The short answer
There is no flat rate. A QRA is priced on the analyst effort it needs, and effort follows scope, programme complexity and the state of your inputs. The table above gives SOMA's indicative effort ranges by scope tier, dated October 2026. They are guides for budgeting, not quotes. A firm figure needs a conversation about your programme.
In this guide, QSRA is a quantitative schedule risk analysis and QCRA a quantitative cost risk analysis. QCSRA is SOMA's shorthand for an integrated cost and schedule risk analysis, which you will often see written out in full. Multiply the days by the day rate for the grades doing the work to get a fee. Rates vary by provider, grade and sector, so the days are the comparable number.
What the day ranges include
The ranges cover input review, risk workshop preparation and facilitation, model build, simulation runs, sensitivity analysis, the report and one round of revisions. They exclude your own people's time in workshops, travel and expenses, VAT, and any maintained or re-run model after the first issue.
A worked example shows how the days build up. Take an integrated QCSRA on a single scheme with about 1,200 activities and two packages. Input review and light remediation take 3 days. Two risk workshops, with preparation and facilitation at 1.5 days each, take 3 days. Model build and runs take 4 days. Sensitivity analysis and the report take 3 days. One round of revisions takes 1 day. The total is 3 + 3 + 4 + 3 + 1 = 14 days, inside the 10 to 20 range for the tier. If the schedule had needed heavy remediation, add up to 10 days from the last row of the table.
What drives the number
Scope of analysis comes first. A QSRA against an existing programme and a QCRA against a cost estimate are the lighter pieces. An integrated analysis is heavier because both models must be built, aligned and run together so that schedule risk drives its cost consequences. AACE International Recommended Practice 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model, describes that approach. 41R-08, Risk Analysis and Contingency Determination Using Range Estimating, covers the cost side, and 64R-11, CPM Schedule Risk Modeling and Analysis: Special Considerations, covers the schedule side.
Programme size and complexity scale effort directly. A 500-activity schedule with three packages needs fewer risks, correlation relationships and workshops than a 5,000-activity master schedule across fifteen packages. Workshop count is the clearest proxy, because each one needs preparation, the right people and a write-up.
Input readiness is the factor clients control and most underestimate. If the schedule is logic-linked and free of artificial constraints, the estimate has had buried contingency stripped out, and the risk register has named owners, the analyst spends the time modelling. If not, the analyst spends days on remediation first and you pay for them. The remediation row in the table is a SOMA rule of thumb, and the true figure depends on how far the inputs are from ready.
Output requirements move the number too. A working internal run to inform a contingency decision needs less documentation than one that must stand up to a NISTA (formerly the IPA) assurance review, a National Highways stage gate, or a nuclear or board gate. A live model maintained through delivery costs more than a single run at sanction.
Two modelling choices also change effort and the result. Separating base-estimate uncertainty from discrete risks avoids counting the same uncertainty twice, which would inflate the P80. Correlation modelling captures the fact that risks and durations tend to move together. Leaving it out narrows the spread and gives a falsely confident number. AACE 66R-11, Selecting Probability Distribution Functions for Use in Cost and Schedule Risk Simulation Models, is the reference for the distributions.
How QRA work is priced
SOMA works both ways. Fixed-price packages suit a well-defined scope: the provider states workshops, model build and deliverables, quotes a fee, and carries the overrun risk. Day-rate suits work where scope cannot be fixed at the start, such as an exploratory review or an engagement that will evolve, and it is also how many embedded and framework roles are priced. Day-rate puts the cost risk with the client, so it needs a cap or an estimate-at-completion that is reviewed as the work proceeds.
Neither is better in itself. Some National Highways and framework work is priced on rate cards, and a rate-card price is not a sign of a weak provider. The test is whether the basis is clear and you can see the days behind the figure. If a provider offers only day-rate on a clearly defined single-scheme QSRA, ask what has been left open.
Retained arrangements apply where risk analysis is ongoing, such as a model re-run at each gate. Once the model exists, each re-run costs less than the first build.
What a credible quote includes
Use these checks to compare quotes. Is the number of workshops stated, and who attends? Is effort given in days by grade? Are base-estimate uncertainty and discrete risks separated, correlation included, and sensitivity analysis provided? Are the deliverables named: S-curve with P50, P80 and P95, a tornado chart and a written report? A number without a tornado gives much less of the value, because the number sets contingency and the tornado shows what to manage.
Is the method and tool stated? Common tools are Oracle Primavera Risk Analysis, Safran Risk, Lumivero @RISK, Deltek Acumen Risk and riskHive. On National Highways work the client often prescribes templates and tools, so the choice may not be yours. Is a named analyst identified? Is it clear what a revision round covers, and what a change in input data costs?
Red flags that make a cheap QRA expensive
A low fixed price usually points to a template risk register used without proper workshops, no correlation modelling, or junior-only delivery. Each produces a QRA that looks complete and fails when challenged, at the gate or board meeting where it matters. A QRA that does not survive challenge is not cheaper. It is wasted, and then repeated.
Commissioning against inputs that are not ready is the other false economy. Either get them ready first, or ask the provider to fix them as part of the work and state the extra days. A QRA on bad inputs gives a precise answer to the wrong question.
Do not read a QRA requirement into every regulated contract. The Single Source Regulations Office (SSRO) regulates qualifying single-source defence contracts under the Single Source Contract Regulations 2014. It does not require a QRA. Whether risk analysis supports a defence price is a matter for the contract and the commercial team.
How SOMA approaches this
SOMA is a four-person core team, so the analyst who scopes the work is the one who does it. On a QSRA we state the days behind the fee, and tell you early if the inputs will add to them.
What to have ready for a scoping conversation
Three items let a provider agree scope quickly. First, the schedule format and size: the tool, the approximate activity count and the number of packages. Second, the estimate status: whether it is at a stage the cost model can use, and whether contingency is held inside lines. Third, the purpose and date of the output: who will rely on it, and when.