Risk-Analysis-Editor: Open-source risk analysis editor supporting EBIOS RM, GDPR DPIA (CNIL), ISO 27005 and custom methodologies

English · Français

Standalone tool for building and visualizing risk matrices — inherent (gross) risk and residual (net) risk — with an open, documented file format, .rae.json.

No installation: the tool runs entirely in your browser. Two ready-to-open demos: 📊 an EBIOS RM–inspired risk analysis (12 risks, 11 measures) and 🛡️ an example of the risk-analysis part of a DPIA, inspired by the CNIL PIA method, focused on feared events, controls and residual risk (12 risks, 12 measures) — both showcasing descriptions, notes, colored tags, progress bars, owners and per-link rationale. The download provides the single HTML file of the latest release: double-click it to work offline.

Matrices › Trajectoryview: each arrow links a risk's initial position (dashed outline) to its residual position (solid outline).

Statisticstab: key counters and distributions — by criticality (initial → residual), category, measure type and status, custom field, and coverage — as tables and/or charts (donut or pie). The grid is customizable and rearrangeable by drag-and-drop, and follows the active filter.

Action plan— timeline: controls sorted by due date, with owner, status and covered risks. Also available as astatus board (kanban)andby owner, with progress and overdue tracking.

Risk Analysis Editor is a standalone web app: a single HTML file, with no network or external service dependency at runtime, that works offline (a simple double-click is enough — no installation, no server).

It lets you carry out a generic, structured risk analysis: scoring configuration, entry of risks and measures, initial and residual assessment, action plan, visualizations and reports.

The tool builds on a generic, configurable model, adaptable to an internal framework and usable to structure and present analyses conducted within approaches such as ISO 27005, EBIOS RM or the DPIA. The grid is broadly configurable: dimensions, axes, levels, labels, thresholds, colors and scoring method; it is saved inside the file.

The whole analysis fits in a self-contained ** .rae.json** file: grid, risks, measures, links and initial/residual assessments. The format is

specified(technical documentation, in French) and comes with a

JSON schemafor validation (schema-analyse-risque.json). Property names are in English; values (labels, descriptions) stay in the analysis's own language.

Official website: www.risk-analysis-editor.com — presentation, screenshots and links.

YouTube channel: @RiskAnalysisEditor — video tutorials.

Getting started: the illustrated user guide (in French) walks through every screen and feature.

Entry point: open the app online — or, for offline use, download the repository and open app/risk-analysis-editor.html with a simple double-click.

RAE focuses on structuring, assessing and presenting risk and measure registers: defining the scoring grid, initial and residual assessment, linking measures to risks, tracking the action plan, visualizing the matrices and generating reports.

Its generic, configurable model lets you work with different approaches — notably ISO 27005, EBIOS RM, DPIA/PIA CNIL or an internal framework — without imposing a single methodology. The provided templates and examples are inspired by these approaches and serve as ready-to-adapt starting points. RAE does not, however, aim to reproduce the full set of steps, objects and controls specific to each method: their complete implementation remains guided by the applicable frameworks and by the context of the analysis.

RAE thus offers a framework that is more structured and consistent than a set of spreadsheets, while remaining lighter, more portable and simpler to deploy than a GRC platform. It is particularly suited to standalone analyses, workshops, consulting engagements and organizations that want to keep local control of their data in an open, documented format.

Two side-by-side matrices:- inherent (gross)and- residual (net)risk.
Trajectory view: an arrow links each risk's initial position to its residual position; unreduced risks are highlighted.
Layout algorithmsfor the trajectories aiming to reduce crossings and overlaps: straight arrows, centered square grid.
Chip layout strategieswhen a cell holds several risks: grid, row, column, cluster/spiral, "+N" overflow…
Manual placementof chips by drag-and-drop, with a configurable N×N snap grid and positions saved in the file.
Interactive chips:- clickinga chip opens the risk record to edit it;- draggingit to another cell- re-scoresthe risk (keyboard:- Enter/- Spaceto edit,- Ctrl+arrows to re-score).
Statistics tab: a figures dashboard — key counters, distribution by- criticality(initial → residual), by risk- category, by measure- typeand- status, by- custom field, and- coverage(risks without a control, orphan controls). Each block as a- table and/or chart(donut or pie). A- customizablegrid (toggle blocks, size, shape) that is- rearrangeable by drag-and-drop; follows the propagated filter; settings saved in the file.
Configurable axes(vertical / horizontal): free number of levels, labels and tooltip descriptions.
Score computation methods: product (P × S), sum (P + S) or- matrix(level defined cell by cell, with a dedicated editor).
Criticality levels: colored zones, thresholds, color, acceptance decision and description, with a- coverage checkof reachable scores.
Axis transposition(vertical ↔ horizontal) in one click, assessments and placements included.
Overview: dedicated tab for the analysis's document metadata (title, status, author, organization, scope, methodology reference, description) and analysis-level custom field values.
Risk register: category, owner, description, initial and residual assessment, change indicator.
Controls / measures: type (technical / organizational…), status (color-coded), responsible, due date, cost.
Risk ↔ measure links, in two sub-tabs:- Associations(checkbox cross-table, many-to-many) and- Details(editable register where each link carries a- noteand its own- custom fields); enriched links are flagged in the cross-table.
Action plan: measure tracking across three views (timeline, kanban by status, grouped by owner),- overduemeasures highlighted (past due date and not finalized), and- overall progress(bar + per-status counters). Each measure is- editable on click(due date, status, owner, notes, custom fields) and, in the kanban, can be- dragged and droppedbetween status columns.
Custom fields: define, in- Settings, extra fields attached to the analysis, risks, measures or links — 10 types (yes/no, integer, decimal, date, text, dropdown, checklist,- colored tagswith single/multiple choice,- progress barin %), multilingual labels (label and help are entered in the active interface language; when a translation is missing, the code is shown), a required flag and bounds (min/max, length, item count), and — for lists (dropdown, checklist, tags) — a- per-value descriptiongathered into a- “Field reference”section of the report; values are entered in the records (risks, measures) and in the- Overviewtab (analysis fields), with validation, and are included in the- reportand in the- CSV import/export.
CSV importof risks, measures and links: columns named after the format's- Englishkeys, auto-detected separator; merge by identifier (risks/measures); integrity check and deduplication (links).
CSV export of risks, measures and links: headers =- Englishkey names (identical whatever the interface language),- ;delimiter and UTF-8 BOM (Excel), with read-only derived columns (score/criticality for risks; covered risks for measures; labels for links); re-importable.
Sorting and filteringof the Risks, Measures and Action plan lists: text search, sort by clicking columns (ascending → descending → original order), and dropdown filters (category, type, status, owner, "overdue only"). When no sort is active, rows can be- reordered by drag-and-drop(⠿ handle on row hover, Ctrl+↑/↓ with the keyboard): the new order is saved in the file and drives the default display, the report and the exports.
Propagated filtering: the dropdown filters for- category(risk),- typeand- status(measure), plus any- custom fielddeclared- usable as a filter(closed values: dropdown, checklist, tags, yes/no),- propagate along the links— restricting every tab, the matrices and the report: filtering on a risk keeps only the measures and links that relate to it, and symmetrically for a measure filter. Criteria combine (AND) and each active propagated filter stays- visible and editablein every bar where it applies. The propagated filter (base + custom fields) is- saved in the fileand restored when the analysis is reopened. Text search and the Action-plan-specific filters (- owner,- overdue) stay local to their view.
Entry aids & safety nets: one-click- duplicate(⧉) of a risk or measure,- “Save and new”for batch entry, an- “Undo”toast after every deletion, clickable R- x/M- xpills that open the referenced record, an optional- “don't ask again”for link confirmations, a warning when editing an already-assessed grid, and a- Help & shortcutspanel (File menu, or the- ?key).
Customizable columnsin the Risks, Measures and Link details registers: show/hide columns and reorder them (drag the headers, or the ▲/▼ arrows in the ⚙ column menu), surface fields otherwise hidden (owner, due date, cost…) and add- custom-field columns. The ID and Actions columns stay pinned; the layout is- saved in the file(- extensions.display.columns).
New / Load / Savein- .rae.jsonformat.
Load by URL: opening the tool with- ?file=<url>(alias- ?url=) automatically loads the pointed analysis at startup — e.g.- risk-analysis-editor.html?file=../examples/demo-ebios-rm-information-system.rae.json. Requires the tool to be served over HTTP(S) (the- file://protocol blocks this read).
Startup URL parameters(combinable):- ?lang=fr|en|itforces the interface language (overrides the file's saved language and the browser language);- ?tab=<tab>[.<sub-tab>]opens a given tab, and optionally its sub-tab — e.g.- ?tab=matrices.traj(Matrices › Trajectory),- ?tab=settings.grid,- ?tab=plan;- ?filter=code:value;…applies custom-field filters (it overrides the saved custom-field part of the filter, then is removed from the address bar). Unknown tokens are ignored.
Matrix exportas- PNG(×1 / ×2 / ×3) and- SVG, with title, subtitle, axis labels and legend; copy to clipboard when this feature is supported and allowed by the browser and the runtime context.
Word export (.docx)of the report and- Excel export (.xlsx)of the analysis:- Filemenu (and a button in the- Reporttab for Word). The Word file reuses the sections, their order, the columns and the scope configured for the report, and adds a- cover page, a- table of contentsnative to Word, refreshable on open if needed, and a- native page header/footer(with page numbers) — metadata, presentation, summary, grid,- matrices as embedded images, registers and detailed sheets — usable as a basis for integration into a corporate template; the Excel workbook has four styled sheets (Summary / Risks / Measures / Links) with typed cells (real dates and numbers), criticality and status colors, frozen header rows and autofilters. Both are generated- locally, offline: hand-written OOXML plus the embedded MIT-licensed fflate library for the ZIP container — still distributed as a single HTML file, with no external resource needed at runtime.
Printable report: the- Reporttab generates a configurable report from the information managed in RAE (metadata, an- Overview blockwith the analysis description and custom fields, summary, grid and criticality levels with descriptions,- field reference and legends(documented dropdown/tag values), Initial/Residual and Trajectory matrices as vectors, risk register, detailed risk and measure lists with their descriptions- and custom field values, links), rendered in a light, printable style (→ PDF via the browser).
Customizable report(- Settings › Report): choose the- sectionsand their- order(drag-and-drop), the- cover page(logo, title, subtitle, notices, confidentiality, free text), the- table of contents, a three-zone- header/footerwith variables (- {title},- {date},- {page}/{pages}…), each table's- columns, the metadata rows, the Initial/Residual matrix layout (side by side or stacked) and the action-plan view, plus the- scope(full analysis or filtered subset). The same configuration determines the sections, their order, the columns and the scope of the- on-screen/PDFand- Wordrenders (with native table of contents and header/footer); it is saved in the file (- extensions.display.report).
Themes: dark, light.
Language selector: French / English / Italian (interface and default data for a new analysis), architecture extensible to other languages.

| Folder | Contents |
|---|---|
| app/ | The application ( risk-analysis-editor.html). |
| docs/ | User documentation(in French): the illustrated user guide, and shared images. |
| specs/ | Specifications(in French): file-format specification, JSON schema and layout strategies. |
| examples/ | Sample analyses in .rae.jsonformat (French and English), including twopopulated demos representative of RAE's features: anEBIOS RM–inspiredrisk analysis (demo-ebios-rm-*.rae.json) and an example of the risk-analysis part of a DPIA, inspired by the CNIL PIA method, for an occupational health service (demo-aipd-sst.rae.json/demo-dpia-ohs.rae.json) — with colored tags, progress bars, owners and justified links. |
| templates/ | Starter templates(xxx.template.<lang>.rae.json, one file per language) for analyses inspired by common methods and frameworks: blank skeletons — grid, criticality levels and custom fields preconfigured, no risks or measures.EBIOS RM,CNIL PIA / DPIA,ISO/IEC 27005and ageneric5×5, each inFrench, English and Italian. Listed underStart from a templatein the onboarding block (the file matching the current interface language is loaded); opening one (from there, or viaLoad…) starts a new,unlinkedanalysis. You can also turn the current analysis into a template withFile › Save as template…, and return to the onboarding block withFile › Home screen. |

Open the app online — or open app/risk-analysis-editor.htmlfrom a local copy, in a recent browser.
The tool starts on a blank analysis, opened on theOverviewtab.
Use Load…to open a.rae.jsonfile (e.g. fromexamples/),Saveto export yours.

Prerequisites: a recent desktop browser (evergreen version) with JavaScript enabled — nothing else. No server, no network access and no installation are required; the app runs from a simple file:// double-click. Only Load by URL (?file=…) needs the tool to be served over HTTP(S).

Development and testing are done primarily with Microsoft Edge (Chromium); recent desktop browsers based on Chromium (Chrome, Edge, Opera, Brave…) are the primarily tested environment and should offer the most complete experience. Known differences with other engines:

Firefox / Safari— the File System Access API (- showSaveFilePicker) is not available:- Savefalls back to a standard- downloadof the- .rae.jsonfile (and- Loadto a classic file picker) instead of writing directly into the opened file. The main features remain available on Firefox and Safari, but differences may exist, notably for the clipboard, file handling, printing and the rendering of generated documents.
Older Firefox (< 127)— copying a matrix to the clipboard- as an image(- ClipboardItem) is not supported; the PNG and SVG download buttons remain available.
Touch devices— drag-and-drop interactions (chips, kanban, column headers) target mouse usage; keyboard and menu alternatives exist (Ctrl+arrows in the kanban and matrices, ▲/▼ arrows in the column menu), but the tool is designed for desktop use.

RAE embeds exactly one third-party library: fflate v0.8.2 (MIT license, © Arjun Barrett), a tiny, fast ZIP/deflate implementation. It provides the ZIP container required by the Word (.docx) and Excel (.xlsx) exports — OOXML files being ZIP archives of XML parts. The library is vendored inline in the HTML file, with its license notice, so the app keeps working fully offline, with no external resource needed at runtime. Everything else (Markdown engine, SVG/PNG export, OOXML generation, UI components) is written from scratch for this project.

Found a bug or have a suggestion? Open a GitHub issue. For bugs, please include your browser and OS, the app version (shown in About), what you expected, what actually happened, and — when possible — a minimal .rae.json that reproduces it (zip it or paste it in a code block, since GitHub does not accept .json attachments directly).

Distributed under the MIT license — see LICENSE.