This needs no explanation, I guess.

But there are some nuances worth discussing.

Each scope-oriented project, is this Fixed Fee or Time and Material regardless, needs to manage risk.

The primary tool for managing risks is review sessions and corresponding mitigation strategies. This is the end all be all.

But many risks convert into cost and having a right-sized buffer is not a bad idea.

We are not talking here on schedule buffer (time lag) as in my opinion longer schedule anyway converts into more cost or workload anyway.

In the end, all buffer types can be expressed in cost.

The project estimation is the moment we can put the next into the total baseline picture. Later is much harder if possible, at all.

The first principle here is Risk Buffer should be a separate line in project estimations.

Shortly there is a baseline and there is a risk buffer.

Many "smart" project managers will build risk buffer on their own as a private contingency. It is part of the baseline and not visible to the organization.

The truth is all those not visible parts have a tendency not to be managed. The Result is it is almost given it will become a cost.

Now we are getting to the core of this discussion.

While defining Risk buffer is not that completed, managing it is much more challenging for projects and supervising companies.

What’s the best practice for this?  Surely risk reviews and each time deciding what mitigation strategy take and if we want to use risk buffer.

Also reaching for a risk buffer is the easiest way to mitigate issues.

The best practice would require at least discussion if there are other mitigation strategies before reaching for money.

Not many PMs are motivated to do so.  But regular risk reviews and transparent risk management with stakeholders will help to facilitate it.

What is transparent risk management? Simply presenting up-to-date risk list and risk buffer status to stakeholders and asking for use of risk buffer if needed.

Easy right? But not always much welcomed. But this is best practice.

What’s the reward?

Very high probability of better financial numbers at completion as well managed risk buffer may lead to some leftovers which are welcomed by sponsoring organization.

And, right professional perception in stakeholders’ eyes.

The previous chapter was project managers' view, now it is time for stakeholder’s view.

What stakeholder I mean here?

This could be a sponsor financing project or just PMO.

How to monitor Risk Buffer? Request Status of risk and risk buffer and participate in a decision on using risk buffer.

Again, not all organizations do this. But I think those where money counts, this is a must.

The other part of monitoring is having some independent visibility of what is happening with the risk buffer.

Here is an example of a very common case.

The project has a baseline of 100 units and a risk buffer of 15%  e.g. 15 units. All together worst-case cost at completion is 115.

It is quite common that project-on-run is estimating the cost at completion on 107 units, but never asked or managed risk. It simply overruns original plans.

In fact, it overruns baseline eating risk buffer w/o managing it.

The key point is to capture the moment when the estimate at completion is going above the expected baseline cost and monitor risk buffer use at the same time. If You have a dashboard with project status it is good to show at the same moment: baseline cost, completion cost, used risk buffer.

All three pieces of information seen at the same time can tell a lot already.