Project AssureP50 vs P80: how to set a defensible completion date
A single completion date is a fiction. How QSRA turns P50, P80 and P90 into decisions on the working programme, commitment and contingency.
Read
Risk Management
Name the risk. Price the uncertainty.
We run risk management as a working control, not a compliance file. Risks are surfaced in facilitated workshops, scored on a 5x5 matrix and owned in a live register. Where the decision warrants it, we model the register against the programme and the estimate to give P50, P80 and P90 positions that a board, funder or bid committee can act on.
Identify. Quantify. Decide.
In brief
What is risk management?
Project risk management is the structured process of identifying, assessing, treating and monitoring uncertain events that could change a project's time, cost or performance. On major projects it combines facilitated workshops, a scored and owned risk register, and quantitative schedule and cost risk analysis that turns the register into P50, P80 and P90 completion dates and contingency.
What we deliver
Risk Management services
- Risk identification workshopsFacilitated sessions with owner, designer and contractor that capture threats and opportunities against a defined scope, programme and contract.
- Risk register set-up and managementA register with causes, owners, responses and trigger dates, scored on a 5x5 matrix and reviewed on a monthly cycle.
- Quantitative schedule risk analysis (QSRA)Monte Carlo simulation of the logic-linked programme, with uncertainty ranges, risk events and correlation, giving P50, P80 and P90 dates.
- Quantitative cost risk analysis (QCRA)Cost uncertainty and risk events modelled against the estimate, so contingency is set at a stated confidence level, not a flat percentage.
- Design-readiness and approval risk driversDesign maturity, authority approvals and permit lead times modelled as drivers, because that is where most programme slippage starts.
- Contingency setting and drawdown rulesThe gap between P50 and P80 held as an owned risk budget, with drawdown rules and monthly reporting against it.
- Bid and tender risk reviewProgramme commitments, risk allocation and pricing stress-tested before submission, so the tender does not promise what the risk profile cannot support.
- Board and funder risk reportingShort, decision-led reports: top risks, trend, response status and probabilistic position, written for boards, lenders and bid committees.
Method
The 5x5 likelihood and impact matrix
Likelihood
5
10
15
20
25
4
8
12
16
20
3
6
9
12
15
2
4
6
8
10
1
2
3
4
5
Impact →
Low · 1-4Accept and monitor
Moderate · 5-9Treat within the project team
High · 10-16Active response, reported to the project board
Critical · 17-25Immediate escalation to the sponsor
Score likelihood x impactEach risk is rated 1 to 5 for likelihood and 1 to 5 for impact on time, cost or performance. The score is the product, from 1 to 25. Impact scales are calibrated to the project's own budget, programme float and contractual thresholds, not borrowed from a template.
Quantify the top of the matrixHigh and Critical risks, plus the main duration and cost uncertainties, feed a Monte Carlo model with correlation applied. P50 sets the working programme, P80 the commitment and contingency, P90 the stress case for funders.
Scope
One office, four disciplines.
01Risk workshops and identificationStructured, facilitated sessions that draw out threats and opportunities from the people closest to the work, tested against scope, programme, contract and interfaces.
02Live risk registerA live register with causes, owners, responses, trigger dates and 5x5 scores, run on a monthly cycle and reported against trend, not just status.
Risk Management
03Monte Carlo schedule risk (QSRA)Monte Carlo simulation of the logic-linked programme, with uncertainty, discrete risk events and correlation, producing P50, P80 and P90 completion dates.
04Contingency and cost risk (QCRA)Monte Carlo simulation of the estimate, integrated with the schedule where time-dependent costs matter, to set contingency at a stated confidence level.
Assessment
The likelihood scale we use.
| Score | Label | Guide |
|---|---|---|
| 1 | Rare | Under 10% |
| 2 | Unlikely | 10% to 30% |
| 3 | Possible | 30% to 50% |
| 4 | Likely | 50% to 70% |
| 5 | Almost certain | Over 70% |
Impact is scored 1 (Negligible) to 5 (Severe) on time, cost and performance, with thresholds calibrated per project to budget, programme float and contractual limits such as delay damages.
Quantitative risk analysis
Monte Carlo, built on a sound network.
Inputs
- Three-point duration and cost ranges
- Discrete risk events with probability and impact
- Correlation between related activities and cost lines
- Design-readiness and authority-approval risk drivers
Distributions
- Triangular
- PERT
- Uniform
- Lognormal
Outputs
- P50: Working programme and target cost
- P80: Contractual commitment, contingency and drawdown rules
- P90: Stress case for boards and lenders
Supporting outputs
- Exceedance (S) curves
- Tornado sensitivity charts
- Criticality index by activity
- Contingency drawdown tracker
Standards and practice
The standards we work to
International
- ISO 31000:2018, Risk management: Guidelines
- IEC 31010:2019, Risk management: Risk assessment techniques
- AACE International Recommended Practice 57R-09, Integrated Cost and Schedule Risk Analysis Using Risk Drivers and Monte Carlo Simulation of a CPM Model
- AACE International Recommended Practice 40R-08, Contingency Estimating: General Principles
- AACE International Recommended Practice 41R-08, Understanding Estimate Ranging (retitled in 2021; formerly Risk Analysis and Contingency Determination Using Range Estimating)
- PMI, The Standard for Risk Management in Portfolios, Programs, and Projects (2019), the update of the Practice Standard for Project Risk Management (2009)
- FIDIC Conditions of Contract for EPC/Turnkey Projects (Silver Book), 1999 and 2017 editions
India
- IS/ISO 31000:2018, Risk management: Guidelines (BIS adoption of ISO 31000)
- Companies Act, 2013, section 134(3)(n): statement in the board's report on the development and implementation of a risk management policy
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, Regulation 21: risk management committee for the top 1,000 listed entities
GCC
- UAE (Abu Dhabi): Law No. 2 of 2019 regulating partnerships between the public and private sectors, administered by ADIO
- UAE (Dubai): Law No. 22 of 2015 regulating partnership between the public and private sectors
- Saudi Arabia: Government Tenders and Procurement Law, Royal Decree M/128 (2019), in force until the new law takes effect. Works and purchases tendered under it remain governed by it, although the Minister of Finance may apply selected provisions of the new law to them
- Saudi Arabia: Government Tenders and Procurement Law, Royal Decree M/76 dated 27/2/1448H (10 August 2026), published in the Umm Al-Qura Official Gazette on 4 September 2026, which takes effect 120 days after publication (Article 101), by simple count 2 January 2027
- Saudi Arabia: Private Sector Participation Law, Royal Decree M/63 (2021)
- Oman: Public-Private Partnership Law, Royal Decree 52/2019
- Oman: Sector Law, Royal Decree 78/2004, for power and water IPPs
Regional practice
Risk Management in India and the GCC
India
Listed companies must describe their risk management policy in the board's report under section 134(3)(n) of the Companies Act, 2013, and the top 1,000 listed entities must run a risk management committee under SEBI LODR Regulation 21. On public and multilateral-funded programmes, environmental assessments and regulatory approvals often sit on the critical path, as they did on the World Bank Tawi River programme, so we model them as risk drivers rather than fixed durations.
United Arab Emirates
PPP projects are regulated emirate by emirate: Abu Dhabi under Law No. 2 of 2019, administered by ADIO, and Dubai under Law No. 22 of 2015. Most contracts use FIDIC forms with heavily amended particular conditions, so the register must follow the risk allocation actually signed, not the standard form. Authority approvals, utility connections and design readiness belong in the model as discrete risk drivers.
Saudi Arabia
PPP and privatisation projects fall under the Private Sector Participation Law (Royal Decree M/63, 2021), with the National Center for Privatization & PPP structuring projects. Under Saudi Arabia's new Government Tenders and Procurement Law, the Article 67 change-order limits of 10% for new items and 20% in total belong in the risk register, and although the maximum delay penalty on works contracts falls to 15%, price adjustment is still limited to the three Article 66 triggers, so material price, tax and unforeseeable physical risks should still be priced and registered explicitly. Each of these laws sets how much variation, delay and funding risk each party carries, so registers and cost models should be checked against the law that governs the contract. See what the new procurement law changes.
Oman
Power and water IPPs, including Oman's first utility-scale waste-to-energy project at Barka, are procured by Nama Power and Water Procurement Company under the Sector Law (Royal Decree 78/2004). Other long-term concessions fall under the Public-Private Partnership Law (Royal Decree 52/2019). On the Barka waste-to-energy bid, where tender commitments would set obligations for 25 years, we stress-tested the bid programme against design and permit lead times and reviewed risk allocation against the FIDIC Silver Book.
Our approach
How we approach risk management
We treat the risk register as a decision tool, not a compliance record. Every High and Critical risk has an owner, a response and a cost, and the Monte Carlo model is built from the same register, so every number the board sees traces back to a named risk. We bind each percentile to an action: P50 drives the working programme, P80 the commitment and contingency, and the gap between them is held and reported like money.
Experience
Related projects
Barka waste-to-energy IPP
Bid assurance on a waste-to-energy bid whose tender commitments would bind for 25 years.
- Bid programme stress-tested against design and permit lead times
- Risk allocation reviewed against FIDIC Silver Book
- Commercially defensible position established
World Bank · Tawi River
Programme assurance where approvals sat on the critical path but were never modelled.
- Approval dependencies mapped
- Baseline revised to realistic timelines
- P50 and P80 scenarios for funder reporting
Etihad Rail Stage 2 & 3
Independent systems assurance across a complex multi-contract programme.
- Systems assurance framework established
- Design stage-gate assessment integrated
- Assurance deliverables through construction and commissioning
Insights
Further reading
Bid and tender programme assurance: stress-testing a schedule before you sign
Stress-test your tender programme before you sign. Independent bid schedule review that exposes optimism, lead-time and FIDIC risk before it becomes a dispute.
ReadDCMA 14-Point Assessment explained · with a worked P6 example
What the DCMA 14-point schedule assessment checks, why BEI and CPLI matter, and a worked Primavera P6 example of a failing programme.
ReadFAQ
Risk Management: common questions
What is the difference between qualitative and quantitative risk analysis?
Qualitative analysis ranks risks; quantitative analysis measures their combined effect. The 5x5 matrix tells you which risks deserve attention first. A Monte Carlo model then runs those risks and the underlying uncertainty through the programme and estimate thousands of times, giving a probability of finishing by a date or within a budget. Most projects need both, in that order.
When is a quantitative schedule risk analysis (QSRA) worth doing?
A QSRA is worth doing when a date or a contingency figure is about to be committed: at bid, at sanction, at baseline and before a major re-plan. It needs a logic-linked programme that passes basic quality checks, because Monte Carlo on a schedule with missing logic or hard constraints produces confident nonsense. We check the schedule before we model it.
How do you choose between P50, P80 and P90?
Choose by the decision, not by habit. P50 is a fair working target with an even chance of being beaten. P80 suits contractual commitments and contingency, because it covers most adverse outcomes. P90 is a stress case that lenders and boards use to test funding headroom. The gap between P50 and P80 is the risk budget you manage.
Why does correlation matter in a Monte Carlo model?
Without correlation, a Monte Carlo model understates risk. If ground conditions run worse on one foundation package, they usually run worse on the next, and the model has to reflect that. Treating every activity as independent lets good and bad outcomes cancel out, which narrows the spread and makes P80 look closer to P50 than it really is.
How is contingency managed once it has been set?
Contingency is drawn down against named risks, not spent as general float or budget. We agree drawdown rules at the outset: who can release it, against which risk and on what evidence. The model is rerun at agreed intervals, and contingency that is no longer needed is released rather than absorbed by scope growth or weak productivity.
Do Indian listed companies need a formal risk management process?India
Yes, at board level. Section 134(3)(n) of the Companies Act, 2013 requires the board's report to address the company's risk management policy, and SEBI LODR Regulation 21 requires the top 1,000 listed entities to have a risk management committee. A project-level register and quantitative analysis give that committee evidence on capital projects, rather than a list of headline risks.
How should a risk register reflect a UAE construction contract?UAE
It should follow the signed risk allocation, not the standard form. UAE projects commonly use FIDIC with amended particular conditions that move ground, approval or design risk between the parties. We map each register entry to the clause that allocates it, so the register shows which risks you actually carry and which you can price, transfer or claim against.
How does Saudi Arabia's new procurement law affect project risk?Saudi Arabia
It changes variation and delay exposure. Under Article 67 an owner may add new items worth up to 10% of contract value with contractor consent and increase existing items by up to 20%, with consent needed above 10%, within a 20% total cap. The works delay-penalty cap falls from 20% to 15%, so registers should record which law governs each contract.
Can you build a risk-adjusted bid for an Omani PPP or IPP?Oman
Yes. On the Barka waste-to-energy bid we stress-tested the bid programme against design and permit lead times and reviewed risk allocation against the FIDIC Silver Book, because tender commitments would set obligations for 25 years. The same approach, with risk-adjusted P50 and P80 positions where the bid needs them, suits other IPPs procured by Nama PWP and concessions under Oman's PPP Law, Royal Decree 52/2019.
Test the exposure before you commit to it.
Send us the programme, the estimate or the current register. We will tell you where the exposure sits and whether a quantitative analysis is worth running. A principal replies within one working day.