Using Bowtie Risk Assessment in Safety Management Systems
Aviation professionals understand the power of collecting data on incidents and near-misses in a Safety Management System (SMS). Corrective and Preventive Actions (CAPA), Incident Reporting, Audit Management—all of these tools are based on conditions observed first-hand.
But what about high-risk events that don’t occur frequently, or haven’t happened in your organization at all? Some risks are simply too great to ignore, whether or not you have data to understand how they would play out in the workplace.
That’s where the bowtie risk assessment model comes in.
The beauty of the bowtie model of risk assessment is that it addresses both the controls needed to prevent an undesired state, as well as how to mitigate the consequences if controls fail and the event occurs.
Key elements of the bowtie model include:
A specific hazard that creates risk in your organization.
The top event resulting from the hazard. This is the specific state you’re trying to avoid, typically involving a loss of control.
Threats fanning out to the left, representing conditions that lead to the top event.
Preventive controls mapped to each threat, describing measures that either eliminate the hazard altogether or prevent the threat or top event.
Consequences fanning out to the right, listing potential outcomes if the top event were to happen.
Recovery controls linked to each consequence, indicating controls that reduce the probability or severity of the specific consequence.
Bowtie risk assessment is common in industries like aviation, oil and gas and chemicals. That’s because all of these industries must somehow address high-risk, if rare, events such as a pilot losing control, a wellhead blowout or a large chemical spill.
Let’s look at the example of a house fire. While it’s never happened in my home, it’s definitely something I’d like to avoid.
The hazard keeping me up at night is our outdated electrical system. This could lead to fire, the top event. Threats that could spark the fire include the shorting out of space heaters embedded in the walls (apparently they thought this was a good idea in 1955), an overloaded extension cord, a short from a damaged cord and improper wattage for light fixtures.
Preventive controls for these include total disconnection of the space heaters, not using extension cords for major appliances, disconnecting the washer and dryer when I go on vacation, checking cords for damage and using the correct wattage for all fixtures.
Unfortunately, it’s possible a fire could happen despite these efforts. And that’s the scary part, because the consequences include my house burning to the ground, my dog being trapped inside and injury to my family. Recovery controls I’ve instituted include smoke detectors, a fire extinguisher and a home monitoring system linked to the city fire department. One recovery control still lacking is a sign notifying the fire department my sweet pup is inside (corrective action currently pending).
How to Get it Right
There are several things Aviation professionals can do to successfully implement bowtie risk assessment within the SMS. Start by assembling a team, including subject matter experts and those familiar with the situation on-the-ground. These people can provide critical input, clarifying how different roles and conditions interact within the workplace so you can ensure your bowtie represents a complete picture of risk.
Before your first meeting, you should identify the key hazard and the top event. Once you’ve worked through each element, you’ll want to spend time digging deeper into the implications. Issues to explore include control effectiveness, the likelihood of each threat, which controls are most critical and who’s responsible for implementing each control.
Capture any requisite Corrective and Preventive Actions within your SMS, preferably one that can automatically route each CAPA request through review, root cause analysis, corrective action taken and verification. You should also schedule a separate session to review and validate your bowtie model. Finally, it’s important to communicate the results of your bowtie risk assessment with your organization, something made simple with an automated SMS.
In the end, bowtie risk assessment is a must-have capability for any effective SMS, a tool that’s even more powerful when integrated with automated functions like CAPA, Enterprise Risk Management and Document Control.