Hi Peter, 

Sorry for delay with th response.
>1 quality of data assumptions - are we all biased in some way?

 Yes, and there are methods to deal with it. 

>2 how to get a collective team risk effort rather than risk manager / software

The schedule development process need to be changed. Initial data has to be collected as a range with primary uncertainties from SMEs. Risk managers have to support that and use collected data for analysis.

> 3 "selling" results to senior management in a meaningful way - is it just contingency drawdown?

It is a risk transfer. Senior management can decide to start the project even if it is only, let say 10% to meet dates and cost commitments. The PMs can do their best, but there is a 90% chance that they ask extra time, money or both.
 

> 4 how do we deal with external project events not explicitily covered in the contract (which seem to becoming more common)

All external dependencies is a specific type of risks and must be managed via risk processes. 

Technically, in a risk simulation tool, create an external task, not a milestone (as it has no duration). Simulate the duration uncertainty of this task. I will cover it the future posts.   

>5 next simple steps beyond MCS for more real world scenario
Learn MCS “side effects” and alternative approaches, like “3 scenarios” method.