Operations Research isn't my field but risk in a project is a stochastic event. I suggest using a Poisson random variable to model occurrence or the inverse to time between occurrences and a Negative Exponential distribution to model the duration. Check out references in Queuing Theory where you may find a better solution.