Subscribe to Email Updates

Quality Creates...Perspective

Using Bowtie Risk Assessment in Safety Management Systems

Rachel Beavins Tracy
by Rachel Beavins Tracy on Tue, Jan 13, 2015

Managing Your Risk Has Its Rewards

Aviation professionals understand the power of collecting data on incidents and near-misses in a Safety Management System (SMS). Corrective and Preventive Actions (CAPA), Incident Reporting, Audit Management—all of these tools are based on conditions observed first-hand.

But what about high-risk events that don’t occur frequently, or haven’t happened in your organization at all? Some risks are simply too great to ignore, whether or not you have data to understand how they would play out in the workplace.

That’s where the bowtie risk assessment model comes in.

The Basics

The beauty of the bowtie model of risk assessment is that it addresses both the controls needed to prevent an undesired state, as well as how to mitigate the consequences if controls fail and the event occurs.


bowtie diagram

Key elements of the bowtie model include:

  • A specific hazard that creates risk in your organization.

  • The top event resulting from the hazard. This is the specific state you’re trying to avoid, typically involving a loss of control.

  • Threats fanning out to the left, representing conditions that lead to the top event.

  • Preventive controls mapped to each threat, describing measures that either eliminate the hazard altogether or prevent the threat or top event.

  • Consequences fanning out to the right, listing potential outcomes if the top event were to happen.

  • Recovery controls linked to each consequence, indicating controls that reduce the probability or severity of the specific consequence.

Bowtie risk assessment is common in industries like aviation, oil and gas and chemicals. That’s because all of these industries must somehow address high-risk, if rare, events such as a pilot losing control, a wellhead blowout or a large chemical spill.

An Example

Let’s look at the example of a house fire. While it’s never happened in my home, it’s definitely something I’d like to avoid.

The hazard keeping me up at night is our outdated electrical system. This could lead to fire, the top event. Threats that could spark the fire include the shorting out of space heaters embedded in the walls (apparently they thought this was a good idea in 1955), an overloaded extension cord, a short from a damaged cord and improper wattage for light fixtures.

Preventive controls for these include total disconnection of the space heaters, not using extension cords for major appliances, disconnecting the washer and dryer when I go on vacation, checking cords for damage and using the correct wattage for all fixtures.

Unfortunately, it’s possible a fire could happen despite these efforts. And that’s the scary part, because the consequences include my house burning to the ground, my dog being trapped inside  and injury to my family. Recovery controls I’ve instituted include smoke detectors, a fire extinguisher and a home monitoring system linked to the city fire department. One recovery control still lacking is a sign notifying the fire department my sweet pup is inside (corrective action currently pending).

How to Get it Right

There are several things Aviation professionals can do to successfully implement bowtie risk assessment within the SMS. Start by assembling a team, including subject matter experts and those familiar with the situation on-the-ground. These people can provide critical input, clarifying how different roles and conditions interact within the workplace so you can ensure your bowtie represents a complete picture of risk.

Before your first meeting, you should identify the key hazard and the top event. Once you’ve worked through each element, you’ll want to spend time digging deeper into the implications. Issues to explore include control effectiveness, the likelihood of each threat, which controls are most critical and who’s responsible for implementing each control.   

Capture any requisite Corrective and Preventive Actions within your SMS, preferably one that can automatically route each CAPA request through review, root cause analysis, corrective action taken and verification. You should also schedule a separate session to review and validate your bowtie model. Finally, it’s important to communicate the results of your bowtie risk assessment with your organization, something made simple with an automated SMS.

In the end, bowtie risk assessment is a must-have capability for any effective SMS, a tool that’s even more powerful when integrated with automated functions like CAPA, Enterprise Risk Management and Document Control.

Free Webinar
thumb webinar predictiveriskPredictive Risk Management Using the Bowtie Method

Listen in as we explore the strategy behind risk in compliance, define the various ways and terms associated with risks, and how business processes are incorporating risk throughout the enterprise, driving a proactive approach to continuous improvement.


Download the Webinar Now!

Leave a comment

Rachel Beavins Tracy
Rachel Tracy is a writer for ETQ with expertise in environmental, healthcare and technology topics. She has a master’s degree from Vanderbilt University and has been writing for businesses since 2008.
Written by Author

Related posts

ETQ Reliance 2019 Now Available

We are excited to announce the release of ETQ Reliance 2019, a major upgrade to our flagship QMS SaaS product. The latest...

Morgan Palmer
By Morgan Palmer - January 29, 2019
6 Critical Audit Capabilities in Aviation Safety Management Systems

The word audit is enough to make some people cringe, and not just because it conjures images of the IRS knocking on your door....

Rachel Beavins Tracy
By Rachel Beavins Tracy - January 12, 2017
Best Practices for Automating the Safety Management System

I’m a list-maker by nature, but recently I had to admit my lists were out of control. The main reason? Too many apps.


Rachel Beavins Tracy
By Rachel Beavins Tracy - February 12, 2015