What is schedule risk analysis (SRA)?

A standard Gantt chart assigns each task one duration and rolls those up into a single project finish date along the critical path. That single date is a point estimate — it ignores the fact that every duration has a spread, that early finishes rarely get passed downstream while late finishes always do, and that paths which are not critical today can become critical once a few tasks slip. The published date is usually closer to a best case than to a realistic commitment.

There is also a structural bias called merge bias: wherever several parallel paths feed one milestone, that milestone cannot start until the latest of them finishes, so the more paths that merge, the lower the odds that all of them are on time. A deterministic schedule cannot see merge bias at all, which is why summing point estimates systematically understates how long a program will actually take.

SRA needs two kinds of uncertainty as input. The first is duration uncertainty for individual tasks, captured as a three-point estimate — an optimistic, most-likely, and pessimistic duration — which is then fitted to a distribution (a PERT-Beta or triangular distribution is most common). This models the everyday variability of work that always takes a little more or less time than planned.

The second is discrete risk events drawn from a risk register: identifiable things that may or may not happen, each with a probability of occurring and an impact if it does (a vendor slips a CMC batch, an assay fails and must be repeated, a long-lead part is delayed). Unlike duration spread, a risk event either fires or it does not, so it is modeled as a probability gate on top of the base schedule. Good SRA also accounts for correlation — when the same underlying cause makes several tasks run long together — because ignoring it understates the tails.

With those inputs defined, a Monte Carlo simulation runs the schedule thousands of times. On each iteration it samples a duration for every task from its distribution, fires each risk event according to its probability, recomputes the critical path for that particular draw, and records the resulting project finish date. After enough iterations the recorded finishes form a distribution rather than a single number.

Because the critical path is recomputed on every iteration, the simulation naturally captures both merge bias and the way near-critical paths take over the schedule under stress — effects no deterministic calculation can reproduce. The simulation is the difference between guessing at a buffer and deriving one from the actual range of outcomes.

The headline output is a set of confidence dates: the P50 (50% chance of finishing on or before it — the realistic midpoint), the P80, and the P90 (progressively more conservative commitments). The gap between the deterministic date and the P80 is the schedule contingency you actually need — the buffer that makes a published date defensible rather than aspirational.

SRA also tells you where the risk lives. A criticality index reports how often each task landed on the critical path across all iterations, so you know which tasks truly control the finish. A tornado (sensitivity) chart ranks the tasks and risk events whose variation moves the finish date the most, turning a wall of uncertainty into a short, prioritized list of where mitigation pays off.

Schedule risk analysis has a recognized professional standard set. AACE International publishes recommended practices for it — notably RP 57R-09 on integrated cost and schedule risk analysis using Monte Carlo, and RP 132R-23, which defines maturity levels for risk-driven scheduling. Level 4, the most rigorous tier, integrates the quantified risk register directly into the schedule model with auditable traceability between risks, the tasks they hit, the simulation, and the resulting contingency.

This matters most in regulated and federally funded R&D, where a probabilistic milestone date must be backed by a defensible, inspectable method rather than a spreadsheet of guesses. AACE 132R-23 Level 4 is what turns 'we think we'll make the date' into an auditable risk-driven schedule a board, a regulator, or a program office can trust.

CritPath AI runs the full SRA workflow in one modern web app. You build the network with full CPM (four dependency types, lag, float, and near-critical detection), attach three-point estimates and a risk register, and run a Monte Carlo simulation that injects risk events, optionally correlates durations, and returns P50/P80/P90 dates, a criticality index, and a tornado sensitivity chart. The deterministic-to-P80 gap is surfaced directly as schedule contingency, and the same engine feeds CCPM buffers, Theory of Constraints / Drum-Buffer-Rope, decision gates with retroactive rescheduling, and EVM.

It is built for AACE RP 132R-23 Level 4 risk-driven scheduling with an append-only audit trail, and a Claude + Gemini AI copilot — grounded in your actual dependency graph — explains which task is driving your P80 slip and what a schedule change does downstream. CritPath is $10 per user per month with unlimited projects; AI usage is billed separately by metered usage. That is a modern alternative to legacy desktop QSRA tools that run roughly $10K+ per seat or are quote-only.