What quantified cost risk analysis actually measures
A risk register total and a QCRA-derived contingency answer different questions — one sums stated values, the other simulates a distribution of outcomes. Here is the gap, and why it matters for the number you put in front of a board.
The number everyone reaches for first
Sum the "most likely" cost of every open risk in a register and you get a number. It looks like a contingency. It is not one — it is a deterministic sum of point estimates, and it systematically understates the range of outcomes a programme can actually see.
Quantified cost risk analysis (QCRA) asks a different question: given the range of possible outcomes for every risk and every estimate uncertainty, what does the distribution of total project cost look like, and what contingency covers it to a stated confidence level?
Why summing point estimates fails
Three mechanisms drive the gap between a register total and a simulated contingency:
- Uncertainty is asymmetric. A risk rarely has a symmetric range around its most likely value — schedule slippage tends to skew right, favourable outcomes are bounded, unfavourable ones often are not.
- Risks are not independent. Ground conditions, contractor performance and consenting delay frequently move together. Summing independent distributions when the underlying risks are correlated understates the tail — the "merge bias" that catches most first-pass Monte Carlo models.
- A register total hides the shape. A P50 output and a P80 output can differ by tens of millions of pounds on a major programme. A single summed figure gives you neither number, only something that resembles an average case that never actually occurs.
What a QCRA output actually gives you
Run a Monte Carlo simulation over three-point (or PERT) estimates for every risk and cost line, and the output is a cumulative distribution: cost on one axis, confidence on the other. From that you can read a P50 contingency (the median outcome), a P80 (the figure that covers 80% of simulated outcomes), or any confidence level a governance process requires.
This is the number that answers the actual question a sponsor is asking — not "what do we expect to happen", but "how much headroom do we need to be reasonably confident we won't need more".
Where this leaves the register
The risk register does not become redundant. It is the input: every risk's probability, cost impact range and correlation assumptions feed the simulation. QCRA is what you build on top of a well-maintained register, not a replacement for keeping one.
Sources
See it on a real programme
Kamba Risk runs quantified cost and schedule risk analysis on your own register, not a demo dataset. Request access to see what your contingency actually looks like at P50 and P80.