Probability distributions in PRQ

Every risk in the PRQ register has an impact distribution: a family of values the impact could take, with their relative likelihoods. PRQ supports three families — triangular, PERT, and fixed — chosen because they cover the practical spread of project-risk impact shapes without requiring elicitation any more elaborate than a low / most likely / high triple.

The job of this article is to make the choice between them deliberate. The wrong distribution exaggerates or hides tail risk; the right one matches the way the underlying impact actually behaves.

Triangular — the workhorse

Specified by three numbers: min, mode, and max. Every value in [min, max] is possible; the probability density is a triangle peaking at the mode and falling linearly to zero at the bounds. Mean is (min + mode + max) / 3; the distribution is symmetric only when mode = (min + max) / 2.

Reach for triangular when:

• You can elicit a low / most-likely / high triple from a workshop, but you don't have data on the inner shape.
• You want the bounds to be hard limits — values strictly outside [min, max] are impossible by construction.
• The default. If you can't articulate a positive reason to use something else, triangular is the safe choice.

Watch out for: triangular puts more weight on the bounds than most real-world impacts warrant. The probability of a value within ±10% of the bound is roughly 5% — which sounds small, but it's larger than you'd expect from a process that's actually skewed toward the mode.

PERT — when extreme values are unlikely but not impossible

Same three parameters as triangular (min, mode, max) but the density is a smooth bell-shaped curve concentrated near the mode. Originally from the US Navy's Program Evaluation and Review Technique (1958), which is where the name comes from. Mean is (min + 4·mode + max) / 6 — note the 4× weight on the mode, which captures the assumption that most outcomes cluster near the mode.

Reach for PERT when:

• You believe the mode genuinely is the most likely outcome by a significant margin and the bounds are rare-tail, not plausible-tail.
• The impact is the result of summing many small effects (central- limit-style behaviour). Schedule-driven cost overruns often fit this — many small slip-causes, summing to a near-mode total most of the time.
• You want the standard "expected value" interpretation: PERT's mean weights the mode 4× the bounds, which most stakeholders intuitively expect.

Watch out for:PERT understates real tail risk compared to triangular. If you genuinely think the worst case could happen with appreciable probability (say, >5%), triangular is more honest.

Fixed — when the impact isn't actually a distribution

A single value. Specified as value. Used when the impact, given that the risk triggers, is essentially known — contractually fixed penalties, predictable per-incident costs, regulatory fines with a published schedule.

Reach for fixed when:

• The impact is a price tag, not a range. "$50k regulatory fine if breach is reported" is fixed; "customer notification costs" is not.
• You want to keep the model honest about which risks have uncertain impact and which don't. A register full of fixed impacts produces a degenerate Monte Carlo run; a mix tells a richer story.

Watch out for: tempting to use fixed for "everything we don't have data on" because it's the simplest input. That collapses the variance the simulation exists to capture.

Eliciting parameters in a workshop

The practical bottleneck on PRQ accuracy isn't the engine — it's the per-risk distributions. A small playbook that works:

1. Ask for the most likely value first. "If this risk triggers, what's the single number you'd put as the central guess?" That's the mode. Don't anchor with a range yet.
2. Ask for the optimistic value second. "What's the value below which there's only a 5–10% chance the impact falls?" That's the min. (Not the absolute minimum — anchoring on the absolute extreme produces narrow distributions.)
3. Ask for the pessimistic value last. "What's the value above which there's only a 5–10% chance the impact falls?" That's the max.
4. Sanity-check the spread. A max-to-mode ratio above ~5× usually means either the SME has factored in low- probability tail events into the bounds (split the risk), or they're under-confident (push back).
5. Pick the family last. Triangular by default; PERT if the SME reacts strongly to "could the worst case actually happen?" with "no, that's basically impossible".

What about lognormal, beta, custom?

PRQ deliberately doesn't expose lognormal, beta, normal, uniform, or arbitrary user-specified distributions. Three reasons:

• Elicitation gets harder. Lognormal and beta need parameters most workshop SMEs can't reason about (geometric mean, σ in log space; α and β shape parameters). Triangular and PERT take three numbers that any project manager can supply.
• Marginal accuracy gain. Most project-risk impacts are positively skewed and bounded. Triangular and PERT cover the practical spread; the gap to a "correct" lognormal fit is usually well inside the elicitation noise.
• Calibration discipline. Restricting the input vocabulary forces the conversation to be about the numbers rather than the shape.

If you need a distribution PRQ doesn't model, the right move is usually to split the risk into two with different bounds, or to elicit the impact as the sum of several smaller risks with their own distributions.

How PRQ samples them

Internally, PRQ uses inverse-CDF sampling for each distribution — draw a uniform [0, 1) random, look up the value at that quantile of the distribution. For triangular this is a closed-form lookup; for PERT it's parameterised as a four-parameter beta and uses a fast incomplete-beta inverse. Fixed is just the value. The sampling is statistically correct (no rejection bias, no premature truncation) and fast — a 50 000-iteration run on a 10-risk register completes in under 100 ms in a Web Worker on modern hardware.