Updating and Documenting a Risk and Uncertainty Analysis

The S curve from a cost risk and uncertainty analysis only quantifies the imperfectly understood risks identified at the time of the analysis. Threats and opportunities that are not known or otherwise not identified when the risk analysis is initially performed will not be quantified. Prudent organizations recognize that uncertainties and risks can become better defined as the program advances and conduct periodic re-evaluations of the risk register.

The initial risk and uncertainty analysis, and each subsequent update, should be fully documented to include the risk data, sources of risk data, and techniques used to validate the risk data. The methodologies used to perform the simulation should be detailed, including correlation and the derivation of probability distributions. In addition, outputs such as the cumulative probability distribution of the total cost estimate should be included, along with a discussion of contingency.

A risk and uncertainty analysis should be performed periodically as the cost estimate is updated to reflect progress and changes to risks. As the program progresses, risks retire or change in potential severity, and new risks that were not previously identified may appear. The time between analysis updates will vary according to program duration, complexity, risk, and the availability of management resources. Preferably, risk analysis is performed before key program decision points to ensure decision-makers have updated information throughout the life of the program. The analysis might be performed more regularly, for instance, to support annual budget request submissions so that adequate contingency can be included in the budget baseline. Alternatively, the analysis results can be used to determine the level of confidence associated with different potential budget levels. If the risk and uncertainty analysis is not updated periodically, the following cannot be determined: the likelihood of completing the program within budget, the amount of contingency needed to provide an acceptable level of confidence in the required budget, and the risks most likely to impact the program cost.

An updated risk analysis is particularly important to support the internal independent assessment process if the program is re-baselined or if significant changes are made to the risk register. Updating the program cost estimate is discussed in chapter 15 and re-baselining is discussed in chapter 20.