Project Risk Management: Success–Failure Spectrum

The maturity of project risk management spans a broad spectrum of practices, from value-creating decision support to actively harmful pseudo-analysis. To describe this spectrum meaningfully, we must define the best, natural, and worst states, along with the intermediate stages between them.

Best

The project develops a quantitative risk simulation model that reflects real delivery conditions, considering all existing constraints, possibilities and resource volatility. This model needs to be:

• Fully integrated with schedule, cost, resources and benefits
• Built on realistic assumptions and credible data
• Actively used to evaluate options, trade-offs, and decisions

In this state, risk management function is used as a decision-support system, not a reporting obligation.

Better

The project applies qualitative risk analysis, where risks are:

• Assessed individually
• Prioritised using structured professional judgement
• Managed through defined mitigation and monitoring actions

This approach improves risk awareness but offers limited predictive capability.

Baseline (Natural State)

Risk management is primarily intuition-driven:

• Risks are not formally documented
• No meaningful qualitative or quantitative analysis is performed
• Decisions rely largely on experience and gut feeling

This is the most common and “natural” state across projects.

Worse

Misapplied qualitative, scoring, or pseudo-quantitative methods are introduced:

• To demonstrate compliance rather than generate insight
• Using arbitrary scales, weak assumptions, or invalid models
• Producing outputs that are largely ignored by decision-makers

At this stage, risk management becomes ceremonial. It is worse than intuition-driven, as projects spend energy performing no value-added risk management rituals.

Worst

Management actively uses the outputs of misapplied risk analysis to make decisions:

• False precision creates unwarranted confidence
• Poor models override professional judgement
• Decisions become systematically biased by misleading data

At this point, risk management causes more harm than having no risk management at all.

Reference to Monte Carlo Simulation

Misapplied Monte Carlo Simulation belongs to the Worse and Worst categories.

• If QRA is performed periodically but its results are ignored, the outcome is wasted effort and cost, with limited direct harm.
• If flawed results are used to drive decisions, the impact is often actively damaging project outcomes.

Unfortunately, misapplied Monte Carlo Simulation is common. Two typical pathways lead projects into the Worst state:

1. Forced QRA
   The project team is required, contractually or externally, to perform QRA, while management doesn’t realise that the reports may be formally compliant but practically misleading.
2. Premature escalation from “Better”
   Projects that reach the Better level attempt to progress by introducing quantitative simulations. While they recognise the value of integrated analysis, they underestimate the effort, skill set, and technological capability required. As a result, maturity collapses from Better directly to Worst.  In this case, projects regress from meaningful qualitative analysis to misleading pseudo-rigour, creating an illusion of sophistication without insight. The outcome is a dramatic drop in risk-management maturity.

Inspired by Douglas W. Hubbard