Most capital programmes across the GCC still set their contingency the same way. A cost estimate is prepared, a percentage is added on top, often ten or fifteen percent, and the resulting figure becomes the budget. The percentage is usually justified by reference to a risk register, where each risk has been scored for probability and impact and coloured red, amber, or green.
The register looks like project risk analysis. The contingency it supports is, in most cases, a guess dressed up as a calculation. This gap between the appearance of analysis and the substance of it is the central weakness of project risk analysis as it is commonly practised across the region, and closing it is what separates real project risk analysis from the ritual version.
The problem is not the risk register, which is a useful tool for identifying and tracking exposure. The problem is the leap from a set of qualitative scores to a single contingency number. A probability-and-impact matrix tells you that a risk is high, medium, or low.
It does not tell you how those risks combine across a whole programme, how likely the budget is to hold, or what reserve would give the owner an acceptable chance of finishing within it. Those are quantitative questions, and a colour on a heat map cannot answer them, which is precisely where quantified project risk analysis has to take over.
There is a further problem with leaning on the register alone. A heat map invites false precision. Scoring a risk as a four for probability and a four for impact produces a tidy sixteen, and the tidiness suggests a rigour that the underlying judgement does not possess.
Two assessors can look at the same risk and score it differently, and neither number carries any information about how the risk behaves in combination with the hundred others on the programme. Good project risk analysis respects the register for what it is, a structured way to capture and track exposure, without asking it to carry a quantitative load it was never designed to bear.
There are two families of method that can. Deterministic analysis works with single-point values and simple rules, producing a contingency from defined percentages or parametric formulas.
Probabilistic analysis works with ranges and distributions, running the numbers thousands of times to produce a spread of possible outcomes. The common framing pits one against the other, as though an owner must choose between a crude shortcut and a sophisticated model. That framing is wrong. Both have a place, and mature project risk analysis uses each where it fits rather than treating one as obsolete.
Getting this right matters because the cost of getting it wrong is large and well documented. Budgets built on optimistic point estimates are a principal reason capital projects overrun, and the pattern is remarkably consistent across regions and decades. The purpose of project risk analysis is to close the distance between the budget an owner approves and the cost the project actually incurs, and disciplined project risk analysis does that by treating contingency as a quantity to be derived rather than a percentage to be assumed.
A risk score tells you a risk is serious. It does not tell you how much money to set aside. Only quantified project risk analysis turns the first answer into the second.
A probability score is not a budget
The appeal of the probability-and-impact matrix is that it is fast and requires no specialist skill. A workshop identifies risks, assigns each a likelihood and a consequence, multiplies the two, and sorts the results. The output is a prioritised list, which is useful for deciding where to focus management attention.
The trouble begins when that same list is asked to justify a financial reserve. Ranking risks by severity and sizing the money to cover them are different tasks, and project risk analysis has to do the second, not merely the first.
Consider what the matrix leaves out. It does not capture how a single risk might range from a minor cost to a severe one, collapsing that whole distribution into one impact score. It does not account for correlation, where one adverse event makes others more likely, so that troubles arrive together rather than in isolation. And it offers no way to combine dozens of individual risks into a statement about the programme as a whole. Project risk analysis that stops at the heat map has identified the risks without ever quantifying the exposure they represent.
Deterministic methods still earn their place
The reaction against crude percentages sometimes tips into dismissing deterministic methods altogether, which is a mistake. Deterministic analysis, applied with discipline, remains valuable, particularly in the early stages of a project when detail is scarce.
A well-constructed parametric model, built from historical data on comparable projects, can produce a contingency estimate that is both defensible and quick, without the overhead of a full simulation. In the earliest phases, when a project is barely defined and estimates may range widely, this kind of rules-based approach is often the proportionate face of project risk analysis, honest about how little is yet known.
The value of deterministic work also lies in what it feeds. Probabilistic analysis is only as good as the inputs it is given, and those inputs, the ranges, the most likely values, the correlations, are frequently informed by deterministic benchmarks and historical records. The Kairos insight on risk register in project management makes the point that a well-maintained register is the raw material for every later stage of analysis, and the same discipline that populates a good register supplies the reference data a deterministic estimate depends on. In project risk analysis the two are not rivals. The deterministic layer gives structure and speed, and it prepares the ground for the probabilistic layer to add precision.
Probabilistic analysis turns a range into a defensible number
Where a project is large enough and defined enough to justify the effort, probabilistic analysis is what converts uncertainty into a budget an owner can defend. The standard technique is Monte Carlo simulation, which takes a three-point estimate for each uncertain item, a best case, a most likely case, and a worst case, and runs the combination thousands of times to build a full distribution of possible total costs.
The Project Management Institute’s guidance on Monte Carlo simulation in cost estimating describes how this distribution lets an owner read contingency directly off a confidence level, typically setting the budget at the P80 or P90 point, meaning the cost has an eighty or ninety percent chance of falling within it. Contingency stops being a round percentage and becomes the difference between the baseline estimate and the chosen confidence level.
The difference this makes is concrete. In a recent peer-reviewed study of a road project, researchers using Monte Carlo simulation with correlated cost variables showed that budgeting at the P90 point cut the probability of an overrun to under seventeen percent, while budgeting at P95 reduced the residual risk to around three percent. The same work found that ignoring correlation between cost drivers understates the true spread, producing budgets that look adequate and are not. That is the practical payoff of project risk analysis done quantitatively: an owner can state, with a number attached, how much protection a given contingency actually buys.
The output also changes the conversation with decision-makers. A single contingency figure invites haggling, and a reserve presented as a flat percentage is the first thing a board tries to cut. A probability curve reframes the discussion, because it shows the trade-off directly: fund to P90 and accept a modest residual risk, or fund lower and accept a higher chance of returning for more money later.
Project risk analysis presented this way turns contingency from a line item that looks like padding into a governance choice about how much risk the organisation is willing to carry. Boards tend to make better decisions when the question is put to them in those terms.
Contingency set at a confidence level is a decision. Contingency set at ten percent because ten percent is the habit is only a hope with a number in front of it.
Optimistic point estimates are the root of chronic overrun
The reason this matters is visible in the overrun record. Deterministic point estimates, prepared without any modelling of uncertainty, tend to be optimistic, because each line is set at its expected or most likely value and the accumulation of downside variation is never captured.
The peer-reviewed evidence puts average infrastructure cost overruns near a third of budget, and considerably higher in some markets, a pattern driven substantially by estimates that ignore variability and correlation and therefore read as more certain than they are. A budget built this way is not conservative. It is a central estimate wearing the costume of a commitment.
Probabilistic analysis addresses this directly by making the optimism visible. When a deterministic estimate is laid over a simulated distribution, it frequently sits low on the curve, near the twentieth percentile or below, which is a clear signal that the base figure is aggressive and that contingency set as a small percentage of it will not hold.
Seeing that gap is often the moment an owner understands why previous programmes overran, and why the project risk analysis behind them gave false comfort. Project risk analysis, in this sense, is less about predicting the future than about exposing how much confidence a given budget really deserves.
How GCC practice can improve without over-engineering
Improving regional practice does not require every project to commission an elaborate model. It requires matching the method to the project, which is the essence of proportionate project risk analysis. Small, well-defined works can reasonably rely on disciplined deterministic contingency drawn from good historical data. Large, complex, or first-of-a-kind programmes, which describe much of the region’s current pipeline, warrant full probabilistic analysis, because the sums at stake dwarf the cost of the modelling.
The Kairos insight on project risk management argues that risk work should be proportionate to the exposure it governs, and the same principle decides how much quantitative effort a given budget deserves.
There is also a capability question that the region has to confront. Probabilistic project risk analysis needs people who can build and interrogate a model, challenge the input ranges, and explain the output to a board that wants a single number.
That skill is scarcer than the software, and buying a simulation tool without the expertise to run it produces confident-looking results that may be quietly wrong. The answer is not to avoid the method but to resource it properly, whether by building the capability in house or by bringing in advisers whose day-to-day work is the analysis rather than the occasional workshop.
Three habits would lift regional practice quickly. The first is to treat three-point estimating as standard on major programmes, so that ranges, not single figures, feed the budget from the outset. The second is to model correlation rather than assume independence, since correlated risks are what turn a manageable spread into a severe one.
The third is to set contingency explicitly at a stated confidence level, so that the reserve is a governance decision the owner has made on purpose rather than a percentage inherited from the last project. None of these is exotic, and together they move project risk analysis from ritual to forecasting the owner can act on.
Conclusion: Contingency is a number you derive
The shift the region needs is not from one technique to another but from assumption to derivation. A contingency figure should be the output of analysis, traceable to the ranges and correlations and confidence level that produced it, rather than a percentage chosen because it feels about right.
Deterministic methods give an owner a fast, structured starting point and the reference data that makes everything downstream credible. Probabilistic methods turn that structure into a defensible statement about how likely the budget is to hold. Used together, and matched sensibly to the scale of the project, they convert project risk analysis from a coloured chart that reassures into a forecast that informs. The budget an owner approves should carry a known probability of being enough, and producing that number is the whole point of the exercise.