Project Risk Management
Don't guess your project's schedule and cost risk, measure it. From the risk register to Monte Carlo simulation, we support the whole project risk management process with three Oracle solutions: Primavera Risk Analysis, Oracle Primavera Cloud Risk and Oracle Crystal Ball.
What is project risk management?
Project risk management is the systematic identification, assessment, analysis and control of uncertain events that could affect a project's objectives: its finish date, budget, scope and quality. Risks are not only threats; opportunities (positive risks) are handled by the same process.
A traditional schedule assumes a single duration and a single cost for every activity. In reality durations and costs are uncertain, and weather, supply delays, design changes and resource problems keep affecting the plan. A single-point schedule therefore doesn't tell you when the project will finish, only when it could finish if everything goes to plan. Quantitative risk analysis closes that gap by answering, with a number, "how likely are we to finish by this date?"
The project risk management process, step by step
- Prepare and check the scheduleA risk analysis is only as reliable as the schedule behind it. Missing logic, constraints and errors are found and fixed before the analysis.
- Identify the risksThreats and opportunities are captured in a risk register, with an owner, cause and the affected activities for each risk.
- Assess them qualitativelyProbability and impact scores rank the risks, and a probability–impact matrix highlights the most critical ones.
- Model uncertainty and riskActivity durations and costs get three-point estimates (optimistic, most likely, pessimistic) and distributions; risks are linked to the activities they affect.
- Run the Monte Carlo simulationThe schedule is simulated thousands of times, producing probability distributions for finish date and cost, P50/P80 values and tornado charts of the key drivers.
- Plan and track responsesPre- and post-mitigation analysis shows what each response is worth; contingency is set and the risks are kept up to date throughout the project.
Project risk management the PRAM way
The process on this page is consistent with the Project Risk Analysis and Management (PRAM) Guide published by APM, the UK's professional body for project management (Association for Project Management). PRAM describes risk management as five phases forming a cycle that is managed throughout the project:
- Initiate Scope, objectives, roles and the risk management plan
- Identify Finding threats and opportunities
- Assess Qualitative and quantitative (Monte Carlo) analysis
- Plan responses Avoid, reduce, transfer, accept; and how to exploit opportunities
- Implement responses Putting responses into action and tracking them
The 3rd edition, published in 2025, puts weight on treating threats and opportunities equally, on the quality of estimates and data, on risk culture and on the cognitive biases that affect judgement. The guide is aligned with ISO 31000 and PMI's PMBOK.
Source: APM, Project Risk Analysis and Management Guide, 3rd edition (2025) · apm.org.uk →
The probability–impact matrix
Each risk is scored 1–5 for probability and for impact; the product of the two sets its priority. Risks in the dark zone (R1 in the example) come first in response planning, while those in the light zone stay on a watch list. The same matrix is used for opportunities, in the direction of positive impact.
- 1–4Low: monitor
- 5–9Medium: assign an owner, consider a response
- 10–15High: plan a response
- 16–25Critical: act now and report to management
Illustrative example; scales and thresholds are set in your organisation's risk management plan.
Three risk management solutions for different needs
All three use Monte Carlo simulation. The difference is who works with them, where, and on what data.
Primavera Risk Analysis (Pertmaster)
The industry-standard schedule and cost risk analysis tool for risk specialists. It takes Primavera P6 and Microsoft Project schedules and offers schedule checks, a risk register, probabilistic branching, weather modelling, correlation and probabilistic cash flow.
- Best forProjects where a risk specialist runs detailed analyses
- Stand-outProbabilistic branching and probabilistic cash flow
Oracle Primavera Cloud Risk
A cloud-based risk register and analysis environment where the whole project team manages risks together in the browser. It includes a unified project and program risk register, Schedule Health Check, pre- and post-mitigation Monte Carlo analysis, dashboards and notifications, and integrates directly with Primavera P6 EPPM.
- Best forOrganisations that manage risk continuously, as a team
- Stand-outShared risk register, dashboards and P6 EPPM integration
Oracle Crystal Ball
A simulation, forecasting and optimisation tool that runs in Microsoft Excel. Rather than a schedule, it applies Monte Carlo simulation to your Excel cost estimates, budgets, feasibility studies and investment models, and uses OptQuest to find the best decision under uncertainty.
- Best forCost estimates, bids and investment analysis
- Stand-outExcel models, forecasting and optimisation
Which risk software is right for you?
| Primavera Risk Analysis | Oracle Primavera Cloud Risk | Oracle Crystal Ball | |
|---|---|---|---|
| Runs on | Desktop (Windows) | Cloud, in the browser | Microsoft Excel add-in |
| Analyses | Schedules (time and cost) | Schedules and the risk register (time and cost) | Excel models (cost, budget, investment) |
| Users | Risk specialist | The whole project team, shared register | Analyst / cost engineer |
| With Primavera P6 | Imports P6 schedules | Direct integration with P6 EPPM | — |
| Risk register | ✓ | ✓ Project and program level | — |
| Monte Carlo simulation | ✓ | ✓ | ✓ |
| Forecasting and optimisation | — | — | ✓ CB Predictor, OptQuest |
For a feature-by-feature comparison of Primavera Risk Analysis and Oracle Primavera Cloud Risk: Primavera Risk Analysis or Oracle Primavera Cloud Risk? →
P50, P80 and contingency
Monte Carlo simulation calculates your schedule thousands of times, each time with different durations and costs. The result is a probability distribution instead of a single date.
- P50A 50% chance of finishing on or before this date
- P80The confidence level most organisations use for commitments and budgets
- ContingencyThe gap between the deterministic plan and the target confidence level
- Tornado chartThe risks and activities that drive the result most
Beyond the software: training and implementation
Primavera Risk Analysis training
Risk analysis methodology, schedule checks, defining uncertainty and risk events, Monte Carlo and reporting, hands-on with Oracle-certified consultants.
Oracle Primavera Cloud Risk training
The risk register, risk assessment, response planning and risk analysis in Primavera Cloud.
Implementation
Licensing, installation, P6 integration and rolling out a risk management process in your organisation.
Frequently asked questions
Is project risk management the same as risk analysis?
No. Risk analysis is one step of project risk management. Risk management covers identifying, assessing and analysing risks, planning responses and tracking risks throughout the project. Quantitative risk analysis (Monte Carlo) is the step that measures the schedule and cost impact in numbers.
What is Monte Carlo simulation?
A method that calculates a model thousands of times, each time with random values for the uncertain inputs (durations, costs, risk probabilities). It produces probability distributions for the project's finish date and cost, with confidence levels such as P50 and P80.
I use Primavera P6. Which risk software should I choose?
Primavera Risk Analysis suits a risk specialist running detailed analyses, especially when you need advanced modelling such as probabilistic branching or probabilistic cash flow. Oracle Primavera Cloud Risk suits teams that manage risks together in the browser and want direct integration with P6 EPPM. See our detailed comparison.
Is Crystal Ball project risk software?
Crystal Ball is a general-purpose simulation and optimisation tool that runs in Excel. Instead of a schedule, it analyses the risk in Excel cost estimates, budgets, bids and investment models, which makes it a popular choice for cost risk analysis on projects.
Can I run a risk analysis on Microsoft Project schedules?
Yes. Primavera Risk Analysis and Oracle Primavera Cloud Risk both work with Microsoft Project schedules.
Can I try the products?
Yes. We offer a trial version and a live demo of Primavera Risk Analysis, and a live demo of Oracle Primavera Cloud Risk. Just fill in the demo request form.
Let's look at your project risks together
We'll show you which solution fits, in a live demo on your own schedules.