# Estimation & Risk Planning

Puts time, cost and confidence on a plan — and refuses to put a number on work nobody has looked at yet.

## Deliverable

One Markdown document, `estimate-and-risks.md`, in the structure set out under **Output** below. It takes the output of **Roadmapping & Prioritisation**.

## Required inputs

- **A work breakdown** — the items to estimate. Sections 2 and 3 of `release-plan.md` are the expected form.
- **Who will do the work**, at least by role. An estimate with nobody behind it is a wish.

Without both, stop. A number produced without the people who would deliver it has no owner and no meaning.

## Optional inputs

- Sizing from the people named above, in whatever unit they already use
- Historical delivery data from comparable work
- Rates or a budget ceiling, if cost is wanted and not only time
- The review, testing, environment, release and approval process this work must pass through
- Known external dependencies and their stated lead times

Where sizing is absent this skill produces the decomposition and the questions that must be answered before a number can exist. It does not produce the number.

## Execution

**1 — Split understood from unexplored.** Every item goes on one of two lists. Work the team can describe end to end is estimable. Work that cannot yet be described is `unexplored` and receives a resolving action — a spike, a call, a document to read — not a figure.

**2 — Decompose until the pieces are comparable.** Anything still sized in months is a container for questions nobody has asked. Keep splitting until each piece can be argued about in a single conversation, or move it to `unexplored`.

**3 — Estimate in ranges.** For every estimable piece: a low, an expected and a high, all from the people who will do the work. Beside the range, one sentence saying what the distance between low and high is made of. A range with no stated driver is a wider guess, not an estimate.

**4 — Add the work that is not writing code.** Review, testing, data migration, environments, deployment, documentation, and the waiting — on access, on an approval, on someone else's release. Each gets its own line and its own range. Plans overrun here far more often than on the feature.

**5 — Build the risk register.** For each risk: what it is, how likely, what it costs if it lands, the early signal that it is starting, the response, and a named owner. A risk with no owner is an observation, and observations do not protect a date.

**6 — Place the buffer where it protects the critical path.** Buffer sits against the chain that sets the finish, not spread evenly over every task. State the confidence the buffered date carries and what would raise it.

**7 — Set the re-forecast checkpoints.** The dates or milestones at which estimate is compared with actual and the model — not the narrative — is corrected.

## Output

`estimate-and-risks.md`, in this order:

- **1. Input and date** — which plan is being estimated, by whom, and when
- **2. Estimable work** — per piece: low, expected, high, the unit, who the figures came from, and the driver of the spread
- **3. Unexplored work** — per item: why it cannot be estimated, the resolving action, and who owns it
- **4. Work that is not code** — the same fields as section 2, listed separately so it cannot be quietly cut
- **5. Totals** — the summed range, the confidence it carries, and the assumptions it rests on
- **6. Cost** — only if rates were supplied; otherwise `not estimated — no rates provided`
- **7. Risk register** — risk, likelihood, impact, early signal, response, owner
- **8. Critical path and buffer** — the path, the buffer against it, and the date that buffer supports
- **9. Re-forecast checkpoints** — when estimate meets actual, and who runs the comparison
- **10. Missing information** — what blocked an estimate, and who can unblock it

## Validation

The document is ready when all of these hold:

- Every item in the input breakdown appears exactly once, in section 2, 3 or 4
- Every range in sections 2 and 4 names the people the figures came from and the driver of the spread
- No item appears in section 2 without a source for its numbers
- Every risk in section 7 has a named owner and a response, not only a description
- Section 5 states a confidence and what it assumes
- Section 6 reads `not estimated` rather than a guess when rates were not supplied

Fail the run if any number has no source, or if a single-point figure appears where a range is required.

## Failure handling

- **No sizing from the team** — produce sections 1, 3, 4 as a checklist, 7 and 10. Deliver no totals. Report that the work has not been sized, and name who must size it.
- **A date is demanded before the work is understood** — deliver the range for what is understood, the `unexplored` list beside it, and the confidence the demanded date actually carries. Never narrow a range to meet a date; narrow it by resolving an unknown.
- **No rates supplied** — estimate time only and mark cost `not estimated`.
- **An earlier estimate was missed** — record the original, the actual and the difference in section 9, and correct the model that produced it. Replace the estimate rather than defending it.
- **External lead times unknown** — list them in section 10 as blocking and mark the totals `EXCLUDES EXTERNAL WAIT`. A total that silently omits a vendor's lead time is the most expensive kind of wrong.