I think this is a great question for several reasons, mostly because it is an inherent risk on every project every time and largely ignored.
Attrition is normal and, in fact, can be beneficial when the rate of attrition is at that sweet spot where incoming and outgoing employees are at a good balance, and when you have a reasonably high performing knowledge transfer capability in place. So some of the impact of this risk is favorable, too, and some of your risk response would include enhancing and exploiting activities.
Part of this risk is inherent to all projects so you would not necessarily capture this on your register for more formal tracking, nor would you tie specific funds for your controls above and beyond the sort of normal 'keep your staff happy' activities. The other part of the risk, however, is discreet, like what the "bus factor" suggests. What scenarios exist that could threaten your staff capability? The answers to that question I would capture and mitigate specifically. For example, if you have to transport your staff from point A to B, some catastrophic event in transportation could occur. That would require specific mitigators such as using several modes of transportation.
One approach I use on nearly all my projects is to facilitate a near zero single point of failure from an employee perspective, i.e., I would minimize where I could that issue where an employee possesses unique skills and knowledge that I cannot replace as easy as I would replace a cog in a machine. Since we're dealing with humans, this is not as easy as a cog solution; however, my mentality is this so I pursue this type of resource acquisition.
We often get blinded by finding the best individual available and the best team available. Intrinsically, that makes all the sense in the world; however, that threatens your ability to replace them in a reasonable way.
I assume that the performance distribution is triangular and positively skewed, as in this picture: 
While it seems like a good idea to find folks who live on the right side of the triangle, replacing these folks because of these inherent risks means you will have difficulty finding them.
In the circle is where most of your practitioners live, where you are very likely to find a replacement easily and where your performance gap between these guys and the ones who live on the right are largely immaterial or acceptable.
So this is more of a mental approach than something I can actually measure during employee selection. When I begin to overly rely one a single individual and start to get the sense that I can't do without that person, I begin my intervention. I will close that gap so if that person leaves I can shrug it off.
