To know if risk is involved in an IT project ,we need to calculate two values: one is MEAN and 2nd is SD (standard deviation).
Percentage ==> SD/Mean==> for example, percentage is 10.90, that project we treat risky.
Note :-Read my previous post for more clarity: https://srinimf.wordpress.com/2011/07/03/it-project-estimation/
General thumb Rule to decide Risk:
If the percentage is higher than 10, we treat the project is in RISK.
So, the one which has higher percentage of all (and greater than 10) call it high risk project.