Methodology

Reading simulation outputs

Every run in PRQ or Event Risk Exposure ends in the same three kinds of picture: a histogram, an S-curve, and a tornado chart, plus a row of percentiles. The tools draw them automatically; reading them is a skill, and it is the skill this page teaches. The one-line version: the histogram tells the story, the S-curve makes the decision, and the tornado tells you where to spend your next hour of analysis.

The histogram: the shape story

The histogram is the raw distribution of simulated outcomes. The Commonwealth's probabilistic-estimation guidance (Guidance Note 3A) puts its purpose plainly: a histogram is useful in telling the risk "story": the mode (most likely outcome), the range, "the skewness of the distribution, whether there are long tails, and/or whether there is any bimodality". Read it in that order:

Where is the bulk? The tallest region is the most likely neighbourhood of outcomes, and it is usually well below the tail figures people quote.
Which way does it lean? Cost-risk distributions are almost always right-skewed: a hard floor (things can only go so well) and a long expensive tail. Skew is why the mean and the median part company; Infrastructure Australia's guidance notes that where the distribution is positively skewed "the mean will be above the P50 value and may lie closer to the P90 value".
Is it one story or two? Two humps (bimodality) usually mean one large discrete risk is toggling on and off across iterations, splitting the outcomes into "it happened" and "it didn't" worlds. That is a finding: no single number summarises a bimodal distribution honestly.

The S-curve: the decision chart

The S-curve is the same data accumulated: for each cost, the share of iterations that came in at or below it. AS/NZS IEC 31010:2020 covers it as a technique in its own right (B.10.4): consequence data "can also be plotted as a cumulative distribution (CDF), sometimes referred to as an S-curve", and "the probability that a consequence will exceed a particular value can be directly read off the S-curve". That direct read is the whole point. Pick a cost on the x-axis, read the probability it won't be exceeded; pick a probability, read the cost. A P80 is nothing more than the S-curve read at 0.8, and the standard notes the cumulative form "makes it easier for a lay person to use this information".

The Commonwealth guidance makes the S-curve the terminus of the whole method: "the final output of the quantitative risk analysis process is a project cost Cumulative Distribution Function (CDF, or 'S' curve) that estimates the probability of exceeding a given cost", enabling decision-makers to "set an appropriate budget with the level of risk the organisation is prepared to accept". For Commonwealth-funded land transport projects that is not optional reading: projects over $25 million provide probabilistic P50 and P90 outturn costs "unless otherwise approved by the Commonwealth". Infrastructure Australia defines the two figures exactly as the S-curve gives them: a P50 estimate carries "sufficient contingency to provide 50 per cent likelihood that this cost would not be exceeded", a P90 the same at 90 per cent.

One more trick from the guidance: the S-curve reads intervals too. The probability of landing between two costs is the difference between their cumulative probabilities; in the guidance's own example, "the probability of the project cost being between $60 and $65 is 91%-44% = 47%".

Which percentile to fund or report is not a statistics question at all; it is an appetite question, covered on the appetite and criteria page and, jurisdiction by jurisdiction, on the Monte Carlo page.

The tornado: where to look next

The tornado chart ranks the register's risks by how much each one drives the total. The Commonwealth guidance gives both of its jobs: "the main use of a tornado diagram is to identify the most influential model parameters", and it doubles "as a sanity check to verify that what the model is calculating as the greatest risks meets with reasonable expectations". If the top bar surprises the people who know the project, either the model found something or the model is wrong; both are worth knowing before the number ships.

PRQ's tornado offers two views because "drives the total" has two honest readings. The rank correlation view (Spearman) asks: across iterations, how strongly does this risk's contribution move with the total? It rewards risks that fire often. The variance share view attributes the total's variance analytically, risk by risk, from each risk's probability and distribution (no re-simulation involved), and rewards large, volatile risks even when they rarely trigger. The shares are exact for an independent register; under a correlation matrix they are an upper bound, which the chart's own caption says. A mid-probability schedule slip can top the first view while a rare, huge cyber incident tops the second; they answer different questions, and the toggle exists so you can ask both. The techniques standard frames the underlying idea as sensitivity analysis: determining "the relative change to the results brought about by changes in individual input parameters", used to identify the inputs whose accuracy matters most.

The percentile strip, and Event Risk's version

Both tools print percentiles straight off the S-curve. Two reading rules keep them honest. First, percentiles belong to the distribution they came from: never add one project's P90 to another's (the Monte Carlo page covers why, with the standard's own warning against consolidating risks by adding them up). Second, in Event Risk the headline percentiles are unconditional: they include the iterations where the event never occurred. When treated occurrence drops low enough, a treated P80 can legitimately read $0; the tool's reporting-percentile chooser and the Event Risk guide explain how to pick a level the comparison survives.

Before you trust any of it

The standard's Monte Carlo entry (B.5.10) lists the limitations that matter here: the accuracy of the results "depends upon the number of simulations which can be performed"; the technique "relies on being able to represent uncertainties in parameters by a valid distribution"; and, most subtly, it "tends to de-emphasize high consequence/low probability risks": averaging over ten thousand mostly-ordinary futures can quietly bury the catastrophic one, which the standard warns "can give unwarranted confidence to the decision maker".

Check convergence before quoting a figure. PRQ's convergence badge measures whether the iteration count was enough for this register: it tracks the P90's confidence-interval half-width against 2% of the base estimate (or 1% of the P90 itself when no base estimate is set). Note it watches the P90 specifically, not whichever percentile you chose to fund. "Marginal" means run more iterations, not round the number harder.
Interrogate the tail, don't just admire it. If the P95 is doing the arguing, ask which risk generates it (the tornado's variance view will say) and whether that risk's distribution deserves the trust.
Reproduce it. PRQ's Seed field lets a quoted figure be re-run exactly. Event Risk's engine accepts a seed too (the worked example's published figures are seeded runs), but its screen does not yet expose one, so on-screen Event Risk figures vary run to run within the convergence noise. A number nobody can reproduce is an anecdote with decimals.

Sources

AS/NZS IEC 31010:2020, B.10.4 (S-curves), B.5.10 (Monte Carlo simulation: outputs and limitations), 6.4.2 (sensitivity analysis). Note the standard nowhere mentions histograms or tornado diagrams by name; those are grounded below.
Department of Infrastructure, Transport, Regional Development, Communications and the Arts, Guidance Note 3A: "Probabilistic contingency estimation", v2.0, November 2023 (histograms, S-curves, tornado charts, the CDF as final output).
Infrastructure Australia, "Guide to risk and uncertainty analysis", July 2021 (P50/P90 definitions; mean-versus-P50 under skew).
"Notes on Administration for Land Transport Infrastructure Projects 2024–29", June 2025 (the over-$25M P50/P90 requirement).