Subscribe to Email Updates

Quality Creates...Perspective

Closed-Loop Risk Management with the Bowtie Method

Tim Lozier
by Tim Lozier on Wed, May 10, 2017

Assessing Risk Using the Bowtie Method Should Form a Critical Part of Your Approach to Risk Management. Here's Why


Today’s unpredictable and volatile business environment is exposing firms to an ever-growing barrage of significant risks – from regulatory uncertainty and consumer demands, to evolving cyber threats and competitive pressures. These can be difficult to identify and mitigate, and they can pose a serious threat to organizations’ ability to achieve their objectives, or in the worst cases, to their survival. Growing numbers of business leaders recognize that focusing exclusively on achieving compliance with only an ad hoc approach to risk management is inadequate. Getting by on the bare minimum is no longer enough to prevent potentially catastrophic problems. 

Proactive Risk Management

Savvy business leaders are now making the shift from baseline compliance to proactive risk management, where the business employs a systematic means of identifying and categorizing risk and establishing processes for reducing and preventing risk. Using quantitative risk assessment tools , every decision made is assessed in terms of risk to give the business an objective, quantifiable means of assessing its overall exposure to risk. Managers and directors are able to form a unified view of the risks inherent in the business's strategies and activities, and make more consistent and informed decisions based on the risk. 

The Power of a Closed-Loop Process

Key to the effectiveness of proactive risk management is its closed-loop process. Hazard identification is followed by risk assessment, which generates an action plan that leads to control implementation. The process is monitored continuously and systematically, with all events and issues tracked, including near misses. This information flows back into the risk assessment and mitigation process, allowing improvements to quality, safety and compliance procedures to prevent hazards occurring. The same risk management system is then applied to these new improved processes, driving continuous improvement. 

Businesses are able to address and close down hazards as soon as they are identified and minimize the impact if the risk materializes. Importantly, proactive Risk Management enables them to determine their chief risks and the potential impact on their core strategies. The continual flow of information helps the business spot emerging and unforeseen risks that could seriously harm the enterprise, its employees or its customers. 

Controlling Rare, High Impact Events with the Bowtie Method

The ability to monitor and control serious risks never before encountered is critical for businesses operating in today's complex, erratic business conditions. For a rare but high impact event, there will be no historical data to inform risk management. Instead, the business needs to employ a predictive means of addressing the problem – a powerful proactive risk assessment tool, the Bowtie Method

The Bowtie Method provides a way to visualize the causes and effects of rare but potentially catastrophic incidents. The tool constructs a scenario where such an event might occur, then puts preventive controls in place to mitigate the risk. It also plans recovery controls to minimize the impact if the event actually occurs.

The center of the Bowtie model describes a specific hazard that could result in a loss of control with disastrous consequences. On the left, threats that could produce that outcome are defined, along with preventative controls mapped to each threat. On the right, the potential consequences are listed, each linked to recovery controls that reduce the severity of the outcome.

To demonstrate how the method might work in the real world, consider fire risk in a storage facility. The undesired event would be an out of control fire. 

Some potential threats would be: 

  • People smoking

  • Poor storage of packaging waste

  • Poor storage of flammable materials

  • Bad maintenance of electrical points.

 Your Risk team would then implement controls to block those threats to reduce the risk of them occurring. 

If despite this, a fire does break out, you would have recovery controls in place to prevent it becoming catastrophic:

  • Smoke alarms to alert you to the fire before it gets out of control

  • Fire marshals to ensure safe evacuation of the building

  • Fire extinguishers suited to your particular flammable hazards

  • A sprinkler system to prevent any fire spreading.

 So even though the event still occurred, there are barriers in place to make sure the risk is minimized. 

Integrating the Bowtie Method with the Safety Management System

Bowtie Method is more powerful when integrated into the business's safety management system (SMS). The system can define critical tasks and assign roles to keep the prevention barriers on the left and mitigation barriers on the right in working order. This ensures that the SMS is focused on actual threats to the business, rather than operating as a separate system conceived in isolation. Managers can assess whether the SMS can control hazards by examining the links between the Bowtie Method risk assessment and the SMS to probe for any weaknesses and objectively establish the effectiveness of the system. In keeping with the closed-loop approach to risk management, the Bowtie Method is reapplied continuously to audit the competence of those operating the safety system as well as the integrity of the resources underpinning it. 

The Bowtie Method is proving to be a critical risk tool for a growing number of businesses, not only for its ability to integrate with and augment the SMS, but also for its power to visualize a complex risk environment. 


  • Baseline compliance with an ad hoc approach to Risk Management is inadequate in today's volatile business environment.
  • Proactive risk management backed by quantitative risk assessment tools builds an objective picture of the business' overall level of risk.
  • Use a closed-loop process, where procedures and outcomes are continuously monitored, assessed and addressed to lower risk.
  • The complex, unpredictable risk environment calls for a predictive risk assessment model such as the Bowtie Method.
  • Integrating the Bowtie Method into your SMS will ensure that it can effectively control rare but potentially catastrophic events that pose a genuine threat to your business.


Discover How to Drive Continuous Improvement in Your Compliance Management Activities. Download: The Proactive Quality Guide to Beyond Compliance.

Proactive Quality Guide to Beyond Compliance

Leave a comment

Tim Lozier
Written by Tim Lozier
Tim is the Manager for Marketing and Strategy at EtQ, Inc.
Written by Author