Tldr: key takeaways

• The BowTie method is a visual risk management tool that maps how hazards lead to incidents and their consequences in a single diagram.
• It identifies two types of barriers: preventive barriers (stop the incident) and recovery barriers (reduce the impact after it occurs).
• The diagram centres on a top event, which is the moment you lose control over a hazard.
• Industries like oil and gas, healthcare, and manufacturing use it to analyse incidents and communicate risk across all staff levels.
• It is simple to learn but reveals gaps in your safety defences before accidents happen.

Introduction: Why safety professionals need the bowtie method for incident analysis

Consider a routine incident investigation following a chemical spill that injures two workers. At first glance, the cause appears straightforward: a faulty valve. However, further examination shows a broader pattern. Maintenance activities were overdue, warning signs were missed during operation, and emergency response equipment was not immediately available.

Traditional incident analysis often stops at identifying a single failure and assigning a corrective action. This approach overlooks how incidents typically occur in safety-critical operations. Serious events rarely result from one isolated mistake. They emerge when multiple barriers fail or degrade at the same time.

The BowTie method addresses this limitation by providing a structured, visual representation of the entire risk pathway. It makes the hazard explicit, defines the precise moment control is lost (the top event), and shows the preventive and recovery barriers that should either stop the event or limit its consequences. By placing barriers at the centre of analysis, the method shifts attention from outcomes to the effectiveness of safety controls.

Royal Dutch Shell formalised the BowTie approach in the early 1990s to support the management of major accident hazards in the petroleum industry. It was developed to communicate complex risk scenarios clearly across different organisational levels, from frontline operators to senior leadership. Since then, it has been widely adopted in high-risk sectors such as oil and gas, aviation, healthcare, and manufacturing.

In this article, you will learn what the BowTie method is, how its core components function, when it should and should not be used, and how to build a basic BowTie diagram correctly. You will also review common errors that undermine barrier-based risk management and learn how to avoid them. By the end, you will have a clear foundation for applying BowTie thinking to incident analysis and proactive risk management.

What is the bowtie method?

The BowTie method is a barrier-based risk management tool that provides a structured, visual representation of how hazards can lead to loss-of-control events and how their consequences can be prevented or mitigated. It presents the complete risk pathway in a single diagram, making complex scenarios understandable and reviewable across an organisation.

Royal Dutch Shell formalised the method in the early 1990s to support the management of significant accident hazards. At the time, Shell required a consistent way to describe high-consequence risks that engineers, operators, and decision-makers could share without relying on detailed probabilistic calculations. The BowTie format met this need by focusing attention on barriers rather than on abstract failure logic.

Conceptually, the BowTie draws inspiration from Fault Tree Analysis and Event Tree Analysis. It uses backward reasoning to identify how threats can lead to a loss of control, and forward reasoning to examine how consequences may unfold after that loss. However, it is not a literal or mathematical merger of these techniques. Instead, it translates their logic into a visual, qualitative structure that prioritises clarity and practical use.

A basic BowTie diagram is qualitative in nature. Its primary purpose is to identify hazards, define the top event, and make preventive and recovery barriers visible so they can be managed and verified. In more advanced applications, BowTie diagrams may incorporate quantitative elements, such as likelihood estimates, barrier reliability data, or performance indicators, particularly when used as part of a safety case or major hazard management framework.

Importantly, the BowTie method does not aim to explain every system interaction. It provides a structured view of the risk pathway, centred on clearly defined barriers. To function as part of a broader systems approach, it must be complemented with escalation factor analysis and barrier health monitoring. Used correctly, the BowTie shifts risk management away from reacting to outcomes and toward maintaining the effectiveness of critical safety barriers.

Core components of a bowtie diagram explained.

Every BowTie diagram is built from a set of core components that together describe a complete risk pathway. Understanding these elements is essential for creating diagrams that are accurate, readable, and useful for barrier-based risk management. Each component has a specific purpose and should be defined precisely.

A BowTie diagram is read from left to right. On the left side are the sources of risk and the conditions that can lead to a loss of control. At the centre is the top event. On the right side are the potential consequences. Preventive and recovery barriers are positioned between these elements to show how risk is controlled.

Hazard: The potential source of harm that exists as part of normal operations, such as stored chemicals, energised equipment, vehicle movement, or working at height. A hazard is not an incident; it is the condition that can cause harm if control is lost.

Top Event: The specific initiating events or conditions that could lead to the top event. Examples include corrosion weakening a vessel, sensor failure leading to overfilling, or impact damage from a reversing vehicle. Threats sit on the left side of the BowTie and act on the hazard.

Threats: The unwanted outcomes that may occur if the top event happens and is not adequately controlled. These may include injuries or fatalities, environmental harm, asset damage, or business interruption. Consequences are shown on the right side of the diagram.

Consequences: The undesirable outcomes on the right side of the top event occur, such as fatalities, environmental damage, or significant asset loss.

Preventive Barriers: Controls on the left side that stop threats from reaching the top event, including safety procedures, maintenance schedules, training, and engineering controls.

Recovery Barriers:  Controls on the right side that minimise harm after the top event occurs, such as emergency shutdown systems, PPE, fire suppression, and emergency response plans.

Think of the BowTie as a story of risk. The hazard is the setting. The top event is the turning point. The consequences are the ending. The barriers are the choices you make to change how the story unfolds; each critical barrier should have a named owner, a verification mechanism and clear performance criteria so it can be monitored and audited.

When to use the bowtie method for incident investigation

The BowTie method works best in specific situations. Knowing when to use it saves you time and ensures you apply the right tool to the right problem. Not every incident or risk assessment needs a BowTie diagram.

Use the BowTie when:

• You are managing significant hazards with high consequence potential, such as scenarios in oil and gas, chemical processing, aviation, or healthcare, where outcomes could be severe.
• You are investigating complex incidents that involve multiple barrier failures rather than a single linear cause.
• You need to communicate risk clearly across different levels, from frontline workers to senior management who are not safety specialists.
• You want to conduct proactive risk assessment before incidents happen, mapping potential scenarios and identifying gaps in your defences.

Avoid the BowTie when:

• You are dealing with simple, linear incidents with clear single causes. Tools like Five Whys or fishbone diagrams are faster and more direct.
• You face highly dynamic, tightly coupled socio-technical systems where causal relationships are emergent and barriers cannot be cleanly enumerated. In such cases, methods like STAMP (Systems Theoretic Accident Model and Processes) may be more suitable. Also note that a BowTie diagram by itself does not capture escalation factors or long-term barrier degradation; to form a fuller systems analysis, you should complement BowTies with escalation analysis and barrier health monitoring.

The BowTie’s real strength is visual clarity and barrier identification. If your goal is to make risk scenarios understandable across your organisation and to ensure every critical barrier has an owner and maintenance plan, the BowTie is your tool.

It moves you from reactive incident response to proactive barrier management. That shift is what makes it valuable in safety-critical industries.

How to create a basic bowtie diagram: step-by-step guide

Building a BowTie diagram follows a structured process. You work through five clear steps, starting with the hazard and building outwards. This systematic approach ensures you capture all the critical elements without missing key barriers or pathways.

Start simple. Your first BowTie does not need to be perfect. You can refine it as you gather more information and involve more people. The goal is to create a clear visual map that your team can use and improve over time.

Work incrementally: define the centre (the top event) first, then map threats and barriers outward, verifying the wording of each element as you go.

You can draw a BowTie by hand, use a whiteboard, or work with specialised software. The tool matters less than the thinking process. Focus on getting the structure right before worrying about how it looks.

Step 1: Identify and define the hazard

• Choose a specific hazard with potential for serious harm that exists as part of your everyday operations.
• Be specific: use "forklift operations in a warehouse" instead of vague terms like "workplace safety".

Step 2: Define the top event

• Identify the exact moment when control over the hazard is lost.
• Make it precise: "collision with pedestrian" or "loss of primary containment", not "incident occurs".

Step 3: Identify potential consequences

• Map what happens if the top event occurs and is not stopped (right side of diagram).
• Think in categories: injuries or fatalities, environmental damage, asset loss, business interruption.

Step 4: Map preventive barriers

• Work backwards from the top event to identify what stops it from happening (left side).
• List specific barriers: operator training, maintenance schedules, safety procedures, engineering controls, inspections.

Step 5: Map recovery barriers

• Work forwards from the top event to identify what reduces harm after it occurs (right side).
• Include: emergency shutdown systems, PPE, first aid, fire suppression, and emergency response procedures.

For each barrier you add, record who owns it, how it will be verified, and what performance criteria will demonstrate it is healthy and effective. If you intend to develop the BowTie into a performance dashboard or include quantitative elements later, identify the measurement points now (inspection intervals, test frequencies, failure-rate records).

Review your completed diagram with your team. Ask if the barriers are realistic, if any pathways are missing, and if the top event is clearly defined. This review step catches errors before you start relying on the diagram for decision-making.

Common mistakes when building bowtie diagrams

Even experienced safety professionals make predictable errors when building BowTie diagrams. Recognising these mistakes early saves you time and ensures your diagram remains a valuable tool rather than confusing documentation.

Mistake 1: Confusing the top event with consequences

• Placing outcomes like "worker injury" as the top event instead of the actual loss of control moment like "equipment struck worker".
• Solution: The top event is the physical incident, not the harm. Ask what happened immediately before the consequence.

Mistake 2: Listing too many barriers

• Documenting every possible control creates cluttered, unreadable diagrams.
• Solution: Focus on critical barriers. If removing a listed barrier does not noticeably increase risk, omit it.

Mistake 3: Using vague barrier descriptions

• Writing "maintenance" or "training" without specifics makes verification impossible.
• Solution: Be precise. Use "quarterly pressure testing of relief valves by a certified technician" rather than simply "maintenance".

Mistake 4: Listing paper barriers that do not exist in practice

• Including controls that exist in the procedure but are not actually implemented or maintained in the field.
• Solution: Challenge each barrier with evidence. Can you verify it occurs? Is there a record? Who is accountable?

Mistake 5: Failing to assign barrier ownership and verification

• Not naming an owner or defining verification means a barrier is unlikely to be reliably implemented.
• Solution: For each critical barrier, record an owner, a verification mechanism, and performance criteria.

Avoiding these mistakes keeps your BowTie diagram clear, accurate and actionable. A well-built diagram guides decisions; a poorly built one creates confusion and false confidence in your risk controls.

Conclusion: advancing your bowtie skills for better risk management

You now have the foundation to start using BowTie diagrams in incident analysis and risk management. Begin with simple, familiar scenarios: map the hazard, define the top event, list threats, and document preventive and recovery barriers. Apply BowTies to real incidents to identify which barriers failed and why, and feed those lessons back into your Safety Management System.

As your capability grows, extend BowTies to include escalation factors, barrier degradation and barrier-health monitoring, and consider specialised BowTie software if you manage many high-consequence scenarios. Bear in mind that a BowTie gives a structured view of the risk pathway but does not alone constitute a complete systems analysis; for that, you must add escalation-factor analysis and time-series barrier health data.

Formal training accelerates correct application, facilitation and advanced barrier analysis. Human Safety Academy offers practical training and facilitation aimed at embedding barrier-based risk management into everyday practice.

The BowTie method moves your organisation from reacting to incidents to actively maintaining the health of critical safety barriers.