Managing Risk in Program Estimation

TL;DR

This is the fourth in a five-part series on program estimation. In our lead article, we introduced the overall estimation process. Subsequent posts explored estimate types and the tools used to produce them. Here, we will discuss managing risk so that your project finishes close to your estimates, in both cost and time.

Estimation is, by its nature, an exercise in uncertainty. No matter how carefully a project is scoped, the real world has a way of introducing surprises. The goal of risk management in estimation is to end up in a place where the gap between estimated and actual outcomes is acceptable to stakeholders, even if it isn’t perfect.

There are several practical ways to do that.

Contract Structure Sets Your Risk Profile

Before diving into contingency methods, it’s worth stepping back to consider your contract structure, since it shapes who carries the risk of the unknowns.

Fixed-price contracts give clients cost certainty but place the risk of unknowns on the delivery team. They work well when scope is clearly defined from end to end and risk is limited: a modification to an existing design, for example, or an agreement up front that an experiment may fail. They work less well when the pathway is unclear and a performance target has to be met, such as investigating the root cause of a new issue and implementing a working solution for global rollout by a fixed date.

Time-and-materials (T&M) contracts shift some risk back to the client. You pay for what the work actually takes, which is appropriate when requirements are developing or the work involves exploration. That said, even with T&M an estimate is still needed, and the estimator will be held to account for large differences between estimates and actuals.

A hybrid approach, fixed price for the well-understood work and T&M for the unknowns, can offer the best of both.

Three Ways to Build In Contingency

Once you’ve settled on a contract structure, you need to decide how to handle contingency, the buffer built into your estimate to absorb the unexpected. Three methods cover most situations.

A Percentage Add-On is the simplest method: add a flat percentage to your base estimate. It’s fast, easy to explain, and sometimes perfectly adequate. It’s also a blunt tool, since it doesn’t distinguish between a project with a few minor risks and one with a dozen major ones.

A Trigger Method adds a layer of precision. Rather than a flat buffer, you define specific risk events and the cost or schedule impact if they occur. If X happens, then Y gets added to the estimate. This works well when risks are discrete and identifiable, for example “if the client’s legacy data turns out to be inaccessible, add two weeks.” Triggers can also be posed as assumptions (“this fixed price assumes the legacy data is accessible”) without a pre-defined numeric impact.

A Risk Contingency Method is the most rigorous approach, and it works especially well when you’re dealing with a number of similarly sized risks that can average together. For each identified risk, you estimate the probability of occurrence and the impact if it does occur. Multiply those together across your risk register, sum them up, and you have a statistically grounded contingency. A few things are worth keeping in mind with this method:

• The more risks you identify, the larger your contingency will be. The point is to be as accurate as possible, and anything below roughly 20% likelihood in this author’s experience tends to add noise without adding value.
• Don’t forget schedule overlap. Risks are often realized in parallel, so avoid simply stacking schedule impacts end to end.
• Opportunities count too. If there’s a reasonable chance you’ll save time or cost, model those as opportunities with a positive impact on cost or schedule.

Practical Tips for Keeping Estimates Close to Actuals

Contract structure and contingency method set the frame. The rest comes down to habits that keep the numbers honest as you build the estimate up.

• Define your outputs precisely. Are you guaranteeing a system that performs to a specific standard, or delivering a working prototype for further development? Distinctions like these should be unambiguous, and they should weigh heavily when you calculate risk.
• Document your assumptions, and be specific. Every estimate rests on assumptions. If you’ve assumed the client will provide clean, structured data, or that two developers will be available full-time, write those down. The more ambiguous a contract, the more likely two people will read it differently, and assumptions related to risk are the ones most likely to matter if something goes sideways.
• Think carefully about contract size. Larger engagements tend to include more unknowns the farther out they project. A size that is large enough for efficiency but short enough to limit unknowns is usually the right call.
• Account for time away. Vacations, sick days, holidays, and other off-project time are predictable factors that often get overlooked and swell your schedule. Adding 5 to 10% to your schedule (not your cost) is a simple way to manage personnel risk.
• Use the nominal case as your baseline. When building a bottom-up estimate, resist the instinct to take the pessimistic (or optimistic) risk scenario in every case. If you do, you’ll end up with a wildly inflated (or deflated) number before you’ve even added contingency. It’s usually better to estimate each item at an average value, then apply your risk methodology at the end, or add up the specific items that carry disproportionately high risk per the Risk Contingency Method above.
• More line items mean better averaging. If your project is a single large deliverable, you’re entirely at the mercy of how that one activity goes. If your project is made up of dozens of smaller tasks, the overruns and underruns across those tasks are more likely to average out and reduce overall risk.

Risk management in estimation isn’t about padding numbers or hedging every decision. It’s about being honest with yourself and your stakeholders about what you know, what you don’t, and what it will cost if things don’t go as planned. Managing risk well means managing your project well, which in turn means accurate estimates that lead to on time, on budget delivery that builds trust.

Related Resources

Managing Risk in Program Estimation

The goal of risk management in estimation is to end up in a place where the gap between estimated and actual outcomes is acceptable to stakeholders, even if it isn’t perfect.

The Only Estimating Toolkit You’ll Ever Need

Five methods for building accurate project estimates, from gut feel to bottom-up, plus three add-ons that sharpen any estimate.

Keeping It Flexible Without Letting It Drift: How to Manage Early-Phase Concept Development

Early phase concept development is a weird part of a project lifecycle. It is often the most exciting phase, because the team is exploring possibilities, generating new ideas, and turning a fuzzy opportunity into something real.

Preparing for Clinical Trials Under Budget and Schedule Pressure

Clinical prototypes must not only function as intended, but also be manufactured, documented, and supported in a way that satisfies regulatory expectations and clinical realities.