Multiply three ordinal ratings and you get a precise-looking number with no meaning. Automotive FMEA replaced it with Action Priority in 2019.
why no RPN
The number we refuse to compute
AI risk frameworks keep rebuilding the Risk Priority Number. The industry that invented it replaced it in 2019.
Every AI risk framework I review ends the same way: one risk score per use case.
Most of them are rebuilding the Risk Priority Number. Severity times occurrence times detectability, each rated one to ten. The automotive industry's own FMEA handbook retired it in 2019.
Why a single score accumulates debt
The ratings are ordinal. A severity of 8 is not twice a severity of 4. Multiplying labels gives you a number with a decimal point, no units, and a severe failure hiding in the middle of the list.
That is exactly why AIAG and VDA replaced it with Action Priority — a lookup table that ranks severity first, so a severity-9 failure cannot be averaged into comfort.
The reality on the ground
The third term is the one people miss. Detectability is how likely you are to catch a failure before a user does — which depends on your logging, your evals, your review. It is a property of your deployment. Rating it on your behalf would be inventing a number about a system I have never seen.
Do not let a common, mild failure outrank a rare, severe one because the arithmetic said so.
A rate without one is a guess with a decimal point.
Nobody outside your organisation can.
When one number is right
Inside one team, on one system, tracking one failure mode over time, a single number going down is real information. The moment it crosses into a risk register or a vendor comparison, split it back into its parts.
Does your AI risk register multiply ratings into a single score — and could a severity-9 failure be hiding inside it?
Every figure here describes something measured and committed. See the measurements · read the method