The risk assessment is only as good as the model on which it is built.

The model is built through a process of gathering stakeholders, identifying risks and opportunities, estimating the potential impact and selecting risks and opportunities for quantification.

The quantification process must be disciplined and deliberate.  

Whether you are doing a cost risk assessment, a schedule risk assessment or a combined risk assessment, the process is straightforward. This process is called ranging. When you range a risk, you assign typically three numeric values to the risk: Optimistic, Pessimistic, and Most Likely. For a cost risk, the range might be expressed in dollars or in percentages.  In a schedule risk exercise, the range will likely be expressed in days, but can also be a percentage.

The simulation is the easy part.

Once the model has been carefully and accurately built, running the simulation is a quick and easy step. However, interpreting the simulation results and adjusting the model in response is where the real payoff comes in the process of risk assessment.