Bowtie turns out to be a very efficient method to understand your risks and manage your barriers in order to support operations. It is an intuitive, scenario-based visualization of reality. As with all models, it must be said that “all models are wrong, but some are useful” (George E. P. Box, 1976), since it is a paper world representation. Box challenged how wrong a model has to be, in order for it not to be useful. In the case of bowties, it is advised to stick to certain guidelines to structure the models’ initial skeleton, to reach an optimal end result and be as useful as possible.
This blog will cover the principles that CGE recommends when formulating basic bowtie elements.

Hazard – the desired state or activity in normal business

When defining a hazard, it is important to keep in mind that there is no ‘hazardous situation’ taking place as of yet. Regardless of the slight negative connotation with the word hazard, in professional situations it is seen as the normal activity or state of daily operations. It does however contain a hazardous substance or energy that, when released, has the potential to cause harm and lead to negative outcomes.

Figure 1: Driving a car has the potential to cause harm

Top Event – a deviation from the desired state or activity in normal business

The top event can be described as the very first moment when control over the hazard is lost. A major pitfall is to define a top event in a disastrous state already, while this is not the idea. The top event is a change of state of your hazard from which it is still possible to recover. Also, sometimes the connection between the hazard and the top event is not established well. Providing a logical relation between these two will prevent this from happening and sets a correct scope for your bowtie.

Figure 2: If we lose control over it, driving a car has the potential to cause harm

Similar to the hazard, the top event can indicate the scale that the bowtie will cover by defining what can be seen as an abnormality in business. Note: One hazard can have multiple top events.

Threats – a direct and independent cause that can lead to the top event

A common mistake when defining threats is stating barrier failures rather than (external) forces acting upon the initial process at hand. Often a barrier has become so common that we forget that it was not a part of your original operation. When being stuck on phrasing barrier failures, it can be helpful to ask why a certain procedure, protocol, or hardware exists in the first place; this will eventually lead you back to the threat that required barriers to be implemented.

Figure 3: Threats leading to loss of control when driving a car

Threats on their own should be sufficient enough to lead directly to the top event. When two threats are needed to occur together before the top level can be reached, it is necessary to reformulate a combination of these two in order to create an independent route leading to the top event.

Consequences – negative event outcomes arising from the top event

Often people are tempted to define a consequence as the loss or damage resulting from the top event. Already by reading this sentence, an alarm bell should sound. “Damage resulting from the top event”, how did that occur then? And this is exactly what should be defined; which events occur after a top event has taken place. These are your consequences.

Figure 4: Consequences once control over a car is lost

Looking at the damage or loss on different aspects of your organization or its environment, can take place when performing your risk assessment through for instance filling out risk matrices.

Barriers – safety measures to prevent a risk scenario from proceeding

Once the initial skeleton of your bowtie has been set it is time to implement the barriers. These are the safety measures that prevent, control or mitigate undesired effects or outcomes. When formulating the basic elements according to the guidelines provided earlier, you will be able to come up with concrete and relevant barriers to place along the different scenarios of your bowtie. In addition, you will notice that this becomes more difficult to execute when the recommended guidelines have been ignored in defining the other elements (hazard, top event, threats and consequences).

Figure 5: Preventive barriers to avoid progressing into a top event

Keep in mind to involve a detect/decide/act component for each barrier, and to phrase your barrier in its desired (non-failing) state. This will guide you in identifying functional and relevant barriers over which you are in control, in order to prevent the next event from happening.

Want to learn more?

Hopefully this was a good way to learn about or refresh your knowledge on the bowtie methodology. Do you feel the need for more education on the topic? Check our event calendar for our upcoming trainings, possibly near you.