Add buffer time to project estimates.
Estimates describe the work you can foresee; buffers cover the work you cannot. A flat percentage handles ordinary optimism, and each named risk factor — an unfamiliar API, a slow approver, an untested dependency — adds a further 5% because identified risks materialise more often than unidentified ones. Converting the padded total into working days at your realistic daily output is what makes the number schedulable rather than theoretical.
Buffered estimate
Buffer hours = estimated hours x (buffer percent + risk factors x 5)/100; hours to quote = estimated hours + buffer hours
20-30% is the common baseline for familiar work. Unfamiliar stacks, multiple stakeholders or unclear requirements push it well above that, which is what the risk-factor count reflects.
Quote the padded total as the estimate rather than itemising the buffer. Clients negotiate against a line labelled contingency, and removing it does not remove the risk.
Because productive hours per day are less than hours at the desk. Use the day count here for capacity planning, then add calendar slack for reviews and handovers.