How is a supplier risk score calculated?

Multiply three ratings on 1-10 scales: severity of the failure if it reaches you, likelihood of occurrence and difficulty of detection. Severity 6, occurrence 4 and detection 3 give 6 × 4 × 3 = 72 on the 1-to-1,000 scale.

What is a good supplier RPN?

There is no universal number, and pretending one exists is how thresholds get gamed. Lower is better; many programs start acting around 100 and refine the line from their own distribution. A severity 9 or 10 is actionable at any total.

What is the severity × occurrence row for?

It is the criticality view: the ranking with detection removed. Detection is the least reliable rating, because scoring it requires knowing how often your own inspection misses. When detection is contested, criticality keeps the comparison honest.

Is RPN still current FMEA practice?

The AIAG-VDA handbook moved to Action Priority tables, which look up rating combinations instead of multiplying them, precisely because products hide high severity. This page computes the RPN convention because supplier scorecards still use it, with an explicit severity warning.

Supplier Quality, Development & Audits calculator

Supplier Risk Score Calculator: Severity × Occurrence × Detection

Score a supplier failure mode the way a process FMEA does: rate severity, occurrence and detection on 1-10 scales and multiply. Your action threshold and the severity-times-occurrence criticality sit beside the total.

What this calculator does

Rank supplier failure modes by FMEA risk priority, with a severity floor and your own threshold.

Formula used

Risk score (RPN) = severity × occurrence × detection
Criticality = severity × occurrence
Over or under threshold = risk score − your action threshold

Inputs explained

Severity of Supplier Failure: Damage if the failure reaches your line or customer.
Occurrence Likelihood: How often it happens, anchored to PPM history.
Detection Difficulty: How likely it escapes your controls; higher is worse.
Your Action Threshold: The RPN level where your program requires action.

How to use the result

Best suited to triaging supplier nonconformances for containment, choosing which suppliers to audit this quarter, building the risk column of a scorecard.
RPN is ordinal, not linear: 120 is not twice as risky as 60. A low total can hide a severity-9 failure behind low occurrence and detection. The AIAG-VDA handbook has moved to Action Priority tables; a customer scheme takes precedence.

Current U.S. benchmarks

U.S. manufacturing runs at 75.7% of capacity (Federal Reserve, Aug 2026). New factory orders are up 8.5% year over year (Census).

Common questions

How is a supplier risk score calculated? Multiply three ratings on 1-10 scales: severity of the failure if it reaches you, likelihood of occurrence and difficulty of detection. Severity 6, occurrence 4 and detection 3 give 6 × 4 × 3 = 72 on the 1-to-1,000 scale.
What is a good supplier RPN? There is no universal number, and pretending one exists is how thresholds get gamed. Lower is better; many programs start acting around 100 and refine the line from their own distribution. A severity 9 or 10 is actionable at any total.
What is the severity × occurrence row for? It is the criticality view: the ranking with detection removed. Detection is the least reliable rating, because scoring it requires knowing how often your own inspection misses. When detection is contested, criticality keeps the comparison honest.
Is RPN still current FMEA practice? The AIAG-VDA handbook moved to Action Priority tables, which look up rating combinations instead of multiplying them, precisely because products hide high severity. This page computes the RPN convention because supplier scorecards still use it, with an explicit severity warning.

Last reviewed 2026-10-01.