When conducting risk management, after identifying a particular threat, you need to determine how to treat it. Typically risk treatment involves some type of mitigating action and then a contingency plan to be deployed in the event the risk is realized or that certain indicators are met that suggests risk realization is imminent. PMBOK describes risk treatment as: mitigation, acceptance, transfer, and avoidance. For favorable risks, or opportunities, PMBOK describes treatment as: share, enhance, and exploit.
No matter what you call them, the idea behind managing your risks is to eliminate or minimize the likelihood and / or impact of the event. And if it should occur, to have resilience (contingency plan) to keep on going.
A contingency plan involves actions you can take that enables you to recover from the risk event and keep on going. Think spare tire. You suffer a flat tire; you change to the spare; you keep on going. It serves to understand that a contingency plan for one risk event can be a mitigation plan from a downstream risk event. Everything's connected.
You have two types of uncertainty: aleatory and epistemic. Aleatory is random variability while epistemic is a specific risk event. Both can cause a PM to increase duration in order to load reserves into your planning values. For example, we may estimate a task could take four to 10 days to complete. If there is a lot of uncertainty in the work, you may load a planning value that is closer to 10 days, like eight or nine or even ten, causing costs to climb but creating buffers for the unknowns. Conversely, if your super confident in the work, you could plan something closer to four days.
One of the most popular is a 5x5 matrix where you have probability on the Y axis and impact on the X axis. It is convenient to report to your stakeholders where you place a risk on the matrix, based on the predicted likelihood and the impact. It is very two dimensional, however, and does not really convey a probabilistic impact scenario for some type of risks. But it is a good reporting tool that seems to resonate with stakeholders but limited value for serious risk managers. Another powerful tool is simulation. The resulting probabilistic distribution is a powerful diagram.
I load "risk management" as an Level of Effort task that simply spans across the entire duration of the project. For known risks where we have mitigation plans, I load those work packages directly into the schedule and load them with resources--both money, labor, and materiel. For contingency plans, I load reserves into my budget and will deploy it to a schedule in the event I have to use them. But at baseline, my contingency budget is NOT part of the performance measurement baseline.
Hope this helps.