A practical case for cost and schedule risk analysis – and the tools built to support it

The Scottish Parliament Building overran its original budget by roughly 1 600 %. The Sydney Opera House overran by around 1 400 %. Closer to home for many of us in the Nordics, the Bank of Norway’s headquarters project ran about 400 % over its initial cost estimate (Flyvbjerg, 2014). These aren’t obscure cautionary tales – they are some of the best-documented projects in the world, delivered by capable, well-resourced teams. And they are far from unusual: a study of public transportation infrastructure projects found that nine out of ten had overrun their initial estimates, typically by 50 to 100 % (Flyvbjerg, 2002). The uncomfortable truth behind these numbers isn’t bad luck or incompetence. It’s that most projects are still planned as if the future were certain – one schedule, one budget, one outcome – when in reality it never is.

Why Schedule Risk Deserves Its Own Analysis

Every project schedule is, at its core, a single guess about the future: one duration for each activity, one sequence, one finish date. But durations are never fixed – they depend on resource availability, weather, technical complexity, supplier performance, and dozens of other factors that behave differently every time a project runs. Research into how schedules go wrong points to two consistent culprits. The first is genuine uncertainty: the natural variability in how long any piece of work actually takes. The second is bias – teams under pressure to win approval or reassure stakeholders tend to anchor on optimistic estimates, and rarely revisit them even as new information arrives.

Schedule Risk Analysis (SRA) addresses both. By running a critical-path schedule through Monte Carlo simulation – effectively simulating the project thousands of times under different combinations of uncertainty and identified risk – it produces something a single-point schedule never can: a realistic range of possible finish dates, and a ranked view of exactly which risks and activities are driving delay. That second part is the one that matters most in practice. Knowing a project might finish late isn’t especially useful on its own. Knowing that a specific procurement risk accounts for three weeks of that delay is something a team can actually act on.

Why Cost Estimates Need the Same Scrutiny

Cost estimates carry the same hidden fragility. Research spanning more than 1 000 large process-industry projects found that the average cost overrun at the most likely estimate was 21 %, with some projects running as much as 88 % over (Hollmann, 2012). For IT projects the picture is similarly stark: average overruns of around 43 %, with roughly seven in ten projects finishing over budget, over time, and under scope (Standish Group, cited in Hulett, 2023).

Much of this is inherited directly from schedule risk. When time-dependent resources – labour, rented equipment, site overheads – run longer than planned, cost rises with them, regardless of whether the direct cost estimate itself was ever wrong. Cost Risk Analysis captures both dimensions: uncertainty in unit costs and quantities, and the indirect cost impact of schedule slippage. Done properly, it doesn’t just produce a bigger contingency figure. It tells decision-makers how much confidence they can genuinely place in a given budget, and which cost drivers are worth managing actively rather than simply padding for.

Cost and schedule risk are rarely independent – a delay drives up cost, and a change in scope reshapes both at once. Analysing them separately, in separate tools, on separate timelines, tends to produce two disconnected pictures of the same project. Integrating them into a single Monte Carlo model instead produces a joint confidence level: the probability of hitting both the date and the budget together, which is usually the number stakeholders actually want to know.

Safran Risk: Cost and Schedule Risk, in One Model

Safran Risk is a fully integrated cost and schedule risk analysis tool, built for project controls professionals who need answers long before a project has a fully resourced schedule. It can be used from project discovery and bid and continues to add value all the way through planning, execution, and closeout.

Its core strength is combining the two disciplines without forcing teams to reconcile two separate systems. Cost data can be layered directly onto the schedule – without the time-consuming, error-prone process of resource-loading every activity – to produce a single, time-phased view of both cost and schedule exposure. From there, Safran Risk turns raw simulation results into decisions teams can act on:

• Tornado charts rank the risks and activities most strongly correlated with delay or overspend, for the whole project or any individual milestone.
• Sensitivity analysis quantifies exactly how many days – or how much money – each risk is likely to add.
• Scatter plots show the Joint Confidence Level for combined cost and schedule targets, so teams can see, and communicate, the real probability of hitting both at once.
• Risk Calendars let downtime risks such as weather be modelled using real historical time-series data for a specific location, rather than a generic assumption.

The result is a single, coherent set of reports – which means cost teams and schedule teams are, for once, looking at the same numbers.

Safran Risk Manager: Making Risk Everyone’s Job

Quantitative modelling is only half the story. Somebody still has to identify the risks in the first place, keep the register current, and make sure the right actions actually happen – and in most organisations, that responsibility sits with one overstretched risk manager and a spreadsheet that’s out of date by the time anyone reads it.

Safran Risk Manager is a cloud-based, collaborative risk register built to spread that responsibility across the whole project team without losing rigour. Risks and actions are structured using the bowtie methodology, capturing causes, consequences, and both preventative and mitigating actions against each one. Assessments start qualitatively, so any team member can contribute, and are then translated automatically into quantitative cost and time exposure – giving risk managers a fast route from a workshop conversation to a defensible number.

A real-time dashboard surfaces the state of the register at a glance. Configurable reports roll individual project risk up into programme and portfolio views for governance and executive reporting. And contingency tracking shows, at any point in the project, how much of the held contingency the current risk exposure actually justifies. Where Safran Risk answers “how much risk is in this plan,” Safran Risk Manager answers “who owns it, and what are we doing about it.”

The Integration between Safran Risk and Safran Risk Manager

Safran Risk and Safran Risk Manager are designed to close the loop between quantitative modelling and the continual day-to-day management of risk/action ownership-status workflows.

Safran Risk Manager initially presents risk assessment as a qualitative exercise, acknowledging that project teams often don’t start with the full facts to make a more detailed inference. Safran Risk Manager automatically converts those initial assessments into quantitative values with slider-bars to help widen or narrow the ranges of possible risk severity, such that they may feed directly into the more detailed Monte Carlo models built inside Safran Risk (the modelling sandbox for comparing available options).

Simulation results can then be replicated back inside Safran Risk Manager, either as new risks representing the hidden cost of schedule delays, or opportunities discovered through “what-if” analysis insights, or as the more robust method for establishing what an appropriate project contingency should be.

This way every risk carries both a story and a number.

Safran recognise the power of this integration and are enthusiastically talking with customers on how to improve the automation on offer here, whilst simultaneously keeping the team in control of the narrative (as multiple scenario versions need to be formally linked with decision-making and governance structures).

From Guesswork to Confidence

None of this makes uncertainty disappear – no software can. What it can do is turn “we hope this finishes on time and on budget” into a number a project team can defend, act on, and improve. That shift, from guesswork to grounded confidence, is the entire point of quantitative risk analysis – and it’s why Safran keeps building tools for the people who do this work every day, not just the ones who talk about it.