Most professionals just use excel. You can create a simple risk matrix in 5 minutes, something like this, then sum() and average the values by column/row depending on how you constructed it.
Something like this:
Probability should be realistic: How often has this happened to your organisation - or similar organisations. I made a risk assessment program a decade ago like a graph with nodes and edges that you could add threats, solutions - like an attack tree for an organisation, but while that kind of software is cool looking, it is also unnecessary for a simple risk analysis.
Excel is sufficient.
_________________
"It is far better to grasp the Universe as it really is than to persist in delusion, however satisfying and reassuring" (Carl Sagan)