132R-23 (Schedule RIsk Analysis Maturity Model)
132R-23 (Schedule RIsk Analysis Maturity Model)
23
SCHEDULERI
SKANAL
YSI
S
MATURITYMODEL
Rev
.May18,2024
AACE® International Recommended Practice No. 132R-23
Any terms found in AACE International Recommended Practice 10S-90, Cost Engineering Terminology, supersede terms
defined in other AACE work products, including but not limited to, other recommended practices, the Total Cost
Management Framework, and Skills & Knowledge of Cost Engineering.
Contributors:
Disclaimer: The content provided by the contributors to this recommended practice is their own and does not necessarily
reflect that of their employers, unless otherwise stated.
Dr. David T. Hulett, FAACE (Primary Contributor) Boris Konrad, CCP PSP
Francisco Cruz, PE CCP Sebastian Soto
Keith D. Hornbacher H. Lance Stephenson, CCP FAACE Hon. Life
Sagar B. Khadka, CCP DRMP PSP FAACE Edward John Thomas
This document is copyrighted by AACE International and may not be reproduced without permission. Organizations may obtain permission
to reproduce a limited number of copies by entering into a license agreement. For information please contact [email protected]
AACE® International Recommended Practice No. 132R-23
SCHEDULE RISK ANALYSIS MATURITY MODEL
TCM Framework: 7.6 – Risk Management
TABLE OF CONTENTS
1. INTRODUCTION
This recommended practice (RP) of AACE International defines a structure of the practice maturity of schedule risk
analysis (SRA) for an organization. This is a topic within quantitative risk analysis, a subsection in Section 7.6.2.2 Risk
Assessment of the Total Cost Management Framework (TCM). [1, p. Section 7.6.2.2] Quantitative schedule risk
analysis is often paired with quantitative cost risk analysis to provide a picture of the risk to two key project controls
targets, time and cost that are causally related, since risks leading to longer activity durations in the schedule will
cause higher time-dependent resources’ direct and indirect cost. One goal of these analysis approaches is to quantify
the desired level of contingency of time and cost for a project. Another is to identify those risks that primarily cause
the need for contingency for the purpose of managing (e.g., mitigating) them to achieve better project results. SRA
addresses both of these objectives. Organizations may benefit from this practical RP by knowing how mature their
current practices are and, by understanding the characteristics of each level, whether to improve their practice. This
recommended practice follows the material published in Cost Engineering earlier. [2]
1.1. Scope
This recommended practice defines and explains the different levels of maturity of schedule risk analysis practice
being used by the profession. It is intended to be a practical document that organizations can implement. It is
presumed that the inputs to the schedule risk analysis are of sufficient detail, quality, and accuracy to support the
risk analysis methodology “Maturity” indicates the level of sophistication of the methodology used, which is
positively correlated to the quality of results.
Less mature levels of SRA practice are described in part because they are widely used, but also because some of the
lower-maturity SRA methods contain elements of methodology that are used in the more mature levels. For
instance, Level 2 emphasizes capturing and expressing probability and impact of risk, so a mature approach at that
level will produce a quality risk register. At Level 3, the project schedule is introduced as the platform for analysis,
so a mature system at that level would produce a quality schedule that is usable at that and higher levels of maturity.
One distinguishing feature of SRA maturity is compliance with RP 40R-08, Contingency Estimating – General
Principles. [3] The key principles of interest here are; “starts with identifying risk drivers”, and “links risk drivers and
cost/schedule outcomes”. The practice of risk analysis generally employs empiricism, experience, and competency
in data collection. This RP addresses risk analysis processes in projects with an estimate maturity level at Classes 1
to 3, where project schedules will generally be developed. Reference class forecasting and parametric models are
more suitable for projects that have estimate maturity levels at Class 4 or Class. [4]
Organizations may decide to stay at Level 2 since, when done right, that level considers all identified risks and
includes prioritization for focused handling. However, Level 2 does not produce an estimate of schedule contingency
and does not take advantage of the project schedule to calibrate the risks’ impacts.
This RP helps organizations understand where their SRA methods fall in maturity compared to where they might
wish to be. In that way, it provides practical information that helps the reader self-identify and understand the
limitations of their current maturity level. It also describes more competent methods, their strengths and
weaknesses, and the competencies needed to reach those.
1.2. Purpose
This RP is intended to provide practical guidelines (i.e., not a standard) to describe different levels of the practice of
SRA that most practitioners would consider to be good descriptions of the maturity of that practice. With this RP
organizations can assess their present SRA maturity level. It also has strengths and weaknesses of the practice at
each level, and descriptions of capabilities needed to improve their maturity of the practice of SRA. This RP describes
and compares the maturity of risk analysis along the path to more sophisticated risk analysis methods and culture.
Maturity levels culminate with integrated cost and schedule risk analysis using Monte Carlo simulation of a CPM
model. [5]
The reader is also encouraged to read recommended practice 122R-22, Quantitative Risk Analysis Maturity Model
for a higher-level discussion of risk analysis in general. [6]
1.3. Background
Project schedules provide a picture in the time dimension of the project plan. The schedule follows a work
breakdown structure (WBS) that captures and organizes all of the work required to complete the project. The
schedule adds substance to this plan by laying it out on a time-scale determined by estimated activity durations
which are logically linked together in predecessor-successor relationships. The logic-linked activities, and their
durations, form a network reflecting how the scope is planned to be done. The schedule provides major milestone
dates for the project, including a finish date by which the entire scope of work (SOW) is planned to be completed.
The nature of a project schedule is that the activities’ durations are estimated with the information available at the
time of building the schedule and may include some error. As with many aspects of risk analysis, there may also be
some bias imparted to the durations based on a desire to complete the project by a pre-determined finish date. In
the schedule, activity durations are represented by single-value (deterministic) numbers, but they are best
understood as estimates of work to be done in the future and are not guaranteed to be accurate. Schedule risk
analysis is conducted because organizational managers recognize that the durations assigned to the activities are
uncertain and that the impact of identified risks may easily delay completion unless they are handled (e.g., mitigated)
or structural changes are made to the plan and its schedule.
This recommended practice is applicable to projects that have, or are about to create, a project schedule and want
to use it as the platform for an SRA or an integrated cost-schedule risk analysis (ICSRA). This capability is not usually
available until projects have a schedule that is Class 3 or better per RP 27R-03. 1 The organization following the
maturity levels described in this RP (see Figure 1) generally will be applying the Monte Carlo simulation methods
described in recommended practices 57R-09 2and 117R-21 3.
The SRA maturity model structure is illustrated in Figure 1. At maturity Levels 0, 1, and 2, risk analysis is qualitative
and does not require a detailed schedule. At maturity Level 2, the risk register is developed to identify the most
important risks to the duration of the project. The risk register identifies risks and assesses their probability and
impact on the finish date without the benefit of a schedule. The risk register qualitatively identifies the most
important risks requiring handling by reviewing the probability and impact assessments, but it does not use the SRA
tools that are available at higher levels of maturity, such as running MCS on the CPM schedule, so Level 2 SRA is
viewed as a low level of maturity.
At maturity Levels 3, 4, and 5, risk analysis extends to include quantitative methods, which assess how uncertainty
and identified risks affect the durations of activities and project milestones. SRA at these levels assesses uncertainty
1 AACE International, Recommended Practice No. 27R-03, Schedule Classification System, Morgantown, WV: AACE International, Latest revision.
[4]
2
AACE International, Recommended Practice No. 57R-09, Integrated Cost and Schedule Risk Analysis Using Monte Carlo Simulation of a CPM
Model, Morgantown, WV: AACE International, Latest revision. [5]
3 AACE International, Recommended Practice No. 117R-21, Integrated Cost and Schedule Risk Analysis and Contingency Determination Using a
Hybrid Parametric and CPM Method, AACE International, Morgantown WV, Latest revision. [30]
of durations and probability and impact of identified risks as they affect the duration of project activities and the
contingency needed to achieve a desired target of certainty.
The distinction between risk and uncertainty becomes important at maturity levels 4 and 5. The identity and
importance of risks, including identified project-specific and systemic risks, can be characterized by their probability
of occurring with some impact on the activity durations, the degree of impact on the activity durations, and the
activities in the schedule that they affect if they occur. The main analytical approach for levels 4 and 5 is to use
Monte Carlo simulation (MCS).
2. RECOMMENDED PRACTICE
2.1. Purpose
This recommended practice helps an organization to evaluate the way SRA may be conducted by comparing various
SRA methodologies, and to rank those by levels of maturity. An early action is to describe the current level of SRA
maturity that exists in the organization and to evaluate the benefits and cost of moving to a more mature level. [20]
This RP provides an overview of the strengths and weaknesses of each maturity level, the required capabilities of
the organization’s staff, and the analytical tools required to conduct more mature risk analysis. This should allow the
organization to assess the financial commitment of achieving a higher level of maturity.
The needs of maturity in SRA may differ by project. In addition to choosing which maturity level is needed at a given
time, the organization might have a general desire to become more adept in executing project risk analysis over
time. The SRA maturity model will help management plan and budget for the next step, including hiring and training
risk staff, acquiring new software tools, and embedding “supports schedule risk analysis” into the project team’s
annual goals for success.
Not every organization needs to achieve Level 5, advanced integrated cost-schedule risk analysis. The RP does not
make that recommendation, although it points out weaknesses associated with low levels of risk management
maturity. Clearly, Level 5 has more capabilities and analytical strength than other lower levels, but describing Level
5 should not be taken to imply that an organization needs to achieve it or to plan to achieve it over time. The benefits
of Level 5 SRA on large, long, and complex projects may be self-evident. The application of risk maturity must be “fit
for purpose,” and will be different for different organizations or projects within an organization.
• Level 0 is named specifically for the lack of awareness of risk affecting the results of the project.
• Level 1 indicates that the organization is aware of risk but is not organized to analyze it.
• Level 2 is the qualitative risk analysis that results in the risk register and the typical risk heat map (See Figure
4) that allows sorting risks into high, moderate and low importance by their apparent probability of
occurring with some impact and the size of that impact on the finish date of the project. There may be uses
of existing historical databases to help build the risk registers.
• Level 3 introduces quantitative methods using the schedule as the analysis platform and applying MCS
methods. However, Level 3 relies on placing range estimates that represent the variability of each activity’s
scheduled duration directly on those activities. It does not distinguish the impacts of uncertainty separately
from those of identified risks. It does not recognize the contribution that the range estimate on an activity
may be caused by multiple risks. It does not reflect that some risks affect multiple activities and therefore
create a correlation between those activities’ duration during simulation. This level of maturity does
produce an estimate of the schedule contingency needed to provide a desired target of confidence, but it
cannot identify which risks contribute the most to the contingency computed. Level 3 does not satisfy the
first principles of AACE risk analysis. [3]
• Level 4 is a fully functional SRA that is driven by background uncertainty and identified risks placed on the
activities they affect if they occur in an iteration of the MCS according to their probabilities. The results
include identifying a schedule contingency for achieving the desired level of confidence. Prioritization of
individual identified risks, which facilitates the search for mitigation action, occurs at this level because the
identified risks are driving the simulation.
• Level 5 adds costs to the SRA schedule for an integrated cost-schedule risk analysis (ICSRA). One fact that
this step makes clear is that schedule risk drives the cost of time-dependent direct and indirect resources.
Consequently, any cost risk analysis that cannot deal with schedule risk simultaneously is in danger of
underestimating the risk to cost and the cost contingency needed to provide the desired level of confidence
in the cost estimates. It provided probabilistic case flows and the joint confidence level (JCL) to determine
the probability that both cost and schedule targets will be achieved.
The steps of the maturity model ladder are described by their features, strengths and weaknesses, and capabilities
needed in helping the organization deal with risks to schedule.
This level of dealing with risk means that management leaves out any consideration of risk while managing their
projects. This approach may succeed on a repetitive type of project such as constructing 100 houses of the same
design at the same location where the owner and the customer have “seen it all” and folded their experience into
the construction of the houses later in the program. Observable behavior at Level 0 includes:
• Project teams rely entirely on the accuracy of the milestone forecasts and projected finish dates in the
schedule. They defend those dates to management.
• Individuals do not think or plan for any event that is a threat to achieving the finish date produced by the
schedule. Risks that occur are surprises and are probably not handled well.
• When faced with contrary results from other projects risk-unaware individuals will claim “this project is
different” or “it won’t happen on my project.”
The fact that some projects at Level 0 of the SRA succeed is not because of effective risk analysis but success may
occur on the project by chance. The organization may attempt to rely on and support the schedule forecasts long
after it becomes obvious the project is not performing to those dates. Risks are not addressed, so they may happen
when they could have been avoided, or their impact on the schedule may be larger than necessary. Surprises,
excuses, and reactive responses are common at this level of maturity. Success in schedule completion is essentially
a random event. At this level, historical databases that can shed light on risk to the next project’s schedule do not
exist or are not used.
Level 1 maturity level indicates an awareness of project risk as something to consider when reviewing or reporting
to management, but there is no structured methodology to help examine risk. It represents opening people’s eyes
to the benefits of probabilistic thinking about projects without giving them the tools to conduct organized risk
analysis or recognizing that there are processes and tools to help them. Risks are viewed as unpredictable random
events because there is no organizing framework.
This level is characterized by an awareness of the importance of risk to successful project execution, but it lacks a
systematic way to think about risks. Consequently, this awareness does not lead to efficient risk handling (e.g.,
mitigation) or an SRA. Risks may be discussed frequently, and decisions may take account of the risk posed by
alternatives, but the influence of risk, such as the contingency of time needed, is neither analyzed nor
mathematically calibrated. Risk analysis is not embraced by the culture or required before decisions are made. Many
organizations perform informal risk management in this way without benefiting from the use of systematic
methodologies that are generally available. The success or failure to address risk depends on the intelligence and
awareness level of organizational management. The organization does not learn how to analyze risks from one
incident to another.
Individuals at this maturity level may not show awareness that activity durations are uncertain, and they exhibit a
willingness to examine assumptions that underlie the schedule. These attitudes imply that the organization is
questioning the deterministic scheduling results without having the tools or systems to examine the risks and
uncertainty directly.
At this basic level of risk maturity is awareness that the project will be executed per planned schedule only when:
(1) the durations are known with certainty and (2) things go according to plan. The organization realizes that “go
according to plan” occurs infrequently. They are aware that achieving the deterministic plan requires recognizing
and dealing with risks to the activity durations. The risk-aware organization may realize that it does not know the
finish date just by looking at the results of even the most sophisticated scheduling software tool, but it has no
organized structure, data or tool to help it proceed beyond this awareness. It also has no tool to prioritize one risk
over another, so its risk management is inefficient. Schedule contingency is often applied by a “standard” multiplier
that may be accepted by industry, such as adding 15% of the original duration. These organizations may understand
the limits this situation puts them in and may be ready to explore more mature risk analysis and handling options.
The main characteristic of Level 1 includes awareness at the top of the organization that the project schedule may
not be assured. Project team meetings are conducted to discuss the project’s prospects of finishing on time. These
discussions are conducted without an organized way of looking at the risks, so they are episodic and not well-
structured. The meetings often go over old ground and come to no conclusion, repeating the same arguments from
positions held earlier based upon inconsistent frames of reference. The discussions are not organized for success
because the sources, parameters, and ways of analyzing the risks are not known. Learning from experience is not
practiced. No historical databases that can shed light on risk to the next project’s schedule exist.
Individuals could compare the project with the results of actual, recent, and similar projects to consider what to
expect. Data needed for this comparison is ad hoc but not systematically maintained at Level 1. This approach has
been called the “outside view” 4
If a project schedule has been developed, the risk team may have a feeling that the estimates of activity durations
have been biased, usually to produce an earlier finish date. This may be driven by forces such as management
mandates, customer or competitive pressure, etc. This is known as the “planning fallacy.” 5 In 2003, Lovallo and
Kahneman proposed an expanded definition as the tendency to underestimate the time, costs, and risks of future
actions and at the same time overestimate the benefits of the same actions. According to this definition, the
planning fallacy results in not only time overruns, but also cost overruns and benefit shortfalls. 6
If scheduling bias is discovered, the schedule may be re-baselined. At a higher level of maturity, this estimating bias
may be corrected in the application of uncertainty before simulation, but that solution is not available at Level 1.
4
B. Flyvberg, "Quality control and due diligence in project management: Getting decisions right by taking the outside view", International Journal
of Project Management, vol. 31, no. 5, pp. 760-774, 2013 [21, pp. 760-774]
5“When forecasting the outcomes of risky projects, executives all too easily fall victim to what psychologists call the planning fallacy. In its grip,
managers make decisions based on delusional optimism rather than on a rational weighting of gains, losses, and probabilities. They overestimate
benefits and underestimate costs. They spin scenarios of success while overlooking the potential for mistakes and miscalculations. As a result,
managers pursue initiatives that are unlikely to come in on budget or on time—or to ever deliver the expected returns.”
6 Planning Fallacy, see D. Lovallo and D. Kahneman, "Delusions of Success: How Optimism Undermines Executives' Decisions," Harvard Business
At Level 1 there is no one person or group designated to analyze project risk. Reinforcing the nascent risk attitude
will be harder because individuals need to adopt a way of thinking probabilistically about finish dates that may differ
from the way they were taught to use the scheduling software, where the finish dates are strictly deterministic.
Since the risks are not addressed in an organized way, some important risks will be overlooked with noticeable
results. Even with the risks that have been identified, they may not be the root causes of schedule variability because
the structure of a risk statement and an RBS does not exist at Level 1. This level lacks an organized way of calculating
how individual risks can be prioritized by their probability and possible impact on the finish date. While a risk may
seem to be important, it may not be on the critical path that could delay the project. At Level 1, there is no
mechanism to prioritize the risks to determine which to address first.
Level 2 of schedule risk management maturity represents examining project risk to schedule (and to other objectives
such as cost, quality and scope) using qualitative methods that lead to developing a project risk register.
Qualitative risk analysis is often viewed as a low-cost and easily-understood method of addressing project risks. Level
2 includes organized ways to gather information on the identity of risks to the schedule. The outputs at Level 2
include a risk register that sorts the risks by their probability and impact into high, moderate and low (red, yellow
and green) categories. This classification can lead to risk mitigation actions focusing on the highest priority risks first,
a significant benefit to the organization. Maturity at level 2 may be sufficient for some projects or some
organizations.
Risk analysis at Level 2 embodies an organized and consistent methodology for naming risks and for focusing on their
two primary characteristics; (1) probability of occurring with some impact on the project schedule, and (2) impact
on the project finish date if it happens. It relies on a widely recognized definition of a risk as: “…an uncertain event
or condition that could affect a project objective or business goal.” Risks can be classified as project-specific and
systemic. [7]
• A related ability is to gather data on risks that are difficult to talk about in a workshop because their
consequence could lead to the project’s failure. Other such risks would be those that contradict official
statements to the customers, funding agencies, the public, or joint-venture partners. Success in gaining the
project team’s candid opinions might require conducting confidential interviews instead of workshops.
• Ability to create and maintain a project risk register. Done well, the risk register helps management identify
and handle individual risks effectively. This can be enhanced by the development and use of a historical
database. 7
There are some software tools that support risk register development, but standard spreadsheet tools are often
used with satisfactory results.
A risk breakdown structure is an important tool to help organize gathered data in the risk register. A standard RBS is
shown in Figure 2. Typically it needs to be tailored to the specific project before being used in risk identification. The
RBS should help the organization realize that the causes of risks arise from many directions and encourage the
project team members to think outside of their areas of expertise or their work assignments. Risk identification
should address technical risk but also risk arising from external, organizational and even project management
sources.
The RBS is to be tailored to specific projects. For instance, an oil drilling project might emphasize sub-surface
conditions while a pharmaceutical plant construction project might require more details on regulatory requirements
or regulations in other countries. These areas can be added to the typical RBS, which is used as a starting point.
The impact of risks on the total project objective selected must be defined for the qualitative risk exercise by project
management. The project manager should look at the definitions (Figure 3) and decide what combination of
probability and impact would warrant a red, yellow or green diagnosis on the heat map (Figure 4). In this exercise,
the manager may set the definitions differently from those, but the red-yellow-green designations for each risk will
reflect management’s level of need to act on the risk or not. This provides the assessment of risks’ impact to be
applied consistently so that risks can be compared. An example of the definitions of impact at five levels from very
low to very high and for schedule and cost different objectives is shown in Figure 3. These definitions need to be
7AACE International Recommended Practice 114R-20, Project Historical Database Development, Morgantown WV, AACE International, Latest
Revision. [11]
scaled appropriately for the project at hand with the participation of the project manager who will be using the
results to influence decisions.
Definition of Probability and Impact Scales for Threats at Level 2 (example values to be tailored)
Objective Very Low Low Moderate High Very High
Probability of
Occurring with < 10% 10% - 30% 30% - 60% 60% - 80% > 80%
Some Impact
Impact on Finish
< 1 week 1 - 2 weeks 2 - 5 weeks 5 - 10 weeks > 10 weeks
Date (Schedule)
There would be a similar table applying to opportunities, supporting the right-hand side of Figure 4.
After approving the impact scales, the project manager needs to identify which combinations of probability and
impact warrant attention. Risks are classified as red, yellow, or green for the risks based on their probability and
impact, as shown in Figure 4. The zones of the probability and impact matrix are designated as very low, low,
moderate, high, or very high risk according to the decision of the project manager about which combination of
probability and impact warrants the least, moderate, or the most attention.
A simple probability and impact matrix for both threat and opportunity is shown in Figure 4. The combinations of
probability and impact that show as red in the red-yellow-green scheme are viewed as the most important and serve
as the “arrow of attention,” a phrase coined by David Hillson. [8]
Handling schedule risk at maturity Level 2 may be effective enough for many projects that do not need more detail
or an estimate of schedule contingency. The smaller, shorter-duration, lower-cost projects might be handled with
the development and maintenance of a risk register.
The risk register can also record the handling, e.g., mitigation, of risks and their post-mitigation assessed probability
and impact scores. Attention needs to be paid to the quality of the risk mitigations that are assumed to improve
scores and hence may be counted on to move risks from red to yellow or yellow to green. Mitigation actions are
new actions, not just a continuation of existing processes. The mitigations also need to be agreed to by the
participants before conferring to improve the risk scores.
More elaborate risk register approaches display the timing of the mitigation and a waterfall of planned improvement
in the outlook associated with that risk.
Data collected and stored on complete projects can be a useful starting point for a risk analysis whether qualitative
or quantitative. RP 114R-20 [9] discusses data and metrics to develop and calibrate empirically-based risk
quantification methods and tools. Risk identification guides (risk registers) and risk monitoring documents from
previous projects may also be useful. Finally, post-mortems from those projects might provide important risks and
pitfalls to be dealt with or avoided.
There are limitations to the qualitative method of handling project risks at Level 2:
• It does not provide an estimate of the probability that the scheduled finish date will be overrun or the
amount of contingency that should be added to the schedule to provide a desired level of certainty. This is
because (a) each risk is assessed independently of the others, and (b) the risks are not analyzed within the
framework of the project schedule.
• Risks are often identified and calibrated in risk workshops. Risk workshops often omit or avoid some of the
most important risks that are known but not talked about, called the “unknown knowns.“ These are risks
that may arise during confidential interviews but are not identified through risk workshops because they
contradict statements of management or jeopardize the existence of the project itself.
• Some people put numbers (e.g., 1-to-5 or using an increasing scales 1, 2, 4, 8, 16) to the probability and
impact ranges, and then treat these numbers as if they were cardinal values that could be multiplied
together with probability to determine the red-yellow-green shading of the cells in the probability and
impact matrix in Figure 4. In fact, the impact ranges are ordinal numbers in nature, representing the order
of risk impact but not the magnitude. For example, high impact (described as 4) is larger than low impact
(described as 2), but not necessarily twice as impactful to the organization’s achieving its objectives as low
impact. These numbers cannot be added, multiplied, divided, or otherwise mathematically manipulated.
Maturity Level 3 recognizes that project schedule success is affected by the uncertainty of the estimated durations
of the activities in the project schedule and can be analyzed statistically by applying Monte Carlo simulation (MCS)
with specialized but available software. This method of applying uncertainty to activity durations prior to simulation
was originally described in RP 41R-08, Risk Analysis and Contingency Determination Using Range Estimating,
published in October 2008. The original RP was retired in February 2022, and replaced by a revised 41R-08 entitled
Understanding Estimate Ranging. 8 [10] In the February 2022 version of 41R-08, range estimating is now limited to
8
Range estimating method, embodied in 41R-08, no longer serves the needs of its members. This decision was made because range estimating
does not follow the first principles established in 40R-08 Contingency Estimating – General Principles [3]that the analysis “starts with identifying
representing uncertainty caused by estimating error and bias and by the inherent variability of the work. It explicitly
does not support using range estimating to reflect the activity durations’ variability that is caused by identified risks.
Many organizations are still practicing SRA at Level 3, and risk ranging is still featured in books, articles, guidelines,
and courses.
At maturity Level 3, possible fluctuations of activity durations from planned are represented by applying probability
distributions directly to the activity durations individually. Typically, these distributions are described with a 3-point
estimate of possible days representing minimum (low, optimistic), most likely, and maximum (high, pessimistic) days.
[11] The 3-point impact is assessed for the activity durations, often using workshops or interviews of the activity
leaders. 9 The 3-point estimate represents the influence of all identified project-specific and systemic risks plus
uncertainty that would cause the activities’ durations to fluctuate. Probability distributions of added days, such as
those shown in Figure 5, are used depending on the activity.
The schedule model is computed or iterated many times using specialized Monte Carlo software that imports a
critical path method (CPM) schedule from scheduling software. The schedule must observe best practice scheduling
without any cushioning to provide for risk inside the durations of schedule activities. [12] Each iteration that the
risk drivers” and “links risk drivers and cost/schedule outcomes.” A revision of 41R-08, published in February 2022, explains the reasonings and
describes areas representing background uncertainty where range estimating is still an approved practice.
9
There are other distribution types available in the software.
schedule produces uses durations selected randomly from the distributions assigned to the variable activities and
produces a finish date for the project as a probability distribution.
The results are shown by a histogram and cumulative distribution of possible finish dates consistent with the
assumptions applied as shown in Figure 6. The figure shows a project histogram by vertical bars indicating the
number of times in simulation the finish date occurred in the week indicated. It also shows the cumulative
distribution, that is, the accumulation of dates from moving from left to right, summing the number of “hits” in the
vertical bars. The cumulative distribution shows the probability that the project finishes on a chosen date or earlier.
In Figure 6, assuming the schedule and risks attached, there is an 80 percent chance that this project will finish on
or before June 17, 2025. Figure 6 also shows that the scheduled finish for this project is October 27, 2023, and that
date has only a 5% likelihood of being achieved.
Figure 6: Results of a Simulation at Level 3 Showing the Possible Finish Dates of a Project
Skills required at this level of maturity include an ability to understand and assess the quality of the project schedule
used in the analysis. Many mature SRA practitioners have become competent in project scheduling and the
scheduling software available, out of necessity since many schedules do not comply with best practices. This means
becoming familiar with scheduling best practices. [12]
Practitioners at Level 3 also collect activity duration ranges from activity managers and create probability
distributions for each activity that has uncertain durations. Activity managers provide 3-point estimates (or 2-point
if a uniform distribution is specified) from their own experience on past projects. Level 3 is the point at which there
becomes a general understanding of stochastic representations of activity durations that are under-represented by
single-point deterministic values in the schedule.
At Level 3, the analyst needs to understand and use the specialized Monte Carlo simulation software that can use
the probability distributions to calculate the schedule thousands of times by selecting durations at random from the
distributions on activity durations. This simulation software can be used at Levels 4 and 5 as well. In addition, the
risk analyst may decide to develop a best-scheduling-practices summary schedule for any risk analysis performed at
Levels 3, 4, and 5.
While AACE International no longer recognizes range estimating as a recommended practice for representing the
influence of identified risks on the schedule, range estimating is still appropriate to represent background
uncertainty. Also, there are some benefits at Level 3 compared to Level 2. Applying probability distributions directly
to the activity durations has the benefit that it facilitates Monte Carlo simulations using the schedule’s logic. It can
compute a probability distribution of finish dates and identify a date that provides management’s desired protection
from further schedule overrun. Other outputs include the risk criticality of activities by the percentage of iterations
an activity appeared on the critical path. Sensitivity analysis is usually calculated for each activity by measuring its
correlation during simulation.
Level 3 uses the project schedule and Monte Carlo simulation software for the calibration of the impact of duration
uncertainty on the project completion date. This method recognizes the important contribution to schedule risk of
the merge bias that may occur when an activity or milestone has two or more predecessors, and the schedule impact
of risk exceeds the free float of at least two of the merging paths. 10
The risk register is not listed in the description of maturity Level 3; working with identified risks becomes very
important at Level 4 and Level 5. That is because risk analysis at maturity Level 3 does not use identified risks as
drivers of the simulation, opting to use probability distributions of activity durations applied directly to the activities.
These distributions represent both uncertainty and all risks affecting individual activities. As stated above, this
approach does not comply with best practices in the risk analysis profession or with the first principles of AACE. [3]
At Level 3, the ranges applied directly to activity durations contain the influence of all sources of uncertainty and
identifiable risks embedded in the activities affected.
• Range distributions are placed directly on the activity durations assuming a 100% probability of occurring.
This assumption is appropriate for uncertainty only but not to identified risks that have less than a 100%
probability of occurring.
• While the analyst responsible for any activity may list one or more risks as being considered when specifying
the probability distribution for that activity, the distribution consolidates all such risks, as well as
uncertainty, as applied to that activity’s duration. Since some activities are impacted by multiple risks, the
impact of an individual risk cannot be distinguished because they are all combined into one distribution.
• Risks can impact several or many activities in the project schedule. Placing impact distributions on each
activity individually masks the fact that some risks affect many activities, so this method cannot represent
the total impact of those risks.
• The risks cannot be prioritized since they are not individually identifiable and used as drivers of the
simulation.
10
The merge bias of a schedule represents the addition of risk that occurs at merge points in the schedule logic where, under certain
circumstances, the path that is shorter (not “driving” the successor activity) may become the longest path to that milestone depending on the
risks assigned to the shorter compared to the longer merging path. The presence of the merge bias was revealed in 1962 to be important in being
careful using the program evaluation and review technique. [32]
• Risk prioritization using tornado charts is based on activities rather than risks. Hence, at Level 3, activities
can be prioritized, but the risks themselves cannot be prioritized for mitigation.
• Sometimes, the analyst specifies a correlation between activity durations. However, individuals are
particularly ill-equipped to specify these correlations directly, having little information or experience on
which to base the size of these coefficients. Handling the effect of correlation can impact important results,
such as the projected finish date and the probability of overrunning the schedule. At Level 3, the correlation
used is largely a guess. Correlation can be approximated through simulation at Level 4 (see Figure 11 below).
The main capabilities available at SRA Maturity Level 4 are described in RP 57R-09, Integrated Cost and Schedule Risk
Analysis using Risk Drivers and Monte Carlo Simulation of a CPM Schedule. [5] [13] [14] The benefits are gained
because the Monte Carlo simulation is driven by; (1) identified risks specified by their probability and impact and
assigned to all activities they affect and, separately, by (2) uncertainty that is 100% likely. It can be assigned to all
activities or as reference ranges to groupings of activities.
Identified risks include both project-specific and systemic risks. Some systemic risks are: [15] [16]
• Completeness of scope definition
• Quality of project control
• Quality of project scheduling
• Quality of team development
• Extent of new technology in the project
• Extent of complexity
In addition, it is always a good idea to review the results of the risk analyses described in this maturity presentation
against relevant and recent historical data. This analysis of historical data brings the perspective of historical data.
The case study illustrating Level 4 capabilities uses a summary schedule of building an offshore gas production
platform. It is shown in Figure 7.
Uncertainty and identified risks are treated at Level 4, but not combined into activity duration range estimating as
at Level 3. Uncertainty is caused by estimating error, estimating bias, and inherent variability of the work. [7] The
first two of these causes have already happened and are embedded in the durations of the schedule, so uncertainty
must correct for them. Inherent variability of the work is caused by many factors that are not individually identified.
Uncertainty cannot be mitigated because risk mitigation techniques cannot be specifically targeted without
identifying the risk.
• Identified risks include both known project-specific risks and systemic risks. [7] in Figure 8, Risk-101
Schedule Uncertainty is background uncertainty of the schedule’s duration estimates. Risk-102 is cost
uncertainty introduced at Level 5, Integrated Cost and Schedule Risk Analysis. Risks 103 – 109 are project
specific risks and Risk-110, The project team may not be adequate for the complex project, is representative
of a systemic risk.
The impacts of the identified risks are represented by Risk-105, Fabrication productivity may not be as high as
planned, as shown using a triangular distribution in Figure 9.
Figure 9: Example of Impact Probability Distribution using a Triangular Distribution with 3-point Estimates
The use of identified risks allows those risks to be assigned to many activities if applicable for the project. This also
implies that some, perhaps many, activities are affected by more than one risk. These characteristics more closely
model reality, particularly in complex projects and produce benefits discussed below.
The use of the “Type: Relative” defines this risk as a risk driver. For any iteration in the MCS, the simulation software
will draw at random from the distribution of multiplicative factors, described as triangular with a 3-point estimate
labeled “Min,” “Likely,” and “Max.” For that iteration, the software will use the chosen factor to multiply the
scheduled duration for all activities the risk affects.
When combined with the logical structure of the schedule, with parallel paths, merge points, and near-critical paths,
placing the influence of risks onto the right detailed tasks gives the result accuracy and transparency.
The risks are assigned to the activities they affect. Some, such as the systemic risks, are assigned to many activities,
while others are assigned to specific types of activity. Figure 10 illustrates assigning risks to the case study schedule.
The risks have to be identified in order to be calibrated and to be modeled in the Monte Carlo simulation at Level 4.
In the process of calibrating risks, risk analysts will gather and assess expert judgments about probability and impacts
to reduce bias and improve the realism of inputs related to schedule probability of occurring (with some impact) and
impact on the activities affected if it occurs. Risk identification is required and discussed at Level 2 where the risk
register is first developed. Experience finds that the risk register is usually incomplete and new risks are identified
during the confidential interviews, also described at Level 2. Often there are risks that cannot be discussed in risk
workshops because of cultural or hierarchical pressures, so the risk analyst will need to conduct probing confidential
interviews to unearth the important risks that need to be added to the risk list used for the quantitative SRA at Levels
4 and 5.
The risk analyst may decide to develop a summary schedule for the risk analysis at Level 4. Class 3 to Class 1
contractor-developed schedules are not always compliant with scheduling best practices, and, in any case, they
contain more logical detail than is needed in a strategic risk analysis. A validated summary schedule needs to include
a representation of all the work in the project and should represent in summary form the key critical paths and
appropriate total float values as the detailed schedule. Notice that the critical path in the baseline schedule may
not be the path most likely to delay the project, as revealed by the simulation.
Using the project-specific risks to drive the simulation allows the analysis model to follow reality more closely than
at Level 3. In particular, one method used at this level of maturity, where the identifiable risks are modeled as risk
drivers affecting more than one activity, causes activity durations to become correlated during simulation. Allowing
a risk driver to affect two – or, in some instances, many – activities results in a correlation between activity durations
that is generated during simulation, thus removing the need for the analyst to estimate correlation coefficients.
Modeling correlations in this way produces a correlation coefficient matrix that is nonnegative definite, i.e., has no
negative eigenvalues.[4] Generating a correlation coefficient between activity durations is shown in Figure 11
below: 11
11These results were developed using simplified simulation models, extracting the iteration results for Activity 1 and Activity 2, placing those
values in Microsoft® Excel, and applying the Excel Correlation calculator between the two columns of simulation results.
Compounding risks applied to one but not both activities drives down the coefficient
Activity 1 Activity 2
Correlation = 37%
Figure 11: Modeling how Risk Drivers Modeling Causes Correlation Between Activity Durations [2] [17]
The simulation of this case study provides the standard output for schedule risk analysis capable only in Levels 4 and
5. These include the histogram and cumulative distribution that are shown in Figure 12 and the sensitivity analysis
resulting tornado diagram in Figure 13. Notice the second mode at about October-November 2026, sometimes found
as the consequence of a systemic risk with low probability but large impact on the schedule if it happens.
Figure 12: Histogram and Cumulative Distribution using Uncertainty and Risk Drivers
The cumulative distribution in Figure 12 allows the calculation of project schedule contingency up to a desired level
of confidence for the organization. The level is shown as the P80 level, which occurs on June 26, 2026. This result
indicates providing eight months of contingency beyond the scheduled finish date of October 26, 2025 and satisfies
the owner’s desire for a comfortable degree of certainty of the finish date. Put another way, 80 percent of the results
with this schedule and these uncertainties and risks are provided for if June 26, 2026, is adopted as the finish date
of this project.
Since specific risks are used to drive the simulation at Level 4, those risks can be prioritized by calculating their
marginal impact on the PRA results at a target level of confidence, such as the P80. The marginal impact is calibrated
by days saved if the risks were fully mitigated. [18] This information is useful for project management to determine
whether to implement mitigation so that its benefits in days saved are worth the cost of the mitigation actions. This
prioritization measure is better than traditional tornado diagrams that use the correlation of activities with the finish
date instead of days saved. The results of risk prioritization using this method are shown in Figure 13.
Since, at Level 4, the SRA is driven by identified risk drivers, project risk management is enhanced by the risk
prioritization shown above. Risk mitigation actions should be developed focusing on the most important risk based
on the days that could be saved if the risk were fully mitigated. Uncertainty is not mitigated since the risks have
already happened in the schedule provided to the risk analyst to use as a platform. Risk estimating error and bias
are characterized by multiple unidentified risks that are sources of inherent variability. A mitigation workshop can
be convened to plan and assign mitigation activities that the owner and contractor, plus key stakeholders, can agree
on. Often the mitigation plans are unconnected to the risk, unlikely to be implemented or effective, or missing from
the risk register entirely. [19] Once the mitigation activities are agreed to, and their cost is estimated, the simulation
software lets the analyst specify post-mitigation probability and impact parameters from implementing the
mitigation actions. A post-mitigation result is a new target, and the mitigation actions need to be implemented and
monitored periodically to be sure they were carried out as anticipated by the mitigation workshop and are effective.
As at Levels 3, 4, and 5 there will be some work to do to review the schedule against good scheduling practices. The
analyst may need to create a summary schedule that complies with good practices from the outset and is easier to
manage and use in communicating the issues associated with risk. Also, as described under Level 2 above, the risk
data collection starts with the existing risk register but needs to be augmented, probably using individual confidential
interviews of project team members, management and other subject matter experts (SMEs).
Implementing a risk analysis at Level 4 is more burdensome than at Level 3. There is often a risk register available
to start the SRA risk data interviews, but as at level 3, additional interviews will be needed to (1) uncover the risks
not in the risk register and (2) estimate the probability and impact for the durations of the activities affected if the
risk occurs. Working with identified risks at Level 4, rather than risk ranges at Level 3, requires more data collection
and consolidation.
Individuals are known to exhibit biases when discussing uncertainty concepts which are, of course, about future
events. Since “there are no facts about the future,” [20] one needs to recognize their inherent biases and try to
offset them. [21] This is why confidential interviews are often used, to put the interviewees in a safe environment
where they can say what they really mean without fear of contradiction or personal repercussions. An expert
interviewer can usually identify the biases in the interviewee’s responses and overcome or correct for them.
This level of maturity recognizes the important fact that activity durations and costs of time-dependent resources
are related. If an activity is performed by labor-type resources including rented equipment, the costs will be higher
if the task takes longer. Assuming no change in the resources applied on a daily basis, this cost will be higher in
proportion to the extension of duration. Indirect costs can be placed on hammock activities, and their costs will
increase in proportion to that of the detailed activities supported. The project cost budget should include a cost
contingency related to accommodate the possibility that the schedule takes longer than planned. [5] [14]
In addition to the knock-on effect of schedule risk on the cost of time-dependent resources, there are risks that can
affect the burn rate of these resources and the total cost of time-independent resources, such as material and
equipment to be installed.
Level 5 builds on all of the capabilities of Level 4, including basing the analysis on the project schedule platform and
using uncertainty and identified risks to drive the Monte Carlo simulation.
The distinguishing characteristic at Level 5 is that risks affecting activity durations in the schedule can have knock-
on effects on project cost. Resources are assigned to activities and distinguished by being time-dependent (labor
and rented equipment) or time-independent (material and equipment to be installed) of the project. The costs must
be expressed without adding any contingency, either in the activities or “below the line,” as in a traditional cost
estimate, to avoid double counting the effect of risks on cost. While resource-loaded schedules may have many
labor categories to support integrated cost and schedule risk analysis (ICSRA), the resources need to be distinguished
only by being time-dependent and time-dependent.
The results from a Level 5 analysis include all results from Level 4 that provide a risk-influenced schedule contingency
estimate. Output at maturity Level 5 adds to those of Level 4 by providing a contingency of cost that reflects cost
risks and knock-on effects of schedule risks affecting cost. In addition, Level 5 provides a way to analyze the results
of cost and schedule together using a scatter diagram to identify the finish date and total project cost achieving
target level of confidence both time and cost targets simultaneously. 12
12 This latter capability, the ICSRA, has been called the joint confidence level (JCL) by the US National Aeronautics and Space Administration
(NASA). [27]
Often the project schedule is not loaded with resources, or those resources are not associated with costs matching
the budget without contingency. Cost estimators and schedulers need to communicate at a common detailed level
in order to place the costs on the schedule. The most obvious way cost and time data can be compared is if the
estimators and the schedulers are using the same work breakdown structure (WBS). This communication is not
always easy since the estimate and schedule may have diverged from an original common WBS along the way.
The risk practitioner should also be alert to traditional cost risks that could increase or decrease the daily expenditure
rate on time-independent resources and increase or decrease time-independent material costs, which do not vary
because of activity durations. These risks will vary the cost even if the schedule follows the baseline schedule.
In each iteration, the Monte Carlo simulation will compute the cost that is generated at the same time and with the
same assumptions for which the schedule is calculated. The costs and durations for any iteration will be affected by
that iteration’s assumptions. In this way, the cost and finish date results would be correct for the same project
structure, uncertainty, and risk parameters.
The risk analysis does not identify which party must pay the extra costs. Depending on the contract, there may be a
presumption that the owner or the contractor pays the cost. However, the risk analysis just computes the costs
irrespective of the contract language and does not contribute to the debate about who pays.
Probabilistic histograms for the schedule are the same as at Level 4. Histograms for cost, which are introduced at
Level 5, are comprehensive since they reflect both the indirect effect of schedule-generated costs of time-dependent
resources, as well as standard cost risks (e.g., local labor rates) on time-dependent labor’s burn rate and on total
cost of material (e.g., world price of steel) on time-independent resources.
Because cost and schedule are the results of the same iterations during simulation, a new concept of project risk is
available at Level 5. The result, representing both the project’s finish date and total cost, is the scatter diagram with
time on the X-axis and the comparable cost on the Y-axis. The scatter diagram allows the user to select a pair of
cost–time points and calculate the likelihood that they will both occur, given the schedule, the estimates, and the
risk data used in the model.
Most projects have both cost and schedule targets or propose both cost and schedule values to management or the
customer. At Level 4, the simulation results for schedule risk are shown as a 2-dimensional histogram and cumulative
distribution. At Level 5, a similar distribution is provided for cost. Specifying a confidence target, e.g., the P80, and
using the values from the histogram / cumulative distributions for each objective will not provide for achieving both
the time and cost targets with an 80 percent likelihood. This is because, for any schedule date at P80 there are many
cost possibilities, and some of those are 80 percent or more likely, but some are not. The same situation applies
when starting with a P80 cost estimate from the cost histogram and cumulative distribution. Notice that above in
Figure 7 the cost (without contingency) was estimated at $1,721,200. Examples of these 2-dimensional time or cost
risk-informed solutions are shown in Figure 14 for this RP’s case study, the Offshore Gas Production Platform
Construction and Installation Project.
Figure 14: Simultaneous Finish Date and Project Cost Results from the Case Study
The scatter diagram in Figure 15 shows that the joint confidence of achieving the P80 time and cost results
individually, shown in Figure 14, is only 76 percent. This figure, which is presented in the southwest quadrant in
Figure 15, shows the percentage of all 10,000 iterations for which the points are in that quadrant. This difference of
76 percent, rather than 80 percent, is not large primarily due to the predominance of labor resources in the case
study model.
Figure 15: Scatter Diagram for the Case Study with the P-80 Cost and Schedule Cross-Hairs
At Level 5 the cost risk results are calculated using the Monte Carlo simulation. To achieve the 80 percent likelihood
of achieving both cost and schedule targets the project manager needs to add time and cost to find a point that
provides a joint success rate of 80 percent. Providing for both time and cost jointly, using the scatter diagram that
shows consistent cost-time iteration results, is the joint confidence level, or JCL-80 point. [22] Since there are many
point combinations that yield a JCL-80 confidence level, the analyst should choose one that is more likely than any
other to occur. Think of the scatter diagram as representing a 3-dimensional ridge of JCL points. Imagine a
topological map and find the highest elevation contour line where the JCL-80 points hit the ridge. That defines the
most likely JCL-80 (or whatever confidence target is desired) point.
Figure 16: Finding the Most Likely JCL-80 Combination of Finish Dates and Project Costs
Using the Scatter Diagram to Achieve an 80% Likelihood of Joint Cost and Schedule Success
From Histograms JCL From Scatter Diagram Add JCL
Finish Date 06/26/2026 76 08/01/2026 1.2 month 80
Project Cost $2,641,943,000 %
$2,807,986,000 $166,043,000 %
Table 1: Finding the P80 Cost and Schedule with the Integrated JCL for an 80 Percent Success Rate for Both
Figure 16 shows that adding 1.2 months to the P80 schedule and $166,043,000 to the P80 cost can achieve an 80%
likelihood of succeeding with both targets. As mentioned before, the higher the correlation of time and costs, the
less adjustments need be made to achieve a JCL level. Time and cost will be correlated because time risk affects the
cost of time-dependent resources. In this case study, labor contributes the largest share of the cost.
NASA fully formalized the JCL policy to develop its proposals of time and finish date to US Congress for approval and
funding in 2012 after having introduced it in 2007 and 2009 in different directives. In 2018 an analysis of the success
of the JCL policy of achieving the dates and cost estimates submitted to Congress was possible since some of these
long projects had been completed. Comparison of cost and schedule growth shows that cost growth against
submissions to US Congress before the JCL policy was in place, was a higher percentage than after JCL was adopted.
“The data demonstrates that the policy has helped NASA manage to its budget which increases the confidence that
missions will be delivered at or below cost and on schedule.” [23, p. Slide 5] It should be clear that using the JCL
leads to proposing higher cost and schedule target values to Congress, so coming closer to or beating the new, higher
estimates means that the agency is making better projections.
In addition, there is an unresolved issue in picking the specific cost and finish date, which is the most likely
combination to provide a probability of achieving both cost and finish date targets at the chosen JCL level of
confidence. Figure 16 shows a combination chosen to be in the area of the scatterplot where the simulation results
are most concentrated. Such a point would be more likely than any other cost/date combination that provides the
desired level of confidence. If the scatterplot were viewed as a 3-dimensional ridge of possible results, this point
would be the one on the “necklace” of connected dots, each being a combination of cost and finish date with the
desired joint result. At this point, the choice of a particular JCL combination of cost and finish dates is judgmental
to some extent. While there is some level of uncertainty with choosing a single, most likely JCL point, some uses,
including reports to Congress for funding or to the Board of Directors, might require more precision in this choice’s
values. There are ways to make this selection less judgmental for those purposes needing more precision. [24]
3. CONCLUSION
In this recommended practice the levels of risk analysis maturity from “no awareness” to “fully integrated cost-
schedule risk analysis” are described, including the required capabilities, benefits and strengths, and weaknesses at
a general level. The main inputs and outputs at Levels 2-5 are illustrated.
Table 2 is shown below for the main characteristics of risk maturity levels. Note that only at maturity Levels 4 and 5
do these methodologies match AACE International’s first principles of Recommended Practice 40R-08, Contingency
Estimating – General Principles, of “starts with identifying risk drivers,” “links risk drivers and cost/schedule
outcomes,” “employs empiricism” and “experience/competency.” [3] The levels in this maturity model generally
apply to project schedules with Class 3, 2, or 1 plan maturity [5]. Parametric models are suitable for projects that
have cost estimate maturity levels at Class 4 or Class 5. [7]
REFERENCES
[1] H. L. Stephenson, Ed., Total Cost Management Framework: An Integrated Approach to Portfolio, Program
and Project Management, 2nd ed., Morgantown, WV: AACE International, 2015.
[2] D. T. Hulett, "Journey Map to a More Mature Schedule Risk Analysis (SRA) Process," Cost Engineering, vol. 61,
no. 02, 2019.
[3] AACE International, Recommended Practice No. 40R-08, Contingency Estimating – General Principles,
Morgantown, WV: AACE International, Latest revision.
[4] AACE International, Recommended Practice No. 27R-03, Schedule CLassification System, Morgantown, WV:
AACE International, Latest revision.
[5] AACE International, Recommended Practice No. 57R-09, Integrated Cost and Schedule Risk Analysis Using
Monte Carlo Simulation of a CPM Model, Morgantown, WV: AACE International, Latest revision.
[6] AACE International, "Recommended Practice No. 122R-22, Quantitative Risk Analysis Maturity Model," AACE
International, Fairmont, WV, USA, Latest Revision.
[7] AACE International, "Recommended Practice No. 10S-90, Cost Engineering Terminology," AACE International,
Morgantown, WV, Latest revision.
[8] D. Hillson, Effective Opportunity Management for Projects: Exploiting Positive Risk, CRC Press, 2004.
[9] AACE International, Recommended Practice No. 114R-20, Project Historical Database Development,
Morgantown, WV: AACE International, Latest revision.
[10] AACE International, Recommended Practice No. 41R-08, Understanding Estimate Ranging, Morgantown, WV:
AACE International, Latest revision.
[11] AACE International, Recommended Practice No. 66R-11, Selecting Probability Distribution Functions for Use
in Cost and Schedule Risk Simulation Models, Morgantown, WV: AACE International, Latest revision.
[12] US Government Accounting Office (GAO), "Schedule Assessment Guide: Best Practices for Project Schedules,
GAO-16-89G," US Government Accounting Office (GAO), Washington, 2015.
[13] D. T. Hulett, Practical Schedule Risk Analysis, Gower Publishing Limited, 2009.
[14] D. T. Hulett, Integrated Cost-Schedule Risk Analysis, Gower Publishing Limited, 2011.
[15] J. K. Hollmann, "(RISK-1027) Estimate Accuracy: Dealing with Reality," in AACE International Transactions,
2012.
[16] J. K. Hollmann, Project Risk Quantification, Sugarland, TX: Probabilistic Publishing, 2016.
[17] S. Book, "A Theory of Modeling Correlations for Use in Cost-Risk Analysis," in Third Annual Project
Management Conference, Galveston, 2006.
[18] E. Druker, G. Gilmer and D. Hulett, "(RISK-1662) Using Stochastic Optimization to Improve Risk Mitigation," in
AACE International Transactions, Morgantown, 2014.
[19] W. T. Whitehead and D. T. Hulett, "(RISK-4401) Assessing Proposed Risk Mitigation Actions Using Mitigation
Scoring," in AACE International Transactions, Atlanta, GA, 2024.
[20] US DOE/EIA, "Annual Report to Congress, Volume III, Rep. No. DOE/EIA-0173(79)/3," GPO, Washington DC,
1979.
[21] A. Tversky and D. Kahneman, "Judgement Under Uncertainty: Heuristics and Biases," Science, vol. 185, no.
4157, 1974.
[22] National Aeronautics and Space Administration, "Appendix J: Joint Cost and Schedule Level (JCL) Analysis," in
NASA Cost Estimating Handbook, 2015.
[23] B. Bitten, B. Kellogg, E. Mahr, S. Lang, D. Emmons and C. Hunt, "The Effect of Policy Changes on NASA Science
Mission Cost & Schedule Growth," Presented at the NASA Cost & Schedule Symposium 14 August 2018.
[24] S. Steiman and D. T. Hulett, "Identifying the Most Probable Cost – Schedule Values from a Joint Confidence
Level (JCL) Risk Analysis," Cost Engineering, vol. 62, no. 04, 2020.
[25] AACE International, "Recommended Practice No. 117R-21, Integrated Cost and Schedule Risk Analysis and
Contingency Determination Using a Hybrid Parametric and CPM Method," AACE International, Morgantown
WV, Latest revision.
[26] B. Flyvberg, "Quality control and due diligence in project management: Getting decisions right by taking the
outside view," International Journal of Project Management, vol. 31, no. 5, pp. 760-774, 2013.
[27] K. MacCrimmon and C. A. Ryavec, "An Analytical Study of the PERT Assumptions," The Rand Corporation,
1962.
CONTRIBUTORS
Disclaimer: The content provided by the contributors to this recommended practice is their own and does not
necessarily reflect that of their employers unless otherwise stated.