The honest short answer
There is no flat rate for a Quantitative Risk Analysis, and any provider who quotes one before understanding your programme is guessing. The cost is driven almost entirely by scope: what you are modelling, how clean your inputs are, how complex the programme is, and what the output has to survive. A focused schedule risk analysis on a single, well-structured programme is a different order of cost from an integrated cost-and-schedule QRA across a multi-package portfolio with bespoke correlation modelling and gateway-grade reporting.
That is not a dodge. It is the same reason a structural engineer cannot quote to design a building from the postcode alone. The useful question is not "what does a QRA cost" in the abstract — it is "what drives the cost of a QRA, and where does my programme sit on each of those factors". This guide answers that, so you can frame the conversation and recognise a credible quote when you see one.
What actually drives the cost
Scope of analysis is the biggest lever. A Quantitative Schedule Risk Analysis (QSRA) against an existing programme is the lightest engagement; a Quantitative Cost Risk Analysis (QCRA) against a cost estimate is comparable. An integrated cost-and-schedule analysis (QCSRA), where schedule risk correctly drives its cost consequences, is the most involved because both models have to be built, aligned and run together.
Programme size and complexity scale the effort directly. A 500-activity schedule with three delivery packages is a fraction of the work of a 5,000-activity integrated master schedule across fifteen packages and multiple interfaces — more activities, more risks, more correlation relationships, and more workshops to populate them credibly.
Input readiness is the factor clients control and most underestimate. If your P6 schedule is logic-linked and free of artificial constraints, your base estimate has had buried contingency stripped out, and you have a real risk register with named owners, the analyst spends their time modelling. If the schedule is constraint-driven, the estimate has contingency baked into every line, and the risk register is a copy-pasted template, the analyst spends days on data remediation before any modelling begins — and you pay for that time.
Output requirements move the number too. A working internal QSRA to inform a contingency decision is one thing; a QRA that has to survive an IPA gateway review or an SSRO submission — documented methodology, transparent assumptions, an AACE-aligned approach, and a report a review panel can interrogate — carries more rigour and more cost. So does a live model maintained through delivery versus a one-off run at sanction.
How QRA work is usually priced
Fixed-scope package is the most common model and, for the buyer, usually the safest. The provider scopes the analysis — number of workshops, model build, deliverables, one round of revisions — and quotes a fixed fee against it. You know the cost upfront and the risk of overrun sits with the provider. This works precisely because a competent provider can scope a QRA accurately once they understand the programme.
Day-rate or time-and-materials is used where the scope genuinely cannot be pinned down upfront — an exploratory piece, or an engagement that will evolve. The upside is flexibility; the downside is that cost certainty sits with you, and a QRA that hits messy inputs can run longer than planned. If a provider only offers day-rate for what is clearly a well-defined QRA, ask why.
Retained or embedded arrangements apply where risk analysis is an ongoing need — a major programme that wants its QRA maintained and re-run at each gate, or an organisation building risk capability across a portfolio. This is priced as a recurring engagement rather than a one-off, and is usually the most cost-effective per-run once the models exist.
What a credible QRA quote should include
A quote worth comparing should spell out the workshops (how many, and with whom — risk identification and three-point estimating need the right people in the room), the model build itself, and the analytical depth: correlation modelling, separation of base-estimate uncertainty from discrete risks, and sensitivity analysis — not just a headline S-curve.
It should name the deliverables: the S-curve and confidence levels (P50, P80, P95), a tornado chart identifying the risks actually driving variability, and a written report a decision-maker — or a gateway reviewer — can act on. A QRA that delivers a number with no tornado is delivering half the value, because the number tells you how much contingency to hold but the tornado tells you what to manage.
It should state the methodology and tooling (an AACE-aligned approach; Safran Risk, Primavera Risk Analysis, @Risk or Acumen Risk), who is actually doing the work (a named, experienced analyst rather than a junior running a template), and what is included for revisions. The absence of these is the signal, not the headline price.
Red flags that make a cheap QRA expensive
A suspiciously low fixed price usually means one of three things: a template risk register applied without genuine workshops, zero correlation modelling (which understates the spread and produces a falsely confident number), or junior-only delivery. Each produces a QRA that looks like the real thing and falls apart under scrutiny — at exactly the gateway or board meeting where it matters most. A QRA that does not survive challenge is not cheaper; it is wasted, plus the cost of redoing it.
The other false economy is commissioning a QRA against inputs that are not ready. If your schedule and estimate are not in a fit state, the cheapest route to a credible number is to get them ready first — or to engage a provider who will fix the inputs as part of the work and tell you honestly what that adds. Paying for a QRA on bad inputs buys a precise answer to the wrong question.
Getting an accurate number for your programme
The only way to a real figure is a short conversation about your programme: what you are modelling, how big and complex it is, what state the inputs are in, and what the output has to satisfy. Twenty minutes is usually enough to scope an engagement and give you a fixed-scope quote you can take to a budget holder.
SOMA delivers QRA as independent, tool-agnostic, fixed-scope engagements built to AACE recommended practice — QSRA, QCRA and integrated QCSRA — with reports written so a board or a gateway reviewer can act on the number. If you are weighing up commissioning a QRA, a scoping call is the fastest way to understand what yours would actually cost.