Here's how I calculate risks and my recommendaton on what to put into the budget.
First of all I build a statistical Risk Cost Model using the principal equations for work, duration and resources.
The model estimates each element in the Deliverable Work Breakdown Structure (DWBS) and has several lines where I meet with the team to identify three point estimates for work. This estimate includes efficiency.
Known-Knowns: For me this is the variation driven by efficiency of during the work. I use Crystal Ball and the result is a normal distribution.
Known-Unknowns: This is more like the traditional risk. However, I list the risks and tie them to the elements in the DWBS. For me the risk is having to rework the elements. So the calculation is made using a percentage of each element impacted by the risk. The knowns are the elements and the unknown is the variation in reworking the elements. Since the elements already have variation the approach produces another normal distribution
Unknowns-Unknowns: There is no direct way to estimate these- after all they are unknown. However, I studied several projects and discovered a method to back our way into this. I found patterns between the original estimates and the final costs. For me the unknowns-unknowns are the difference between the total of efficiency and risks. I applied this technique to current projects, forecasted the final cost, and tracked them. The results were fairly accurate considering we were working with unknowns. I plotted projects on a continuum and found they formed clusters. So by looking for patterns that are similar to projects in each of the clusters I was able to forecast final cost that included all of the known and unknown costs.
Now for my recommendation on what to put into the budget. Let me say that I do not believe in using thumb rules like adding 20%. This is because the number can be much higher and mislead everyone on the true final cost.
My point estimate is pulled off of the efficiency distribution is always higher than P50- the higher the uncertainty I have about the project the higher the value. Most of the time I use the P70. I would prefer to present a range but most managers are uncomfortable with a variation.
For the Risk Reserves I pull from known-unknown distribution. Here I pull from P20 to P100 depending on the uncertainty in the project.
For the Unknown-Unknowns: I recommend showing the number as a separate risk reserve number and let management decide what to include in the budget. Yes this is politically charged but management needs to take responsibility for taking on projects with large unknowns.