Yep. I like the idea of an agency or internal team that does the following: Come up with risk classes and complexity classes, with objective measure for what i

Yep. I like the idea of an agency or internal team that does the following: Come up with risk classes and complexity classes, with objective measure for what is or isn't in each class. ("Class X risk involves a library/technique/platform with we are not yet familiar."). Measure time spent on all tasks. Collect statistical distributions for each portion of the risk/complexity grid. Use those distributions and monte carlo simulation to estimate future projects to an appropriate degree of confidence (e.g. 95%). This probably means scheduling lots more time than you would have before, more than you will often need, use the rest for refactoring, training, completing unforeseen and therefore unestimated tasks (bug fixes?) maintaining the FOSS you are dependent on, etc.