Energy performance contracting provides guaranteed minimum energy savings to building owners, enabling them to finance project costs using utility savings over the duration of the project. This has been an attractive project delivery method for organizations with reduced budgets for capital projects, particularly among correctional facilities which frequently have lengthy periods of deferred maintenance and ongoing building operations and maintenance concerns. This research builds on a previously developed project factors risk framework for energy service companies undertaking building retrofits. This paper proposes a risk analysis and evaluation model that includes quantitative, expert-based, and probabilistically derived information. Expected cost was used to evaluate risks over lengthy project life cycles and a new metric was developed for use in the model—expected life cycle value. Model results reveal that the most critical risk factors relate to the reduced availability of “low-hanging fruit” energy conservation measures, work scopes based on traditional design-bid-build procurement, unavailable or inaccurate facility information, facility age and current code requirements, and conducting the investment grade audit too quickly. The life cycle cost-based risk model employed in this paper is proposed as an advancement over traditional risk management methods, and it is expected to be applicable, with modification, across other municipal and state government subdomains, especially high security projects.