How do you calculate a configuration complexity score?

Multiply severity by occurrence by detection difficulty, then normalize to the scale. With severity 8, occurrence 5, and detection 4, the raw product is 160, which maps to a priority score of about 5.95 on the calculator's scale.

What do severity, occurrence, and detection mean here?

Severity is how bad the impact is if a misconfiguration ships, occurrence is how often that configuration path is hit or fails, and detection difficulty is how hard it is to catch before order release. Each is scored on a common scale.

What is a high configuration complexity score?

Higher is worse. A score driven by high severity like the 8 in this example, even with moderate occurrence and detection, deserves attention. Sort all rules by score and harden the top of the list first.

Why use multiplication instead of adding the three scores?

Multiplication makes the score blow up when all three factors are bad at once, which is exactly when risk is real. A configuration that is severe, frequent, and hard to detect is far worse than one bad on a single axis.

How is this different from a standard FMEA RPN?

The logic is the same risk-priority math, but the factors are framed for configure-to-order risk: bad option combinations, rule conflicts, and order-release escapes rather than physical failure modes.

Should I act on severity alone if occurrence is low?

Often yes. A rarely hit but catastrophic misconfiguration can still warrant a guardrail. Use the score to rank, but never let a low occurrence fully mask a high-severity outcome like an unbuildable shipped order.

Configure-to-Order & Product Configuration calculator

Configuration Complexity Score Calculator

Configuration Complexity Score applies FMEA-style risk priority thinking to configure-to-order products, ranking how dangerous a given configuration, rule, or option combination is to your order flow. Product configuration engineers and CPQ administrators use it to triage which rules, option dependencies, or buildable combinations deserve hardening before they cause a bad quote or an unbuildable order. By scoring severity, occurrence, and detection difficulty on a common scale, teams compare configuration risks against quote, rule, and order-release risks consistently. It converts gut feel about messy configurations into a sortable priority number.

What this calculator does

Rank configuration complexity risk from option count, rule interactions, dependencies, exclusions, and engineering review needs.
prioritizing CPQ rule cleanup, option simplification, or engineering review controls
It multiplies severity, occurrence, and detection-difficulty scores into a single risk priority number for a configuration or rule, normalized to the scoring scale.

Formula used

Configuration Complexity Score risk priority score = configuration complexity severity score × configuration complexity occurrence score × configuration complexity detection difficulty score
Use the same scoring scale when comparing configuration, quote, rule, and order-release risks.

Inputs explained

Configuration complexity severity score:
Configuration complexity occurrence score:
Configuration complexity detection difficulty score:

How to use the result

Use it during CPQ rule reviews, new-option introductions, or when triaging configuration defects that reach quoting or order release.
Like all RPN scores it is ordinal, not absolute; equal products can hide very different risk profiles, so a high severity with low occurrence should not be averaged away.

Common questions

How do you calculate a configuration complexity score? Multiply severity by occurrence by detection difficulty, then normalize to the scale. With severity 8, occurrence 5, and detection 4, the raw product is 160, which maps to a priority score of about 5.95 on the calculator's scale.
What do severity, occurrence, and detection mean here? Severity is how bad the impact is if a misconfiguration ships, occurrence is how often that configuration path is hit or fails, and detection difficulty is how hard it is to catch before order release. Each is scored on a common scale.
What is a high configuration complexity score? Higher is worse. A score driven by high severity like the 8 in this example, even with moderate occurrence and detection, deserves attention. Sort all rules by score and harden the top of the list first.
Why use multiplication instead of adding the three scores? Multiplication makes the score blow up when all three factors are bad at once, which is exactly when risk is real. A configuration that is severe, frequent, and hard to detect is far worse than one bad on a single axis.
How is this different from a standard FMEA RPN? The logic is the same risk-priority math, but the factors are framed for configure-to-order risk: bad option combinations, rule conflicts, and order-release escapes rather than physical failure modes.

Last reviewed 2026-05-12.