Between 2016 and 2021, the global banking sector recorded more than 65,000 operational loss events, totaling approximately US$$ 600 billion in losses, according to ORX data analyzed by McKinsey.
Most of these failures did not stem from unpredictable events. They stemmed from known risks that were poorly prioritized or discovered too late.
That is exactly the problem FMEA was designed to solve. Not as a quality checklist, but as a discipline of anticipation that connects engineering, operations, and risk governance before the failure becomes news to the board.
By the end of this article, you will have clarity on how to structure an FMEA analysis at the executive level, integrate it into your risk management architecture, and avoid the mistakes that turn the method into impactless bureaucracy.
Why FMEA is no longer just a shop floor tool
FMEA originated in the US military in the 1940s and became established in the automotive and aerospace industry as a reliability tool, as documented in ASQ. For decades, it was associated with product and process engineers.
This technical origin still confuses many executives about what FMEA means in management practice. In essence, it is a structured method to map how a product, process, or service can fail, the effect of each failure, and the root cause behind it.
The strategic turning point is another: failures in critical processes today do not remain restricted to the production line. They propagate to contracts, regulatory compliance, and brand reputation in a matter of hours.
From quality control to the risk committee
Mature companies no longer treat FMEA as an isolated engineering document. They treat it as an input for the regulatory risk management and for corporate risk committees.
This status change, from a technical tool to a governance input, is what separates reactive organizations from organizations that anticipate.
FMEA and the vocabulary of enterprise risk management
A failure mode, in the language of corporate risk, is simply an operational risk named with surgical precision. This translation is what allows an FMEA analysis to feed directly into the company's risk matrix, rather than just being an archived technical report.
Who has already structured a effective risk mapping acknowledge the parallel: the difference lies in the granularity and causal rigor that FMEA imposes.
How to structure an FMEA analysis that drives decisions, not just documentation
An effective FMEA analysis follows five steps: mapping failure modes, identifying effects and severity, pointing out causes and probability of occurrence, evaluating existing detection controls, and calculating the resulting action priority.
Most FMEA analyses fail not due to a lack of methodology, but because of an excess of it disconnected from business priorities. Conducting an effective FMEA analysis requires three simultaneous elements: technical rigor, prioritization discipline, and a clear owner for each action.
Failure mode, effect, and cause: the MECE test applied to risk
Each failure mode must be mutually exclusive and collectively exhaustive in relation to the others, the same MECE principle used in strategy consulting. Two failure modes describing the same problem with different words inflate the inventory without adding real visibility.
| Element | Decisive question |
| Failure mode | In what specific way can the process fail? |
| Effect | What do the customer, the business, or the regulator feel when this happens? |
| Cause | What root mechanism causes this failure? |
| Current control | What already exists to detect or prevent this today? |
The Risk Priority Number (RPN) and its limits
The traditional FMEA model multiplies severity, occurrence, and detection to generate the Risk Priority Number (RPN), allowing hundreds of potential failures to be prioritized in a single action list.
The RPN, however, has a known weakness: two risks with the same score can have completely different financial natures.
Therefore, recent research in cost-oriented FMEA advocates complementing the RPN with the estimated financial impact of each failure before allocating mitigation budgets.
In executive practice, this means a simple rule:
- High RPN and high financial cost → immediate action, with a designated owner and formal deadline.
- High RPN and low financial cost → control standardization, without escalating to the committee.
- Moderate RPN and reputational or regulatory effect → escalate even with a lower technical score.
Failure mode and effects analysis: the link between operational risk and strategy execution
Robert Kaplan, co-author of the Balanced Scorecard, argued that risk management should be treated as the third pillar of shareholder value creation, alongside revenue growth and productivity, proposing a risk scorecard indicator parallel to the balanced scorecard.
Failure mode and effects analysis is, in practice, the operational mechanism that feeds this risk indicator with granular and causal data, not with qualitative committee perceptions.
Why management tools are born, but only those that generate decisions survive
It is worth noting, for the sake of methodological integrity, that the use of the Balanced Scorecard among large companies fell from a peak of 66% in 2007 to 29% in 2018, according to Bain & Company’s survey of management tools.
The lesson for FMEA is straightforward: no framework survives on tradition alone. Only what continues to generate executive decisions with updated data survives, and that is where risk management technology becomes decisive, not optional.
From static inventory to live risk scorecard
An FMEA sitting in an outdated spreadsheet is no different from an unidentified risk; both leave the organization blind at the moment of failure.
The question that remains is: can your company track today, in real time, whether the controls listed in an FMEA from two years ago still exist?
What separates companies that avoid costly failures from those that merely document them
The cost of fixing a failure increases non-linearly the later it is discovered, which is why FMEA has a greater impact when applied early in process design, rather than after it is already in full operation.
One case illustrates this logic well. The BMW plant in Regensburg faced recurring line stoppages due to conveyor belt failures.
By implementing predictive monitoring on the same signals that an FMEA analysis had already mapped as critical failure points, the plant avoided more than 500 minutes of unscheduled downtime per year, according to a report by MIT Sloan Management Review.
Organizations that bridge the gap between FMEA and continuous monitoring share a structural characteristic: they treat each critical failure mode as an indicator to be monitored, not as a closed line in a report.
The role of data and real capacity-based prioritization
The Project Management Institute found that, among the factors most frequently cited by high-performance organizations, risk identification and management appeared in 51% of the responses, ranking even ahead of quality management, according to the report Pulse of the Profession 2024 do PMI.
This confirms what practice was already showing: well-managed risk is no longer a silent differentiator and has become an explicit criterion for organizational performance.
How much it is worth investing in this? The market itself answers.
Gartner projects that global spending on information security and risk management reach US$1.44 trillion by 2028, growing at a compound annual rate of over 10%—a clear sign that failure prediction has become a strategic budget line item, not a residual cost.
What a mature FMEA demands from technology
Organizations that solved this problem share a structural characteristic: they connected failure mode analysis directly to the architecture of risk management from the company.
FMEA ceases to be a parallel document and starts feeding, in real time, the same matrix that guides executive committee decisions.
This requires three capabilities that an isolated spreadsheet cannot deliver: traceability between failure mode and action plan, continuous updating of existing controls, and consolidated visibility for those prioritizing mitigation budgets, the same principles that support a good prioritization of strategic initiatives.
It is precisely this architecture that Actio Risk Management built to sustain. More than just recording failures, the software connects each identified failure mode to action plans with assignees and deadlines, automatically calculates probability and impact matrices, and keeps mitigation controls visible to the entire leadership team.
In practice, this means that a chief operating officer stops asking “when was the last time we reviewed this risk?” and gets the answer on a single, updated dashboard, without depending on parallel spreadsheets or institutional memory.
Companies that have already integrated this type of discipline report the same gain: less time reacting to crises, more time allocating resources where prevention truly pays off.
FMEA as a permanent discipline
Returning to the initial question: the 600 billion US$ lost by the banking sector were not, for the most part, unknown risks. They were risks that could have been identified by any well-conducted failure-mode and effects analysis, but they never made it to the decision-making table in time.
FMEA, when treated as a living discipline rather than a one-off audit exercise, is what ensures that your company's next critical failure is discovered in a mapping spreadsheet.
The question that remains for your organization is simple: if a critical failure mode were silently active today, how long would it take for it to appear on the radar of someone with the authority to act?
If the answer is not immediate, it is worth knowing how Actio Risk Management You can structure this radar for your company: from initial flaw mapping to continuous executive-level risk governance.
Fill out the form below to schedule a free demonstration and understand how Actio can help your company manage risks.
