What is QSRA? Quantitative schedule risk analysis, explained properly

Every project schedule is a single story about the future: this activity takes 20 days, that one starts when this one finishes, and the whole thing lands on the 24th of August. Quantitative Schedule Risk Analysis (QSRA) is the discipline of admitting that the single story is one draw from a distribution — and then computing the distribution.

Instead of one duration per activity, a QSRA carries a three-point estimate — minimum, most likely, maximum — for each. Instead of a register of risks scored red/amber/green, it carries each risk's probability and impact range, mapped to the activities it would actually hit. Then a Monte Carlo engine plays the project out thousands of times: each iteration samples every duration and every risk, re-computes the full critical-path network, and records when the project finished. Ten thousand iterations later, you have something no deterministic plan can give you: the probability attached to any date.

The outputs that matter

Three numbers do most of the work in practice. The P50 is the coin-flip date — half the simulated outcomes finish before it. The P80 is the date you can commit to with an 80% chance of keeping your word; it is the customary commitment level across UK infrastructure and much of oil & gas, and the difference between it and the deterministic date is your schedule contingency, in working days. And the probability of achieving the plan — the deterministic date's rank in the distribution — is the single most clarifying number in the pack, because on real networks it is routinely under 20%. Not because planners are bad, but because of how networks behave (see merge bias).

What separates a credible QSRA from theatre

• A sound network underneath. Simulation propagates risk through logic. If the logic is broken — open ends, hard constraints pinning dates, leads hiding sequence — the P80 is confident nonsense. A readiness check (we use a DCMA-aligned 14-point gate) comes first.
• Ranges with a basis. Three-point estimates elicited from the people who own the work, calibrated against how estimates have actually performed — not a lazy ±10% smeared over everything.
• Risks mapped to activities. A risk that "impacts the project" impacts nothing. A risk mapped to the switchgear delivery, firing 30% of the time with a 20–80 day impact, moves the answer.
• Correlation. Independent activities cancel each other's errors; real activities share crews, weather and estimating assumptions. Ignoring correlation systematically understates risk — the tails come out too thin.
• Reproducibility. If your analyst cannot re-run the model and get the same answer, you have a vibe, not an analysis. Seeded simulation makes every number auditable.

The standards, briefly

The APM PRAM Guide frames QSRA inside a risk-management process: identify, assess, plan responses, then quantify what remains. AACE International's RP 57R-09 goes further and describes exactly the method above — Monte Carlo simulation of a CPM model with risk drivers mapped to activities, integrated with cost. If a client asks what method you used, those are the two citations that end the conversation, and they're the two our methodology page is aligned to, formula by formula.

Where the answer becomes a decision

A QSRA earns its fee at three moments. When the P80 says the commitment date needs 90 days of contingency the deterministic plan doesn't have — before signature, while it's still negotiable. When the driver ranking says one risk carries 70% of the exposure — so the mitigation budget goes there, not everywhere. And when the pre/post-mitigation comparison prices the mitigation package in pounds per day recovered — which turns a risk register from a compliance artefact into a business case.