How do you calculate a risk priority number?

Multiply the three ratings: severity times occurrence times detection. On this scale, severity 6, occurrence 4, and detection 3 combine to a risk score of about 4.55 on the register's normalized scoring output.

What is a good risk register score?

Lower is better — it means low consequence, rarely occurs, and is easy to catch. There is no universal threshold; set an action limit for your register (many teams act above a fixed percentile) and always escalate high-severity items regardless of total.

Why can two risks with the same score need different action?

Because multiplication hides the mix. A severity-9 risk that is easy to detect can score the same as a severity-3 risk that is invisible, yet the first can hurt a customer. Always read the three inputs, not just the product.

Should detection be high or low for a well-controlled risk?

Lower detection scores mean you catch the problem easily, which is good. A high detection score means your controls are likely to miss it — that inflates the priority number, which is the intent.

How is this different from a simple probability times impact matrix?

A 2-factor matrix uses likelihood and impact only. Adding detection captures how well your current controls would catch the failure before it reaches the customer, which is central to FMEA and to demonstrating control effectiveness in a QMS.

Do I need the same scale across all entries?

Yes. Comparability is the whole point — if one risk uses a 1-10 severity scale and another uses 1-5, the ranking is meaningless. Lock the scale definitions before scoring the register.

QMS, CAPA & Quality System Management calculator

Risk Register Coverage Calculator

Risk Register Coverage produces an FMEA-style risk priority number so you can rank entries in a quality risk register consistently. Quality engineers, QMS owners, and risk facilitators use it to decide which risks get mitigation resources first and which are tolerable. It matters because a register with dozens of entries is useless unless you can defensibly say which three matter most — and a shared severity-occurrence-detection scale is how you do that. Feed in the three ratings on a common scale and it returns the multiplied score used to sort and threshold your register.

What this calculator does

Estimate risk register coverage for qms, capa and quality system management using production-ready inputs so teams can rank risks and decide which issue needs containment, controls, or escalation first.
Use it when risk register coverage in qms, capa and quality system management needs a defensible ranking against other qms, capa and quality system management risks for the next review.
It multiplies severity, occurrence, and detection ratings into a single risk priority number for ranking register entries.

Formula used

Risk register coverage risk score = risk register coverage severity score × risk register coverage occurrence score × risk register coverage detection score
Use the same scoring scale across comparable risk register coverage risks.

Inputs explained

Severity of harm if the risk occurs:
Likelihood the risk occurs (occurrence):
Chance controls fail to detect it (detection):

How to use the result

Use it when triaging or reviewing a quality risk register, or during an FMEA, to prioritize which risks need action.
Multiplicative RPNs are known to be coarse — different rating combinations can yield the same score while carrying very different real-world consequence, so a high severity should trigger review regardless of the total.

Current U.S. benchmarks

U.S. manufacturing runs at 75.6% of capacity (Federal Reserve, May 2026). New factory orders are up 2.3% year over year (Census).

Common questions

How do you calculate a risk priority number? Multiply the three ratings: severity times occurrence times detection. On this scale, severity 6, occurrence 4, and detection 3 combine to a risk score of about 4.55 on the register's normalized scoring output.
What is a good risk register score? Lower is better — it means low consequence, rarely occurs, and is easy to catch. There is no universal threshold; set an action limit for your register (many teams act above a fixed percentile) and always escalate high-severity items regardless of total.
Why can two risks with the same score need different action? Because multiplication hides the mix. A severity-9 risk that is easy to detect can score the same as a severity-3 risk that is invisible, yet the first can hurt a customer. Always read the three inputs, not just the product.
Should detection be high or low for a well-controlled risk? Lower detection scores mean you catch the problem easily, which is good. A high detection score means your controls are likely to miss it — that inflates the priority number, which is the intent.
How is this different from a simple probability times impact matrix? A 2-factor matrix uses likelihood and impact only. Adding detection captures how well your current controls would catch the failure before it reaches the customer, which is central to FMEA and to demonstrating control effectiveness in a QMS.

Last reviewed 2026-05-12.