PERT and Monte Carlo Project Risk Analysis

Why This Matters: The Leap from Gut Feeling to Probability Curves

Every project manager faces three inescapable questions: How long will this take? How much will it cost? Will the final product actually work? For centuries, the answers relied on experience, intuition, and hope. The intellectual breakthrough of the modern era — arguably one of the most consequential developments in management science — was the transformation of risk from a matter of fate into a domain that could be studied, quantified, and systematically managed .

In qualitative risk analysis, we assign descriptive ratings like "High" or "Medium" to probability and impact. This is valuable for prioritisation, but it cannot answer the question a defence program director or shipyard production manager actually needs answered: "What is the probability that this project will be delivered within 42 months and under AUD 185 million?"

That question demands quantitative risk analysis (QRA) — the application of numerical techniques to estimate probability distributions for schedule completion, total cost, and performance outcomes. It is the difference between knowing a risk is "likely and high-impact" and knowing there is a 78% probability of completing the project within the approved timeline.

This article traces the evolution of QRA from early 20th-century Gantt charts through PERT and CPM to modern Monte Carlo simulation, and explains the mechanics of how schedule and cost risk analyses are actually performed. If you aspire to manage projects in defence, aerospace, or heavy engineering — where schedule overruns are measured in years and cost blowouts in billions — this is foundational knowledge.

What Is Quantitative Risk Analysis? The Three Pillars

The Triple Constraint Under Uncertainty

Project risk manifests across three interdependent dimensions, each of which can be subjected to quantitative analysis:

Schedule Risk asks: What is the probability that this project will overrun its deadline? The output is a cumulative probability curve showing the likelihood of completion at any given point in time. For example, a schedule risk analysis might reveal that there is only a 50% chance of completing the project in 35 months, an 80% chance of completing it in 42 months, and virtual certainty of completion by 70 months .

Cost Risk asks: What is the probability that this project will exceed its budget? The output is an analogous curve, but with total project cost on the horizontal axis. A cost risk analysis might show an 80% probability that total costs will remain below AUD 280 million, but only a 20% probability of staying within the original AUD 200 million budget.

Performance Risk asks: Will the deliverable meet its technical specifications? Unlike schedule and cost — where generic methods apply across industries — performance risk analysis is tightly coupled to the specific technical domain. A fighter jet's avionics performance risk requires entirely different models than a desalination plant's throughput uncertainty. For this reason, performance risk analysis typically combines quantitative sub-system models with expert judgment for system-level integration .

What the Output Looks Like

The ultimate product of a quantitative schedule or cost risk analysis is a cumulative density function (CDF) — an S-curve that answers the question: "What is the probability that the project will be completed in no more than X months (or cost no more than $Y)?"

These curves evolve over the project lifecycle:

• During planning: Both curves have a gentler slope, reflecting high uncertainty — the range of possible outcomes is wide.
• During execution: Curves shift left or right as risks materialise or are retired, and may steepen as uncertainty narrows.
• Near completion: Curves become steep, approaching a vertical line as the final cost and completion date become known with near-certainty.

Generating these curves rigorously for a large, multi-year defence program is not trivial. The rest of this article traces how the methods to do so were developed.

How We Got Here: A Historical Arc of Quantitative Project Risk Analysis

The Gantt Chart : Visibility Without Probability

The first quantitative technique of modern project management was the Gantt chart, developed by an early industrial planning practitioner in 1917. It provided a graphical summary of project progress by listing tasks vertically and representing the start and duration of each task as a horizontal bar along a time axis. A vertical line marking the current date made it immediately visible which tasks were ahead of or behind schedule .

The Gantt chart's contribution was visibility — but it had a critical limitation for complex projects: it could not easily show task interdependencies. In heavy engineering, many tasks have precedence requirements — you cannot install turbine blades until the rotor assembly is complete, and you cannot test the rotor assembly until the bearings have been fitted and inspected. As the number of tasks grows into the hundreds or thousands, showing these relationships on a Gantt chart becomes impractical.

PERT : Probability Enters the Picture

The breakthrough came with the national naval authority's a large complex development programme in the mid-1950s — a crash effort to develop nuclear submarines capable of launching intercontinental ballistic missiles. The programme director directed his special programme office (special programme office) to survey available project management techniques in American industry. They found almost nothing adequate for the scale and complexity of a large complex development programme.

Within weeks, the special programme office staff and outside contractors developed the Program Evaluation Review Technique (PERT) — a network-based method that represented all anticipated tasks as nodes in a directed graph, with arrows showing precedence relationships. Crucially, PERT introduced probabilistic task durations: planners would elicit three estimates from expert engineers for each task:

• Optimistic (a): The minimum realistic duration
• Most Likely (m): The single best estimate
• Pessimistic (b): The maximum realistic duration

These three values were used to fit a Beta distribution for each task, with the expected duration and variance calculated as:

$$t_e = \frac{a + 4m + b}{6}$$

$$\sigma^2 = \left(\frac{b - a}{6}\right)^2$$

By summing expected durations along the longest path through the network (the critical path) and using the Central Limit Theorem to combine variances, PERT could produce a probability estimate for overall project completion time.

CPM : Deterministic Networks and Resource Optimisation

At roughly the same time, DuPont developed the Critical Path Method (CPM) for construction planning. CPM also used network diagrams but initially dispensed with probabilistic duration estimates — DuPont's construction projects had sufficient historical data that task durations could be estimated deterministically with reasonable accuracy .

The deterministic approach simplified computation enormously and enabled a powerful feature that PERT lacked: systematic resource allocation optimisation. CPM could explore alternative allocations of labour, equipment, and materials to compress the critical path, subject to cost constraints. This "crashing" capability made CPM immediately practical for construction and manufacturing scheduling.

Stochastic CPM and Monte Carlo Simulation (1980s–Present)

As computing power exploded through the 1970s and 1980s, the natural evolution was to combine CPM's network structure with PERT's probabilistic thinking — but to replace PERT's restrictive analytical assumptions with Monte Carlo simulation.

In stochastic CPM, the process works as follows:

1. Build the task network with precedence relationships, just as in deterministic CPM.
2. Assign a probability distribution to each task's duration (not just three points, but a full distribution — triangular, Beta, log-normal, or others as appropriate).
3. Run thousands of simulated "project histories" by randomly sampling a duration for each task from its distribution and computing the resulting project completion time.
4. Aggregate the results across all iterations to produce a probability distribution for total project duration.

This approach also produces a valuable by-product: criticality indices. In a deterministic network, a task is either on the critical path or it is not. In a stochastic network, each task has a probability of being on the critical path — a percentage reflecting how often that task appeared on the longest path across all simulation iterations. A task with a 95% criticality index demands far more management attention than one at 15%, even if neither is always critical.

How Cost Risk Analysis Works: The WBS-Based Approach

From Tasks to Cost Elements

While schedule risk analysis evolved through the PERT/CPM lineage, cost risk analysis developed largely independently, built on the Work Breakdown Structure (WBS).

The WBS decomposes a project into progressively finer levels of components, services, and facilities. WBS-based cost estimation attaches a cost to each element and sums to a total. For quantitative cost risk analysis, the process mirrors the schedule approach:

1. Decompose the project into WBS cost elements at an appropriate level of detail.
2. Assign probability distributions to each cost element (again using expert elicitation, historical data, or parametric models).
3. Run Monte Carlo simulation to produce a probability distribution for total project cost.

The output is a cost CDF — an S-curve showing the probability of completing the project at or below any given total cost.

Cost Estimating Relationships (CERs): The Top-Down Alternative

For projects still in early planning — where the WBS may not yet be sufficiently detailed — analysts often use Cost Estimating Relationships (CERs). These are regression-based models fitted to historical data from similar completed projects, using characteristics like platform type, weight, technology maturity, and program duration as predictors.

For example, a CER for military jet engines might relate unit production cost to thrust-to-weight ratio, turbine inlet temperature, and production quantity, based on a database of historical engine programs . CERs provide a valuable "sanity check" against bottom-up WBS estimates, particularly for novel technology programs where bottom-up data is scarce.

The PERT Three-Point Estimate: Mathematics and Mechanics

The three-point estimation technique, while originating with PERT, remains foundational to both schedule and cost risk analysis today. The earlier process-based project-management guidance recommends it as a standard input to quantitative analysis.

The Formulas

For a task or cost element with optimistic (a), most likely (m), and pessimistic (b) estimates:

PERT-Weighted Expected Value:

$$t_e = \frac{a + 4m + b}{6}$$

Standard Deviation:

$$\sigma = \frac{b - a}{6}$$

Variance:

$$\sigma^2 = \left(\frac{b - a}{6}\right)^2$$

Worked Example: Turbine Blade Machining

Consider a CNC machining work package for turbine blades in a gas turbine overhaul:

• Optimistic (a): 12 weeks (everything goes perfectly — tooling available, no material defects, experienced operators)
• Most Likely (m): 16 weeks (typical performance based on similar jobs)
• Pessimistic (b): 28 weeks (major tooling failure, material supply disruption, or rework due to dimensional non-conformance)

$$t_e = \frac{12 + 4(16) + 28}{6} = \frac{12 + 64 + 28}{6} = \frac{104}{6} \approx 17.3 \text{ weeks}$$

$$\sigma = \frac{28 - 12}{6} = \frac{16}{6} \approx 2.67 \text{ weeks}$$

The expected duration is 17.3 weeks — notably higher than the most likely estimate of 16 weeks, reflecting the asymmetric (right-skewed) distribution of uncertainty. This rightward pull is characteristic of project tasks: there are many more ways things can go wrong than right.

Common Probability Distributions Used in QRA

While PERT assumes a Beta distribution fitted to three points, modern Monte Carlo tools support a wider range:

Putting It Together: The Monte Carlo Simulation Process

Step-by-Step Mechanics

The modern QRA process integrates network scheduling, WBS cost structures, and Monte Carlo simulation into a unified workflow:

Step 1 — Structure the Model. Build the schedule network (for schedule risk) or the WBS cost tree (for cost risk) at an appropriate level of aggregation. Include all precedence relationships, resource constraints, and logical dependencies. Step 2 — Elicit Probability Distributions. For each task duration or cost element, obtain three-point estimates (or full distribution parameters) from subject matter experts. This is typically the most challenging and consequential step — the quality of the entire analysis depends on the quality of the inputs. Step 3 — Specify Correlations. Identify and model dependencies between related tasks or cost elements. For example, if steel prices rise, multiple fabrication cost elements will be affected simultaneously. Ignoring correlations systematically understates total project variance . Step 4 — Run the Simulation. Execute 1,000 to 10,000 iterations. In each iteration, the software samples a random value for each uncertain element from its specified distribution, computes the resulting total project duration or cost, and records the result. Step 5 — Analyse Outputs. Compile the results into a probability distribution (CDF). Extract key statistics: the P50 (median), P80 (often used for contingency planning), P90 (conservative planning), and sensitivity/criticality rankings. Step 6 — Communicate Results. Present the CDF and sensitivity analysis to decision-makers in a format that supports actionable decisions about contingency reserves, milestone commitments, and risk response priorities.

Software Tools in Practice

The following tools are widely used for Monte Carlo-based QRA in defence and heavy engineering:

• Simulation software (Palisade/Lumivero) — spreadsheet software add-in; widely used for cost risk analysis via WBS models
• Simulation software (a software provider) — spreadsheet software add-in; similar capability to simulation software
• Schedule-risk software (a software provider) — Integrates directly with scheduling software schedules for schedule risk analysis
• Enterprise risk-management platform — integrates risk ownership, controls, actions and reporting for complex programmes
• Specialist schedule-risk software — Specialised schedule risk analysis tool with advanced correlation modelling

National Government Mandate: Policy Versus Practice

The relationship between QRA policy and QRA practice in government programs is more nuanced than most textbooks suggest.

After the perceived success of PERT in the large complex development programme, the national acquisition authority briefly mandated PERT for all major acquisitions. This specific mandate was short-lived, replaced by broader requirements that risk analysis and risk management be incorporated into acquisition management without prescribing particular techniques .

Despite these policy requirements, empirical evidence consistently shows that QRA methods are unevenly applied:

• Published acquisition studies found uneven adoption of PERT and related quantitative techniques.
• Reviews found material gaps between textbook advocacy and consistent use on complex programmes.
• Other studies found persistent gaps between policy requirements and actual practice in programme offices.

This gap between advocacy and adoption is one of the most important themes in the study of quantitative risk analysis, and it sets the stage for the critical examination of these methods that we will explore in the next article.

Empirical Evidence: The Retrospective View

Do Projects Actually Overrun? (Spoiler: Yes.)

A complementary approach to prospective QRA is retrospective analysis — studying completed projects to compare planned versus actual cost and schedule outcomes. Independent acquisition research pioneered this work from the 1950s through the 1970s, and the findings have been remarkably consistent across decades:

• Most projects overrun on both schedule and cost.
• Overruns have not improved with the passage of time, despite advances in management techniques.
• Performance shortfalls are common, though often the schedule and cost overruns are incurred precisely in the effort to achieve original performance specifications.
• Covariates (program characteristics used as predictors) have not been very informative in regression analyses, suggesting that overrun patterns are driven by factors not easily captured in project descriptors .

These findings raise a fundamental question that we will examine in the next article: if quantitative risk analysis methods are supposed to produce accurate predictions, why hasn't their widespread advocacy reduced the frequency or magnitude of overruns?

Pitfalls: What Can Go Wrong With QRA

Garbage In, Probability Curves Out. The most sophisticated Monte Carlo engine produces meaningless results if the input distributions are poorly elicited. The entire edifice depends on the quality of expert judgment. False Precision. A beautifully rendered S-curve with values to two decimal places can create an illusion of accuracy that the underlying data does not support. One experienced practitioner told a critical quantitative-risk review that the usefulness of early project risk analysis was "inversely proportional to the number of decimal places."Ignoring Correlations. Treating all cost elements or task durations as independent will systematically understate total project variance. If common factors (supply chain disruptions, currency movements, design changes) affect multiple elements simultaneously, the tails of the distribution are fatter than an independence assumption suggests. Confusing the Map With the Territory. The S-curve is a model of reality, not reality itself. It reflects the risks that were identified and quantified. Unknown unknowns — the risks that were never identified — are not captured in the distribution. Schedule and Cost Silos. Performance risk, schedule risk, and cost risk are deeply interconnected, but they are almost always analysed separately. A performance shortfall that triggers a design change will simultaneously blow out both schedule and cost. Analysing these dimensions in isolation can produce individually defensible but collectively misleading results.

Key Takeaways

• Quantitative risk analysis produces probability distributions, not point estimates, for project schedule and cost outcomes, enabling risk-informed decision-making about contingency reserves and milestone commitments.

• The foundational methods evolved from Gantt (visibility) through PERT (probability) and CPM (network optimisation) to modern stochastic CPM and Monte Carlo simulation, driven by exponential growth in computing power.

• Schedule risk analysis uses Monte Carlo simulation on a task network to produce a completion time CDF and criticality indices. Cost risk analysis uses Monte Carlo simulation on WBS cost elements to produce a cost CDF.

• Three-point estimates (optimistic, most likely, pessimistic) remain the standard input mechanism, fitted to triangular, Beta, or other distributions depending on the context.

• Retrospective studies consistently show that most projects overrun on schedule and cost, raising important questions about the accuracy and utility of prospective QRA methods.

• The gap between QRA advocacy and QRA adoption is persistent and significant, even in organisations that formally require these techniques.