How do you calculate outsource quality risk?

Multiply the three 1-10 scores: severity x occurrence x detection. With severity 6, occurrence 4 and detection 3 the RPN is 72 on a raw 1,000-point scale.

What is a good outsource quality risk score?

Lower is better. On a classic FMEA scale, RPNs under about 100 are routine, 100-200 warrant a containment plan, and anything driven by a severity of 9-10 needs action regardless of the total.

What's the difference between severity, occurrence and detection?

Severity rates how bad the failure is for the customer, occurrence rates how likely the supplier is to make it, and detection rates how unlikely you are to catch it before it ships to your line.

Should I still outsource a part with a high RPN?

You can, but pair it with controls — source inspection, a higher AQL, capability studies, or dual sourcing — to drive the detection or occurrence score down before production volume.

Why use RPN instead of just severity?

Severity alone ignores whether the defect actually happens or gets caught. RPN combines all three so a rare, easily-caught severe defect doesn't outrank a frequent, invisible one.

How do I compare two suppliers fairly?

Score every supplier on the identical 1-10 scale and rank by RPN. Mixing scales (1-5 here, 1-10 there) makes the comparison meaningless.

Make-Buy, Outsourcing & Network Design calculator

Outsource Quality Risk Calculator

Outsource Quality Risk is a Risk Priority Number (RPN) that scores the danger of a quality defect slipping in from an outsourced supplier. It multiplies how severe a failure would be, how often the supplier is likely to produce it, and how hard it is for your incoming inspection to catch it. Supplier quality engineers and sourcing teams use it to rank suppliers and defect modes so audit time and source-inspection dollars go where they matter most. A high RPN flags a part you should not have outsourced without containment in place.

What this calculator does

Estimate outsource quality risk for make-buy, outsourcing and network design using production-ready inputs so teams can rank risks and decide which issue needs containment, controls, or escalation first.
Use it when outsource quality risk in make-buy, outsourcing and network design needs a defensible ranking against other make-buy, outsourcing and network design risks for the next review.
It multiplies the severity, occurrence and detection scores of an outsourced defect mode into a single Risk Priority Number.

Formula used

Outsource quality risk score = outsource quality risk severity score × outsource quality risk occurrence score × outsource quality risk detection score
Use the same scoring scale across comparable outsource quality risk risks.

Inputs explained

Defect severity if it reaches the customer (1-10):
Likelihood the supplier ships the defect (1-10):
Difficulty detecting the defect at receiving (1-10):

How to use the result

Use it during supplier qualification, PPAP review, or when a make-vs-buy decision moves a part to an external shop and you need to rank quality exposure.
RPN is ordinal, not absolute — an RPN of 72 is not twice as risky as 36, and equal RPNs can hide a critical severity-10 mode, so always inspect the individual scores.

Current U.S. benchmarks

Sourcing currencies as of 2026-07-02 (Federal Reserve H.10): 6.7886 CNY and 17.4524 MXN per USD. Landed-cost comparisons move with these daily rates.
U.S. iron and steel imports ran $2.1B in May 2026 (Census International Trade). The U.S. ran a trade deficit of $0.4B in the category that month. Import volumes are the pressure gauge behind tariff and reshoring decisions.

Common questions

How do you calculate outsource quality risk? Multiply the three 1-10 scores: severity x occurrence x detection. With severity 6, occurrence 4 and detection 3 the RPN is 72 on a raw 1,000-point scale.
What is a good outsource quality risk score? Lower is better. On a classic FMEA scale, RPNs under about 100 are routine, 100-200 warrant a containment plan, and anything driven by a severity of 9-10 needs action regardless of the total.
What's the difference between severity, occurrence and detection? Severity rates how bad the failure is for the customer, occurrence rates how likely the supplier is to make it, and detection rates how unlikely you are to catch it before it ships to your line.
Should I still outsource a part with a high RPN? You can, but pair it with controls — source inspection, a higher AQL, capability studies, or dual sourcing — to drive the detection or occurrence score down before production volume.
Why use RPN instead of just severity? Severity alone ignores whether the defect actually happens or gets caught. RPN combines all three so a rare, easily-caught severe defect doesn't outrank a frequent, invisible one.

Last reviewed 2026-05-12.