Start with what the number is for
The choice is a build-or-buy decision with three inputs: whether you have the capability, whether you have the tooling, and who has to rely on the output.
A QRA that informs your own contingency decision is a different job from one that supports a funding ask to a board, a NISTA (formerly the IPA) Gateway Review or a contract price. In the first case you are the main reader. In the second, the reader is looking for reasons to doubt the number, and a figure produced by the team that wants the funding carries an obvious conflict.
What requires independence, and what only favours it
We know of no rule in NISTA assurance guidance, the HM Treasury Green Book or the SSRO regime that requires a quantitative risk analysis to be written by a third party. Gateway Reviews test the project's own analysis. The Green Book requires optimism bias and risk to be addressed in the business case, but not by whom.
The Single Source Regulations Office (SSRO) regulates qualifying single-source defence contracts under the Single Source Contract Regulations 2014, through reports such as the Contract Pricing Statement. It does not require a QRA. If you include contingency in a regulated price, you need to be able to evidence it, and a documented QRA is one way to do that.
So independence is required only where your own funding agreement, assurance plan or contract says so. Check those documents first. Everywhere else it is advisable, and the advice gets stronger as the stakes rise.
Independence also does not come with the invoice. A consultant paid by the sponsor faces similar pressure to please. It is worth having only if three safeguards are written down: a reporting line that does not run through the person who wants the answer, scope to challenge the schedule, estimate and risk register, and freedom to report a result the sponsor dislikes.
Optimism bias is the reason for the Green Book adjustment. The evidence behind it (a 2002 study for HM Treasury) is about promoters' estimates in general, not in-house against external ones. The uplift applies whoever produced the estimate, so independence does not remove it. A bottom-up QRA does relate to it: where the risk allowance is quantified and evidenced, you can argue against double counting with a top-down uplift, but you need to show the evidence to the assurer.
Disputes are a different case. A QRA looks forward, while delay and quantum claims turn on retrospective analysis by an expert who owes a duty to the tribunal. Do not count a dispute as a reason to buy a QRA.
When in-house works
In-house works when four things are true. You have an analyst who has facilitated three-point estimating workshops, built Monte Carlo models and defended correlation and distribution choices to a reviewer. You hold licensed tooling, for example Safran Risk, Oracle Primavera Risk Analysis, Lumivero @RISK, Deltek Acumen Risk or riskHive, and the time to use it. Your risk register is real, with owners who challenge their own numbers. And the demand is recurring.
It is strongest for iterative work such as monthly re-runs on a live programme, where an internal analyst keeps the context.
The self-check is simple. Hand your last QRA to a sceptical reviewer. Could you defend the methodology, the calibration of the three-point inputs, and the split between base-estimate uncertainty (the spread around each activity or cost line even if no risk happens) and discrete risks (events that may or may not occur)? In our experience that split is where untested models most often fail. If you cannot say yes with evidence, treat the capability as unproven.
Three routes, not two
Independent delivery. An outside analyst builds and runs the model. It suits concept and sanction stage numbers, low run frequency and teams without tested capability. The weakness is that the knowledge leaves with the consultant unless handover is in scope.
In-house delivery with independent review. Your analyst builds and runs the model; an outside analyst reviews the schedule, estimate, risk inputs, model and report before it goes to the gate. This is usually the cheapest route to outside credibility for a team with some capability. It works when the model is documented and the inputs are ready. It fails when the reviewer finds the model needs rebuilding, because you then pay for a review and a rebuild.
Hybrid. Independent for the run that faces outside scrutiny, in-house for working analysis between gates. The independent run sets the baseline and method; the internal team maintains and re-runs it. It is also the usual path from buy to build: document the first independent run so your analysts can interrogate the model, then take over the working runs.
A QRA that fails challenge at a gate has to be redone under time pressure. You pay twice and lose confidence in the rest of the team's output in between.
Illustrative annual cost and break-even
These figures are SOMA estimates for illustration, not quotes or market data. Replace each with your own. As in our guide to what a QRA costs, effort is driven by scope and input readiness.
Assumptions: in-house licence £5,000 a year; training and mentoring £3,000 a year; independent review of one in-house run a year, 4 analyst days at £900, which is £3,600; in-house effort 15 days per run at a loaded internal cost of £500 a day, which is £7,500; independent effort 12 days per run at £900 a day, which is £10,800.
Fixed in-house cost is £5,000 + £3,000 + £3,600 = £11,600 a year. The saving per run is £10,800 less £7,500, which is £3,300. Break-even is £11,600 / £3,300 = 3.5 runs a year, so four runs. At three runs a year in-house costs £11,600 + 3 x £7,500 = £34,100 against £32,400 independent. At four it costs £41,600 against £43,200.
The model excludes the time an analyst needs to become competent, which is measured in supervised runs rather than a course, and the cost of a failed review, which is the largest item if it happens. Poor inputs add days to both routes. Treat four runs a year as a prompt to check your own numbers, not a threshold.
QSRA and QCRA are different build decisions
A Quantitative Schedule Risk Analysis (QSRA) needs a logic-linked schedule, scheduling skills and schedule risk software. A Quantitative Cost Risk Analysis (QCRA) needs a structured estimate with contingency stripped out and estimating skills. Many teams have one capability and not the other, so make the decision for each. An integrated analysis needs both. The method sources we work to are AACE International Recommended Practices 57R-09 Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model, 41R-08 Risk Analysis and Contingency Determination Using Range Estimating, and 40R-08 Contingency Estimating – General Principles.
How SOMA approaches this
SOMA sells independent QRA, review of in-house models and in-house training on request, so we have a stake in your choice. On National Highways schemes the client's template and toolchain set the format. On any engagement we ask the same three questions first: who will rely on the number, how often it will be re-run, and whether an existing model would survive a sceptical review. The answers usually decide the route before cost does.