The common mistake of using a "normal" distributions for all kinds of things - usually misuse.
Here's the core problem. For any modeling to work in any tractable way, the individual probability distributions - say for duration or cost - are assumed to be independent. That way what ever modeling tool you are using Monte Carlo or (heaven forbid PERT) has to generate N-single variance Independent sets of numbers for the model. PERT makes this assumption along with several others.
Now if the entities in the model are NOT independent - that is they represent a "real" schedule, or a "real" cost model, you've got to generate an N-Variable probability distribution.
The three-point estimates and distribution curves now define the marginal distributions of the underlying multivariate distribution. Or at least, they should. To determine this and the interrelationships, the correlations among tasks need to be defined.
The correlation (co-relation) measures the dependence between two variables:
P(A, B) = P(A) x P(B) + "adjustment factor"
If the two variables (A and B) are independent then "adjustment factor" = 0 and the joint distribution P(A, B) is just the product of the two marginal distributions.
But this is rarely true in practice and is what wrecks all the conversation provided by the naive approaches to probabilistic risk analysis, including the dreaded Black Swan conversation. (I know I regret mentioning the BS term, 'cause it'll stir up all those past posts about there being no such thing as a BS).
Anyway, the correlation measures lots of things, the most important the connection between cost and schedule. This is called a product-moment correlation. Durations and cost are interval measures, not ordinal measures. As interval measures the individual variables are "coupled" to each other in unknown ways.
Covariance is the measure of this coupling
Cov(X, Y) = E[(X - μx) x (Y - μy)] = E[XY] -μxμy = Cov (Y, X)
All of this is pretty much uninteresting to project managers working on software projects with informal methods. Projects where "brute force" overcomes all. But in our domain, where billions are being spent on complex integration projects - many software intensive - most with multiple subcontractors and forward pricing models - failing to understand the correlation between cost and schedule can be disastrous.
So What Does This Mean - Really
What it means is if you fail to consider how work in coupled, you're going to pay dearly when something goes wrong. This notion is not address in most paradigms of project management. The simple (and sometimes simple minded) notion that work is queued up - Kanban, or work is arranged by customer prioritiy - Scrum - all works fine if the work is not correlated.
Ah, but what if it is? There's the Rub as the Bard says.
