In general risk costs are not estimated as part of the initial estimates. How do you handle these costs? Through Change Requests? Any other thoughts on these costs? What is the best way to communicate these to Senior Management and Sponspors?

  • 2
    Are you saying that at your enterprise it is not common to perform cost estimates on risks? It is very common elsewhere, and this makes me wonder if I have misunderstood your question.
    – MCW
    Jul 19, 2013 at 18:03
  • May be few risks are part of the initial estimates. Few risks might be identified during the design or coding phase or late in the project. My question is how do you deal with those cost of the risks? Jul 20, 2013 at 5:56
  • 1
    Via management and contingency reserves. In addition, the planning values you choose also will have some risk buffer in them, unless you used a planning value in the low 20th percentile or thereabouts. Jul 20, 2013 at 12:57
  • But if you run out of money, you have to ask for more and that is the change control process. Jul 20, 2013 at 12:59
  • The costs of the risks are part of the project budget. The question of who pays for the risks is part of the contract and depends on the contract type ( eg firm fixed priced, cost plus, etc.) Jul 21, 2013 at 2:43

4 Answers 4


Without estimating the cost for risks, any cost or timeline estimate that you have provided to senior management or sponsors is a best-case scenario. You have set an expectation for when the project will be delivered and how much it will cost, but if any of those risks materialize you will not be able to meet those expectations.

In general, the impact (cost in currency and time) and likelihood (percentage) risks should be estimated, and ways to mitigate those risks should be identified (as well as the costs for the mitigations and the impact that they have on the risks - whether they reduce the cost of the risk or the likelihood of the risk materializing).

This information should then be included with your estimate along with your suggestion on how the risks should be dealt with. This means pointing out which mitigations you feel should be performed (and added directly to the estimate for the cost and timeline) and how much additional cost and timeline (from the remaining risk cost and likelihood) should be included in the estimate. A very simple way to do this is to just multiply each risk's cost by the likelihood of that risk and then sum those values. More complex methods also exist.

If your senior management and sponsors are open to it, you can provide a range for the cost and timeline, letting them know what the best case answer is as well as the worst case, and where on that spectrum things are most likely to fall.

It is important though to make sure that the proper expectations are set, and what your estimates represent. Ultimately, it will be up to the people providing the budget to decide on whether they want to pay to mitigate the risks or wait for the risks to materialize.


Best practices for risk management (as established in the Practice Standard for Risk Management) include quantitative analysis of costly risks. (Unless you are managing so much risk that costly risks fall below the threshold for quantitative evaluation of risks; in that case you have a serious problem).

Common methods to assess costly risks include

Although I've linked to wikipedia, the material in the Practice Standard is superior, but it is only available to PMI members and to those who wish to pay.

Standard practice on communicating these risks varies widely in my experience, but probably the most common is to establish the Expected Monetary Value with a range & confidence interval. "Current forest fires in the area of Supplier X mean that there is a significant risk that Supplier X will be unable to deliver widget Y on schedule. We estimate with an 80% confidence that this will cost the project $13,000"


Cost risk should be part of the initial estimate. It is unrealistic to paint a picture to Senior Management or sponsors that the effort will go exactly as planned.


Generally, risks ARE estimated in your initial estimates, which would include a firm budget on known mitigating actions as part of your cost baseline but also reserves that sit in both management and contingency for risks identified later or when unknown unknowns impacts you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.