The short answer
QSRA (quantitative schedule risk analysis) answers this question: given the risks and uncertainties on this programme, what is the range of completion dates, and what is the probability of meeting any given date?
QCRA (quantitative cost risk analysis) answers the equivalent question for money: given the same risks, what is the range of final costs, and what contingency is defensible at a stated confidence level?
Both are Monte Carlo simulations. Both draw on the same risk register and three-point estimates, and both produce S-curves and tornado charts. The difference is what is modelled: activity durations, logic and float in a QSRA; estimate lines and cost packages in a QCRA. An integrated run models the two in one model, so schedule delay drives cost inside the simulation instead of being added afterwards.
How a QSRA works
A QSRA starts with a logic-linked schedule, typically built in Primavera P6, Asta Powerproject or Microsoft Project. It needs complete relationships, credible durations and few artificial constraints. A schedule with hundreds of hard dates cannot pass delay through the network, so the simulation shows less risk than exists.
Each activity duration then gets a three-point estimate (optimistic, most likely, pessimistic), usually on a triangular or PERT distribution. Discrete risks from the register sit on top: each has a probability of occurring, an impact range and a list of the activities or chains it affects. The schedule-side inputs that most often decide the quality of the result are:
Calendars, so that weather shutdowns, possession windows and shift patterns are modelled as they will be worked. Risk-to-activity mapping, so every risk lands on the activities it affects. Correlation, so durations and risks with a common cause move together. Duration uncertainty on all activities, not just today's critical path.
The engine runs the schedule thousands of times, sampling from the input distributions on each run. It aggregates the results into a distribution of completion dates, which is the S-curve. The P50 is the date with a 50% chance of being met or beaten. The P80 has an 80% chance. The percentile that matters is the one the client or approving body specifies: P80 is common, but P50, P70 and P90 all appear in practice.
The tornado chart shows which activities and risks the completion date is most sensitive to. Criticality indices show the share of iterations in which an activity sat on the critical path. Neither shows the return on mitigation; that needs a re-run with the mitigation modelled.
A QSRA also quantifies merge bias. Where several paths converge, the project must complete all of them, and the chance that every path finishes on time is lower than the chance for any one. A deterministic schedule hides this and tends to understate the completion date.
How a QCRA works
A QCRA starts with a cost estimate, usually structured by work breakdown structure, with base estimate lines held separately from risk provisions. The base should be the best forecast of cost if the project goes broadly to plan. Any contingency already inside line items must be removed first. The QCRA generates the contingency, so leaving allowances in double-counts contingency and overstates the P80.
Each cost line gets a three-point range. This is estimating uncertainty: how well the cost of that package can be pinned down at the current stage of design. It is separate from discrete risk. A ground-condition risk that might add £2m to civils if triggered is a different input from a range of -10% to +25% on a steelwork package. This is the approach AACE International describes in Recommended Practice 41R-08, Risk Analysis and Contingency Determination Using Range Estimating.
Discrete risks from the register are then applied, each with a probability and a cost impact range. Risks alone understate the spread; ranges alone omit the events behind the biggest overruns. Both layers belong in the model.
Correlation matters in cost models. If two packages share a subcontractor, ground conditions or a design risk, they are not independent. Treating them as independent lets a good outcome on one offset a bad outcome on the other, which narrows the S-curve. A credible QCRA specifies correlation and records the basis.
The output is a cost S-curve with P50, P80 and P95 values and a tornado chart of the lines and risks driving the spread. Contingency at a chosen percentile is that percentile's cost minus the base estimate. P80 is commonly used as the funding ceiling, but the percentile is set by the client or approving body. The HM Treasury Green Book (2026 edition) requires optimism bias and risk to be reflected in costs. It does not specify P80, and a QRA percentile is a different thing from a reference-class adjustment. NISTA (formerly the IPA) owns the IPA Cost Estimating Guidance (2021), which remains the extant document. Check the guidance your approving body applies.
Integrated cost-schedule risk analysis
Schedule risk and cost risk are linked. A programme that finishes four months late also pays four months of site overheads and extended preliminaries, may carry more inflation exposure, and may trigger liquidated damages. These are time-dependent costs; fixed-price packages are time-independent. A standalone QCRA treats the schedule as given and misses the cost of delay unless it is added by hand.
An integrated run puts the cost estimate on the schedule. The model needs a cost-loaded schedule in which each cost is flagged as time-dependent or time-independent. Delay then raises time-dependent costs inside every iteration. The cost and the date come out of the same simulated outcomes, so you can read the joint confidence level (JCL): the probability of meeting a cost and a date together.
AACE International sets out integrated methods in two Recommended Practices that differ in approach. 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model, defines risk drivers as events or conditions that act on both durations and costs, and simulates them through a critical path method model. 65R-11, Integrated Cost and Schedule Risk Analysis and Contingency Determination Using Expected Value, takes an expected-value approach to contingency. They are not interchangeable; a report should say which it follows.
The integrated cost at a given percentile is typically higher than the standalone QCRA figure, because the delay cost is captured. The difference depends on the time-dependent share of the estimate and can be small.
Which analysis answers which question
Run a QSRA when a milestone needs a defensible confidence level on the date, the network has many converging paths, or merge bias may be flattering the headline programme.
Run a QCRA when a funding submission or contract needs risk-quantified contingency, or when the estimate is early. AACE classifies estimates by maturity of definition, from Class 5 (least defined, concept screening) to Class 1 (most defined). Class 5 and Class 4 estimates carry the widest uncertainty. The classification system is in 17R-97, Cost Estimate Classification System, with sector versions such as 56R-08 for building and general construction and 18R-97 for the process industries.
Run an integrated analysis when delay is a material driver of cost, a mature cost-loaded schedule exists, and the decision needs cost and date confidence together. It takes more effort. Where time-dependent costs are a small share of the estimate, two separate analyses can be enough.
Three illustrative examples
These examples are illustrative. All figures are invented to show how outputs are read. They are not taken from any client or SOMA engagement. They share one hypothetical project: a civil engineering scheme with a deterministic programme of 36 months from 1 January 2026 and a base estimate of £100m with no contingency.
Example 1, QSRA. The deterministic finish is 31 December 2028. The simulation gives a P50 of 31 March 2029 (month 39), a P80 of 30 June 2029 (month 42) and a P95 of 30 September 2029 (month 45). The P80 therefore sits six months after the deterministic date, and the P50 sits three months after it. The top three drivers by sensitivity are a ground-condition risk on the earthworks (30% probability, 2 to 6 weeks), a utility diversion consent (40% probability, 1 to 3 months) and the design approval duration (most likely 8 weeks, range 6 to 16 weeks).
Example 2, QCRA. The civils package has a base of £30m and a range of £27m, £30m and £37.5m (low, most likely, high). The mean of that triangular range is £31.5m, so estimating uncertainty alone adds £1.5m of expected cost. The ground-condition risk from Example 1 has a 30% probability and a cost impact of £3m, £5m or £9m. The mean impact if it occurs is £5.67m, so its expected cost is about £1.7m. Across the whole estimate, with correlation applied, the simulation gives a P50 of £111m, a P80 of £120m and a P95 of £129m. Contingency to P80 is £120m less £100m, which is £20m. Note that the P50 is not the sum of the most likely values, and the P80 is not the sum of the expected risk costs.
Example 3, integrated. Take the same project with £1.5m of time-dependent cost per month, so a six-month delay costs £9m in isolation. Cost-load the schedule and run both together. The standalone QCRA assumed the programme finished on time. The integrated run gives a P80 cost of £126m against the standalone £120m, an increase of £6m. It is less than £9m because the P80 of the combined outcome is not the P80 cost plus the P80 delay cost: the worst cost and the worst delay do not always coincide. The same iterations show the chance of meeting the standalone £120m is now about 68% rather than 80%, and the chance of meeting both £120m and month 42 together is about 60%. That joint figure is what the sponsor needs when committing to cost and date at once.
Tools and standards
The choice of software matters less than the quality of the inputs. Tools used on UK programmes include @RISK (Excel based, common for cost-only models), Safran Risk, Acumen Risk from Deltek and Primavera Risk Analysis. Product status, support and licensing change, so confirm the current position with the vendor before committing. The Monte Carlo method is the same in each; they differ in schedule integration, correlation settings and reporting.
AACE International Recommended Practices are the usual reference standards. Cite the number and the title, because the practices cover different methods: 41R-08 for range estimating, 57R-09 for risk drivers, 65R-11 for expected value, and 66R-11, Selecting Probability Distribution Functions for Use in Cost and Schedule Risk Simulation Models, for the choice of distributions.
Questions to put to a provider
Ask two questions of anyone commissioned to run a QRA. Does the model include estimating or duration uncertainty as well as discrete risks? Has correlation been modelled, with a stated basis? A no to either means the output is a number without a defensible confidence position.
On our own QSRAs we check the schedule against the DCMA 14-point assessment first, then test logic, constraints and calendars before any risk is loaded. We state the percentile requested, the correlation basis and the main assumptions on the face of the report.