5.21 Perform Quantitative Risk Analysis

5.21 Perform Quantitative Risk Analysis
Inputs Tools & Techniques Outputs

Replace this with term.

Purpose & When to Use

  • Estimate the likelihood of meeting key dates and budgets using numbers, not just ratings.
  • Size cost and schedule contingency based on modeled uncertainty.
  • Identify which risks and assumptions drive the most variance.
  • Compare alternatives or response strategies using expected value and scenarios.
  • Use after qualitative risk prioritization, and on projects that are large, complex, or have tight targets or high uncertainty.
  • Repeat at major milestones or after significant scope, estimate, or risk changes.

Mini Flow (How It’s Done)

  • Confirm inputs and data quality: risk register with well-defined risks, schedule network, cost estimates, assumptions, and constraints.
  • Build the model: add uncertainty to durations and costs (e.g., three-point estimates) and include discrete risk events with probabilities and impacts.
  • Select distributions and dependencies: choose suitable probability distributions and model correlations where variables move together.
  • Run analysis: use simulation for cost and/or schedule, perform sensitivity checks (e.g., tornado charts), and use decision trees or expected value where choices exist.
  • Interpret results: review percentiles (e.g., P50, P80), ranges, probability of meeting targets, and the top risk drivers.
  • Decide and update: propose contingency reserves, refine risk responses, adjust targets if needed, and update the risk report and risk register.
  • Communicate and iterate: explain assumptions and confidence levels, then rerun when plans or risks change.

Quality & Acceptance Checklist

  • Scope, schedule, and cost models reflect the current baseline and logic ties are valid.
  • Key threats and opportunities are modeled, with clear probabilities and impacts.
  • Uncertainty ranges for major estimates are justified and sourced.
  • Chosen distributions and correlations are reasonable and documented.
  • Outputs include percentiles, probability of meeting key targets, and a list of main risk drivers.
  • Recommended contingency is traceable to analysis results, not arbitrary padding.
  • Assumptions, data quality limits, and scenario choices are recorded.
  • Stakeholders reviewed results and understand confidence levels and implications.

Common Mistakes & Exam Traps

  • Confusing qualitative with quantitative analysis; quantitative uses numeric models and probabilities, not just risk ratings.
  • Assuming it is required on every project; it is used when the benefit outweighs the effort and data is sufficient.
  • Ignoring opportunities; include positive impacts as well as threats in the model.
  • Leaving out correlations; dependencies between variables can materially change ranges.
  • Using point estimates only; always include uncertainty ranges for key costs and durations.
  • Misreading percentiles; P80 is not a guarantee, it is a confidence level under stated assumptions.
  • Double counting reserves; contingency comes from analysis for known-unknowns, while management reserve is separate for unknown-unknowns.
  • Running simulations on a weak schedule; missing logic ties or unrealistic calendars produce misleading results.

PMP Example Question

Your sponsor asks for the probability of finishing within the approved budget and a data-backed recommendation for cost contingency. You have already prioritized risks using likelihood and impact scores. What should you do next?

  1. Add a fixed percentage contingency based on organizational policy.
  2. Perform quantitative risk analysis using a cost model with uncertainties and discrete risks.
  3. Update the risk register with more qualitative categories.
  4. Request management reserve to cover unknown risks.

Correct Answer: B — Perform quantitative risk analysis using a cost model with uncertainties and discrete risks.

Explanation: The sponsor wants probabilities and defensible contingency. This requires quantitative analysis using a numerical model, not qualitative scoring or arbitrary percentages.

ICS/OT Cybersecurity Fundamentals — Security Built for Industrial Systems

Industrial control systems cannot be secured like ordinary IT. A forced reboot, aggressive scan, or incompatible patch can interrupt production and create real safety consequences. Effective OT security begins with understanding the systems, constraints, and risks unique to industrial environments.

This course gives IT professionals, engineers, operators, and security practitioners a practical foundation in ICS threats, zone and conduit design, risk assessment, passive asset visibility, and vendor evaluation. You will learn how IEC 62443, NIST CSF, and MITRE ATT&CK for ICS apply where availability and safety come first.

Eight reconstructed incidents—including Stuxnet, Triton, Ukraine 2015, Colonial Pipeline, and PIPEDREAM—show how attackers move through OT environments, what they target, and which defenses could have changed the outcome.

Watch the course preview, then build the vocabulary, frameworks, and judgment needed to take credible first steps in ICS/OT cybersecurity.

Explore the Course


ICS/OT Cybersecurity Fundamentals course preview

Stop Managing Admin. Start Leading the Future!

HK School of Management helps you master AI-Prompt Engineering to automate chaos and drive strategic value. Move beyond status reports and risk logs by turning AI into your most capable assistant. Learn the core elements of prompt engineering to save hours every week and focus on high-value leadership. For the price of lunch, you get practical frameworks to future-proof your career and solve the blank page problem immediately. Backed by a 30-day money-back guarantee-zero risk, real impact.

Enroll Now