It is a build-vs-buy decision, and both can be right
Whether to run a Quantitative Risk Analysis in-house or commission an independent consultant is a build-vs-buy decision, and the honest answer is that either can be right. It turns on three things: whether you have the capability, whether you have the tooling, and whether the output has to be credible to someone outside your organisation. Most teams get this wrong by defaulting to whichever looks cheaper on the surface, rather than asking what the QRA is actually for.
The deciding question is rarely cost. It is independence and credibility. A QRA produced to inform an internal contingency decision is a different thing from a QRA that has to survive an IPA gateway, justify a funding ask to a board, or stand up in a contractual dispute. The first you can reasonably do in-house if you have the skills; the second is where independence stops being a nicety and becomes part of what makes the number believable.
When in-house QRA makes sense
In-house is the right call when you genuinely have the capability and the need is recurring. That means a trained risk analyst — someone who has facilitated three-point estimating workshops, built and calibrated Monte Carlo models, and can defend correlation and distribution choices — not a planner who has watched a tutorial. It means the licensed tooling (Safran Risk, Primavera Risk Analysis, @Risk or Acumen Risk) and the time to use it properly. And it means a risk culture where the register is real and owners challenge their own numbers.
In-house also makes sense when the analysis is iterative and internal. If you are running a QRA monthly to track changing exposure on a live programme, the turnaround and context-retention of an internal analyst is genuinely valuable — you are not re-briefing an external party every cycle. For working analysis that informs your own decisions and does not have to convince an outside reviewer, in-house is often the better answer once the capability exists.
The honest test is this: if your internal QRA were handed to a sceptical gateway reviewer, would it survive? If the answer is yes — your methodology is AACE-aligned, your inputs are calibrated, your model is defensible — then you have real capability and should use it. The trap is that most teams who assume they have this capability have never had it tested against genuine outside challenge.
When you need an independent QRA
Independence becomes the point — not a luxury — the moment the number faces external scrutiny. IPA gateway reviews, HM Treasury Green Book business cases, SSRO submissions on single-source defence contracts, board-level capital approvals, and contractual disputes all share a feature: the reader is looking for reasons not to trust the number, and a figure produced by the team that wants the funding carries an obvious conflict. An independent QRA removes that conflict, so the methodology can be challenged without the motive being in question.
Independence also guards against optimism bias, which is not a character flaw but a structural force. Internal teams are under pressure — explicit or implicit — to produce a number the organisation is comfortable with. HM Treasury formalised optimism-bias uplifts precisely because in-house estimates run systematically optimistic. An independent analyst with no stake in the outcome is the most reliable defence against a QRA that quietly tells the sponsor what they want to hear.
The infrequent-need case is the other clear trigger. If you run one or two QRAs a year, building in-house capability is hard to justify: the tool licences, the training to genuine competence (which takes years of real reps, not a course), and the opportunity cost of senior time rarely pay back against a fixed-scope external engagement. Independence and infrequency together make the buy decision straightforward.
A pragmatic middle path
The choice is not strictly binary. A common and sensible pattern is independent for the runs that face outside scrutiny — the gateway submission, the funding case, the board paper — and in-house for the working, iterative analysis that informs day-to-day decisions. The independent run sets the defensible baseline and the methodology; the internal team maintains and re-runs it between gates.
The other middle path is independent delivery now, capability-building alongside. Bring in an independent QRA for the engagement in front of you, and use it as the vehicle to train your own people — workshops they sit in, a model they can interrogate, a methodology they can adopt. Over time you build the in-house capability that lets you take more of the working analysis internally, while keeping independence for the runs that need it. This is how most organisations should move from buy to build, rather than attempting in-house from a standing start on a programme that cannot afford the learning curve.
How to decide for your programme
Start with what the QRA is for. If it has to convince anyone outside your team — a gateway, a funder, a board, a counterparty — default to independent, because independence is part of the credibility you are buying. If it is internal working analysis and you have genuinely tested capability and tooling, in-house is reasonable. If you are unsure whether your in-house capability would survive scrutiny, that uncertainty is itself the answer.
SOMA delivers independent QRA to AACE recommended practice, and also builds client capability — through training and the SOMA Academy — for teams moving toward in-house. If you are weighing the two for a specific programme, a short scoping call is the fastest way to get an honest read on which is right for you, and what an independent engagement would cost if that is the route you take.