AACE 132R-23 Level 4 risk-driven scheduling explained

AACE International (the Association for the Advancement of Cost Engineering) publishes Recommended Practices that codify how cost and schedule professionals should do their work. RP 132R-23 is the recommended practice for Quantitative Schedule Risk Analysis — the discipline of attaching probabilities to a project's finish date instead of presenting a single deterministic date as if it were certain.

The core idea is that a deterministic critical path schedule answers "when does the plan finish if nothing varies?" — a question no real program ever lives in. QSRA answers the question sponsors actually ask: "what is the probability we finish by this date, and how much schedule contingency do we need to be 80% confident?" RP 132R-23 sets out the inputs, methods, and reporting that make that probabilistic answer trustworthy.

The 132R-23 maturity model classifies a risk analysis by how rigorously the schedule's confidence dates were derived. Each level adds modeling fidelity over the one below it.

A Level 4 analysis is the fully risk-driven tier, and it has concrete, checkable requirements. It is not a label you can claim by running a single uncalibrated simulation.

First, every relevant activity needs a defensible three-point estimate (optimistic / most-likely / pessimistic), not a uniform blanket range. Second, a maintained risk register supplies discrete risk events with probability and impact, and each event is explicitly mapped to the activities it would hit, so the simulation injects real, traceable risks rather than generic noise. Third, a Monte Carlo engine runs thousands of iterations across the network — respecting the dependency logic, and where appropriate modeling correlation between activities so common-cause risks are not understated.

The simulation then yields confidence dates (P50, P80, P90), and schedule contingency is set from that distribution — for example, the gap between the deterministic date and the P80 — rather than from a flat percentage. Sensitivity outputs (a tornado of which activities most drive the finish date, and a criticality index showing how often each activity lands on the critical path) explain where the risk lives. Finally, the whole chain — register, mappings, distributions, inputs, assumptions, and the resulting contingency decision — must be auditable, so a reviewer can reconstruct exactly how the confidence dates were produced.

Regulated and capital-intensive R&D programs cannot present unfounded dates. A biotech board deck that carries a P50 IND date no one actually computed, or a DARPA milestone with no probabilistic backing, is a credibility risk — and in late-stage pharma, where cost of delay can run on the order of hundreds of thousands of dollars per day, a soft estimate is also a financial one. Level 4 forces the discipline of deriving those dates from an explicit, reviewable risk model.

Federal sponsors and FFRDCs increasingly expect AACE-grade risk-driven scheduling, and pharma quality cultures expect the same defensibility they apply to everything else. The audit trail is the heart of it: when a regulator, a sponsor, or an internal reviewer asks "why is the contingency this size?", a Level 4 schedule can answer with the register, the mappings, and the simulation rather than with judgment. That traceability is also the foundation on which heavier compliance regimes (such as 21 CFR Part 11 electronic records and signatures) are later built.

CritPath AI implements the full AACE 132R-23 Level 4 model as built-in product behavior rather than an analyst's spreadsheet exercise. PERT-Beta three-point estimates feed a Monte Carlo engine that injects discrete risk events from the risk register, optionally models duration correlation, and reports P50/P80/P90 confidence dates with a tornado sensitivity chart and a criticality index. Schedule contingency follows from that distribution, and an append-only audit log records the inputs and decisions so the result is reconstructable end to end.

Because the engine also runs CPM (four dependency types, lag, float, near-critical) and TOC / Drum-Buffer-Rope alongside the simulation, and because a Claude + Gemini copilot reasons over the actual dependency graph, the risk numbers are explainable in context — which activity is driving your P80, what a gate decision does downstream. CritPath is $10 per user per month for every standard feature, with AI usage billed separately by metered usage. The audit-trail foundation for regulated programs is in place today; full 21 CFR Part 11 electronic signatures and re-authentication are on the Enterprise roadmap and are not yet shipped, so they should not be relied on as available.