Quantitative Cost Risk Analysis (QCRA) is a Monte Carlo–based modelling technique that converts a deterministic project cost estimate into a probability distribution of possible outcomes. The output: a defensible contingency figure tied to a confidence level (typically P50, P80, or P90) instead of a guess.
If your CFO has ever asked “why are we carrying 15% contingency?” and the answer was “that's what we always do” — QCRA is the discipline you're missing.
QCRA = your cost estimate + risk events + uncertainty ranges, simulated thousands of times in Monte Carlo, to give you a P50 / P80 / P90 cost outcome.
Why QCRA matters in 2026
Three pressures make QCRA non-negotiable on capital projects today:
- Cost overruns are the norm, not the exception. Independent reviews of UK and GCC megaprojects consistently show overruns >30% when contingency is set by gut feel.
- Boards demand defensible numbers. “We used 15%” no longer passes investment committee scrutiny — they want to see the curve.
- Auditors and lenders require P-value reporting. In oil & gas, infrastructure, and government EPC work, QCRA outputs are now part of standard FEL gate evidence.
QCRA vs QSRA vs QRA — what's the difference?
These acronyms confuse even senior risk practitioners. Here's the clean breakdown:
| Acronym | Stands for | What it does |
|---|---|---|
| QRA | Quantitative Risk Analysis | The umbrella discipline. |
| QSRA | Quantitative Schedule Risk Analysis | Full QSRA guide → |
| QCRA | Quantitative Cost Risk Analysis | Monte Carlo on the estimate → final-cost P50/P80. |
| JCL | Runs them together so cost inherits schedule slip risk — the most realistic view. |
The 6 steps of a QCRA
A defensible QCRA follows this sequence:
1. Build a clean cost estimate
Garbage in, garbage out. You need a line-item estimate with clear cost drivers (quantities × unit rates × productivity factors) — not just a top-line “Phase 2 = £48M”.
2. Identify discrete risk events
These are the “if this happens, it adds cost” events from your quantitative risk register. Each has a probability and a cost impact range (min / most likely / max).
3. Quantify continuous uncertainty
Cost rates, productivity, exchange rates, escalation — these don't “happen or not”, they vary continuously. Model them with probability distributions (PERT, triangular, lognormal).
4. Set correlations
If steel prices spike, concrete costs usually move too. Ignoring correlation in Monte Carlo systematically underestimates the upper tail — exactly where overruns live.
5. Run the Monte Carlo simulation
Tools: @Risk, Crystal Ball, Safran Risk (cost module), Argo. Typical run: 10,000+ iterations.
6. Read the S-curve and tornado
The S-curve gives you P50/P80/P90 cost. The tornado chart tells you which risks and uncertainty drivers matter most.
Figure 1 — Sample QCRA cumulative distribution (S-curve). The deterministic estimate typically sits near P30; defensible contingency targets P80.
How big should the contingency be?
The contingency you carry = (target P-value cost) − (deterministic base estimate).
If your base estimate is £44M and the P80 from QCRA is £54M, then £10M (≈23%) is your defensible contingency at P80.
One survives investment committee. The other doesn't.
Where most QCRAs go wrong: the inputs
The biggest failure mode is not the model — it's the inputs. Workshop participants give optimistic 3-point estimates (typically 10–15% range when reality is 30–60%). The simulation then faithfully reproduces this optimism bias.
This is the problem IQRM's Risk Data Engine™ (RDE™) was built to solve. Instead of relying on subjective three-point estimates from workshop fatigue, RDE™ derives empirical distributions from your historical project data — so your QCRA reflects how your projects actually behave, not what people wish they did.
Frequently asked questions
What software is used for QCRA?
The most common platforms are @Risk (Palisade/Lumivero), Crystal Ball, Safran Risk's cost module, and Argo. The choice depends on integration with your estimating workflow and whether you need integrated cost-schedule (JCL).
Is QCRA the same as cost contingency analysis?
QCRA is the method; contingency sizing is one of its outputs. You can also use QCRA outputs for funding decisions, lender stress tests, and bid-price strategy.
What's the difference between QCRA and a sensitivity analysis in Excel?
A sensitivity analysis flexes one variable at a time. QCRA varies all variables simultaneously with their probability distributions and correlations — capturing combined risk that “one-at-a-time” analysis misses.
How long does a QCRA take?
A first pass on a £50M project: 2–4 weeks if your cost estimate is clean and risk register is mature. Most of the time goes into inputs and stakeholder validation, not the simulation itself.
Ready to build QCRA capability in-house?
IQRM's QRM Professional Programme covers QSRA, QCRA, and integrated JCL with hands-on Safran Risk and Argo workshops — built around real UK and GCC EPC and infrastructure case studies.
Explore the Programme →Further reading: QSRA Explained · Monte Carlo for PRM · P50 vs P80 vs P90 · Tornado Charts
