I'm a little bit worried about the way you phrased your question. From what I gather, you want some sort of formula or process to account for the risks, then use that formula to get the perfect estimate that will in turn protect you from those risks? Something like this doesn't exist.
There are a few problems with that kind of logic (and with estimating in general):
- an estimation is never a prediction or a certainty. By its definition, an estimation is something uncertain. Your estimate can thus be wrong compared to what something will actually take.
- in general, people suck at estimating. Using a formula or a well defined process for obtaining an estimate gives you a (false) certainty that you covered everything. But maybe you didn't. Deriving an estimate from proven quantitative methods will give you a better degree of confidence in the estimate, of course, and it's the professional thing to do, but confidence does not equal certainty.
- you might not be able to predict all the risks. Maybe you forget something, maybe you miss something else, etc. If you forget some risk and that risk then manifests itself, then whatever estimate you provided initially, taking into account other risks, will be wrong;
- identified risks can or cannot manifest themselves. You don't know which will manifest and which not, so now your estimate turns in multiple estimates for each combination of the risks happening or not happening. Which of the estimates is the correct one? You cannot know.
- even if you identify all risks, you will have to calculate an impact for each. The impact is again an estimation. And you can get that wrong too (as mentioned in the previous points). So your final estimate with all the risk impacts can also be wrong compared to what something will actually take.
I could go on with the examples but there is entire literature on the topic of estimation and risk.
Getting back to the question.
You obviously can't use just your base estimate (with zero risks considered) because something might happen. But you can also not include all the impact all of the risks can add, because some of the risks will probably not happen. So you need some sort of a risk buffer. How long will this buffer be? Between zero (i.e. no risks) and "a lot" (i.e. all the risks), obviously. But how much exactly?
You start by computing a risk exposure for each risk, which is the probability of the risk occurring multiplied by the impact the risk can have (e.g. 10% probability for risk1, with an impact of 7 man days on work if it happens, results in a risk exposure of 0.7 man days for risk1). You do the same for risk2, ..., riskN. All these added together will be your risk buffer.
But if you compute these, you will see that the buffer value will probably be much lower than the highest impact the worst risk can have. And just as well, the value of the buffer can be very large, much larger than the estimate itself. So are you going to chose to add this buffer? Or use a smaller buffer? Or a larger buffer? Basically how much risk you cover yourself from, and how much risk you just accept and move on?
You are now back to square one.
And the problem is that you are trying to get the estimate back as a number. An estimate is never a number. It's a range. You have best case scenario, worst case scenario, and most probable case scenarios. See for example the Three-point estimation technique. And this is where the most important part comes. How you communicate the estimate and how your boss or client deals with it.
An estimate is not something like 6 months, it's something like "With a degree of confidence of 68% we can say it takes 6 months. Why only 68%? Because there is risk1 that adds 3 extra months of work if it occurs, another 2 weeks if risk2 occurs, and so on". In other words "s#it happening is part of life". So more then spending large amounts of time trying to get the best estimates upfront, it's more important to have bosses and clients that understand an estimation is not a certainty or a commitment, that there are risks involved, risk that must be managed by either adding buffers or accepting the risk and moving on, and when something happens, to collaborate and decide on the next best course of action.