What reviewers actually look at
NISTA (formerly the IPA) took over Gateway Reviews in April 2025. The Gate 0-5 structure continues. The reviewer may be a NISTA-appointed review team member, a departmental assurance lead or an investment committee member. In each case they have read many QRA reports and will not read yours cover to cover.
The test we apply is that they look first at three things: the headline confidence levels (the P80 cost and the P80 date, for example), the method, and whether the underlying data can be inspected, meaning the risk register, the three-point estimates and the correlation structure. If those are easy to find and easy to challenge, the report builds confidence. If they are buried in appendices or wrapped in narrative, it builds scepticism.
Behind that sits one question: is this an honest analysis of the programme's risk, or a model tuned to a number the delivery team wanted? Both have S-curves, P80 figures and risk registers. They differ in how well the work is documented, and reviewers know what that difference looks like.
What the QRA needs to show at each gate
The table above is our reading of how emphasis shifts across the gates. At Gates 0 and 1 the question is whether the range is credible for the stage. At Gate 3 the question is whether the analysis supports the investment decision. At Gates 4 and 5 the question is whether the forecast has been kept honest and what it taught the organisation.
Check the terms of reference for the specific review. Scope, evidence requests and the confidence level the sponsor works to vary by programme and department, and the review team will say what it wants.
The structure that works
Open with an executive summary that states the position in plain terms. As SOMA practice, aim for three to five sentences covering what was analysed, the confidence levels produced (P50, P80 and ideally P95), the principal drivers and the data sources. A reader who stops there should still know what the analysis shows.
The methodology section comes next. State the AACE International Recommended Practices the work is aligned to. AACE recommended practices are guidance, not a compliance regime, so write 'aligned to' rather than 'compliant with'. The right practice depends on the approach: 57R-09 (Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model) for a risk-driver model; 41R-08 (Risk Analysis and Contingency Determination Using Range Estimating), 42R-08 (Risk Analysis and Contingency Determination Using Parametric Estimating) or 44R-08 (Risk Analysis and Contingency Determination Using Expected Value) for cost contingency methods; 65R-11 for integrated cost and schedule risk using expected value; 64R-11 for CPM schedule risk modelling; 66R-11 for selecting probability distributions. Cite only the practices you actually followed.
Then say how variability and event risk were separated, how correlation was handled, which distributions were used, how many iterations were run and which tool produced the model. In our view, a clearly stated and followed method is the strongest early signal of rigour a reviewer gets.
The results section gives the confidence levels with S-curves, a tornado or sensitivity chart and a driver ranking. As SOMA practice, show the top five to ten drivers. A results section without sensitivity analysis is incomplete and will be asked for.
Put the risk register, three-point estimate tables, correlation matrix and workshop records in appendices, and reference them from the summary and methodology: 'the full risk register is in Appendix A, the three-point estimates in Appendix B, the correlation matrix in Appendix C'.
Documentation that makes the QRA defensible
Every three-point estimate should trace to its origin: the workshop, the person who gave it, the evidence or benchmark it was calibrated against and the scope assumptions beneath it. A reviewer who challenges a pessimistic value should be able to look up how it was derived and form their own view.
Show the qualitative assessment (probability band, impact band, owner) next to the quantitative inputs (probability as a decimal, impact distribution, mapped activities or cost lines). The two must agree. A risk scored high on both axes should contribute materially to the model. A risk that dominates the tornado chart should appear in the narrative the team is actually managing.
Explain the correlation matrix. Dense correlations with no stated rationale look like tuning. Correlations tied to documented drivers are defensible, for example weather across outdoor activities in winter, or a shared specialist commissioning team. If no correlation is modelled, say so and justify it. Ignoring correlation understates the spread of outcomes, so a genuinely uncorrelated model is a strong claim and will usually be challenged.
Record the workshops: who attended and in what role, how long was spent on each line, and what reference evidence was introduced. Without this the reviewer cannot judge whether the elicitation was rigorous.
Green Book alignment
For public-sector programmes, reviewers expect the QRA to sit coherently with the business case and the HM Treasury Green Book (2026 edition). The Green Book requires appraisal to adjust for optimism bias and risk. It does not mandate a P80, and its percentile example comes from reference-class data, not from a Monte Carlo output.
The common gap is optimism bias. The Green Book's supplementary optimism bias guidance expects the adjustment to reduce as specific risks are identified, quantified and mitigated. Applying the full uplift to the base estimate and then adding a QRA risks counting the same uncertainty twice. The report should say which route was taken: an optimism bias adjustment justified from the reference class, a QRA-based allowance with an explanation of why it covers the bias, or a stated combination with the overlap removed. Reviewers will want to see the evidence behind whichever is chosen.
On confidence levels, let the decision set the level rather than defaulting to P80. The sponsor or approver decides the level for each decision, and the report should explain the choice against the programme's risk appetite and the business case. Showing P50, P80 and P95 side by side lets the reader see the others.
Common failure modes
A report that prompts a recommendation to redo the work usually shows one or more of these patterns. The method is vague, citing 'Monte Carlo simulation' and 'three-point estimates' with no alignment, tool or iteration count. The register has many entries but the contribution is concentrated in a few, which suggests the rest are filler. Ranges are symmetric across most activities, which may point to anchoring rather than differentiated uncertainty. That is an indicator to investigate, not proof.
The other pattern is a headline that does not reconcile to the register. The valid check compares probability-weighted exposure with the model, not a raw sum of impacts with the P80. Worked example, all figures illustrative: a base estimate of £180m, with P50 at £196m, P80 at £208m and P95 at £221m. Three event risks have probability and impact of 30% x £20m, 50% x £8m and 10% x £30m. Their expected values are £6.0m, £4.0m and £3.0m, a total of £13.0m. The P50 uplift is £196m less £180m, which is £16.0m, and the P80 uplift is £28.0m. That is consistent: the events account for £13.0m of the P50 uplift and range variability supplies the rest. The raw sum of the three impacts is £58m, which exceeds the P80 uplift of £28m, and that is not a fault because the risks will not all occur. If the P50 uplift were £9m, below the £13.0m expected value of the events alone, the gap would need explaining. A right-skewed distribution can place the P50 below the mean, but not by that much without a reason.
A report that fails this reconciliation is hard to rescue without a rerun. Check it before the reviewer does.
Making the reviewer's job easier
Reviewers are usually working to time pressure across several documents. Use visual hierarchy so the headline P80 cost and date can be found within ten seconds of opening the report. Add a one-page methodology summary that can be skimmed without reading the full section.
State the limitations, and say what you believe each does to the confidence position. All models have limitations. Reviewers distrust analyses that claim more precision than they can support.
Answer the review team's questions in the order they ask them. Departmental assurance leads and review teams work to their own guidance, so check the terms of reference and structure the report to the questions that apply to that gate. On a QSRA or QCRA report we build the draft against those questions and run the reconciliation check above before issue.
Pre-issue checklist
Executive summary states what was analysed, P50, P80 and P95 for cost and date, the top drivers and the data sources.
Methodology names the AACE practices followed, the tool, the iteration count, the distributions and the treatment of variability, event risk and correlation.
Sensitivity analysis shows the top five to ten drivers.
Every three-point estimate traces to a workshop, a provider, evidence and scope assumptions.
Qualitative and quantitative registers agree, and probability-weighted exposure reconciles to the model.
Optimism bias treatment is stated, and double counting has been checked.
The confidence level chosen is justified against risk appetite.
Limitations are named, with their effect on the result.
The headline P80 cost and date can be found in ten seconds.