given date. If you’re an owner’s representative deciding how much contingency to hold, or a project director assessing whether the contractual completion date is achievable, you need the probabilistic answer.

This guide covers the full QSRA (Quantitative Schedule Risk Assessment) process for construction: from schedule quality preparation through Monte Carlo simulation to contingency setting. It’s the prospective complement to our guide on forensic schedule analysis, which covers retrospective delay investigation after the fact.

What we found: The CIOB Guide to Good Practice in the Management of Time, §4.9.9.2, sets the typical band for construction QSRA modelling between P75 and P90: a 75% to 90% probability of completing by a given date. A deterministic CPM finish date sits well below that band; in CIOB’s own framing, the contingency required to reach P90 is “much greater” than the contingency required to reach P75.

What it means: A deterministic schedule alone is insufficient for decisions about contingency, investment, or contractual obligations. If you haven’t quantified the probability of meeting your key dates, you’re working below the certainty band the CIOB guidance treats as normal practice.

What Is Schedule Risk Analysis?

Schedule risk analysis quantifies the probability of achieving schedule milestones using probabilistic methods. Instead of a single duration per activity, you model a range of possible durations and simulate the schedule thousands of times to produce a probability distribution of completion dates.

The distinction from deterministic scheduling is fundamental:

Characteristic	Deterministic (CPM)	Probabilistic (QSRA)
Duration per activity	Single point estimate	Range (three-point estimate or distribution)
Output	Single finish date	Probability distribution of finish dates
Confidence level	Implied 100%	Explicit (P50, P80, P90)
Float handling	Fixed value	Varies by iteration
Critical path	Single, fixed	Probabilistic; activities join and leave it across iterations
Contingency	Not quantified	Calculated from confidence levels

A deterministic schedule tells you what the finish date is if every activity takes exactly its planned duration. A probabilistic analysis tells you the likelihood of finishing by any given date, given the range of durations each activity could actually take.

Why Construction Projects Need Schedule Risk Analysis

Bent Flyvbjerg’s database of 16,000 projects across 136 countries shows that 91.5% of major projects go over budget, over programme, or both. Construction schedules are optimistic by nature: they assume everything goes to plan. Real projects encounter weather delays, permit holdups, design changes, supply chain disruptions, and site conditions that differ from assumptions.

The Boston Central Artery/Tunnel Project (“Big Dig”) moved from an original estimate of $2.8B to $14.6B at completion, with more than $22B once interest was counted, finishing nine years late against the 1998 plan. A deterministic schedule for that project would have shown on-time, on-budget delivery. A probabilistic analysis would have revealed the risk.

Major project owners increasingly mandate QSRA as part of project governance. If you’re managing a project where the contractual completion date carries liquidated damages, or where investment decisions depend on delivery timing, you need to understand the probability of meeting that date, not just the deterministic projection.

For a broader overview of schedule analysis methods, see our guide to construction schedule analysis.

Key Concepts in Schedule Risk Analysis

Deterministic vs probabilistic scheduling

A deterministic schedule assigns each activity a single duration. The CPM calculation produces fixed early/late start and finish dates, total float, and a single critical path. If any activity takes longer than planned, the finish date moves. The deterministic schedule cannot tell you how likely that is.

A probabilistic schedule assigns each activity a range of possible durations. The Monte Carlo simulation samples from these ranges thousands of times, producing a distribution of possible outcomes. You can read off the probability of finishing by any given date.

Three-point estimates

The foundation of schedule risk analysis is the three-point estimate: optimistic (best case), most likely, and pessimistic (worst case) durations for each activity.

Estimate	Definition	Example (concrete pour)
Optimistic	Everything goes right	3 days
Most likely	Normal conditions	5 days
Pessimistic	Everything goes wrong	12 days

The PMI Practice Standard for Scheduling, Section 2.3.4, describes Monte Carlo simulation as considering “the uncertainty in an activity’s duration, cost, resources, and relationships, etc., using the risks from the risk register to drive the uncertainty in activity durations or by estimating those durations directly as optimistic, most likely, and pessimistic estimates for activities.”

Probability distributions

A three-point estimate defines the range. The distribution shape determines how the simulation samples within that range.

Distribution	Shape	When to Use
Triangle	Defined by three points; skewed if most-likely differs from midpoint	Default for construction; simple, intuitive, good for interview-based estimates
Normal	Symmetric bell curve around the mean	When uncertainty is symmetric; most-likely equals the midpoint
Lognormal	Skewed right (longer durations more likely than shorter)	Construction durations, where delays are more likely than early finishes
Uniform	All values equally likely	Maximum ignorance; when you have no basis for preference within the range

For construction, triangle and lognormal distributions are most common. Triangle is easier to explain in workshops. Lognormal is more realistic because it reflects the asymmetry of construction risk: activities can overrun by weeks but rarely finish weeks early.

Monte Carlo simulation

Monte Carlo simulation runs the schedule thousands of times. In each iteration, the software randomly samples a duration for each activity from its assigned probability distribution, calculates the CPM network, and records the finish date. After 3,000 to 5,000 iterations, the results form a probability distribution.

The PMI Practice Standard for Scheduling, Section 2.3.4, confirms this process: “A simulation is made up of many iterations, each of which represents a possible project result. For each iteration, durations (and resultant costs, etc.) are selected by the Monte Carlo simulation software to be consistent with the probability distributions and activity types specified by the project team.”

Confidence levels: P50, P80, P90

The simulation output tells you the probability of finishing by any given date. The shorthand:

• P50: 50% confidence. The date by which there’s an even chance of finishing. Typically later than the deterministic date.
• P80: 80% confidence. The date by which you’re likely to finish four times out of five. Common contractual target for contingency setting.
• P90: 90% confidence. Conservative; used for high-stakes milestones or when delay costs are extreme.

P50 is not a plan. It’s a coin flip. Planning to P50 means you expect to be late half the time. For construction projects, P80 is the typical minimum for contingency planning.

Correlation between activities

Activities in construction share common risk drivers: weather affects all outdoor activities simultaneously; a design change cascades across related work packages. If you model each activity’s duration independently, the simulation underestimates the risk because it assumes good luck on one activity offsets bad luck on another. In reality, a rain event delays everything.

Correlation modelling links activities so they move together in the simulation. This increases the spread of the output distribution and produces more realistic results.

QSRA vs QCRA

Element	QSRA (Schedule Risk)	QCRA (Cost Risk)
Unit of analysis	Activity durations	Activity costs
Output	Probability of finish dates	Probability of total cost
Typical software	Primavera Risk Analysis, @RISK	@RISK, Crystal Ball
Common confidence level	P80 for schedule contingency	P80 for cost contingency
Integration	Combined QSRA/QCRA for full project risk picture	Same

QSRA and QCRA are often run together on major projects. The schedule drives the cost risk, so QSRA typically runs first.

Schedule Quality: The Foundation of Reliable Risk Analysis

Risk analysis on a flawed schedule produces unreliable results. If the logic is wrong, the simulation samples incorrect durations and cascades them through an incorrect network. The output looks sophisticated but is meaningless.

Garbage in, garbage out applies to QSRA more than any other analysis type because the errors compound across thousands of iterations.

Key insight: Before running any Monte Carlo simulation, validate the schedule against the Defense Contract Management Agency’s DCMA 14-Point Assessment. If the schedule fails quality checks, fix it first. Running QSRA on a poor-quality schedule gives you a precise probability of an incorrect outcome.

The schedule quality issues that most undermine risk analysis:

Quality Issue	Why It Undermines QSRA	DCMA Check
Missing logic (open ends)	Random durations don’t cascade correctly through the network	Check 1 (Logic)
Hard constraints overriding logic	Constraints prevent probabilistic scheduling from moving dates	Check 5 (Hard Constraints)
High-duration activities	Range estimates are meaningless on bundled work that should be subdivided	Check 8 (High Duration)
Excessive lags	Lags can’t be assigned probability distributions; they’re fixed in the simulation	Check 3 (Lags)

For detailed quality check methodology, see our guide to the DCMA 14-Point Assessment.

Step-by-Step: How to Conduct a Schedule Risk Analysis

The following 8-step process covers the full QSRA from schedule preparation through to results integration.

Step 1: Prepare the schedule

Before adding any risk information, ensure the deterministic schedule is complete and high-quality:

• Run the DCMA 14-Point Assessment and resolve any failing checks
• Verify all logic links are correct and complete
• Confirm the critical path is logic-driven, not constraint-driven
• Ensure activity durations are realistic for the work content
• Verify the data date is current

For a structured approach to schedule preparation, see our guide to baseline schedule review.

Step 2: Identify schedule risks

Develop a risk register specific to the schedule. Common construction schedule risks:

Risk Category	Examples
Weather	Rain delays, extreme heat, cyclone season
Permits and approvals	Late consent, condition changes, regulatory hold
Supply chain	Material shortages, delivery delays, price escalation
Design changes	Scope changes, undocumented site conditions, client variations
Site conditions	Contaminated soil, archaeology, unexpected ground conditions
Resource availability	Labour shortage, trade overlap, equipment breakdown

Distinguish between:

• Event risks: may or may not happen (e.g. a flood, a strike)
• Uncertainty: will happen but the impact is uncertain (e.g. how long the concrete pour will actually take)

Map each risk to specific activities or groups of activities. A risk that isn’t mapped to the schedule can’t be modelled in the simulation.

Step 3: Collect three-point estimates

This is the most practical challenge in QSRA. You need duration ranges from the people who understand the work: the construction team.

Interview techniques:

1. Start with the most-likely duration (the one already in the schedule) and ask: “What’s the best case if everything goes right?” and “What’s the worst case if everything goes wrong?”
2. Anchor on the pessimistic estimate. People naturally anchor on the most-likely case and underestimate downside risk. Ask: “Has this type of work ever taken twice as long? What caused it?”
3. Use historical data where available. Previous projects from the same region, same trade, or same contractor provide better ranges than guesswork.
4. Watch for artificially narrow ranges. If the optimistic and pessimistic estimates hug the most-likely value tightly (say, a few days either side of a multi-week activity), the team is anchoring on a single number and calling it a range. Push back.

Common mistake: eliciting estimates from people who built the schedule, not the people who will execute the work. Schedulers produce durations from first principles; the site team knows what actually happens.

Step 4: Assign probability distributions

For each activity with a three-point estimate, assign a distribution type:

• Triangle: default for construction. Simple, transparent, understood by non-specialists. Adequate for most QSRA purposes.
• Lognormal: more realistic for construction durations where delays are more likely than early finishes. Requires specialist software to set up.
• Normal: when uncertainty is symmetric around the most-likely value. Rare in construction.
• Uniform: when you have no basis for preference within the range. Conservative (wider uncertainty).

The choice of distribution matters less than the quality of the three-point estimates. A well-estimated triangle distribution produces more reliable results than a poorly estimated lognormal.

Key insight: The CIOB Guide §4.9.9.4 notes that QSRA tools offer “a dozen or more” distribution options, but treats the triangular distribution as the practical starting assumption for project activities. Reach for a more exotic distribution only when you can defend the choice; triangle is the default that survives most workshop scrutiny.

Step 5: Model correlation between activities

Identify groups of activities that share common risk drivers:

• All outdoor activities in the same month (weather correlation)
• All activities depending on a single design package (design correlation)
• All activities in the same geographic area (site access correlation)

In Primavera Risk Analysis, use the correlation matrix to link activities within each group with a moderate-to-strong correlation coefficient. In @RISK, use the risk driver method to assign shared risk events to multiple activities. Either approach achieves the same outcome: activities sharing a driver move together in the simulation rather than diversifying their luck.

Ignoring correlation is one of the most common QSRA mistakes. It produces an optimistic output because the simulation assumes good-luck and bad-luck outcomes balance across activities when in reality they cluster.

Step 6: Run the Monte Carlo simulation

Iterations. The CIOB Guide describes Monte Carlo as repeating the schedule calculation “hundreds of times with different values selected from within the range.” Practitioner guidance in QSRA software documentation typically pushes higher than that, with several thousand iterations common, especially when P90 or P95 outputs need to be stable across reruns. Run enough iterations that the headline confidence-level dates stop shifting between runs; that is the stability test that matters.

Random seed: set a fixed seed for reproducibility. If you need to demonstrate that your results are consistent, run the simulation with different seeds and confirm the P80 date varies by less than a few days.

Interpreting output:

Output	What It Shows
Cumulative probability curve (S-curve)	The probability of finishing by any given date
Histogram	The frequency distribution of finish dates across iterations
Tornado chart	Which risks or activities contribute most to finish-date uncertainty
Probabilistic critical path	Which activities are most frequently on the critical path across iterations

For P6 integration, use Oracle Primavera Risk Analysis (PRA), which imports the P6 schedule directly and maintains the CPM logic.

Step 7: Interpret results and set contingency

The cumulative probability curve tells you the probability of finishing by any given date. Read off the confidence levels:

• P50 date: the median outcome. On a well-estimated construction schedule this lands later than the deterministic date; by how much depends on the input ranges and on how much correlation the model captures.
• P80 date: the typical contractual contingency target. The gap to the deterministic date is larger again, and grows with the spread of the three-point estimates.
• P90 date: further still. The CIOB Guide §4.9.9.2 frames P75 to P90 as the certainty band construction QSRA usually targets; the contingency required to reach P90 is meaningfully greater than the contingency required to reach P75 on the same schedule.

Schedule contingency is the difference between the deterministic finish date and the P80 finish date. This is not additional time added to every activity; it’s the quantified uncertainty in the overall schedule.

Distinguish:

• Risk contingency: quantified by QSRA; held against the probability of identified risks materialising
• Management reserve: held for unknown risks; not quantified by QSRA
• Float: available within the schedule; consumed by realised risks

Step 8: Integrate findings into project controls

QSRA isn’t a one-time exercise. It feeds back into project controls:

1. Update the schedule with risk-adjusted durations or add contingency activities (not by inflating individual activity durations)
2. Monitor actual progress against probabilistic predictions. If the project is tracking above the P80 curve, risk is materialising faster than expected
3. Re-run QSRA at major reporting milestones and after any material change to the risk register, baseline, or critical path, as the project’s risk profile evolves
4. Use risk analysis results to support or challenge EOT claims

For a broader look at software tools that support this process, see our guide to schedule analysis software.

QSRA Methods Compared

Method	How It Works	Strengths	Weaknesses	Best For
Monte Carlo Simulation	Thousands of iterations sampling from probability distributions	Gold standard; comprehensive; produces full probability distribution	Requires software and expertise; needs quality three-point estimates	Major projects where QSRA is mandated; any project needing P80 contingency
PERT	Weighted average of three-point estimates using formula: (O + 4M + P) / 6	Simple; no specialist software; quick	Approximates only the mean; doesn’t produce a full distribution; ignores correlation	Smaller projects; initial screening; when Monte Carlo isn’t feasible
Scenario Analysis	Three discrete scenarios: best case, worst case, most likely	Quick; easy to communicate; no software	Crude; doesn’t quantify probability; scenarios may be subjective	Early-stage assessment; portfolio-level screening; workshops

For most construction projects where QSRA is contractually required, Monte Carlo is the expected method. PERT and scenario analysis are useful for preliminary assessment but don’t meet the bar for formal risk quantification.

Schedule Risk Analysis and EOT Claims

QSRA results inform EOT assessment in two ways: by showing whether a delay event sat inside or outside the modelled risk profile, and by quantifying remaining contingency against the contractual completion date.

How QSRA supports EOT assessment

• If the QSRA P80 finish date is earlier than the contractual completion date, the project has quantified contingency: there’s an 80% probability of finishing on time even with identified risks
• If the P80 date exceeds the contractual date, the project is at risk; the QSRA quantifies by how much and which risks contribute
• Tracking contingency consumption over time shows whether delays were foreseeable (within the risk profile) or unforeseeable (outside it)

How to use QSRA to challenge or support claims

A contractor seeking an EOT may argue that a delay event was unforeseeable. If the QSRA risk register included that risk category and the P80 date already accounted for it, the event was foreseeable within the probabilistic analysis. Conversely, if the event falls outside the modelled risk profile, it may support an EOT on the basis of unforeseeability.

Risk analysis is not expert determination. The principle is the same one the Society of Construction Law’s Delay and Disruption Protocol, 2nd Edition, paragraph 4.9, applies to Time Impact Analysis: “prior to determining the effect of an Employer Risk Event on the Updated Programme, any patently unreasonable or unrealistic logic, constraints or durations should be corrected by agreement.” SCL §4.9 governs TIA, not QSRA, but the input-integrity reasoning carries across: if the underlying schedule logic or risk inputs are disputed, the QSRA output sits on the same disputed ground.

For EOT claim methodology, see our guide to EOT claim analysis.

Software for Schedule Risk Analysis

Software	Integration	Key Features	Best For
Primavera Risk Analysis (PRA)	Direct P6 import	Monte Carlo, risk register, correlation matrix, tornado charts	P6-based projects; industry standard
@RISK (Palisade/Lumivero)	Excel-based; ScheduleRiskAnalysis module	Monte Carlo, distribution fitting, cost and schedule risk	Excel-centric teams; combined QSRA/QCRA
Safran Risk	Safran Project integration	Monte Carlo, risk driver method	Safran users
Full Monte	Standalone	Fast Monte Carlo for project schedules	Quick assessments without P6
Barbecana	Standalone and P6 plugin	Schedule risk analysis, risk driver method	Schedule-focused risk analysis

Common Mistakes in Schedule Risk Analysis

Mistake	Why It’s Wrong	What to Do Instead
Running QSRA on a poor-quality schedule	Flawed logic produces meaningless probabilities	Validate schedule quality first; run DCMA 14-Point
Single-point estimates instead of ranges	Removes the uncertainty the analysis is supposed to quantify	Collect three-point estimates for all risk-exposed activities
Ignoring correlation	Underestimates risk; assumes good luck offsets bad luck	Model correlation for shared risk drivers
Double-counting risks	Inflates contingency; same risk in both duration uncertainty and risk register	Ensure each risk is modelled once
Planning to P50	50% confidence is a coin flip	Use P80 minimum for contingency planning
Overcomplicating the model	Obscures results; hard to explain and audit	Start with triangle distributions; add complexity only where justified
Anchoring on most-likely	Teams give artificially narrow ranges	Use structured estimation techniques; challenge narrow ranges

Key Takeaways

• Schedule risk analysis quantifies the probability of meeting schedule milestones using probabilistic methods. It complements deterministic CPM scheduling by revealing the uncertainty the deterministic schedule hides.
• QSRA is prospective (“how likely are we to finish on time?”); forensic schedule analysis is retrospective (“what caused the delay?”). Both are essential for different purposes.
• The foundation is schedule quality. Running Monte Carlo on a poor-quality schedule produces precise but meaningless results. Validate with DCMA 14-Point first.
• Three-point estimates (optimistic, most likely, pessimistic) are the core input. Collect them from the construction team, not the schedulers. Challenge narrow ranges.
• Monte Carlo simulation with 3,000-5,000 iterations produces a probability distribution of finish dates. Read off P50, P80, and P90 confidence levels.
• Correlation between activities is critical. Ignoring it produces optimistic results because the simulation assumes independent outcomes for activities that share risk drivers.
• Schedule contingency is the difference between the deterministic finish date and the P80 finish date. P80 is the typical minimum for construction contingency planning.
• Re-run QSRA at key milestones as the risk profile changes throughout the project.