I think I found the answer is quantitative risk analysis. If quantitative risk analysis is not performed then plan risk response will determine them.

Risk management planning should aim at eliminating threats and reduce cost and time making contingency reserve available for oppertunities and threats that remain after risk management process is completed.