Risk Priority Number Calculator
Compute an FMEA risk priority number from severity, occurrence and detection on the 1–10 scales, with criticality and an action priority.
Inputs
Risk Priority Number
240of 1000
Criticality (S × O)
40of 100
Share of the Maximum RPN
24.0%
Action Priority
High — action required, and a decision not to act must be justified in writing
Threshold Verdict
Above your threshold of 100 — raise a corrective action with an owner and a date
Where to Act
Severity — the only real fix is design change, because severity is a property of the effect and cannot be inspected away
Safety and Regulatory Note
No safety or regulatory flag, so RPN ranking alone is a reasonable basis for prioritisation
Step by step
Values used
Severity of the effect = 8 — Very high, system inoperable; Likelihood of the cause occurring = 5 — Occasional; Ability of the current control to detect the cause = 6 — Low; Your action threshold for RPN = 100 points; Failure has safety or regulatory consequences = No
Risk Priority Number
RPN = severity × occurrence × detection, each rated 1–10, giving a range of 1 to 1000; criticality = severity × occurrence.
Action priority
Action priority follows the AIAG-VDA style logic: high severity with any real occurrence, or a large RPN, demands action regardless of the arithmetic.
Risk Priority Number
= 240 of 1000
Criticality (S × O)
= 40 of 100
Share of the Maximum RPN
= 24.0
Action Priority
= High — action required, and a decision not to act must be justified in writing
Threshold Verdict
= Above your threshold of 100 — raise a corrective action with an owner and a date
Where to Act
= Severity — the only real fix is design change, because severity is a property of the effect and cannot be inspected away
How it works
The detection scale is inverted — 1 means you will certainly catch it, 10 means you have no chance — so a high RPN can come from a genuinely dangerous failure or merely from a blind spot in monitoring. Criticality is reported alongside because it drops detection entirely, which stops a team from adding an inspection step to make a dangerous failure mode look acceptable. RPN is the standard way to rank failure modes in an FMEA and it works well as a queue, but it is an ordinal product, not a measurement, so a 200 is not twice as bad as a 100. Use it to order the work, then argue about the top of the list.
Formulas
Risk Priority Number
RPN = severity × occurrence × detection, each rated 1–10, giving a range of 1 to 1000; criticality = severity × occurrence.
- severity
- How bad the effect is, 1–10
- occurrence
- How often the cause happens, 1–10
- detection
- How poorly the current control detects it — 10 means no detection at all
Action priority
Action priority follows the AIAG-VDA style logic: high severity with any real occurrence, or a large RPN, demands action regardless of the arithmetic.
- criticality
- Severity × occurrence, which ignores detection and so cannot be gamed by adding inspection
- S ≥ 9
- Hazardous effects are actioned on severity alone
Frequently Asked Questions
How is Risk Priority Number calculated?
RPN = severity × occurrence × detection, each rated 1–10, giving a range of 1 to 1000; criticality = severity × occurrence. The detection scale is inverted — 1 means you will certainly catch it, 10 means you have no chance — so a high RPN can come from a genuinely dangerous failure or merely from a blind spot in monitoring. Criticality is reported alongside because it drops detection entirely, which stops a team from adding an inspection step to make a dangerous failure mode look acceptable.
Why does Risk Priority Number matter?
RPN is the standard way to rank failure modes in an FMEA and it works well as a queue, but it is an ordinal product, not a measurement, so a 200 is not twice as bad as a 100. Use it to order the work, then argue about the top of the list.
What values do I need to enter?
This calculator takes 5 inputs: Severity of the effect, Likelihood of the cause occurring, Ability of the current control to detect the cause, Your action threshold for RPN, Failure has safety or regulatory consequences. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is RPN a reliable way to rank risks?
It ranks reasonably and measures badly. The scales are ordinal, so multiplying them produces gaps and duplicates — 120 can be reached six different ways with very different meanings. That is why the newer AIAG-VDA method replaced RPN thresholds with an action priority table, and why criticality and severity are shown here alongside the number.
Why does severity alone sometimes force action?
Because you cannot inspect your way out of a hazardous failure. If the effect is severity 9 or 10, the acceptable responses are design change or elimination of the cause; improving detection only means you find out sooner that someone was hurt.
You might also need
- Residual Risk CalculatorCommonly used together
- Risk Heatmap CalculatorCommonly used together
- Control Effectiveness CalculatorCommonly used together
- Disaster Recovery RTO CalculatorAlso in Compliance & GRC
- Security Investment ROI CalculatorAlso in Compliance & GRC
- ISO 27001 Compliance CalculatorAlso in Compliance & GRC