How to Calculate the Cost of Risk on Construction Projects: Monte Carlo, PERT and How Often to Run Each

Drawing on more than 25 years in commercial leadership and project controls, I use cost-risk analysis to establish a defensible view of likely outturn, not to add an arbitrary percentage to an estimate. The method should match the maturity of the information, the decisions to be made and the scrutiny the forecast must withstand.

In my experience chairing monthly risk reviews and managing QCRA governance with QSRA oversight on a major defence infrastructure programme, a model's value depends as much on its assumptions and updates as on its calculations.

What does “cost of risk” mean?

A project’s risk exposure is not one number until its scope and calculation basis are clear:

• Base estimate: the cost of the defined scope before the specified risk allowance.
• Identified risk events: potential events with a probability and cost consequence.
• Estimate uncertainty: variation in quantities, rates, productivity, inflation and other assumptions.
• Schedule-driven cost: costs that may change if the programme takes longer or activities move.
• Contingency: provision set against a stated confidence level and governed through agreed controls.

The estimate is built in layers, each with its own owner and controls:

• Base estimate: the defined scope priced at current rates, with no allowance for anything outside the stated assumptions.
• Risk allowance: provision for uncertainty within the base assumptions, such as quantity variation and productivity, derived from the estimating ranges rather than the risk register.
• Contingency: a governed provision set against a stated confidence level for risks outside the base assumptions, held and released under formal control.
• Management reserve: a sum above contingency, owned at programme or portfolio level, for risks beyond the project's own analysis.

The distinction matters in both directions: uncertainty that belongs in the base ranges should not reappear as a register event, and a discrete risk with a clear owner should not be absorbed into generic ranges. When boundaries blur, double counting follows.

A worked example shows the mechanism. Suppose a programme holds £2.0m of estimating uncertainty in its base ranges and £1.0m of contingency against register risks. If a team adds a £400,000 ground-conditions event without checking that ground uncertainty already sits inside the ranges, the exposure is counted twice and the risk position rises with no change in reality. The control is a written mapping of what sits in the ranges, register and reserves, tested before every addition.

Methods for calculating construction cost risk

No single method suits every stage. The methods below can be used in sequence, from a quick risk-register calculation to a fuller quantitative model.

Method	What it calculates	Best suited to	Main limitation
Expected monetary value (EMV)	Probability multiplied by cost impact for each discrete risk	Early screening and regular register reviews	An average; does not show the range or confidence level
Three-point estimating and PERT	A central estimate and spread for uncertain cost items	Estimating uncertainty where low, likely and high values can be justified	Sensitive to the quality of the three estimates
Sensitivity and scenario analysis	The effect of changing selected inputs or conditions	Identifying material drivers and testing decisions	A one-at-a-time test may miss combined effects
Monte Carlo QCRA	A distribution of possible total costs from combined uncertainty and risks	Funding, contingency and assurance decisions	Requires reliable inputs, sound assumptions and governance
Risk-adjusted cost forecasting	A current forecast incorporating changed exposure, realised risks and mitigations	Ongoing project control	Must be reconciled with the approved baseline and contingency rules

1. Expected monetary value: a transparent starting point

For a discrete risk, the basic calculation is:

Expected value = probability of occurrence × cost impact

Suppose there is a 20% probability of a ground-condition event costing £500,000, and a 10% probability of a utility diversion costing £300,000:

• Ground-condition exposure: 20% × £500,000 = £100,000
• Utility exposure: 10% × £300,000 = £30,000
• Combined EMV: £130,000

This provides a useful expected-value view for comparison and tracking. It does not mean the project needs precisely £130,000 of contingency: EMV is an average across outcomes, and does not show how severe the less likely outcomes could be.

That average depends on how probabilities and impacts were elicited, and two failure patterns recur:

• Anchoring on a single point estimate. An existing costed estimate tends to become the impact figure, even where the risk describes a different outcome. The fix: assess the impact separately from the priced scope, supported on its own basis.
• Overconfidence in probability. Experts assigning probabilities typically underestimate the chance of adverse events, particularly for risks they own. Probabilities drawn from historical frequency, comparable projects or structured ranges are more defensible than a consensus number.

EMV also makes exposure visible over time: tracking total register EMV period by period shows whether the position is genuinely reducing. On a defence infrastructure programme I supported, a rising EMV where nothing had materialised meant mitigation was not working, prompting challenge long before contingency showed it.

The table below shows a register extract before and after agreed mitigation:

Risk	Probability	Impact	EMV	Post-mitigation probability	Post-mitigation impact	Post-mitigation EMV
Ground conditions worse than assumed	20%	£500,000	£100,000	15%	£500,000	£75,000
Utility diversion delayed by third party	10%	£300,000	£30,000	5%	£300,000	£15,000
Design development on façade package	25%	£200,000	£50,000	15%	£220,000	£33,000
Late delivery of long-lead equipment	15%	£400,000	£60,000	10%	£400,000	£40,000
Total			£240,000			£163,000

The façade line rewards a second look: mitigation reduced the probability, but the impact rose because the mitigation carries cost. Post-mitigation EMV should reflect that full position. The total is an expectation across independent risks, ignoring correlation, which the stages below address.

2. Three-point estimating and PERT

For an uncertain cost item, estimate a low, most likely and high value, each relating to a clearly defined scope and supported by evidence such as comparable work or structured expert judgement.

A simple triangular mean is:

(Low + Most likely + High) ÷ 3

A commonly used PERT weighted mean is:

(Low + 4 × Most likely + High) ÷ 6

For example, if an uncertain package is estimated at £0.8m low, £1.0m most likely and £1.6m high, its PERT mean is about £1.07m. PERT weights the most likely value more heavily, but the range still needs justification.

What shape each formula assumes matters, because the choice changes the modelled exposure:

• Triangular treats the three values as the corners of a simple peak: easy to elicit and explain, though the corners carry more weight than they usually deserve.
• PERT produces a smoother, more central shape, suiting items where the most likely value is well evidenced and the extremes are genuinely rare.
• Beta and other flexible families allow the analyst to shape the distribution more precisely, which matters once a model moves beyond single items into a full quantitative run.

Skew matters more than most teams expect. Cost distributions are usually right-skewed: there is a floor at the priced minimum, but the upside is bounded only by how badly conditions, quantities or suppliers can perform. A package rarely comes in far below its low estimate, yet it can overrun its high estimate widely when escalation and rework stack together. A symmetric range therefore understates the tail, and the understatement compounds when items are combined. The discipline that improves three-point data most is a challenge question at elicitation: what would have to happen for cost to exceed the high value, and has that been costed? A careless distribution cannot be rescued by a sophisticated model later.

Three-point data also has a second life: it is the raw material for monte carlo schedule risk analysis and its cost-side equivalent. Each low, likely and high value becomes an input distribution the model samples thousands of times, and a careless distribution cannot be rescued by a sophisticated model.

In a QCRA, three-point values define probability distributions for individual cost elements, sampled alongside discrete risks. A useful explanation of distribution selection is available in AACE International’s guidance on probability distribution functions.

3. Sensitivity analysis and risk-adjusted forecasting

Sensitivity analysis tests which assumptions most affect the result: whether total cost is most exposed to excavation quantities, labour productivity or the duration of site preliminaries.

Scenario analysis compares distinct conditions: a late approval, a procurement route change or a severe ground-condition case. Scenarios should be clearly labelled, not presented as probabilities unless assessed.

Within a quantitative model, sensitivity is usually presented as a tornado diagram: a horizontal bar chart in which each input spans the cost effect of moving between its low and high bounds, widest bars at the top. A variable near the bottom is effectively declared immaterial. For governance, it converts statistical output into a single visual a board can absorb in seconds, making the model's dependence on assumptions explicit.

One limitation: one-at-a-time testing misses correlation. Two variables may each look moderate in isolation yet produce a severe combined effect because they move together. The clearest construction example is quantity growth and labour productivity: a design that grows in scope tends to be built less efficiently, so the exposures are not independent, and a model treating them as such understates the combined tail. Correlation can be captured by defining relationships between input distributions rather than sampling each independently, though it takes discipline and usually widens the upper tail.

A project example shows why the ranking matters commercially. On a rail-linked infrastructure project, the tornado analysis placed the duration of site preliminaries above every other driver, well ahead of the material prices dominating the team's attention. The mitigation plan was reshaped accordingly: the programme was resequenced to shorten full-time overheads and the preliminaries estimate rebuilt on a shorter duration. Without the analysis, effort would have gone into material rates, a minor driver. The technique shows where mitigation actually buys exposure reduction.

A risk-adjusted forecast goes further than a static register. It reflects current information: risks materialised, exposure reduced through mitigation, changes to forecast-to-complete and contingency used. It remains traceable to the approved baseline, with changes under formal control.

4. Monte Carlo QCRA and schedule risk analysis

A Quantitative Cost Risk Analysis (QCRA) combines cost uncertainty and risk events into a range of possible outturn costs. Each iteration samples the input distributions and calculates a total; repeating this produces a distribution rather than a point estimate.

The result is often reported as P50, P80 and P95:

• P50: a 50% probability that the outturn will be at or below this figure.
• P80: an 80% probability of not exceeding it.
• P95: a 95% probability of not exceeding it.

If the base estimate is £10.0m and the model produces P50 £10.9m, P80 £11.8m and P95 £12.7m, the allowances above base are £0.9m, £1.8m and £2.7m. These are illustrative figures, not recommended percentages. The confidence level selected should follow the project’s funding policy and risk appetite.

Two questions arise whenever a Monte Carlo model is proposed: how many iterations, and how are inputs sampled?

On iterations: reported percentiles must be stable, not exhaustive. Between 5,000 and 10,000 iterations is usually sufficient, with 10,000 preferred where P95 figures are material, because the extreme tail is where small samples wobble most. If re-running with unchanged inputs moves the P80, the count is too low.

On sampling: each iteration draws a value from every input distribution and calculates the total, so each iteration is a plausible version of the project. Most modern tools use Latin Hypercube sampling, dividing each distribution into equal-probability bands and sampling each band once, for a smoother representation from fewer iterations.

Correlation deserves its own sentence in the model documentation. Where inputs move together, for example rates across a supply chain responding to one market, sampling them independently understates the spread of totals, concentrating the effect in the tail: the P80 and P95 come out too low precisely where reliability matters most. Ignoring correlation makes the model optimistic, and optimism in the tail is the costliest error a quantitative model can carry.

The standard output is the S-curve: cumulative probability plotted against total cost. The figure at the 80% point is the P80; the gap between the P50 and P80 points is what the contingency policy is actually buying; and the steepness of the curve indicates dispersion, a shallow curve signalling heavy dependence on assumptions. The fastest way to build board fluency is to mark the current funding position on the curve.

For infrastructure work, cost and time are connected. Schedule risk analysis identifies the probability of delay, while an integrated cost-and-schedule model shows how delay affects prolongation, escalation and other time-related costs. My article on QCRA and QSRA: which quantitative risk analysis should you run first? covers aligning the analyses.

Choosing the confidence level: P50, P80 or P95?

The model produces the range; the organisation decides where along it to fund. That is a policy matter, best made explicitly rather than by convention.

• P50 funds an even chance, suiting a portfolio that absorbs overruns across many projects or a commercial strategy that transfers most downside risk to contractors.
• P80 is the common corporate standard. It accepts an objective 20% chance of calling on further provision and avoids tying up capital against unlikely outcomes.
• P95 suits projects where a further call on funding is unacceptable: a fixed public commitment, or a delivery vehicle with no contingency above its own.

P50, P80 and P95 are conventions, not requirements. Some programmes report a lower bound as well as an upper one: a P10, P50 and P90 set, for example, presents the likely outturn range symmetrically around the median, which suits programmes tracking both upside potential and downside exposure through the same curve. On such programmes, funding is usually set against the P90 rather than a P80, and the P10 has its own governance use, marking the level at which headroom against the median becomes visible and can be checked before it is quietly absorbed. What matters is not the percentile numbers chosen but that the reported levels, the contingency held and the drawdown rules all point at the same figures. A programme reporting P90 while its contingency was set at a P80 funding position carries a gap it will discover at drawdown, not at reporting.

Portfolio aggregation is why many organisations deliberately fund at a lower confidence at project level than for a single project. Overruns are only imperfectly correlated: when several projects are held at P80, the portfolio sits well above P80, because the projects are unlikely to all overrun together. Funding every project at P95 would immobilise capital that aggregation already protects. The better arrangement funds projects at P60 to P80 and holds a portfolio-level reserve with agreed drawdown criteria.

The confidence level also connects to how contingency is drawn. A funded level with no drawdown rules is an allowance in name only. At minimum, the policy should state: what evidence is required before contingency is committed; whether realised risk costs are absorbed or trigger a re-baseline; who approves drawdown above thresholds; and what happens when consumption runs ahead of the risk burn-down profile. The healthiest governance reviews consumption against modelled expectation each quarter.

How often should you run a QCRA Monte Carlo?

No rule requires a full Monte Carlo monthly or quarterly. Set the cadence by how quickly the risk picture changes, how often senior decisions are made, and whether inputs can be refreshed with discipline.

Cadence	Appropriate approach
Monthly	Update the risk register, forecast-to-complete, realised risks, mitigation status and schedule assumptions. Run a full Monte Carlo if material exposure or a decision has changed.
Quarterly	Complete a formal QCRA review, challenge assumptions and present updated confidence levels, contingency position and key drivers through governance.
Event-driven	Re-run when a material scope or design change, major delay, ground finding, procurement shift or market movement changes the exposure.

A quarterly full QCRA with monthly lighter updates is often proportionate for a project whose exposure is changing steadily rather than sharply. In the intervening months, EMV calculations, sensitivity checks and a refreshed risk-adjusted forecast provide control without repeating a full model with no material new information.

A monthly Monte Carlo can be justified when the cost or schedule position is volatile, when board-level decisions take place monthly, or when contingency changes need frequent quantitative assurance. It is less useful if the risk inputs are not reviewed monthly and the model is simply rerun with unchanged assumptions: frequency should strengthen forecast integrity, not create the appearance of precision.

The cadence works best when anchored to the governance calendar. A workable annual pattern:

Month	Governance activity	Quantitative activity
Quarterly months	Portfolio review	Full QCRA and monte carlo schedule risk analysis refresh; assumption challenge; updated S-curve to governance
Every month	Monthly risk review and cost forecast	Register update, EMV refresh, risk-adjusted forecast, mitigation status; sensitivity spot-checks where drivers have moved
Quarter-end plus two weeks	Assurance checkpoint	Reconcile contingency drawdown with modelled expectation; confirm inputs were refreshed
Year end	Annual basis review	Revisit estimating basis, escalation assumptions, market conditions and distribution choices

Off-cycle re-runs should be governed by triggers agreed in advance, so the decision to rerun is never an argument. Triggers that work well:

• Forecast movement above a threshold, typically a 5% change in forecast outturn against the last modelled position.
• A new material risk, defined as any risk whose EMV or impact exceeds an agreed value.
• Contingency drawdown ahead of plan, for example consumption exceeding the modelled expectation for the period.
• Scope or design change above a threshold, where the change alters the basis of the modelled ranges.
• A schedule movement changing the critical path or the exposure of time-related costs, linking the QCRA back to schedule risk analysis.

Ownership matters as much as the calendar. The model owner is accountable for input currency: distributions reflecting the latest estimating basis, register values reconciled with risk owners, market assumptions checked. On a major defence infrastructure programme, models that failed assurance were rarely wrong in their mathematics; they were stale in their inputs. An input-refresh sign-off on every run removes that failure mode.

The cost of getting cadence wrong runs both ways. Running the full model on unchanged inputs produces report churn and trains readers to ignore the output; running it too rarely leaves decisions made against a distribution that no longer describes the project. The cadence is right when the interval between runs is shorter than the time in which exposure can change materially.

Whichever cadence is selected, set event triggers so that significant change does not wait for the next scheduled review, and record what changed between runs and what action followed.

A practical governance sequence

The process is:

Set the cost baseline and scope
            ↓
Identify discrete risks and estimate uncertainty
            ↓
Choose EMV, ranges, scenarios or Monte Carlo to suit the decision
            ↓
Check schedule links, dependencies and double counting
            ↓
Agree the confidence level and contingency controls
            ↓
Update monthly, review formally at the agreed cadence,
and rerun after material change

Each run should state its estimate basis, assumptions, risk ownership, treatment of correlation, escalation basis and limitations. The report should show the base estimate alongside P50/P80/P95, explain changes since the previous period, identify the principal cost drivers, and explain how contingency is held, released and replenished.

The AACE guidance on integrated cost and schedule risk analysis is a reference for combining estimate ranges, expected value and Monte Carlo. For public-sector appraisal, the UK Government Green Book addresses optimism bias, which should be reconciled with project-specific risk analysis to avoid double counting.

Common pitfalls, and the fix for each

Most failures in cost-risk practice are not analytical errors but governance habits. Those I meet most often, with the remedy for each:

• Padding dressed as analysis. A contingency decided socially and justified afterwards with a model is not risk analysis; the tell is a confidence level that moves to fit the funding position. The fix: the model runs first, the result is reported as it stands, and the funding decision follows.
• Double counting. The same exposure held in estimating ranges and again in the register. The fix is the boundary map tested at every refresh.
• Stale distributions. Ranges elicited at sanction and reused two years later describe a different project. The fix is an input-refresh sign-off on every run and an assumption log with dates.
• Unwarranted precision. Reporting a P80 of £4,836,251 invites the wrong challenge. Round at governance level: report P80 as £4.8m.
• Orphaned assumptions. An assumption no one owns, such as a supplier rate holding, will not be checked. The fix is a named owner and review date for every material assumption, expiry treated as a trigger to revisit the model.
• Treating one run as truth. A single S-curve is one view of one model on one day. The fix is trend reporting: track percentiles across runs.

The right method is the one that improves control

EMV provides a clear expected value for discrete risks; PERT and three-point estimates describe uncertainty, with distributions whose shape matters; sensitivity analysis identifies the drivers that deserve mitigation effort, provided correlation is respected; and Monte Carlo combines everything into a range the organisation chooses to fund at P50, P80 or P95. Risk-adjusted forecasting keeps those insights connected to live control, and the governance calendar keeps the apparatus current.

For many projects, monthly risk and forecast updates paired with a formal quarterly QCRA, and event-triggered re-runs governed by written thresholds, offer a balanced starting point. Increase the cadence when risk volatility or governance decisions demand it. The governing principle is straightforward: every model run should improve the evidence available for a cost, contingency or delivery decision, and no run is worth its cost unless its inputs are as current as its calculations.

About the author

Nick Garvey is a construction and project controls professional with more than 25 years’ experience in commercial leadership. His work includes chairing monthly risk reviews and managing QCRA governance with QSRA oversight on a major infrastructure programme. He writes about cost forecasting, risk, governance and delivery assurance. Credentials: MCIOB, FCaSA, FQSi.

All views my own, shared in a personal capacity.