The 8% Contingency Mandate on a First-of-Kind Integration

What I will not do: sign a one-line confirmation. 'Adequate' is a probability statement, and I cannot make one without a model or a credible comparable basis. Giving the sponsor a yes/no would transfer an analytical judgement into a political one.

How to frame it:

• The 8% is a policy ceiling for contingency at gate approval. It is not an assessment of this project's uncertainty. Name that distinction explicitly, to the sponsor and to the PMO.
• Separate contingency (known risks, held in the cost baseline, project-controlled) from management reserve (unknown unknowns, held above the project, sponsor/portfolio-controlled). The question 'is 8% enough?' conflates the two.
• Run a quantitative cost-risk analysis: three-point ranges per cost element plus the discrete register risks, correlated where there is a common driver (vendor platform maturity, client requirement stability). Report P50 / P80 / P90 exposure, not a single number.
• Present the result as a decision with options, not as a verdict: (a) tailored exception to the 8% rule, with the analysis attached; (b) keep 8% and hold a supplementary management reserve at portfolio level; (c) phase reserve release against defined trigger conditions instead of releasing it wholesale at gate.

Evidence to put on the table: the two prior overruns of 22% and 9% against an 8% policy. That is the policy's own track record in this portfolio, and it is the strongest single argument for a documented exception.

Ownership: I quantify and recommend. The sponsor owns the reserve decision; the PMO owns the policy exception. Record the decision, its basis and who made it in the risk management plan and the risk report so it is auditable later.

Tailoring is a set of explicit decisions with rationale, not a silent deviation from the template. For this project the defensible changes are:

• Methodology: quantitative cost and schedule risk analysis required at gate approval and at each interface baselining; qualitative review monthly. The template's annual cycle is unusable for a 14-month first-of-kind build.
• Risk breakdown structure weighted to the actual exposure: vendor/platform maturity, client-owned interfaces, integration and cutover, compliance and data migration. A generic RBS will leave the real categories empty.
• Cadence and triggers: monthly re-scoring of the top risks; event-driven reassessment whenever a client requirement is baselined or an interface specification changes.
• Calibrated scales: probability and impact defined in money and weeks, with agreed thresholds for escalation and for reserve drawdown. 'High' is not a scale.
• Roles: a named risk owner for each risk above the agreed threshold - accountable person, not the person doing the mitigation.
• Reserve release criteria: which triggers release contingency, to whom, with what evidence.
• Reporting: exposure trend and decisions required, not just a status snapshot.

Documentation: every tailoring decision, its rationale, who approved it, and any compensating control where we deviate from corporate policy. An undocumented deviation is indistinguishable from non-compliance at audit, and it leaves the next risk manager with no reasoning to inherit.

Test of a good plan here: a new team member could read it and know when analysis is required, who owns what, and when reserve is released, without asking me.

Eight weeks is longer than the decision can wait, so stop treating this as a binary of comply-or-exception.

Short term (this fortnight):

• Proceed on the policy basis: contingency set at 8%, formally recorded as the current approved position. Do not withhold the baseline over this.
• Quantify the gap. Produce the P50/P80 analysis and state plainly: at P50 the project likely needs X, at P80 it needs Y, and 8% corresponds to roughly Z% confidence. A single sentence - '8% corresponds to approximately 45% confidence on our current data' - is far more persuasive than an argument about policy.
• Raise the risk of the gap, not just the number: register 'reserve insufficient relative to assessed exposure' with the sponsor as owner and a defined trigger for when it must be funded (e.g., when the second client interface slips its baseline).

Medium term:

• File the exception request anyway (it runs in parallel; the clock has to start somewhere) and attach the analysis.
• Propose the portfolio-level management reserve as the interim mechanism - it does not require changing the project's 8%, only the portfolio's holdback.
• Escalate through the governance route defined in the risk management plan if the sponsor will not carry the gap.

What I avoid: quietly absorbing the gap by trimming scope or cutting analysis effort to 'live within 8%'. That converts a visible reserve decision into an invisible quality decision, and it is the failure mode the two prior overruns most likely came from.