The ‘3 points estimation’ known as a PERT methodology is relatively simple to use for cost, but for the schedule, it’s more complicated. The fact that some activities are on the critical path means that the volatility of those specific activities, as opposed to the set of all project’s activities, can make a big difference for Monte Carlo Simulation.

Risks and Critical Path

It is well accepted that risks are measured based on the probability of the event (or condition) occurring and the consequences.

Risk Exposure = Probability (Event) * Consequence

The same risk may have different consequences for Time, Cost, Safety, Reputation and other project objectives.

  • The time consequence is highly dependent on the criticality of impacted activities. If impacted activities are on the critical path# [including delay], the project is going to be delayed. Otherwise, it will impact some parts of the project but not the overall delivery date(s).
  • Risk consequences are not always a stable parameter. Some of them depend on project conditions.
  • Risk consequence has to be measured based on future conditions when the risk is likely to occur, not the current situation.
  • When the risk is likely to occur project critical path may be different from the current critical path. It could be due to the impact of project uncertainties, other risks, scope changes or any other reasons.
  • At that time, there will be only two possibilities: the critical path impacted or not. In other words, the probability (CP) that the risk has a time impact will be 0% or 100%. Do not mix with the Probability of the event, which is not dependent on the critical path.

However, when the risk is assessed, it is not always possible to predict if the impacted activities are going to be on the critical path or not, so the probability (CP) could be different from 0% and 100%.

Probabilistic vs Deterministic Delivery Model

If the Monte Carlo Simulation is performed based on a dynamic PROBOBALISTIC model (aka schedule) that includes data uncertainties and “conditional branches ”, the critical path will be recalculated during each calculation, and only the event probabilities need to be assessed prior to the simulation.

PROBABILISTIC project delivery systems, like Spider Project, could additionally calculate the probability of each activity being on the critical path, which is known as ‘activity criticality index’.

However, if the Monte Carlo Simulation is performed based on a DETERMINISTIC schedule (developed in Primavera, Microsoft Project or another CPM-based scheduling tool) and risk data is collected in a separate risk register, the probability that impacted activities are going to be on the critical path (CP) has to be assessed manually. The accuracy of such an evaluation would be significantly different from calculated probabilities and it will have following effect the results of the Monte Carlo Simulation.

Some risk management tools provide users with an option to define if the critical path is going to be impacted or not with a binary option (Yes/No). Users potentially could assess it’s based on the current critical path, but, with some rare exceptions, it is impossible to say whether the future critical path is going to be impacted or not as it depends on other materialised risks.

Some project Risk consultants just assume that the Critical Path is going to be the same

(Probability (CP) =100% or 0%) and only assess event probability even if the previous similar projects had critical path volatility.

Risk Exposure

If the (time) consequence depends on the Project Critical Path, or to be precisely the probability that impacted activities are going to be on the critical path when risk is materialised, Risk Exposure also depends on this parameter:

Consequence (Net) = Probability (CP) * Consequence (Gross)


Risk Exposure = Probability (Event) * Probability (CP) * Consequence (Gross)


Risk Exposure = [ Probability (Event) * Probability (CP)] * Consequence (Gross)

Cost Impact

So far, we have discussed only time exposure. What about the cost exposure? Is it also dependent on the critical path? Yes, but in a different way.

Risk cost consequence has two parts: direct cost impact and cost of delay.

Direct cost impact only depends on the Probability (Event) and the cost of delay only depends on Probability (CP).


The volatility of the Critical path means that risk consequence is not a stable parameter and depends on future project conditions when the risk is likely to occur. It is hard to accuratelly predict which activities are going to be on the Criticla Path at that time.

The results of Time and Cost probability distributions received based on deterministic the CPM-based schedule and predefined risk data could be misleading and should be used for project decisions with caution.

Risk consequences have to be calculated in each simulation. Dynamic probabilistic model with fully integrated risk data is required for reliable Monte Carlo Simulation.

Alex Lyaschenko

PMO | Portfolio Planning & Delivery | PMP | P3O Practitioner | AgilePM Practitioner | Six Sigma