Cost Risk Analysis (CRA)

Cost Risk Analysis (CRA) does for the cost estimate what Schedule Risk Analysis does for the programme. It takes the deterministic cost estimate — the line-by-line breakdown of expected expenditure — and overlays uncertainty. Each cost element is given a range (typically a three-point estimate) reflecting the degree of confidence in that estimate, and discrete risk events from the risk register are modelled as probabilistic cost impacts. A Monte Carlo simulation then produces a full probability distribution of possible outturn costs.

CRA is used to establish how much contingency the project needs and to test whether the approved budget is sufficient. The P50 from a CRA represents the expected outturn cost — the amount you would expect to spend on average. The P80 is typically used to set the contingency budget, representing the amount that gives an 80% probability of staying within budget. The gap between the deterministic base estimate and the P50 is often referred to as 'the expected risk exposure' and reflects the anticipated impact of risks that are likely but not certain to occur.

A well-structured CRA distinguishes between aleatory uncertainty (inherent variability in quantities and rates that cannot be eliminated by better information) and epistemic uncertainty (gaps in knowledge that could be reduced by further design development). At early project stages, epistemic uncertainty dominates and the cost range will be very wide. As the design matures, the range should narrow — if it does not, this is a signal that design development is not reducing risk as expected. Avoid the trap of using CRA outputs to justify a predetermined budget: if the analysis shows the P80 exceeds the approved funding, that is information to act on, not to suppress.