What it is, in three sentences
Monte Carlo simulation runs your project model thousands of times. Each time, it picks a random value for every uncertain input (each cost estimate, each activity duration, each risk) consistent with the range and shape you specified for that input. The result is a distribution of possible outcomes, showing how likely each one is.
The name comes from the 1940s, when the method was developed for nuclear weapons calculations and computing time was scarce. Today a laptop runs 10,000 iterations of a project model in seconds. The technique is ordinary. Using it well is the hard part, and that depends on understanding what it can and cannot do.
A poor analysis still produces an authoritative-looking S-curve, even when the inputs are too narrow and correlation is ignored. This guide covers the gap between that and a good one.
What Monte Carlo does well
It is the most widely used technique for combining many uncertain inputs, and it handles models of any size without simplifying assumptions about their structure. Analytical convolution, the method of moments and reference-class methods also give distributions, but Monte Carlo copes best with many inputs, skewed shapes, dependencies and a schedule network. It carries sampling error, and it is only as good as its inputs.
One consequence surprises people. If you add 100 independent line items, each with a standard deviation of 10% of its value, the total has a relative standard deviation of about 1% (10% divided by the square root of 100). Independent uncertainties largely cancel. The overall range is therefore much narrower than the range on any one line, and a model that samples everything independently will look very confident. Correlation is what restores the spread, and it is covered below.
Monte Carlo also handles merge bias in schedule models, described in its own section below. Its output is a full distribution: a P50 of £100m and a P80 of £125m tells a board how much confidence the figure carries, which a single £100m cannot.
Garbage in, garbage out
Monte Carlo is a processing engine, not a source of truth. Narrow input ranges give a confidently narrow S-curve. Wide, realistic ranges give a wide, honest one. The simulation cannot tell you which inputs are credible.
The usual failure is anchoring on the most likely estimate. Someone who has planned an activity for months is asked for a minimum and maximum, and moving away from the anchor feels like admitting a problem. The minimum comes in at 10% below the most likely and the maximum at 15% above, and the distribution is far narrower than the real uncertainty. Anchoring and optimism are well documented in the judgement literature (Kahneman and Tversky) and in Flyvbjerg's work on optimism bias and strategic misrepresentation in public projects. They affect experienced practitioners as much as new ones.
The response is structured calibration. Ask for the minimum and maximum before the most likely value, ask what would have to happen to hit each bound, show outturn data from comparable activities, then test the output.
Two checks are SOMA rules of thumb, not published standards. First, if the P80 on a complex cost estimate is only a few percent above the P50, ask what is driving such a narrow spread. The right gap depends on scale, risk count and what the P50 already contains. Second, if the P80 completion date on a multi-year programme is within a couple of weeks of the deterministic finish, ask the same question. Both are prompts to recheck the inputs, not proof of a problem.
The stronger check is the reference class. What did comparable projects cost and how long did they take? If the model P80 sits materially below the outturn of comparable projects, the inputs are probably optimistic however rigorous the workshops looked. HM Treasury's Green Book (2026 edition, 'Optimism bias' section) sets out the reference-class adjustment for public-sector business cases.
Inputs can fail in two directions. A register from which risks have been argued down in workshops understates exposure. The opposite error is double counting: an event risk placed in the register and also allowed for in the three-point range on the same activity. Keep variability (the normal spread of an activity) and event risk (things that may or may not happen) separate.
Merge bias: what a deterministic schedule hides
Merge bias is why a properly run schedule simulation usually produces a P50 later than the deterministic finish, before any discrete risk is applied. Sponsors who see the gap often think the simulation is pessimistic.
The mechanism is simple. At a merge point, the successor can only start when the last predecessor finishes, so in each iteration the model takes the latest of the converging paths. The more near-critical paths converge, the more often one of them is late.
Example. Three parallel chains each have a 50% chance of finishing on time and a 50% chance of finishing two weeks late. They converge on a commissioning milestone. The chance that all three are on time is 0.5 x 0.5 x 0.5 = 12.5%, so there is an 87.5% chance of at least one being late. Because on-time has only a 12.5% chance, the milestone P50 is two weeks late.
With ten paths converging, the chance that all ten finish by their planned dates depends on the confidence in each path. At 50% per path it is 0.5 to the power 10, about 0.1%. At 75% per path it is 0.75 to the power 10, about 5.6%. At 80% per path it is 0.8 to the power 10, about 10.7%. The size of the resulting slip to the P50 depends on the path durations and spreads in the specific model, so no general figure applies.
Correlation works against merge bias. Independence maximises it. If the paths share a common cause (the same weather, the same subcontractor), they tend to be late together, the chance that all are on time rises, and the merge gap narrows. In the extreme case of perfectly correlated paths there is no merge bias at all. A model that ignores correlation therefore exaggerates merge bias on the schedule side while understating spread on the cost side. Both effects need to be modelled together, with the correlation assumptions stated.
Projects with many converging paths, such as commissioning and system integration milestones, need explicit schedule contingency beyond the deterministic programme.
Correlation: the most neglected input
Correlation captures the fact that uncertainties are not independent. A wet winter affects every weather-sensitive activity, not one. A subcontractor that underperforms on one package is likely to underperform on another. A steel price rise affects every steel-intensive cost line.
When everything is sampled independently, good and bad outcomes on different elements offset each other in each iteration. The mean of the result does not change, but the spread shrinks, as in the 100-item example above. In real projects, bad outcomes cluster.
A simple illustration, using a normal approximation rather than a model run. Take the same 100 items, each with a standard deviation of 10% of value, on a £100m base. With independent sampling the total standard deviation is about 1.0% (£1.0m). With a pairwise correlation of 0.5 between all items it is about 7.1% (£7.1m), since the variance of the sum scales with 1 + (n - 1) x correlation. The P80 minus P50 gap, about 0.84 standard deviations, moves from roughly £0.8m to roughly £6.0m. The effect depends on item count, relative size and coefficients, so run your own model.
Setting coefficients does not need statistical training, but it does need care. The practical approach is to group risks by common driver (weather, a given subcontractor, a given approval) and assign a coefficient within each group. As a SOMA rule of thumb, use around 0.2 for low, 0.5 for medium and 0.7 for high dependency, and justify each group in writing. Then run the model at a lower and a higher set (for example 0.3, 0.5 and 0.7) and report how P80 moves. If the answer is sensitive to the choice, say so.
Take care with overlapping groups. A risk that sits in both the weather group and the subcontractor group can produce a correlation matrix that is not positive semi-definite, which is not mathematically valid. Some tools adjust it silently. Check what your software does, and prefer a single driver per risk, or a risk-driver structure, where the dependency is built into the model rather than entered as a matrix.
When reading a QRA report, ask whether correlation was modelled, how, and what the sensitivity run showed. If it was not modelled, the contingency may be understated.
Reading the output for a board
The standard outputs are an S-curve and a tornado chart. Neither is self-explanatory. The presenter needs a short script that links numbers to decisions.
For the S-curve: "This chart shows the range of possible project costs given the risks and uncertainties we modelled. Cost runs along the horizontal axis and cumulative probability up the vertical axis. The curve crosses 50% at £X, the P50: in half of the modelled scenarios the project cost £X or less. It crosses 80% at £Y, the P80. We recommend you note the confidence level your funder requires and, if it is P80, fund to £Y, which gives an 80% modelled chance of completing within budget."
For the tornado chart, name the measure. A simulation tornado normally ranks inputs by their rank correlation with the output, or by their contribution to the output variance, across all iterations. It is not a what-if on one input. A long bar for ground conditions means they explain much of the spread. It does not say the project lands below P50 if the ground is good. Driver size is also not the same as controllability. Mitigation priority needs the size of the driver, how far management can influence it and what the response costs.
Two points to avoid. First, do not present the P50 as the most likely cost. It is the median. In a right-skewed cost distribution the mode (the single most likely value) sits below the median. Second, do not present the P80 as a ceiling. There is a 20% modelled chance of exceeding it. Have the P95 ready, and be clear whether the gap between the funded figure and the P95 is covered by management reserve or is residual exposure.
The most useful message for a board is how much confidence to place in the numbers. A model with calibrated inputs, stated correlation assumptions and a register that reflects real exposure is a sound planning tool. A model with narrow ranges, no correlation and an edited register gives false assurance. Reviewers at a Main Gate approval or a NISTA (formerly the IPA) assurance review will press on correlation, reference class and optimism bias, and will notice a distribution that appears to have been tightened to fit the funding envelope.
Which percentile for which decision
Cost and schedule use percentiles for different purposes, and confusing them causes problems. The confidence level used for funding varies by sponsor and stage, so check the requirement of National Highways, the MOD, NISTA, HM Treasury or the funder in question. P80 is commonly used. The Green Book requires optimism-bias and risk adjustment but does not mandate P80.
As a working rule, SOMA separates three uses. A planning target for the team can sit near the P50, provided the schedule contingency between the deterministic date and that P50 is visible to the client and is not squeezed out. A date or budget committed to a client or funder should be set at the confidence level that party requires, commonly P80. Management reserve then covers the range from the committed figure up towards the P95, held by the sponsor and released against specific risks. Promising the P50 date externally means accepting a 50% chance of being late. Schedule commitments often need higher confidence than the planning target because lateness carries cost and contractual consequences.
The difference between the deterministic estimate and the P80 is the QRA-derived contingency only if the deterministic estimate is the base with no risk allowance already in it. If the base includes an allowance, remove it before comparing, or contingency will be understated.
How SOMA approaches this: on a QSRA or QCRA we ask for the input ranges, the source of each range and the correlation assumptions before looking at the output. We rerun the model at three correlation levels and two random seeds, and report how far P50, P80 and P95 move.