Lessons learned from the real world application of the bowtie method

Risk assessment lies at the heart of risk management and one of the most powerful and increasingly popular risk assessment techniques is the bow-tie method. Its strength is that it goes beyond the usual risk assessment ‘snapshot’ and highlights the links between risk controls and the underlying management system. It is an excellent demonstration tool, but is also well-suited to communicating risk issues to non-specialists.

Bow-ties originated as a method for assessing hazard and operational risks. The Royal Dutch/Shell Group was the first major company to integrate the total bow-tie method into its business practices and is credited with developing the technique which is widely used today. Use of bow-ties has subsequently spread between companies, industries, countries and from industry to regulator. Their application has extended across all risks, including financial, strategic, security, quality, business interruption, political, human resources, design and project risk.

BOW-TIE METHOD

The method for building a bow-tie diagram is well-documented, and involves asking a structured set of questions in a logical sequence to build up the diagram step by step (Figure 1). The completed bow-tie illustrates the hazard, its causes and consequences, and the controls in place to minimise the risk. Facilitated workshops involving people who are regularly confronted with the hazards have proven to be the most effective way of identifying real controls and capturing current practice.

“The main benefit for me is the simple pictorial representation, giving an almost instant top level view on the adequacy of prevenative measures.”

PRACTICAL USES AND BENEFITS

Demonstration – Bow-ties are used to demonstrate that hazards are being controlled, and that there is a direct link between the controls and elements of the management system. For example, bow-ties have been used successfully in safety reports produced for compliance with the UK onshore chemical industry Control of Major Accident Hazard (COMAH) Regulations.

There are other ways of demonstrating this link (e.g. simple tables) but the bow-tie provides a clear graphical illustration which is easy to understand.

Communication – The diagram is understood by personnel at all levels of an organisation, including those who are not connected with the day-to-day operation being assessed. The bow-tie can be displayed on posters highlighting key risk control issues. Pocket books and leaflets have also been produced for dissemination of the risk management message, and web-based bow-ties form part of on-line training and information systems. The graphical-based approach is easy to implement with multi-national teams.

It is not necessary to use sophisticated techniques to get the most from the bow-tie method. Talking through the components of a particular scenario whilst sketching a bow-tie layer by layer can clearly illustrate how the hazard is managed.

Organisational improvements – Bowties can highlight areas where organisational control is weak, enabling proactive, sustainable strategies for reducing risk to be targeted on these areas. Bow-ties have also been used to ensure that critical controls do not ‘fall through the cracks’ after a company reorganisation. Bow-ties can be used during incident investigations to identify organisational weaknesses that allowed risk controls to fail.

Procedures and competence – A completed bow-tie analysis includes a list of critical tasks undertaken to assure the ongoing integrity of risk controls. The tasks can be used to verify the adequacy of a company’s competence assurance system; the competencies defined for each role should align with the bow-tie controls. Bow-ties have also been used to manage handover/new-starter responsibilities.

Critical systems – Systems which prevent, detect, control or mitigate a hazardous event are deemed ‘critical’. Such systems are clearly illustrated along the threat and consequence branches of the bow-tie and can be linked to defined performance standards and means of verification.

‘Future proof’ risk management – Unlike other risk assessment techniques, the bow-tie illustrates not only what controls are currently in place, but, through the use of critical tasks, why they will still be there tomorrow.

Ownership – Bow-tie workshops stimulate communication between key stakeholders who all have a role to play in managing risk. Bow-ties focus on risk management at the operational level for use by operational people, rather than technical risk specialists. All staff can see why what they do is critical for risk control.

Auditable trail – Bow-tie diagrams and critical task lists provide a protocol for auditing management arrangements.

CONCLUSIONS

Bow-ties provide a clear visualisation of the relationships between the causes of business upsets, escalation to a range of possible outcomes, and controls which prevent the event from occurring and limit the consequences. More importantly, the controls are linked to tasks, procedures, responsible individuals and competencies, thereby identifying how the management system provides assurance that risks will continue to be properly managed.

The benefits of using bow-tie diagrams for risk management have been realised by organisations world-wide across a variety of business sectors.

“This is the way you make your risk management case real and day to day.”

This article first appeared in RISKworld Issue 6.