The Top 6 Project Risk Analysis Tools in 2024

6 Best Project Risk Analysis Tools in 2024

by David Vose
Published: 14 February 2024

Summary of key review points

Product reviewed What you may like What you may not like Cost over 3 years ( )
Acumen Risk Simple interfaces
Single risk to multiple impact is realistic
Manages the correlation problem
Limited options for describing risk, especially no range for risk impacts
Primavera Risk Analysis (PRA) Nostalgia Not updated in 10+ years
Very complicated interfaces
Schedule Risk Analysis Runs in Excel, so lots of options for bespoke modelling Slow
Excel not ideal for networks
Risky Project Inexpensive
Feature rich
Overly complex interfaces
~1,300 + maintenance
Safran Risk Very similar to PRA, but faster Limited options for describing risk
Poor handling of correlation
~14,000 + maintenance
Tamara Fastest
Largest options for describing risk
Handles the correlation problem
No ability to build schedule from scratch or edit links ~5,900

Acumen Risk

~ $14,300/3 years

What you may like:

  • Simple interfaces
  • Single risk to multiple impact is realistic
  • Manages the correlation problem

What you may NOT like:

  • Limited options for describing risk, especially no range for risk impacts
  • Price

Primavera Risk Analysis (PRA)

~ $10,800/3 years

What you may like:

  • Nostalgia

What you may NOT like:

  • Not updated in 10+ years
  • Price
  • Very complicated interfaces

Schedule Risk Analysis

~ $13,100/3 years

What you may like:

  • Runs in Excel, so lots of options for bespoke modelling

What you may NOT like:

  • Slow
  • Excel not ideal for networks
  • Price

Risky Project

~ $13,300/3 years
+ maintenance

What you may like:

  • Inexpensive
  • Feature rich

What you may NOT like:

  • Overly complex interfaces
  • Aesthetics

Safran Risk

~ $14,000/3 years
+ maintenance

What you may like:

  • Very similar to PRA, but faster

What you may NOT like:

  • Limited options for describing risk
  • Poor handling of correlation
  • Price
Best Price


~ $5,900/3 years

What you may like:

  • Fastest
  • Price
  • Largest options for describing risk
  • Handles the correlation problem

What you may NOT like:

  • No ability to build schedule from scratch or edit links

My recommendation

If you have a very limited budget, RiskyProject offers a lot of value for money. Conversely, in my view, ScheduleRiskAnalysis is very poor value for money from a project risk perspective because it is one component of a larger suite of tools. Primavera Risk Analysis is no longer developed or supported so your IT department probably won’t let you use it.

If you can afford a bit more, please read the rest of this article because, in all fairness, Acumen Risk, Safran Risk and Tamara are all fine products and the one best suited for you will depend on the typical types of projects you work on and the nature of their risks. Either Tamara is underpriced or the other two overpriced because they are pretty equal overall. If you want to jump ahead, here are the sections:

The approach I’ve taken in this review

First off, Tamara – the last software listed in the table above – is made by my own company, so keep an eye out for any bias. I hope you’ll have to look quite hard.

This review begins with an explanation of why I think you should do a project cost and schedule risk analysis. That comes down to two things:

  • You won’t get a realistic idea of how much the project will cost, or how long it will take, without one
  • You will miss out on opportunities to do the project quicker, for less cost and with greater predictability

Then I look at what I think are the key practical issues and modelling challenges around producing a good quality project risk analysis. Some will be relevant to your circumstances, others perhaps not so much, and the way each software product addresses the issues of relevance to you should help you pick out the products to take a closer look at.

In my review of Excel risk analysis add-ins, I was able to download and thoroughly test each product. That hasn’t been the case here since downloads for most products are not easily available. So, to keep the playing field even, I am summarising from the documents and videos I was able to find, and judged whether I had enough information to state whether the products addressed the issues I describe below. Getting pricing information was also tricky. I suggest you request a firm quote from vendors for the total cost of three years of ownership including maintenance and updates before making up your mind.

Looking good is nice, but I haven’t paid much attention to it – at least one product looks dreadful in my view but has a lot of great features. What matters most is whether you will be able to do a good risk analysis for your purposes, and whether you could do it without fighting the software too much.

Why you might value my review

I’ve worked as an independent risk analysis consultant for thirty or so years. I’ve written several books on risk analysis as well as some international guidelines for organisations like the WTO, WHO, EPRI and The Open Group, and I’ve co-authored UK’s Association for Project Management risk analysis guidebook.

David Vose quantitative risk analysis books covers

Reasons why a project risk analysis is valuable

A project schedule built in Primavera, Microsoft Project, etc. is a great planning tool. It allows you to:

  • List the tasks necessary to deliver a completed project
  • List the resources necessary to complete each task
  • Describe the sequencing of tasks, and their dependence on other tasks being completed
  • Communicate the project execution plan to stakeholders
  • Track progress on the project

A project scheduling tool is therefore very useful for managing a project, but it has its limits. You also need a project risk analysis tool …

Reason 1: Project risk analysis provides more realistic delivery goals

Add start, finish and task duration data to a project plan and the scheduling software will estimate milestone and completion dates. Add resource cost rates and expenses and the software will estimate a total cost for the project. Many people use these estimates to set a target delivery date and budget. These estimates will almost always be quite optimistic, often wildly so. I’d argue that the duration and cost estimates one gets from a scheduling tool are essentially useless. Why is that?

Scheduling tools fail to provide realistic estimates of duration and cost because they do not include uncertainty and risk events, both of which increase the likely cost and duration. Risks are easier to understand. For example, the risk that one may have a planning application rejected could result in a resubmission of the application which takes time and money. That will not typically be included in a normal project plan.

The effect of uncertainty is a little less intuitive. Imagine that, as part of a construction project, you will need to dig some foundations. If the weather is perfect, you estimate it will take as little as 30 working days to complete. If the weather is “normal”, you estimate 35 days to complete, but if the weather is horrendous, it could as much as 50 days, perhaps more. This could be represented with a probability distribution:

Example of how a triangular probability distribution is used to describe uncertainty

The blue line describes how relatively likely the task duration is to be each value on the horizontal axis. The likelihood is zero below 30 days (the minimum) and above 50 days (the maximum) and is highest at 35 days (the most likely outcome). Note that the distribution extends further to the right (50-35 = 15 days) of the most likely estimate than it does to the left (35-30 = 5 days). This skewed shape reflects reality quite well. We endeavour to do things as quickly and cost-effectively as possible, so if things go perfectly we may save a little time or money – but not much. On the other hand, if things get out of control, we could take a great deal longer and spend a great deal more money. A mathematician can prove to you that when a probability distribution is skewed to the right like this, there is always less than a 50:50 chance of coming in under the most likely estimate. In this distribution, the chance is only 25%, and the 50:50 duration is about 38 days:

How a three point distribution corrects for the optimism bias of a best guess estimate

This means that the most likely duration (or cost) will nearly always be optimistic. If you build a schedule based on “best guesses”, i.e. costs and durations that are the most likely to occur, you are piling up one optimistic estimate on top of another. If you’ve ever wondered why projects come in late and over budget, even when nothing goes wrong, this bit of probability maths is the explanation.

In summary, scheduling tools are great for planning, organising, and managing a project, but should not be used for estimating budgets and delivery dates for important projects. Project cost and schedule risk analysis tools will give you more realistic estimates.

Reason 2: Saving time and money, and gaining predictability

We’d all like our projects to cost less and finish earlier. A project risk analysis tool can tell you which activities are influencing the total cost and duration the most. It can also tell you which activities are most driving the unpredictability. In the planning stages of a project, that information can be used to test out different approaches to executing the project, and selecting the one that is most likely to produce the outcome you are looking for. During the execution of the project, some tasks will have been completed and some risks no longer relevant, which means you can fine tune your project as you go along.

The essentials of producing a good project risk analysis

Hopefully, by now I’ve convinced you it’s worth performing a risk analysis. However, I believe it is better not to do a risk analysis at all than to do one that is quite wrong. A poor risk analysis can lead you to commit to a project full of unknown terrors or reject one that is quite benign. In this section, I point out the common failures in risk analysis modelling of a project. That will help you appreciate the features each reviewed tool has to overcome these failures and, when such features are absent, what you are letting yourself in for.

Massive schedules

If you run highly complex projects, they will come with very large operating schedules (say 10,000 tasks +). Usually, there will be a lot of detail for imminent work, getting progressively less detailed projecting out into the future. Then as the project evolves, and tasks are completed, the next wave of activities are broken down into more detail. Project risk analysis is done using Monte Carlo simulation which is very computationally intensive. It uses lots of computer memory and the simulation time is roughly proportional to the number of tasks in the schedule. Historically, it has been quite impractical to run a Monte Carlo simulation on very large schedules because the software couldn’t load the schedule or perform a simulation run within a reasonable time frame (i.e. minutes, not days) so people had one master schedule for coordinating the project, and another for doing risk analysis. As schedules get big and complex, maintaining a second cutdown schedule for the risk modelling becomes impractical, as well as extremely tedious.

Breaking down a large task into smaller ones as greater detail becomes needed brings its own problems for risk analysts. I’ll give you an example – let’s say that you are building a fence, and estimate it will take Triangle(30,40,60) days to complete. As the time comes closer to building that fence, you break it down into 10 equal sections, each taking Triangle(3,4,6) days to complete. Suddenly, your risk analysis shows a dramatic reduction in the time to complete the project:

Uncertainty contraction effect as a result of breaking a task down into several parts

The reason is that your project risk analysis software is assuming each of these tasks is statistically independent, i.e. that if the first fence section takes a very long time (6 days), it says nothing about whether the next section will take a short or long time. The Law of Large Numbers (LLN) helpfully explains that this will reduce the calculated uncertainty. Software handle this in three different ways: (1) it does nothing and hopes you won’t notice; (2) it uses a simulation trick to ensure that all distributions in a group are sampled with 100% correlation; or (3) it asks what is driving the uncertainty, and makes all task durations dependent on that external factor.

One last practical thing – if you have a schedule of 1,000’s of tasks, imagine how tedious it would be to assign uncertainty to each one. Assigning bulk uncertainty is very useful. This is usually done by selecting a group of tasks and applying a global percent variation to each. But be careful – if the duration uncertainty for a large group is due to a common factor – like the competence of a contractor – you are faced with the LLN problem again, so make sure that is captured or you will greatly underestimate the risk.

Conclusion: if you are intending to simulate large schedules, make sure the project risk software can handle the size, runs really fast, includes a way to handle the LLN problem, and can assign uncertainty to large groups of tasks in a flash.

Describing uncertainty

Probability distributions are used to describe the uncertainty of task durations and cost items. There are plenty of different distributions to choose from. Here are the most common:

Probability distributions typically used for describing task duration and cost uncertainty in a project

  • Uniform – because it is so crude
  • Split Triangle – because it doesn’t match what people want to say
  • Normal– because the mean and standard deviation inputs are unintuitive, and life is not symmetric
  • Lognormal – same mean, standard deviation issues, and the tail can be wildly uncontrolled

  • Triangle – because people understand it, even if its crude, but it tends to overestimate uncertainty
  • PERT – a curvy Triangle, easy to understand, but it tends to underestimate uncertainty

  • Modified PERT –Last parameter alters how flat the curve is, controlling over/underestimation of uncertainty. I invented it, so a bit biased
  • ThreePoint – a Modified PERT where you give a “practical max”(like a 95th percentile) instead of the absolute max which is very hard to elicit from an SME. It’s a distribution specific to VOSE software products, so perhaps a bit biased here

Conclusion: make sure the software offers at least one of the orange or green smiley face distributions. Ignore red smiley face distributions.

Single risk event, multiple impacts

Think of a risk event like a supplier goes out of business. There could be multiple impacts – delays to procurement of various materials, different additional costs, etc. These consequences will either all happen together, or not at all. If you can’t model that properly, you’ll underestimate the total risk and the value in managing your supply risk.

Conclusion: make sure the software can map single risks to multiple consequences if that’s something that could realistically happen in your world.

Describing risk event frequency

Risk events are things like strikes, equipment failure, and accidents. They happen or they don’t. If they happen, they add some cost or delay or both. Many risks can happen more than once, in which case you’d want to be able to describe that. The likelihood of occurrence of risks that could only happen once (like the building is destroyed) is described by a probability. The likelihood of occurrence of repeatable risk is described by an expected frequency (like 0.7 times/year). If the software only allows describing single risks, and you have repeatable ones, you’re going to have to do some juggling with the model or you’ll underestimate the uncertainty.

Conclusion: make sure the software can distinguish frequency and probability if you have repeatable risks.

Dreadful weather

Weather can be very important, e.g. if you do offshore work or operate in a part of the world with extreme seasons or weather events. Risk analysis software usually manage this with weather calendars.

Conclusion: if weather is something you fight against, check to see whether the software can handle it.

Complex cost model

Schedule models typically allow you to enter various types of cost:

  • A fixed cost incurred at the beginning, middle or end of a task
  • Rates for resources (e.g. $/hr for workers, $/day for equipment), attached to tasks and prorated by their duration
  • Expense rates (like office site rental) that are independent of individual tasks

Project risk analysis software typically pick these values up, adds some uncertainty as needed, and adds the possible costs of risk events to get an aggregate estimate of the total project costs. But that is only part of the picture. There will be many other costs that have no practical place in a schedule – legal and license fees, costs of materials, insurance, financing costs, etc. These are typically analysed separately by cost engineers and financial analysts – and they also have a lot of uncertainty. The results of these two risk models need to be merged somehow to get a full picture.

Conclusion: if you are interested in the uncertainty of the total cost of a project, not just the schedule-related part, the software needs to be able to integrate the two sources either by exporting the data in some form or by including a spreadsheet simulation tool within the product.

Investment risk analysis

Most projects are undertaken to provide some financial return. For example, a new product is developed to sell into the market, or a new building is constructed to rent out. Typically, the upfront investment associated with the project execution is set against the forecast cashflows using a discounted cashflow (DCF) model, calculating financial metrics like net present value (NPV). When the project takes longer to finish, it will incur additional costs eroding the NPV, but the delay in receiving the compensating cashflows also reduces the NPV.

Discounted cashflow calculations are typically performed in Excel, and the uncertainty around those cashflows (and hence the NPV achieved) is evaluated using an Excel risk analysis add-in like ModelRisk. Discount rates are usually in the range of 10-15% per annum. A solid internal rate of return (IRR) would be around 20-25%, and a marginal IRR would be around 5%. Thus, if a project has a lot of upfront cost, a delay of 1-2 years can easily turn the investment from a great opportunity to a financial failure. The effect of project cost and schedule overrun risk, and the cost profile over time, need to be factored into the discounted cashflow models in such cases.

Conclusion: if your business uses risked DCF models to select potential investments, your development project risk analysis will need a mechanism to export the simulated cost time series to a spreadsheet risk analysis tool. Better still, the project risk analysis software could have a built-in spreadsheet simulation tool.

Suitability of the baseline schedule you want to use

Project risk analysis tries to predict what might happen by accounting for all the major uncertainties and risks that impact a project. You can imagine that a schedule that includes milestones and task finish dates that are locked don’t really match that idea. Similarly, a schedule that has leading lags (e.g. task B will start 30 days before task A has finished) is pretending to know what the future holds (what if task A gets delayed ¾ of the way through?). Or two tasks will finish together (F-F). Most of these non-Finish-Start links are common planners’ shorthand for a more intricate network, but you should be aware how they can be in contradiction with a risk analysis model that simulates and builds on predecessors only.

Conclusion: make sure your schedulers understand that fixed milestones are banned, and that F-S link logic is the best way to go whenever possible. Also, the project risk analysis software should do a logic check on a schedule during import and highlight any problems.

Have you thought about a spreadsheet model?

If, for your purposes, you can decently summarise your project into a small set of tasks, you can build a quick schedule model in a spreadsheet. You can read about, download and play with a couple of example models here and here.

Project risk analysis software comparison table

Depending on your circumstances, in my view the lines in bold are the most important in differentiating between the products.

Product name Acumen Risk Primavera Risk Analysis Schedule Risk Analysis Risky Project Pro Safran Risk Tamara
Publisher Deltek Oracle Lumivero Intaver Safran Vose

Cumulative cost (USD - see reference):

1 year 10 300 10 800 4 355 1 200 14 000 2 140
2 years 12 300 10 800 8 710 ? ? 4 100
3 years 14 300 10 800 13 065 ? ? 5 900

Schedule-related features

Imports from (1): PV, MSP, OP PV, MSP PV, MSP PV, MSP PV, MSP PV, MSP
Performs update against master schedule Unsure Unsure Unsure
Performs schedule quality check Partial Partial
Imports cost data Partial
Edit schedule tasks and links
Create schedule from scratch
Runs very large schedules Unsure
Simulation speed (educated guess) Fast Slow Very slow Medium Fast Very Fast

Risk information input

Uncertainty in task duration as %
Uncertainty in task duration in units
Uncertainty in scope as %
Uncertainty in scope in units
Uncertainty in cost item as %
Uncertainty in cost item in units
Uncertainty of risk impact size
Uncertainty in productivity rates
Group uncertainty factors
Resource cost uncertainty Unsure
Work type aggregate factors
Unplanned work risk events Manual
Task-specific risk events Manual
Calendar delay risk
Weather calendar Manual
Link to external risk register Import Import (Pelican)

Scenario analysis options

Switch risks on/off Manual
Define multiple scenarios
Risk treatment analysis

Analysis and reporting

Results for any task or milestone With rerun
Compare different scenarios on 1 plot
Tornado charts for sensitivity Partly
Tornado charts use natural numbers [2]
Critical index
Total cost-Finish date joint plot
Cost profile over time
Stochastic Gantt chart
Report templates
Export formats PV, MSP, OP PV, PV,

Mathematical basis

Distributions [3] N, T, U MP, P, T, U L, P, T, U, + L, N, P, T, U, + P, T, U Any
Repeatable risk event supported Manual
Simulation spreadsheets built-in
One risk maps to multiple impacts Manual
IF THEN conditional modelling Manual Manual
Avoids correlation coefficients Manual


  1. PV = Primavera, MSP = Microsoft Project, OP = Open Plan
  2. Natural numbers means in units of currency or time, not a rank order correlation which is unintuitive
  3. L = Lognormal, MP = Modified PERT, N = Normal, P = PERT, T = Triangle, U = Uniform

Screen caps