Project AssureA design approval comes in late. The late approval holds up a long-lead order, the late order forces the site works to be resequenced, and the resequencing adds delay and overhead cost. On site, these four risks tend to happen together. In the risk register, they are four rows, each scored as if the other three did not exist.
Nothing on those rows is wrong. The register is incomplete: it lists the risks but not how strongly they move together. Totals add up as if every risk were independent, and mitigation is spread row by row.
Why does a risk register understate correlated risks?
A register scores likelihood and impact one row at a time. When it feeds a Monte Carlo model, each risk is sampled on its own unless the model is told otherwise, so the model assumes that a bad outcome on one risk says nothing about the next. Real projects do not behave that way. Drivers upstream, such as design maturity and approvals, affect many scope risks tied to work packages, and accumulators at the end, such as delay and overheads, collect cost from all of them. When one goes wrong, the others usually follow.
Our quantitative schedule and cost risk analysis (QSRA and QCRA) already applies correlation between related activities and cost lines. Dependency-aware analysis applies the same discipline to the risk events themselves: a correlation coefficient for each pair of risks that tend to occur together. Leaving it out understates the numbers a board relies on most:
- Contingency is too thin. The P80 sets the commitment and the contingency. An uncorrelated run assumes bad outcomes cancel out, so it rarely shows several risks landing at once.
- The stress case is understated. The P90 that boards and lenders test is where correlated risks stack up most.
- Mitigation is spread thin. Without coefficients every row looks equally worth treating, so the budget goes everywhere instead of to the few risks at the centre of each cluster.
How does the framework work?
It keeps the workshops, the register and the Monte Carlo runs, and adds one number for each related pair of risks: a correlation coefficient. The coefficient runs from 0, where two risks are unrelated, to 1, where they always occur together. A coefficient of 0.7 between a late design approval and a slipped long-lead order says that when one goes wrong in a run, the other very often goes wrong too. Negative coefficients are possible but rare for project risks.
Correlation does not change how often each risk occurs. It changes how often risks occur together, and that is what drives the tail.
Five steps do the work. Each answers one question a board or lender will ask.
- Map. Sort the risks into drivers, scope risks and accumulators, and mark which risks tend to occur together, and why.
- Score. Set each risk's chance and three-point cost. Score each likelihood as its total chance, including the times other risks set it off, and state that basis.
- Correlate. Set a coefficient from 0 to 1 for each related pair. Evidence it from comparable projects and audits, not a workshop vote, and check that the full set forms a consistent correlation matrix.
- Price. Run the same model twice, uncorrelated and correlated, and report the gap at P50, P80 and P90.
- Target. Set each risk's coefficients to zero in turn, rerun, and fund the short list that moves the gap most.
Step 2 is where most surprises hide. A coefficient will not raise a likelihood that was scored too low. If a risk is usually set off by others, its likelihood must already include those occasions; the coefficient then adds only the clustering.
How do you price the dependency gap?
Run one Monte Carlo with every coefficient at zero, so each risk is sampled on its own. Run it again with the same model, ranges and seed, with the coefficients applied. The difference at a confidence level is the dependency gap. Report it at every level the project commits to, not only at the P90. P50 vs P80 explains what each level should govern.
| Level | What it sets | What a gap here means |
|---|---|---|
| P50 | Working programme and target cost | Usually small. Correlation leaves each risk's own chance unchanged, so the middle of the curve barely moves. |
| P80 | Contractual commitment, contingency and drawdown | Contingency is too thin for risks that arrive together. |
| P90 | Stress case for boards and lenders | The exposure a funder sees is understated, most of all where correlated risks stack up. |
Correlation leaves each risk's own chance where it is, so the average outcome barely moves. What changes is the spread.
- Good runs get better and bad runs get worse. Correlated risks either stay away together or arrive together. The curve flattens: it crosses the uncorrelated curve near the middle and pulls away from it towards P90.
- The gap grows with confidence. Little change at P50, a clear gap at P80 and the largest gap at P90. That is the contingency an uncorrelated model leaves out.
If the gap at P50 is large, check the model before reporting it. Correlation on its own moves the middle of the curve very little, so a large shift there usually points to a change in ranges, likelihoods or logic between the two runs.
The register is the starting point, not the problem. What it lacks is how strongly its rows move together.
Where should mitigation money go?
Test every risk in the model. Set its coefficients to zero, keep its own chance, rerun, and measure the fall in the gap at P80 and P90. Most risks barely move the result. A few move it a lot, usually the drivers at the centre of a cluster.
Fund that short list first: three to five risks, each with an owner, an action and a date. Treating a shared cause, such as design maturity or an approvals backlog, can lower several coefficients at once. Where several risks sit close together in the ranking, fund the group, and rerun the test whenever a risk occurs or is treated.
Where does it fit in QSRA and QCRA?
No new process is needed. The workshop gains one question: which risks tend to occur together, and how strongly? The register gains a coefficient for each related pair and a stated scoring basis. The Monte Carlo gains one extra run. P80 and P90 are then set from the correlated run, and the gap is held as an owned risk budget alongside the contingency.
Run it where commitments are made: at bid, at sanction, at baseline and before a major re-plan.
Five questions to ask of any risk model
- Were likelihoods scored as total chances, on a stated basis?
- Does the register record which risks are correlated, with a coefficient for each pair?
- Are the coefficients evidenced from comparable projects, not opinion?
- Is the gap reported at P50, P80 and P90, with and without correlation?
- Is mitigation funded on the short list of risks that move the gap?
A model that answers all five can be defended to a board, a lender or the other side.
What this framework does not claim
It sharpens judgement on how risks move together. It does not replace evidence, or the people who know the site.
- Correlation is not cause. A coefficient says two risks move together, not which one sets off the other. The mitigation test, not the coefficient, shows where to act.
- Coefficients need evidence. Without comparable-project data behind them, the gap is only as good as the guess.
- The scoring basis still matters. Correlation does not raise any risk's own chance. Likelihoods scored too low stay too low.
- Test against outturn. Where project history exists, compare how often risks actually occurred together with the coefficients used, and recalibrate.
Examples and coefficients are illustrative. This article is for general information and is not advice on any specific project, contract or investment.
