“Bad weather may impact the project.” This is the kind of risk statement that destroys Monte Carlo outputs before the simulation even runs. It is not quantifiable. It is not assignable. It has no clear impact.
This guide shows you how to write risk statements that are quantifiable, defensible, and immediately useful for QSRA, QCRA, and integrated JCL models — using the IQRM WHY / WHAT / HOW framework.
Every risk statement must answer three questions — WHY it might happen (cause), WHAT it would be (event), and HOW it would hurt the project (impact).
The WHY / WHAT / HOW framework
WHY — the cause (an existing condition)
A risk doesn't appear out of thin air. There is always a cause — a condition that already exists today. Start your sentence with “Because of…”. If you can't, you're not describing a risk.
Example: “Because the procurement plan relies on a single LSTK contractor for the long-lead reactor…”
WHAT — the uncertain event
The event itself. Start with “there is a risk that…”. This is the uncertain future. It might or might not happen.
Example: “…there is a risk that the contractor declines or delays award by more than 8 weeks…”
HOW — the impact
How does this hurt the project? Quantifiable in cost, schedule, scope, quality, or HSE. Start with “resulting in…”.
Example: “…resulting in 2–10 weeks delay to FEED completion and £0.5M–£2.2M additional rebid cost.”
Before & after examples
| Weak (unquantifiable) | Strong (WHY / WHAT / HOW) |
|---|---|
| “Weather may delay piling.” | “Because piling is planned through the GCC summer (June–Aug), there is a risk that heat-stress shutdowns reduce productivity by 20–40%, resulting in 2–6 weeks delay to the piling milestone.” |
| “Material costs may rise.” | “Because steel prices are tracking +12% YoY with high volatility, there is a risk that the rebar package escalates 8–25% above tender rates, resulting in £0.8M–£2.5M cost impact.” |
| “Permits may take time.” | “Because the environmental permit submission depends on third-party hydrology data with a 6-month turnaround, there is a risk the permit is issued 3–9 months later than baseline, resulting in start-of-construction slip of 3–9 months.” |
Why this matters for QSRA, QCRA & RDE™
A Monte Carlo model can only quantify what is quantifiable. Vague statements like “weather may impact” can't be assigned probability or impact ranges — they end up either ignored or buried in a generic “general uncertainty” line that nobody trusts.
WHY/WHAT/HOW statements lock down what's being modelled. They also surface the cause, which is what your response strategy must address.
This same discipline underpins IQRM's Risk Data Engine™ (RDE™). RDE™ matches your project's risk causes against historical project outcomes — but only if those causes are written precisely. Vague statements break the empirical link.
Common pitfalls to avoid
- Listing the impact as the risk. “Cost overrun” is not a risk — it's the consequence of many risks.
- Listing the cause as the risk. “Unstable steel prices” is the condition. The risk is what happens because of it.
- Compound risks. If a statement contains “and/or” multiple events, split it into separate risks.
- Risks without owners. A risk without an owner won't be managed — and won't be updated as it evolves.
Frequently asked questions
How many risks should a register have?
Quality over quantity. 30–80 well-written risks usually outperform 200+ vague ones. The QSRA/QCRA tail is driven by 10–15 critical risks anyway.
Should opportunities use the same framework?
Yes — WHY/WHAT/HOW works equally well for opportunities. The “HOW” becomes a positive impact (cost saving or schedule acceleration).
Where do correlations get captured?
Not in the statement itself — but the WHY column lets you see common causes (e.g. “commodity price volatility”) that imply correlation between risks.
Train your team in WHY / WHAT / HOW
The QRM Professional Programme dedicates a full module to risk identification & quantification using IQRM's signature framework.
Explore the Programme →Related: Quantitative Risk Register · What is QCRA? · QSRA Explained
