Beyond probability-impact matrices in project risk management: A quantitative methodology for risk prioritisation

The paper addresses the challenge of prioritising project risks to guide limited management resources toward protecting key objectives (time and cost). Although probability–impact (P×I) risk matrices are widely used and embedded in standards (PMBOK, ISO 31000, PRINCE2, IPMA), the literature documents important shortcomings: subjectivity in category assignment, poor comparability across risks, insensitivity to negative correlations, and potential for misleading rankings. The research question posed is whether a methodology can prioritise project risks while overcoming probability–impact matrix limitations. The authors propose a quantitative prioritisation method leveraging Monte Carlo Simulation (MCS) to estimate each identified risk’s absolute impact on project duration and cost, thereby aligning the qualitative and quantitative phases of risk assessment and enabling objective, decision-focused prioritisation.

The review situates the work within established risk management processes and critiques of risk matrices. Risk matrices (qualitative, semi-quantitative, quantitative) map likelihood and impact categories (often 3×3, 5×5, etc.) to risk levels, sometimes scoring cells by P×I. Their popularity stems from simplicity and communication value. However, critiques (e.g., Cox 2008; Duijm 2015; Goerlandt & Reniers 2016) highlight: coarse categorisation, subjectivity, inconsistent ranking, and potential bias (including color use). Proposed fixes include fuzzy sets, logarithmic scales, continuous plots, cell size calibration, and consideration of risk attitudes via utility theory, but issues remain. Some recent works integrate qualitative risk data into MCS, yet often revert to expected values or thresholding. The authors argue for fully embedding identified risks (with probability and impact) into a project simulation model to quantify each risk’s absolute contribution to time and cost outcomes, differentiating between these objectives.

The proposed quantitative prioritisation method integrates qualitative risk inputs into an MCS-based project model to estimate each risk’s absolute impact on duration and cost. - Identification: Compile the project risk list R = [R1, …, Rm]ᵀ. - Qualitative estimation: For each risk, estimate probability of occurrence (P) and impact (I), distinguishing impact on duration and on cost. Map qualitative levels (e.g., Very Low, Low, …) to numeric ranges suitable for simulation. - Uncertainty modelling: - Aleatoric uncertainty (variability): Model activity durations and variable costs with suitable PDFs (e.g., triangular for activities with Min, Most Probable, Max). Risk impacts that vary over ranges can also use appropriate PDFs. - Stochastic uncertainty (event uncertainty): Model risk occurrence with a Bernoulli distribution using the estimated probability; deterministic impact values can be applied conditional on occurrence. - Epistemic uncertainty (knowledge gaps): When only ranges are known (from qualitative categories), model probability and impact with uniform distributions over the defined intervals; refine as knowledge improves. - Project baseline simulation (no risk occurrences): Build a planned project model with activity precedence, duration distributions, and cost structure (fixed and variable components). Run MCS to obtain distributions and summary statistics for total duration and total cost: [Tot_Dur, Tot_Cost]. - Risk-by-risk simulations: For each risk Ri with parameters (Pi, Ii), include Ri in the model and run MCS to obtain [Tot_Dur_i, Tot_Cost_i]. Use a sufficiently large number of iterations (e.g., 20,000) to stabilise estimates. - Risk appetite and percentile selection: Choose a percentile α (Value-at-Risk, VaR) reflecting organisational risk appetite (commonly P95; sometimes P80 in project contexts). Extract the α-percentile of Tot_Dur and Tot_Cost for the baseline and for each risk-included simulation. - Impact computation: For each risk Ri, compute Imp_Dur_i = Tot_Dur_i(α) − Tot_Dur_baseline(α) and Imp_Cost_i = Tot_Cost_i(α) − Tot_Cost_baseline(α). - Prioritisation: Rank risks separately by Imp_Dur_i and Imp_Cost_i magnitudes to obtain two lists (duration-focused and cost-focused). Provide absolute impact values (time units; monetary units) to support decision-making on where to allocate mitigation resources. Implementation details in the case study: activities modelled with triangular PDFs; costs decomposed into fixed and variable parts; risks’ probabilities and impacts (duration and/or cost) modelled with uniform distributions derived from qualitative ranges; simulations executed with the MCSimulRisk software using 20,000 iterations per run.

From the EPC case study (industrial facility expansion): - Percentile selection: Using P95 as VaR better captures tail risk than P80; e.g., P95 planned cost ≈ 3.0339×10^7 monetary units vs P80 ≈ 3.03×10^7, and P95 reflects material risk impacts that P80 may understate. - Baseline (risk-free) P95 results: Project duration = 323.4339 days; Project cost = 30,339 (×1,000 monetary units). - Duration impact prioritisation (top): R3 = +26.33 days (rank 1), R5 = +22.666 days (2), R2 = +22.639 days (3), R8 = +14.818 days (4), R4 = +2.055 days (5). Cost-only risks (R10–R15) add 0 days by construction. - Cost impact prioritisation (top): R15 = +3,060.9 (×1,000) monetary units (rank 1), R13 = +777.35 (2), R11 = +766.54 (3), R5 = +750.36 (4), R10 = +413.55 (5). Some duration-focused risks also substantially impact cost (e.g., R5 ranks 4th by cost impact). - Divergence from risk matrix rankings: The MCS-based absolute impact ranking differs markedly from the probability–impact matrix results; e.g., R3 emerges as most critical for duration, and R15 for cost, with quantified magnitudes. - Structural insight: Risks impacting duration inevitably influence total cost due to extended durations and variable costs, while risks impacting cost alone do not change total duration in this model. - Simulation setup: 20,000 iterations per simulation; activities use triangular duration distributions with fixed/variable cost split; risk probabilities and impacts from qualitative ranges are modelled as uniform distributions.

The quantitative MCS approach directly answers the research question by overcoming known issues of probability–impact matrices: it avoids ordinal category pitfalls, reduces subjectivity by embedding risks in a project network with precedence and cost structures, and produces absolute effects on time and cost at a chosen risk appetite percentile. The separate rankings for duration and cost reveal that the most critical risks depend on the objective under consideration (schedule vs budget). The case study shows that duration-affecting risks can dominate cost impacts more than nominal cost-only risks due to their influence on project duration and variable costs. Compared with the risk matrix, the method yields different and more actionable prioritisation by quantifying magnitudes rather than relative P×I scores. This enables targeted allocation of mitigation resources to the risks that most threaten the selected objective at the desired confidence level.

The study proposes and demonstrates a quantitative, MCS-based method to prioritise project risks without relying on probability–impact matrices. By modelling risk occurrence and impacts (on time and cost) within the project network, the method provides absolute impact estimates at a chosen risk appetite percentile and generates separate priority lists for schedule and budget. In the case study, rankings differ substantially from the risk matrix, revealing critical risks (e.g., R3 for duration, R15 for cost) and their magnitudes. The approach strengthens the linkage between qualitative and quantitative risk analyses and enables objective, goal-focused decision-making. Future research directions include handling interdependent risks (correlation/causality among risks), improving estimation of probability and impact distributions, conducting broader sensitivity analyses across diverse projects, and validating the methodology in real-world implementations across sectors.

- Input estimation sensitivity: Results depend on expert-derived probability distributions, impact ranges, and chosen percentile (risk appetite). Enhancing estimation methods was outside scope. - Independence assumption: The approach assumes risks are independent to isolate each risk’s contribution via separate simulations. In complex projects, risks may be interrelated; modelling dependencies would require extensions (e.g., copulas, Bayesian networks). - Generalisability and calibration: Probability/impact ranges and PDFs (e.g., uniform for epistemic uncertainty, triangular for activities) may require tailoring to specific projects; accuracy improves with better data. - Single-risk inclusion for attribution: Attributing impact by including one risk at a time does not capture combinatorial or interaction effects among concurrent risks.