1 Into the Unknown: An Introduction to Project Risk Analysis

“In preparing for battle I have always found that plans are useless, but planning is indispensable.” — Dwight D. Eisenhower

Every project estimate is really a best guess. Your team genuinely believes the schedule when they write it, and that’s the right attitude to have. But once the project starts, reality has a way of offering its own revisions. Materials arrive late. Scope grows. That team member who was penciled in for three concurrent tasks runs into the usual constraints of time and bandwidth.

This is where quantitative methods come in.

1.1 What Is Project Risk?

Risk, in the technical sense, is uncertainty that matters. Not all uncertainty is risk; we don’t worry about the exact number of paperclips in the supply closet, but uncertainty about task durations, resource availability, weather, regulatory approvals, and supplier performance absolutely is. Risk has two components:

Probability: How likely is this uncertain event to occur?
Impact: If it does occur, how much does it affect cost or schedule?

Traditional project management often handles risk qualitatively: a risk register with “High / Medium / Low” likelihood and impact ratings, maybe a $10\%$ contingency tacked onto the budget because that’s what was done last time. This approach is comfortable, but it lacks precision. It cannot tell you whether your P80 schedule estimate is 3 weeks or 3 months above the base estimate. It cannot tell you which risk deserves the most mitigation dollars.

Quantitative risk analysis, the subject of this book, can.

1.2 The Quantitative Toolkit

The PRA package provides a collection of methods that complement each other. Think of them as different lenses on the same project:

Chapter	Method	What it answers
Chapter 2	Monte Carlo Simulation	What is the full distribution of possible outcomes?
Chapter 3	Second Moment Method	What are the mean and variance quickly, analytically?
Chapter 4	Sensitivity Analysis	Which task drives the most variance?
Chapter 5	Earned Value Management	How is the project actually performing right now?
Chapter 6	Bayesian Inference	How should I update my risk estimate given new evidence?
Chapter 7	Learning Curves	When will the team reach full productivity?
Chapter 8	Design Structure Matrices	Which tasks are most tightly coupled through shared resources?
Chapter 9	Probabilistic Networks	How do risks propagate through the project?
Chapter 10	Portfolio Networks	How do shared risks affect multiple projects at once?
Chapter 11	Agentic Risk Analysis	Can I just ask an AI to run all of this?

These methods are not competing alternatives; they are a progression. You might use the Second Moment Method for a quick back-of-the-envelope estimate, then Monte Carlo for the formal risk report, and a Bayesian network when you need to understand how one risk cascades into others.

1.3 How to Navigate This Book

Each chapter is self-contained; feel free to jump to the method you need. That said, there are natural dependencies: Monte Carlo (Chapter 2) and the Second Moment Method (Chapter 3) build on the same uncertainty concepts; probabilistic networks (Chapter 9, Chapter 10) extend Bayesian inference (Chapter 6); and the agent chapter (Chapter 11) assumes familiarity with all prior methods.

Your situation	Start here
Building an initial schedule or cost estimate	Chapter 2 or Chapter 3
Project underway; need to assess performance	Chapter 5
New information arrived; want to update risk estimates	Chapter 6
Tasks keep failing together; want to understand why	Chapter 8 or Chapter 9
Managing a portfolio of projects with shared resources	Chapter 10
Forecasting when the team will reach full productivity	Chapter 7
Want AI-assisted analysis without writing code every time	Chapter 11

1.4 A Map of the Methods

1.4.1 Early Estimation

When you are building the initial project estimate, you have distributions but no data yet. The Second Moment Method (Chapter Chapter 3) and Monte Carlo Simulation (Chapter Chapter 2) are your tools here. SMM is fast and analytical, giving you a mean and variance in seconds using only the mean and variance of each task. MCS is slower but more powerful, able to use any distribution shape and handling correlations between tasks.

1.4.2 During Execution

Once the project is underway and you have actual cost and schedule data, Earned Value Management (Chapter Chapter 5) tracks how the project is performing against the plan. EVM’s performance indices (CPI, SPI) are early-warning signals: if your Cost Performance Index drops below 1.0 in period 3, you want to know what the final cost forecast looks like before it becomes a surprise in period 10.

1.4.3 As Evidence Arrives

Bayesian Inference (Chapter Chapter 6) lets you update your risk estimates as you learn more about the project environment. Observed that a key supplier is struggling? Update your material cost distribution accordingly. This is particularly powerful in phased projects where information accumulates progressively.

1.4.4 Understanding Structure

Design Structure Matrices (Chapter Chapter 8) and Probabilistic Networks (Chapters Chapter 9 and Chapter 10) address the question of why risks correlate. When two tasks both depend on the same crew, a labor shortage affects them both simultaneously. These methods make that structure explicit and quantifiable. Learning Curves (Chapter Chapter 7) capture a different kind of structure: how a team’s productivity evolves over time.

1.4.5 AI-Assisted Analysis

Chapter Chapter 11 introduces the PRA agentic framework: slash commands for instant deterministic analysis, a chat interface powered by a local or cloud LLM, and an MCP server that lets tools like Claude Code call PRA functions directly. Think of it as having a risk analyst on call who always has the EVM formulas at hand.

1.5 Installing the Package

install.packages("PRA")

Or the development version:

remotes::install_github("paulgovan/PRA")

Load it in any session:

library(PRA)

1.6 A Note on Uncertainty About Uncertainty

Garbage In, Garbage Out

Quantitative risk analysis can give a false sense of precision. The output of a Monte Carlo simulation, “P95 = 47.3 weeks”, sounds authoritative. But that number is only as good as the distributions you fed it.

The skill is not in running the software. The skill is in:

Choosing distributions that honestly represent what you know and don’t know
Identifying correlations that actually exist in your project
Communicating results in a way that drives good decisions rather than false confidence

Every chapter in this book includes exercises that push you to think critically about these choices, not just to run the code, but to question whether the inputs are defensible.

With that caveat in mind, let’s run some simulations.

# Into the Unknown: An Introduction to Project Risk Analysis {#sec-intro} > *"In preparing for battle I have always found that plans are useless, but planning is indispensable."* > — Dwight D. Eisenhower Every project estimate is really a best guess. Your team genuinely believes the schedule when they write it, and that's the right attitude to have. But once the project starts, reality has a way of offering its own revisions. Materials arrive late. Scope grows. That team member who was penciled in for three concurrent tasks runs into the usual constraints of time and bandwidth. This is where quantitative methods come in. ## What Is Project Risk? Risk, in the technical sense, is uncertainty that matters. Not all uncertainty is risk; we don't worry about the exact number of paperclips in the supply closet, but uncertainty about task durations, resource availability, weather, regulatory approvals, and supplier performance absolutely is. Risk has two components: 1. **Probability**: How likely is this uncertain event to occur? 2. **Impact**: If it does occur, how much does it affect cost or schedule? Traditional project management often handles risk qualitatively: a risk register with "High / Medium / Low" likelihood and impact ratings, maybe a $10\%$ contingency tacked onto the budget because that's what was done last time. This approach is comfortable, but it lacks precision. It cannot tell you whether your P80 schedule estimate is 3 weeks or 3 months above the base estimate. It cannot tell you which risk deserves the most mitigation dollars. Quantitative risk analysis, the subject of this book, can. ## The Quantitative Toolkit The `PRA` package provides a collection of methods that complement each other. Think of them as different lenses on the same project: | Chapter | Method | What it answers | |---------|--------|----------------| | @sec-mcs | Monte Carlo Simulation | What is the full distribution of possible outcomes? | | @sec-smm | Second Moment Method | What are the mean and variance quickly, analytically? | | @sec-sensitivity | Sensitivity Analysis | Which task drives the most variance? | | @sec-evm | Earned Value Management | How is the project actually performing right now? | | @sec-bayes | Bayesian Inference | How should I update my risk estimate given new evidence? | | @sec-sigmoidal | Learning Curves | When will the team reach full productivity? | | @sec-dsm | Design Structure Matrices | Which tasks are most tightly coupled through shared resources? | | @sec-network | Probabilistic Networks | How do risks propagate through the project? | | @sec-network2 | Portfolio Networks | How do shared risks affect multiple projects at once? | | @sec-agent | Agentic Risk Analysis | Can I just ask an AI to run all of this? | These methods are not competing alternatives; they are a progression. You might use the Second Moment Method for a quick back-of-the-envelope estimate, then Monte Carlo for the formal risk report, and a Bayesian network when you need to understand how one risk cascades into others. ## How to Navigate This Book Each chapter is self-contained; feel free to jump to the method you need. That said, there are natural dependencies: Monte Carlo (@sec-mcs) and the Second Moment Method (@sec-smm) build on the same uncertainty concepts; probabilistic networks (@sec-network, @sec-network2) extend Bayesian inference (@sec-bayes); and the agent chapter (@sec-agent) assumes familiarity with all prior methods. | Your situation | Start here | |---------------|-----------| | Building an initial schedule or cost estimate | @sec-mcs or @sec-smm | | Project underway; need to assess performance | @sec-evm | | New information arrived; want to update risk estimates | @sec-bayes | | Tasks keep failing together; want to understand why | @sec-dsm or @sec-network | | Managing a portfolio of projects with shared resources | @sec-network2 | | Forecasting when the team will reach full productivity | @sec-sigmoidal | | Want AI-assisted analysis without writing code every time | @sec-agent | ## A Map of the Methods ### Early Estimation When you are building the initial project estimate, you have distributions but no data yet. The **Second Moment Method** (Chapter @sec-smm) and **Monte Carlo Simulation** (Chapter @sec-mcs) are your tools here. SMM is fast and analytical, giving you a mean and variance in seconds using only the mean and variance of each task. MCS is slower but more powerful, able to use any distribution shape and handling correlations between tasks. ### During Execution Once the project is underway and you have actual cost and schedule data, **Earned Value Management** (Chapter @sec-evm) tracks how the project is performing against the plan. EVM's performance indices (CPI, SPI) are early-warning signals: if your Cost Performance Index drops below 1.0 in period 3, you want to know what the final cost forecast looks like before it becomes a surprise in period 10. ### As Evidence Arrives **Bayesian Inference** (Chapter @sec-bayes) lets you update your risk estimates as you learn more about the project environment. Observed that a key supplier is struggling? Update your material cost distribution accordingly. This is particularly powerful in phased projects where information accumulates progressively. ### Understanding Structure **Design Structure Matrices** (Chapter @sec-dsm) and **Probabilistic Networks** (Chapters @sec-network and @sec-network2) address the question of *why* risks correlate. When two tasks both depend on the same crew, a labor shortage affects them both simultaneously. These methods make that structure explicit and quantifiable. **Learning Curves** (Chapter @sec-sigmoidal) capture a different kind of structure: how a team's productivity evolves over time. ### AI-Assisted Analysis Chapter @sec-agent introduces the `PRA` agentic framework: slash commands for instant deterministic analysis, a chat interface powered by a local or cloud LLM, and an MCP server that lets tools like Claude Code call `PRA` functions directly. Think of it as having a risk analyst on call who always has the EVM formulas at hand. ## Installing the Package ```{r} #| eval: false install.packages("PRA") ``` Or the development version: ```{r} #| eval: false remotes::install_github("paulgovan/PRA") ``` Load it in any session: ```{r} library(PRA) ``` ## A Note on Uncertainty About Uncertainty ::: {.callout-warning} ## Garbage In, Garbage Out Quantitative risk analysis can give a false sense of precision. The output of a Monte Carlo simulation, "P95 = 47.3 weeks", sounds authoritative. But that number is only as good as the distributions you fed it. The skill is not in running the software. The skill is in: 1. **Choosing distributions** that honestly represent what you know and don't know 2. **Identifying correlations** that actually exist in your project 3. **Communicating results** in a way that drives good decisions rather than false confidence Every chapter in this book includes exercises that push you to think critically about these choices, not just to run the code, but to question whether the inputs are defensible. ::: With that caveat in mind, let's run some simulations.