What this is
What is a bowtie analysis?
What is a bowtie analysis?
A bowtie analysis is a single-diagram risk assessment built around one top event, the moment control of a hazard is lost. Threats sit on the left with the preventive barriers between them; consequences sit on the right with the mitigating barriers that limit harm. It is a qualitative barrier model, used where a hazard can kill rather than for routine task risk.
What is a critical control?
A critical control is a barrier whose failure or absence would significantly increase the likelihood of a fatality, and which is not a duplicate of another barrier in place. The ICMM definition is deliberately narrow: if everything is critical, nothing is. Here Is This A Critical Control is the gate, and Control ID binds it to the register.
What is an escalation factor?
An escalation factor is a condition that defeats or degrades a barrier without itself causing the top event. A gas detector is a barrier; the detector isolated for maintenance is an escalation factor. This is where most real failures live: it is the mechanism by which a barrier that exists on paper is absent on the day.
Scope
When is a bowtie analysis required?
A bowtie sits at the top of the risk study stack. It answers what stops the worst thing happening and how confident we are that those stops still work. It does not answer how a job should be sequenced or what today's crew should watch for.
Use this template when
- A hazard has been identified as capable of causing a fatality and needs a named barrier model
- A fatal risk protocol or principal hazard management plan needs a documented barrier basis
- The Critical Control Register needs a defensible source for which controls earned critical status
- A control failure, serious potential incident or change has invalidated the barrier picture
- An annual cycle falls due and the Next Review Due date has been reached
Do not use it for
- Job Safety Analysis, which breaks a job into steps and sets controls per step, and answers how to do this work safely rather than what stops the hazard
- Task Risk Assessment, which scores likelihood and consequence on the shared matrix and is far quicker where the outcome is injury rather than death
- Hazard Identification Study, which is the divergent step that finds candidate hazards and should run before you decide which deserve a bowtie
- Critical Control Verification, which is the field check that a named control is present and working, and consumes the bowtie output rather than replacing it
- Barrier Health Check, which samples barrier condition between cycles and is no substitute for rebuilding the model after a change
Compliance mapping
Which ICMM requirements does this satisfy?
Bowtie has no single owning standard. It is referenced by critical control management guidance, by process safety regulation and by major hazard regimes, and the sections map onto what each expects to see.
| Clause | Requirement | Where it lands |
|---|---|---|
| ICMM Critical Control Management Good Practice Guide | Identify material unwanted events, then the controls that prevent or mitigate them, and select the critical few | The top event |
| ICMM Critical Control Management Good Practice Guide | Define performance and verification requirements for each critical control, with an accountable owner | Threats and preventive barriers |
| ISO 31000:2018 cl.6.4 | Risk analysis must consider the effectiveness of existing controls, not merely their presence | Consequences and mitigating barriers |
| ISO 31000:2018 cl.6.6 | Monitoring and review of risk and controls at planned intervals, with results recorded | Result |
| 29 CFR 1910.119(e) | Process hazard analysis addressing hazards, controls, and the consequences of control failure | Threats and preventive barriers |
| COMAH Regulations 2015 | Demonstrate that all measures necessary to prevent major accidents and limit consequences are taken | Result |
What it does not cover
- A diagram with no criticality decision, which leaves every barrier nominally equal and gives the verification programme no basis for spending its limited field time.
- Barriers marked effective without evidence, which is why Barrier Effectiveness separates Effective and verified from Effective, unverified rather than offering one green option.
- Critical controls with no Control ID, which never reach the Critical Control Register and so never inherit a verification frequency, an owner or a failure route.
- Escalation factors left blank, which hides the isolations, bypasses and staffing gaps through which barriers routinely go absent on the day.
- A bowtie signed only by the facilitator, which records that a workshop happened but not that the accountable risk owner accepted the barrier picture.
Global
Bowtie Analysis requirements by country
Bowtie is a practice, not a legal instrument, so the question in each jurisdiction is which regulator accepts it as the demonstration behind a major hazard duty.
Control of Major Accident Hazards Regulations 2015
Upper-tier operators must produce a safety report demonstrating that all measures necessary have been taken to prevent major accidents and limit their consequences.
HSE inspectors accept bowtie as the presentation format for that demonstration and probe the effectiveness claims rather than the diagram. Unverified barriers presented as adequate are the usual challenge.
OSHA Process Safety Management, 29 CFR 1910.119(e)
Covered processes require a process hazard analysis using a recognised methodology, revalidated at least every five years.
The rule lists acceptable methodologies and permits an appropriate equivalent, so bowtie is normally run downstream of HAZOP rather than instead of it. Where it is the only study, expect to justify how it covers the deviation-by-deviation rigour the rule anticipates.
Work Health and Safety (Mines and Petroleum Sites) Regulation, principal hazard management plans
Mine operators must identify principal hazards and document the control measures managing them, with the plan reviewed on defined triggers.
Bowtie is the de facto format for principal hazard management plans in Australian mining, and the critical control concept here maps onto what a regulator asks to see verified in the field.
How to complete it
How to complete a bowtie analysis, step by step
Filling the fields is mechanical. Four judgements decide whether the record holds up when a control fails.
The top event fixes everything downstream. Set it at the moment control is lost and the left side becomes a genuine causal set while the right becomes a real mitigation set. Too early and you are describing a threat, too late and you are describing harm. If the team cannot agree, test whether a barrier could sit on both sides. If it can, the point is wrong.
Is This A Critical Control is a resourcing decision disguised as a tick box. Every barrier marked Yes acquires a Control ID, a Barrier Owner and a Verification Frequency, each consuming supervisory time. A bowtie marking fifteen controls critical will have all fifteen verified badly. Ask which barriers, if silently absent, would leave nothing between the threat and the top event.
Effective, unverified is not a soft version of effective, it is a declared gap, and it should feed the Barrier Gaps Found count. Teams under time pressure default to Effective and verified because the barrier exists in a procedure, converting an unknown into false assurance. Name the evidence before selecting verified.
Strong, Adequate or Degraded is a judgement the risk owner signs, not an arithmetic result. Let a single Not effective rating on a critical control force Degraded however healthy the rest looks. Recording Adequate on a bowtie carrying an unverified critical control is the pattern that reads worst in hindsight.
What auditors find
Most common bowtie analysis findings
Six patterns account for most of what goes wrong with bowtie records, each with a specific repair.
| Finding | Clause | What fixes it |
|---|---|---|
| Barrier inflation, with thirty or more barriers listed and none distinguished | ICMM Critical Control Management Good Practice Guide | Re-run the criticality test on each row. Anything that is a supporting activity rather than something that stops the event should be demoted out of the barrier list, or recorded as an escalation factor control. |
| Procedural and human-action barriers claimed with the same confidence as engineered ones | ISO 31000:2018 cl.6.4 | Use Barrier Type honestly, then downgrade effectiveness for procedural and human-action barriers unless a competency or observation record exists. Barrier Type is a reliability signal, not metadata. |
| Two barriers sharing a single point of failure, counted as independent | IEC 61511-1 | Trace power, instrument air, control system and operator to each barrier. Barriers sharing any of these are one barrier, not two, and should be merged before the critical control count is set. |
| Critical controls with an empty Control ID | ICMM Critical Control Management Good Practice Guide | Raise the register entry during the workshop and enter the returned Control ID on the barrier row. A critical control that exists only in the bowtie is never verified. |
| Next Review Due set a year out and never moved after a control failure | ISO 31000:2018 cl.6.6 | Treat any control failure or serious potential incident touching a named barrier as a review trigger. Bring Next Review Due forward rather than waiting for the annual cycle. |
| Barrier Gaps Found recorded as zero while unverified barriers sit in the rows | COMAH Regulations 2015 | Define the gap count as every barrier rated Partially effective, Not effective or Effective, unverified, and reconcile it against the rows before signing. A zero on a fatal risk bowtie will be tested. |
Case in point
Case in point: the barrier that was isolated for eleven months
A processing site built a bowtie on loss of containment from an ammonia refrigeration circuit. A high-level alarm on the receiver was recorded as a preventive barrier and rated Effective and verified because it appeared in the plant's alarm rationalisation document. It was marked critical, but Control ID was left blank: the register entry was to be raised after the workshop, and nobody owned that once the room emptied.
Eleven months later an instrument check found the alarm had been inhibited during a maintenance campaign and never reinstated. With no register entry it had never reached a verification schedule, and the inhibit passed through eleven shift handovers unremarked. The Escalation Factor field would have caught it. The repair was not a better diagram: raise the register entry inside the workshop so Control ID exists before anyone leaves, and record reinstatement of inhibits as the escalation factor control.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- SAF-062
- Archetype
- Assessment
- Record ID
- BOWTIE-2026-000
- Scoring
- Barrier health
- Direction
- High is good
- Singleton
- No
- Basis
- ICMM, energy industry practice
- Links
- Feeds Critical Control Register
- Tags
- Risk, Critical risk
- Sections
- 5
- Fields
- 43
- Follow up fields
- 3
- Repeating sections
- 2
- Links out
- 3
Header
8 fieldsBowtie ID*
Auto sequence. Format BOWTIE-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Analysis Date*
Facilitator*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Risk Owner*
Team Members*
The top event
4 fieldsOne Event, Clearly Stated
The top event is the moment control is lost, not the consequence. Loss of ammonia containment is a top event. Fatality is a consequence.
Material Unwanted Event*
Hazard*
Worst Credible Consequence*
- Multiple fatalities0 pts
- Single fatality1 pt
- Permanent disability2 pts
- Serious injury3 pts
Threats and preventive barriers
Repeats10 fieldsThreat*
Something that could cause the top event.
Preventive Barrier*
Barrier Type*
Barrier Effectiveness*
- Effective and verified3 pts
- Effective, unverified2 pts
- Partially effective1 pt
- Not effective0 pts
Is This A Critical Control*
Control ID
Links to FDN-011 Control ID
Barrier Owner
Verification Frequency
Escalation Factor
Something that could defeat this barrier.
Escalation Factor Control
Consequences and mitigating barriers
Repeats6 fieldsConsequence*
Mitigating Barrier*
Barrier Type*
Barrier Effectiveness*
- Effective and verified3 pts
- Effective, unverified2 pts
- Partially effective1 pt
- Not effective0 pts
Is This A Critical Control*
Control ID
Links to FDN-011 Control ID
Result
15 fieldsPreventive Barriers*
Mitigating Barriers*
Critical Controls Identified*
Barrier Gaps Found*
Overall Barrier Health*
- Strong4 pts
- Adequate2 pts
- Degraded0 pts
Diagram
Next Review Due*
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Facilitator*
Signature*
Risk Owner*
Second Signature*
SAF-062 · record IDs look like BOWTIE-2026-000 · Feeds Critical Control Register
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
A bowtie decays between reviews, not during them. What slips is keeping barrier status current, chasing verification, and noticing when maintenance has quietly removed a critical control.
Holds the bowtie library against your fatal risk list, pushes each critical control into the Critical Control Register with its owner and verification frequency, and brings the review forward when a control failure touches a named barrier.
Ties engineered and detection barriers to the assets that deliver them, so an inhibit, an overdue test or a deferred work order shows up as a barrier gap rather than a maintenance backlog line.
Backs the human-action and procedural barriers with competency records, so a barrier depending on an operator responding correctly can be rated verified against evidence rather than assumption.
Runs the annual cycle, chases open barrier gaps and CAPA references, rolls barrier health across every bowtie into one view, and holds every write for your approval.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Glossary
Bowtie Analysis definitions and key terms
- Top event
- The moment control of a hazard is lost. It sits at the knot of the bowtie, threats to the left and consequences to the right.
- Preventive barrier
- A control on the left that stops a threat causing the top event. Its failure makes the event more likely but does not itself cause harm.
- Mitigating barrier
- A control on the right-hand side that limits the consequence once the top event has occurred. Emergency response and detection barriers usually sit here.
- Escalation factor
- A condition that degrades or defeats a barrier, such as an isolation, a bypass, a missing spare or an absent competent operator.
- Barrier health
- A summary judgement of how much of the barrier set is present, effective and verified, expressed as Strong, Adequate or Degraded.
FAQ
Frequently asked questions about bowtie analysis
How many bowties should a site have?+
Far fewer than most sites expect. One per material unwanted event, which means one per fatal risk, typically six to twelve for an operating site. If the count runs to dozens, the top events have been set at task level rather than at loss of control.
Does a bowtie replace a HAZOP or a risk assessment?+
No. HAZOP finds deviations, a risk assessment scores and treats them, and a bowtie models the barriers around an event already flagged as having fatal potential. Under OSHA PSM in particular, bowtie alone is unlikely to satisfy the process hazard analysis duty without a supporting deviation-based study.
How many barriers should sit on each threat line?+
There is no target number, and chasing one is how barrier inflation starts. What matters is whether the barriers are independent of each other and whether at least one is engineered rather than reliant on a person acting correctly under pressure.
Can the same control appear on more than one bowtie?+
Yes, and it commonly does. That is why Control ID links to the Critical Control Register rather than the control being retyped on each diagram. A shared control verified once satisfies every bowtie referencing it, and a failure on it should trigger review of all of them.
Who should facilitate the workshop?+
Someone with no operational ownership of the barriers being discussed. The template records Facilitator and Risk Owner separately and takes two signatures for that reason. A facilitator who owns the controls rates them generously, usually without noticing.
How is this template scored?+
Scoring is barrier health, high is good. Barrier Effectiveness, Worst Credible Consequence, Overall Barrier Health and the action fields carry the weight, so a multiple-fatality hazard with degraded barriers surfaces at the bottom of any ranked view.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Critical Control and Fatal Risk
Bow Tie Analysis Record
Maps threats, the top event, consequences and the barriers on each side for a major hazard
Barrier Health Review
Reviews whether the barriers relied on in a bow tie are actually in place and working
Critical Control Register
Lists the controls that stand between your people and a fatal or catastrophic event, with an owner and a required check frequency for each
Risk Assessment
The single risk assessment used across the whole business
Serious Potential Incident Report
Used when an event could have killed or seriously injured someone, whatever the actual outcome
Job Safety Analysis
Breaks a job into steps, finds the hazards in each and sets the controls
More in Risk Studies
Job Safety Analysis
Breaks a job into steps, finds the hazards in each and sets the controls
Pre-Task Risk Assessment
A short check done by the crew right before work starts, covering what has changed today
Task Risk Assessment
A fuller assessment of a task, its hazards and its controls, using the shared risk method
Hazard Identification Study
A structured search for hazards across an area, process or new installation
What If Study
A guided team discussion asking what could go wrong at each stage of a process
Change Risk Review
Assesses the risk created by a proposed change before it goes ahead
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ICMM Critical Control Management Implementation Good Practice Guide
- ISO 31000:2018 Risk management, cl.6.4 and cl.6.6
- OSHA Process Safety Management, 29 CFR 1910.119(e)
- Control of Major Accident Hazards Regulations 2015 (SI 2015/483)
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.