Price a risk register, not its average
Four discrete risks add up to a $7,050 expected cost. The outcome is never $7,050. A worked example shows what to price instead of the average.
A risk register is a list of lumpy outcomes
A task range describes ordinary variation: it takes a bit longer or a bit shorter. A risk event is different. It either happens or it does not, and when it does it adds a block of cost. The usual way to price a register is to multiply probability by impact for each line and add the results. That figure is a legitimate average, but it is not what the project will cost.
Four risks, worked through
Assume four independent, illustrative risks on a fixed-price delivery:
| Risk | Probability | Added cost if it happens | Probability × impact |
|---|---|---|---|
| Client content arrives late | 30% | $6,000 | $1,800 |
| Third-party API changes | 20% | $12,000 | $2,400 |
| Key person unavailable | 15% | $9,000 | $1,350 |
| Security review forces rework | 10% | $15,000 | $1,500 |
The expected added cost is $1,800 + $2,400 + $1,350 + $1,500 = $7,050. Now enumerate every combination of the four events. The chance that none of them happens is 0.70 × 0.80 × 0.85 × 0.90, or about 42.8%. In that world the risk cost is $0. The most common non-zero outcome, the client delay alone, has a probability of 18.4%. A risk cost of exactly $7,050 is not one of the possible outcomes.
| Risk cost at or below | Probability |
|---|---|
| $0 | 42.8% |
| $6,000 | 61.2% |
| $9,000 | 68.8% |
| $12,000 | 79.5% |
| $15,000 | 87.5% |
| $21,000 | 96.0% |
What to read from it
- The median is $6,000, the P80 is $15,000. Quoting the average of $7,050 gives roughly a 61% chance the risks cost less and a 39% chance they cost more. About one outcome in eight exceeds $15,000, and about 8% exceed $20,000.
- Most of the time the reserve is unused, and sometimes it is far too small. That is the nature of discrete risks, and it is why a flat percentage on the base estimate is a poor tool for them.
- The reserve is a policy choice. Decide the confidence you want to hold, then read the matching figure: $6,000 for a median reserve, $15,000 to cover about 87% of outcomes.
Keep the register honest
Probabilities in a register are judgments, not measurements. Write the reason beside each one, check them against jobs you have actually finished, and revisit them when scope changes. Independence is also an assumption: two risks driven by the same client are not independent, and treating them as if they were understates the chance of several hitting at once.
Keep risk events out of your task ranges so the same delay is not priced twice; contingency without double counting shows how. Then check the resulting quote's loss probability with the fixed-price project calculator.
Try the calculation or follow the workflow
- Calculator
Risk mitigation value calculator
Compare expected risk cost before and after mitigation. Find net expected benefit and the break-even mitigation spend without confusing averages with reserves.
- Calculator
Project contingency calculator
Calculate a contingency reserve above a named cost baseline at P50 to P99 using a clearly labeled PERT normal approximation. Free worked example.
- Guide
Bid review checklist: a defensible price and delivery decision
Review scope, cost assumptions, confidence, capacity, risks, cash flow and quote authority before bidding. Includes an interactive downloadable checklist.