Bow-tie analysis with example

A bow-tie analysis is a risk method in which you place one unwanted event in the centre, with all causes on the left and all consequences on the right. Between cause and event you draw the preventive barriers, and between event and consequence the recovery barriers. The diagram looks like a bow tie, which is where the name comes from. At a glance, you see which measures stop an accident and which limit the damage.

The bow tie is described as a technique in IEC 31010:2019 . It is worked out in the reference work Bow Ties in Risk Management by CCPS and the Energy Institute. Within certification, you mainly use the bow tie for serious risks under hazards and risks in ISO 45001, in VCA and the Veiligheidsladder (Dutch safety ladder), and increasingly for scenarios in the risk analysis for ISO 27001.

Where does the bow-tie method come from?

The earliest known mention is training material from the British chemical company ICI, dating from 1979. In the 1990s, Shell made the method its company standard for safety risks, after which other sectors followed. Today the bow tie is used in the process industry, aviation, healthcare, construction and information security.

The parts of a bow tie

A bow tie has seven fixed parts. Use these names, so that every auditor or safety officer understands your diagram.

Part	Meaning	Example (roofing)
Hazard	Something with the potential to cause harm	Working at height
Top event	The moment you lose control	Person falls from the roof
Causes (threats)	What can lead to the top event	Slipping, tripping over material, roof edge gives way
Preventive barriers	Measures on the left: stop it from happening	Edge protection, fall protection, LMRA (Last Minute Risk Assessment)
Consequences	What can happen after the top event	Serious injury, death
Recovery barriers	Measures on the right: limit the damage	Fall arrest with harness, BHV (Dutch company emergency response team), rescue plan
Escalation factors	What can make a barrier fail	Rushing, bad weather, harness not inspected

The difference from a risk matrix: the matrix gives one score per risk. The bow tie shows which measures keep that risk low, and whether you depend too heavily on one barrier.

Example: bow-tie analysis for falls from height

A roofing company with VCA and ISO 45001 makes a bow tie for its biggest risk. The diagram looks like this in text.


CAUSES                PREVENTIVE               TOP            RECOVERY               CONSEQUENCES
                                               EVENT
Slipping on wet       -> anti-slip footwear,   ->             -> fall arrest harness -> serious injury
roof                     stop work in rain        Person         and anchor point
Tripping over         -> tidy workplace,       -> falls from  -> rescue plan and      -> permanent injury
material                 LMRA at start            the roof        trained BHV member
Roof edge gives way   -> edge protection       ->              -> quick alarm         -> death
                         per plan                                  112 with location

The team works out each barrier in a table. This turns the bow tie into a working document rather than a picture.

Barrier	Side	Owner	How do you know it works?	Escalation factor	Extra measure
Edge protection	Preventive	Site supervisor	Workplace inspection at start	Temporarily removed for materials	Only removed with a permit and harness
LMRA at start	Preventive	Every fitter	Completed LMRA in app	Rushing, routine	Spot check by site supervisor
Fall arrest with harness	Recovery	Fitter	Annual harness inspection	Harness not worn	Toolbox talk, sanctions policy
Rescue plan	Recovery	Project manager	Drill once a year	Nobody knows where the plan is	Plan in the van and in the app

The analysis reveals a weak spot. Three of the four barriers depend on the behaviour of the fitter. The company therefore also chooses technical measures, such as permanent edge protection. This matches the occupational hygiene strategy in the Dutch Working Conditions Act (Arbowet) and the hierarchy of control measures in ISO 45001.

A barrier is only a barrier if it can stop the chain on its own. “Training” and “procedure” are support, not barriers. They make a real barrier, such as a harness, more reliable.

Bow-tie analysis for information security

The bow tie also works outside safety. A SaaS company with ISO 27001 makes a bow tie for the top event “attacker gains access to customer data”.

Side	Element	Example
Cause	Stolen password	Phishing email
Preventive	Barrier	Multi-factor authentication on all accounts
Cause	Unknown vulnerability	Outdated library in the application
Preventive	Barrier	Monthly patching and vulnerability scan
Recovery	Barrier	Logging with an alarm for unusual download behaviour
Recovery	Barrier	Incident procedure and data breach notification within 72 hours
Consequence	Damage	Data breach, fine, loss of customers

This shows which measures from Annex A belong to each scenario. It is useful when you justify your statement of applicability.

Step by step: making a bow-tie analysis

Choose the hazard and the top event

Take a risk that scores red or orange in your risk matrix. The top event is the moment you lose control, not yet the damage.

Name the causes and consequences

Work with people from the field. Five to eight causes and three to five consequences are usually enough.

Place the barriers

Start with the measures that already exist. For each barrier: who is the owner, and how do you check that it works?

Look for escalation factors

For each barrier, ask: when does it fail? Think of an extra measure for that case.

Use the bow tie

Link barriers to inspections, toolbox talks and audits. Take the bow tie out after an incident: which barrier failed?

Bow tie after an incident

After an accident or near miss, the bow tie is a strong tool for the accident investigation. You look at which barriers failed and why. To find the deeper cause for each failed barrier, combine it with a root cause analysis.

Common mistakes in a bow-tie analysis

The top event is already the damage. “Death” is a consequence. The top event is “person falls”.
Barriers that are not barriers. “Awareness” does not stop a fall.
Too much in one bow tie. One top event per diagram. Make more diagrams instead.
No owner per barrier. Then nobody checks whether it still works.