QCRA vs QSRA: Which Quantitative Risk Analysis Should You Run First?

Complex infrastructure and facilities management programmes rarely experience cost and schedule risk in isolation. A delayed approval can extend preliminaries, a late design decision can disrupt procurement, and a supply-chain failure can affect both the critical path and the outturn cost.

That is why the sequencing of QCRA risk management and QSRA risk management matters. The analysis must reflect the way the programme will actually perform, rather than treating cost and time as separate reporting exercises.

The short answer is:

Run QSRA first where the delivery sequence is mature and time is a material cost driver. Run QCRA first where scope and cost certainty are the immediate binding constraints. Where both models are sufficiently mature, use an integrated cost-and-schedule analysis.

The correct decision depends on the quality of the underlying baseline, not on a universal rule.

QCRA and QSRA: two different management questions

QCRA means Quantitative Cost Risk Analysis. It answers:

What is the probability distribution of the programme’s outturn cost, given the base estimate, cost uncertainty and identified risk events?

QSRA means Quantitative Schedule Risk Analysis. It answers:

What is the probability distribution of key milestone and completion dates, given the logic, durations, constraints and schedule risks in the programme?

Both normally use Monte Carlo simulation. The model runs a large number of scenarios by varying uncertain inputs according to defined distributions. The output is not a single forecast but a range of possible outcomes.

Aspect	QCRA	QSRA
Primary question	What might the programme cost?	When might the programme complete?
Main inputs	Cost estimate, CBS, quantities, rates, inflation assumptions, risk events and mitigation	Logic-linked schedule, activity durations, calendars, constraints, interfaces, risk events and mitigation
Main outputs	Cost S-curve, P50/P80 cost, contingency requirement, cost risk drivers	Completion-date S-curve, P50/P80 dates, float exposure, schedule risk drivers
Typical use	Capital programme cost management, funding, contingency and affordability	Delivery confidence, milestone assurance, access planning and time contingency
Principal failure mode	A risk model disconnected from the programme sequence	An unrealistic schedule containing excessive constraints or weak logic

A QCRA model should distinguish between:

• Base cost: the planned cost of defined scope before quantified risk and uncertainty.
• Cost uncertainty: variation in quantities, productivity, rates, inflation or other parameters.
• Discrete risk events: events such as late approvals, ground conditions or supplier failure.
• Contingency: the budget provision retained to address uncertainty and risks materialising.

A QSRA model should distinguish between:

• Deterministic durations: the current planned durations.
• Duration uncertainty: realistic variation around those durations.
• Discrete schedule risks: events that may delay activities or milestones.
• Logic and dependencies: the relationships that determine how delay propagates.

The Institute of Risk Management’s infrastructure guidance emphasises that cost and risk estimates should be considered together, with schedule risk recognised as fundamental to cost risk on many major programmes.

Which analysis should run first?

Run QSRA first when schedule drives cost

QSRA should normally be the first detailed analysis where:

• The programme has a credible, logic-linked schedule.
• Time-related costs are significant.
• The completion date is externally constrained.
• Access, possessions, shutdowns, operational interfaces or approvals drive the delivery sequence.
• Delay to one work package can affect multiple downstream packages.
• The cost estimate relies on planned durations or construction sequencing.

This is common in defence infrastructure, live operational estates, major FM mobilisation and complex capital programmes. A three-month delay may extend project management, site overheads, temporary facilities, security arrangements, inflation exposure and financing costs.

In that situation, QCRA run before understanding schedule exposure risks understating the cost distribution. The cost model may contain a line for preliminaries, but without a probabilistic view of duration it cannot properly model the likelihood or consequence of prolongation.

The practical sequence is:

1. Assure the integrated schedule and remove artificial constraints.
2. Quantify duration uncertainty and schedule risk events.
3. Run QSRA to establish P50, P80 and key milestone dates.
4. Translate schedule outputs into time-dependent cost assumptions.
5. Run QCRA, or preferably an integrated cost-and-schedule model.
6. Set cost and time contingency according to the agreed governance policy.

Run QCRA first when cost and scope certainty are the binding constraints

QCRA can reasonably come first where:

• The cost model is more mature than the schedule.
• The immediate decision is affordability, option selection or funding approval.
• Scope and quantities are the principal sources of uncertainty.
• The programme is at an early business-case stage.
• Schedule logic is not yet detailed enough to support meaningful QSRA.
• The cost decision must be made before detailed sequencing is available.

This does not make schedule irrelevant. It means that an early QCRA should be clearly labelled as an initial or provisional cost risk assessment. It should not be presented as the final contingency requirement if time-related cost exposure remains materially unresolved.

The cost model should record which assumptions depend on schedule development. Once the programme becomes sufficiently mature, QSRA should follow and the QCRA should be refreshed.

Use an integrated model where both are material

For a high-value programme, the preferred position is often an integrated quantitative cost and schedule risk analysis. The cost estimate is aligned to the programme schedule, and simulations allow schedule outcomes to influence cost outcomes within the same model.

This is particularly important where:

• Prolongation costs are material.
• Work packages are strongly interdependent.
• Risk events have both time and cost consequences.
• There are significant operational or stakeholder interfaces.
• The board needs a joint view of affordability and delivery confidence.

Practical sequencing flowchart

The following decision logic provides a workable starting point for infrastructure risk and contingency management:

START
  |
  v
Is the scope, WBS, CBS and risk taxonomy aligned?
  |
  +-- No --> Stabilise the integrated baseline before quantitative analysis
  |
  +-- Yes
        |
        v
Is the schedule logic sufficiently mature and does time materially drive cost?
        |
        +-- Yes --> Run QSRA first
        |             |
        |             v
        |          Quantify P50/P80 dates and time-related cost exposure
        |             |
        |             v
        |          Run QCRA or integrated cost-schedule analysis
        |
        +-- No
              |
              v
Is the cost model sufficiently mature for an affordability decision?
              |
              +-- Yes --> Run QCRA first as an initial cost range
              |             |
              |             v
              |          Develop and assure the schedule
              |             |
              |             v
              |          Run QSRA and refresh the integrated cost view
              |
              +-- No --> Improve both models before relying on P-level outputs

The flowchart is deliberately conservative. A sophisticated simulation cannot compensate for a weak baseline.

Common mistakes in QCRA and QSRA

1. Running QCRA on a cost model with no schedule logic

A cost model that contains no credible schedule relationship may produce a technically valid distribution but a commercially incomplete answer. It may omit prolongation, escalation timing, resource constraints and interface effects.

Where schedule is a material cost driver, the QCRA should either be linked to QSRA outputs or clearly disclose the limitation.

2. Using unvalidated three-point estimates

Three-point estimates are useful only when the optimistic, most likely and pessimistic values have a defensible basis. They should be supported by comparable project data, supplier intelligence, historical performance or structured expert assessment.

A wide range is not automatically prudent, and a narrow range is not automatically efficient. Each point should reflect a defined scope, confidence level and treatment of mitigation.

3. Double counting correlated risks

The same risk may appear in several places:

• A design uncertainty may already be included in a cost-line range.
• The resulting design delay may also appear as a discrete schedule risk.
• The delay-related cost may then be added again as a separate QCRA event.

Risk owners, estimators and planners must map each risk through its cause, consequence and cost treatment. Correlations should be modelled explicitly where appropriate, rather than allowing the same exposure to be added independently.

4. Treating P50 as a target

P50 is the median of a distribution. For cost, it represents a 50% probability that the outturn will not be exceeded. For schedule, it represents a 50% probability of completing on or before the stated date.

It is not a guaranteed budget or delivery commitment. A board may use P50 for a central estimate and P80 for affordability or assurance, but the decision must be documented. A higher P-level is not automatically better; it represents a different risk appetite and funding decision.

5. Re-baselining after the analysis to remove the exposure

Quantitative analysis should inform management of the existing exposure. It should not be used to rewrite the baseline until the result appears acceptable.

A risk-adjusted forecast should be managed alongside the approved baseline. Changes to scope, assumptions, strategy or approved funding should pass through formal change control. Otherwise, the programme loses the ability to distinguish performance variance from a revised starting point.

Worked example: defence facilities capital programme

Consider an illustrative £180 million estate modernisation programme with a planned duration of 30 months.

The initial assessment identifies:

• £180 million deterministic base estimate.
• Significant design development and ground-condition uncertainty.
• Monthly time-related costs of approximately £850,000.
• A critical operational access window.
• Supply-chain risk affecting specialist building services.
• An existing schedule with credible Level 1 logic but incomplete lower-level interfaces.

A first QSRA produces:

Confidence level	Completion outcome
P50	October 2028
P80	January 2029
P90	March 2029

The analysis shows that access approvals, specialist equipment procurement and systems integration are the principal schedule drivers.

The P80 date is three months later than P50. At £850,000 per month, the direct prolongation exposure is approximately £2.55 million. That amount should not simply be added to the QCRA as a separate risk if the integrated model already allows the simulated schedule to drive time-related cost.

The refreshed cost analysis produces:

Cost position	Illustrative value
Base estimate	£180.0m
QCRA P50 outturn	£190.5m
QCRA P80 outturn	£202.0m
P50 risk allowance	£10.5m
P80 risk allowance	£22.0m

The board report should show both the central forecast and the higher-confidence position. It should also explain that the £11.5 million difference between P50 and P80 includes correlated schedule and cost exposure, rather than being an arbitrary uplift.

The management response should identify:

• Which risks are owned at project level.
• Which risks require programme-level contingency.
• Which mitigations reduce the P80 exposure.
• What evidence is required before contingency is drawn down.
• How the P-level will be reviewed as design, procurement and delivery mature.

Linking quantitative output to contingency and board reporting

A board-level risk report should not present only a single contingency number. It should connect the number to the underlying control framework.

At a minimum, report:

1. Base cost and base date: the approved scope and deterministic position.
2. P50 and P80 outturns, with the selected confidence level clearly stated.
3. Contingency held and contingency consumed: separated by project, programme and sponsor level.
4. Top cost and schedule drivers, including their owners and mitigation status.
5. Change from the previous period: explaining whether exposure moved because of risk materialisation, mitigation, scope change or improved information.
6. Confidence in the model, including schedule maturity, estimate classification, data quality and correlation assumptions.
7. Required decisions, such as approval of mitigation, release of contingency or escalation of an emerging risk.

The IPA Cost Estimating Guidance and IPA Gateway 2 guidance both reinforce the need to align cost, schedule, scope, risk and contingency. They also expect major projects to explain the confidence level represented by the reported contingency.

The objective is not to create an impressive S-curve. It is to establish a controlled, auditable basis for decisions.

Conclusion

There is no universal rule that QCRA must always precede QSRA, or vice versa.

Run QSRA first when schedule logic is credible and time drives material cost. Run QCRA first when the immediate decision is affordability and the cost model is more mature than the schedule. Where both are significant, integrate them through a common baseline and shared risk structure.

The essential control is sequencing the analysis according to programme maturity, then maintaining the link between cost, schedule, scope, risk and contingency as the programme develops. That is what turns quantitative risk analysis into usable assurance rather than another isolated forecast.

---

About the Author

Nick Garvey is a chartered construction professional (MCIOB, FCaSA, FQSi) with more than 25 years of experience in commercial leadership and project controls across defence infrastructure, government estates, highways, facilities management and public-sector programmes. He leads cost, schedule, risk and performance reporting on major defence infrastructure programmes, chairs risk reviews at senior governance level, and writes about earned value management, quantitative risk analysis, NEC4 contracts and forecast integrity.

All views my own, shared in a personal capacity.