Bowtie – closing the loop between risk assessment and the management system

Companies in major hazard industries have long been accustomed to carrying out hazard identification and risk assessment. They are also expected to have in place a structured safety management system. In recent years, moves have been made to link the two visibly – to demonstrate that the management system is indeed able to control the actual hazards present, rather than being a separate system produced in isolation.

The latest such development has occurred in the US, where offshore operators are required to develop and implement a Safety and Environmental Management System (SEMS) for oil and gas operations in the Outer Continental Shelf. A key requirement is for SEMS to demonstrate that safety critical equipment is being maintained and that safety critical jobs are undertaken by competent people – in other words a joined up SEMS.

LINKING BARRIERS TO THE SEMS

Bowtie analysis is an established risk assessment technique that allows detailed analysis of prevention and mitigation measures for specific hazards. This is achieved by constructing a bowtie diagram which illustrates potential causes of the hazardous event and ultimate consequences. However, one aspect of the technique that is not always exploited to its full potential is to verify the link between the barriers in the bowtie and the SEMS (see Figure 1).

Each prevention barrier on the left side and each mitigation barrier on the right side can be linked to critical tasks which keep the barrier working and are in turn linked to job descriptions, training and competence assessments, i.e. the competence assurance part of the company’s SEMS.

Barriers that make a claim on a piece of equipment can also be linked to computerised maintenance management systems which specify the equipment’s criticality and inspection/test regime, as well as to performance standards, performance assurance activities and verification schemes, i.e. the asset integrity part of the company’s SEMS.

MANAGING WHAT MATTERS

Exploring these direct links between risk assessment and the SEMS highlights any weaknesses in arrangements and establishes objectively whether effective systems are in place to sustain those measures essential for controlling hazards.

Not only does this provide assurance that hazards are effectively managed, it also ensures that the SEMS is designed to focus on the real-life threats to the organisation’s safe operation – it manages what matters.

Having conducted the risk assessment and confirmed the links between hazards and the SEMS, a further ‘layer’ of bowtie analysis allows for the audit of the arrangements on the ground. The bowtie diagrams and supporting critical activities and equipment reports can act as checklists to verify that the hazards continue to be controlled as intended.

LIVING SAFETY CASES

Safety cases can use bowties to map the link between major hazard barriers and the SEMS. Operators or regulators inspecting the facilities can easily check for evidence of the supporting competence assurance and asset integrity activities, providing proof that the safety case is based on reality and that hazard management is truly owned by the workforce.

CONCLUSION

Making full use of the bowtie methodology helps organisations develop a joined up SEMS, which is targeted at major hazards. The approach ensures that the SEMS is indeed managing what matters. Thereafter, using bowties to audit competence and asset integrity closes the loop between the SEMS and risk assessment.

This article first appeared in RISKworld Issue 23