Each failure mode gets rated 1 to 10 on three scales: severity of the effect, likelihood of occurrence, and likelihood the current controls detect it before it escapes. Multiplying them gives a risk priority number (RPN); the newer AIAG-VDA handbook replaces raw RPN with action priority tables, partly because teams gamed RPN by inflating detection scores. Either way the discipline is the same: list the ways it can fail, rank them, act on the top.

The DFMEA versus PFMEA split matters. A DFMEA drives design for manufacturability decisions while geometry is still cheap to change. A PFMEA examines a specific process at a specific plant, which is why a generic PFMEA copied across sites is a red flag. Both are core deliverables inside APQP, written during development and updated whenever the design or process changes.

For procurement, a supplier's PFMEA is a window into process maturity. Ask for it before award: does it cover every operation, do high-severity items (9 and 10) get design-side action regardless of RPN, and has it been revised after past escapes and root cause investigations? An FMEA written once to pass a quality assurance audit and never touched again predicts exactly nothing.