English · Français

Standalone tool for building and visualizing risk matrices — inherent (gross) risk and residual (net) risk — with an open, documented file format, .rae.json.

No installation: the tool runs entirely in your browser. Two ready-to-open demos: an EBIOS RM–inspired risk analysis (12 risks, 11 measures) and an example of the risk-analysis part of a DPIA, inspired by the CNIL PIA method, focused on feared events, controls and residual risk (12 risks, 12 measures) — both showcasing descriptions, notes, colored tags, progress bars, owners and per-link rationale. The download provides the single HTML file of the latest release: double-click it to work offline.

Matrices › Trajectory view: each arrow links a risk's initial position (dashed outline) to its residual position (solid outline).

Statistics tab: key counters and distributions — by criticality (initial → residual), category, measure type and status, custom field, and coverage — as tables and/or charts (donut or pie). The grid is customizable and rearrangeable by drag-and-drop, and follows the active filter.

Action plan — timeline: controls sorted by due date, with owner, status and covered risks. Also available as a status board (kanban) and by owner, with progress and overdue tracking.

Risk Analysis Editor is a standalone web app: a single HTML file, with no network or external service dependency at runtime, that works offline (a simple double-click is enough — no installation, no server).

It lets you carry out a generic, structured risk analysis: scoring configuration, entry of risks and measures, initial and residual assessment, action plan, visualizations and reports.

The tool builds on a generic, configurable model, adaptable to an internal framework and usable to structure and present analyses conducted within approaches such as ISO 27005, EBIOS RM or the DPIA. The grid is broadly configurable: dimensions, axes, levels, labels, thresholds, colors and scoring method; it is saved inside the file.

The whole analysis fits in a self-contained .rae.json file: grid, risks, measures, links and initial/residual assessments. The format is specified (technical documentation, in French) and validated by a JSON schema (schema-analyse-risque.json). Property names are in English; values (labels, descriptions) stay in the analysis's own language.

Official website: www.risk-analysis-editor.com — presentation, screenshots and links.

Getting started: the illustrated user guide (in French) walks through every screen and feature.

Entry point: open the app online — or, for offline use, download the repository and open app/risk-analysis-editor.html with a simple double-click.

RAE focuses on structuring, assessing and presenting risk and measure registers: defining the scoring grid, initial and residual assessment, linking measures to risks, tracking the action plan, visualizing the matrices and generating reports.

Its generic, configurable model lets you work with different approaches — notably ISO 27005, EBIOS RM, DPIA/PIA CNIL or an internal framework — without imposing a single methodology. The provided templates and examples are inspired by these approaches and serve as ready-to-adapt starting points. RAE does not, however, aim to reproduce the full set of steps, objects and controls specific to each method: their complete implementation remains guided by the applicable frameworks and by the context of the analysis.

RAE thus offers a framework that is more structured and consistent than a set of spreadsheets, while remaining lighter, more portable and simpler to deploy than a GRC platform. It is particularly suited to standalone analyses, workshops, consulting engagements and organizations that want to keep local control of their data in an open, documented format.

• Two side-by-side matrices: inherent (gross) and residual (net) risk.
• Trajectory view: an arrow links each risk's initial position to its residual position; unreduced risks are highlighted.
• Layout algorithms for the trajectories aiming to reduce crossings and overlaps: straight arrows, centered square grid.
• Chip layout strategies when a cell holds several risks: grid, row, column, cluster/spiral, "+N" overflow…
• Manual placement of chips by drag-and-drop, with a configurable N×N snap grid and positions saved in the file.
• Interactive chips: clicking a chip opens the risk record to edit it; dragging it to another cell re-scores the risk (keyboard: Enter/Space to edit, Ctrl+arrows to re-score).
• Statistics tab: a figures dashboard — key counters, distribution by criticality (initial → residual), by risk category, by measure type and status, by custom field, and coverage (risks without a control, orphan controls). Each block as a table and/or chart (donut or pie). A customizable grid (toggle blocks, size, shape) that is rearrangeable by drag-and-drop; follows the propagated filter; settings saved in the file.

• Configurable axes (vertical / horizontal): free number of levels, labels and tooltip descriptions.
• Score computation methods: product (P × S), sum (P + S) or matrix (level defined cell by cell, with a dedicated editor).
• Criticality levels: colored zones, thresholds, color, acceptance decision and description, with a coverage check of reachable scores.
• Axis transposition (vertical ↔ horizontal) in one click, assessments and placements included.

• Overview: dedicated tab for the analysis's document metadata (title, status, author, organization, scope, methodology reference, description) and analysis-level custom field values.
• Risk register: category, owner, description, initial and residual assessment, change indicator.
• Controls / measures: type (technical / organizational…), status (color-coded), responsible, due date, cost.
• Risk ↔ measure links, in two sub-tabs: Associations (checkbox cross-table, many-to-many) and Details (editable register where each link carries a note and its own custom fields); enriched links are flagged in the cross-table.
• Action plan: measure tracking across three views (timeline, kanban by status, grouped by owner), overdue measures highlighted (past due date and not finalized), and overall progress (bar + per-status counters). Each measure is editable on click (due date, status, owner, notes, custom fields) and, in the kanban, can be dragged and dropped between status columns.
• Custom fields: define, in Settings, extra fields attached to the analysis, risks, measures or links — 10 types (yes/no, integer, decimal, date, text, dropdown, checklist, colored tags with single/multiple choice, progress bar in %), multilingual labels (label and help are entered in the active interface language; when a translation is missing, the code is shown), a required flag and bounds (min/max, length, item count); values are entered in the records (risks, measures) and in the Overview tab (analysis fields), with validation, and are included in the report and in the CSV import/export.
• CSV import of risks, measures and links: columns named after the format's English keys, auto-detected separator; merge by identifier (risks/measures); integrity check and deduplication (links).
• CSV export of risks, measures and links: headers = English key names (identical whatever the interface language), ; delimiter and UTF-8 BOM (Excel), with read-only derived columns (score/criticality for risks; covered risks for measures; labels for links); re-importable.
• Sorting and filtering of the Risks, Measures and Action plan lists: text search, sort by clicking columns (ascending → descending → original order), and dropdown filters (category, type, status, owner, "overdue only"). When no sort is active, rows can be reordered by drag-and-drop (⠿ handle on row hover, Ctrl+↑/↓ with the keyboard): the new order is saved in the file and drives the default display, the report and the exports.
• Propagated filtering: the dropdown filters for category (risk), type and status (measure), plus any custom field declared usable as a filter, propagate along the links — restricting every tab, the matrices and the report; criteria combine (AND) and each active propagated filter stays visible and editable in every bar where it applies. The propagated filter (base + custom fields) is saved in the file and restored when the analysis is reopened. Text search and the Action-plan-specific filters (owner, overdue) stay local to their view.
• Entry aids & safety nets: one-click duplicate (⧉) of a risk or measure, “Save and new” for batch entry, an “Undo” toast after every deletion, clickable Rx/Mx pills that open the referenced record, an optional “don't ask again” for link confirmations, a warning when editing an already-assessed grid, and a Help & shortcuts panel (File menu, or the ? key).
• Customizable columns in the Risks, Measures and Link details registers: show/hide columns and reorder them (drag the headers, or the ▲/▼ arrows in the ⚙ column menu), surface fields otherwise hidden (owner, due date, cost…) and add custom-field columns. The ID and Actions columns stay pinned; the layout is saved in the file (extensions.display.columns).

• New / Load / Save in .rae.json format.
• Load by URL: opening the tool with ?file=<url> (alias ?url=) automatically loads the pointed analysis at startup — e.g. risk-analysis-editor.html?file=../examples/risk-analysis-information-system.rae.json. Requires the tool to be served over HTTP(S) (the file:// protocol blocks this read).
• Startup URL parameters (combinable): ?lang=fr|en|it forces the interface language (overrides the file's saved language and the browser language); ?tab=<tab>[.<sub-tab>] opens a given tab, and optionally its sub-tab — e.g. ?tab=matrices.traj (Matrices › Trajectory), ?tab=settings.grid, ?tab=plan; ?filter=code:value;code:value applies custom-field filters — e.g. ?filter=feared_event:access. Unknown tokens are ignored.
• Propagated filtering: the base dropdown filters — category (risk), type and status (measure) — and any custom field flagged usable as a filter (closed values: dropdown, checklist, tags, yes/no) all propagate along the links, restricting every tab, the matrices and the report: filtering on a risk keeps only the measures and links that relate to it, and symmetrically for a measure filter. Criteria combine (AND), and when a propagated filter is active its value stays visible and editable in the filter bar of every tab where it applies. Text search and the Action plan's own owner / overdue filters stay local to their view. Custom-field filtering is reflected in the URL (?filter=code:value), so a filtered view can be shared by copying the address.
• Matrix export as PNG (×1 / ×2 / ×3) and SVG, with title, subtitle, axis labels and legend; copy to clipboard when this feature is supported and allowed by the browser and the runtime context.
• Word export (.docx) of the report and Excel export (.xlsx) of the analysis: File menu (and a button in the Report tab for Word). The Word file reuses the sections, their order, the columns and the scope configured for the report, and adds a cover page, a table of contents native to Word, refreshable on open if needed, and a native page header/footer (with page numbers) — metadata, presentation, summary, grid, matrices as embedded images, registers and detailed sheets — usable as a basis for integration into a corporate template; the Excel workbook has four styled sheets (Summary / Risks / Measures / Links) with typed cells (real dates and numbers), criticality and status colors, frozen header rows and autofilters. Both are generated locally, offline: hand-written OOXML plus the embedded MIT-licensed fflate library for the ZIP container — still distributed as a single HTML file, with no external resource needed at runtime.
• Printable report: the Report tab generates a configurable report from the information managed in RAE (metadata, an Overview block with the analysis description and custom fields, summary, grid and criticality levels with descriptions, Initial/Residual and Trajectory matrices as vectors, risk register, detailed risk and measure lists with their descriptions and custom field values, links), rendered in a light, printable style (→ PDF via the browser).
• Customizable report (Settings › Report): choose the sections and their order (drag-and-drop), the cover page (logo, title, subtitle, notices, confidentiality, free text), the table of contents, a three-zone header/footer with variables ({title}, {date}, {page}/{pages}…), each table's columns, the metadata rows, the Initial/Residual matrix layout (side by side or stacked) and the action-plan view, plus the scope (full analysis or filtered subset). The same configuration determines the sections, their order, the columns and the scope of the on-screen/PDF and Word renders (with native table of contents and header/footer); it is saved in the file (extensions.display.report).

• Themes: dark, light.
• Language selector: French / English / Italian (interface and default data for a new analysis), architecture extensible to other languages.

1. Open the app online — or open app/risk-analysis-editor.html from a local copy, in a recent browser.
2. The tool starts on a blank analysis, opened on the Overview tab.
3. Use Load… to open a .rae.json file (e.g. from examples/), Save to export yours.

Prerequisites: a recent desktop browser (evergreen version) with JavaScript enabled — nothing else. No server, no network access and no installation are required; the app runs from a simple file:// double-click. Only Load by URL (?file=…) needs the tool to be served over HTTP(S).

Development and testing are done primarily with Microsoft Edge (Chromium); recent desktop browsers based on Chromium (Chrome, Edge, Opera, Brave…) are the primarily tested environment and should offer the most complete experience. Known differences with other engines:

• Firefox / Safari — the File System Access API (showSaveFilePicker) is not available: Save falls back to a standard download of the .rae.json file (and Load to a classic file picker) instead of writing directly into the opened file. The main features remain available on Firefox and Safari, but differences may exist, notably for the clipboard, file handling, printing and the rendering of generated documents.
• Older Firefox (< 127) — copying a matrix to the clipboard as an image (ClipboardItem) is not supported; the PNG and SVG download buttons remain available.
• Touch devices — drag-and-drop interactions (chips, kanban, column headers) target mouse usage; keyboard and menu alternatives exist (Ctrl+arrows in the kanban and matrices, ▲/▼ arrows in the column menu), but the tool is designed for desktop use.

RAE embeds exactly one third-party library: fflate v0.8.2 (MIT license, © Arjun Barrett), a tiny, fast ZIP/deflate implementation. It provides the ZIP container required by the Word (.docx) and Excel (.xlsx) exports — OOXML files being ZIP archives of XML parts. The library is vendored inline in the HTML file, with its license notice, so the app keeps working fully offline, with no external resource needed at runtime. Everything else (Markdown engine, SVG/PNG export, OOXML generation, UI components) is written from scratch for this project.

Found a bug or have a suggestion? Open a GitHub issue. For bugs, please include your browser and OS, the app version (shown in About), what you expected, what actually happened, and — when possible — a minimal .rae.json that reproduces it (zip it or paste it in a code block, since GitHub does not accept .json attachments directly).

Distributed under the MIT license — see LICENSE.

© 2026 Stéphane Vinter