Bowtie analysis is a risk management method that maps out everything that could cause a dangerous event and everything that could happen as a result, all in one visual diagram. The shape resembles a bowtie: threats fan in from the left, consequences fan out to the right, and the critical event sits in the center knot. Between each layer, you place barriers, the controls and safeguards that either prevent the event or limit the damage. The result is a single picture that shows an entire risk scenario from start to finish, making it one of the most widely used tools in high-hazard industries.
The Five Core Elements of a Bowtie Diagram
Every bowtie diagram is built around five components, and understanding them is the key to reading or building one.
Hazard: The underlying source of potential harm. This could be a pressurized vessel, a biological agent, a height at which people work, or any condition that carries inherent risk.
Top event: The moment you lose control of the hazard. In oil and gas, this might be a loss of containment, a blowout, or an uncontrolled fire. In healthcare, it could be the wrong medication reaching a patient. The top event sits at the center of the diagram, forming the knot of the bowtie.
Threats: These appear on the left side and represent the specific causes that could trigger the top event. A single hazard usually has multiple threats. For a chemical storage tank, threats might include corrosion, operator error, and external impact.
Consequences: These fan out on the right side and describe what happens if the top event occurs and isn’t controlled. Consequences can range from minor equipment damage to environmental contamination, injuries, or fatalities.
Barriers: Vertical lines placed between threats and the top event (on the left) and between the top event and consequences (on the right). These are the controls, procedures, equipment, and safeguards that either stop the event from happening or reduce its impact once it does.
How Barriers Work on Each Side
The left side and right side of the bowtie serve fundamentally different purposes, and this distinction is what makes the method so useful for managing risk.
Barriers on the left side are preventive. Their job is to interrupt the chain of events so that a threat never escalates into the top event. For a pipeline leak scenario, a preventive barrier might be a regular inspection program or an automated pressure monitoring system. If any one of these barriers holds, the scenario stops there.
Barriers on the right side are mitigative. They accept that the top event has already occurred and focus on keeping the situation from getting worse. Emergency shutdown systems, evacuation procedures, and containment booms are all examples of right-side barriers. They don’t prevent the loss of control; they limit the fallout.
This separation forces teams to think about risk in two distinct phases: what are we doing to stop this from happening, and what will we do if it happens anyway? Many organizations discover gaps in one side or the other during this exercise.
Escalation Factors and Barrier Degradation
A bowtie diagram doesn’t assume barriers will always work. Escalation factors (sometimes called degradation factors) are conditions that reduce or defeat a barrier’s effectiveness. They’re added to the diagram as branches off each barrier, making weaknesses visible.
For example, if one of your barriers is staff training, an escalation factor might be a lack of awareness that the training exists. If a barrier relies on monitoring equipment, equipment failure or inaccessibility at the time it’s needed are escalation factors. Poor communication between team members, units displaying different measurements, and scheduling conflicts that prevent attendance at safety briefings are all real examples drawn from healthcare bowtie models.
Identifying escalation factors is often the most valuable part of the exercise because it reveals how barriers fail in practice, not just in theory. Teams can then add controls for the escalation factors themselves, creating an additional layer of defense.
How to Build a Bowtie Diagram
Building a bowtie typically happens in a facilitated workshop with people who know the operation firsthand. The process follows a logical sequence.
First, you identify the hazard and define the top event. This sets the scope. A single hazard can generate multiple bowtie diagrams if it has distinct top events, so being specific here matters. “Loss of containment from a storage tank” is a clear top event. “Something goes wrong” is not.
Second, you map threats on the left and consequences on the right. Brainstorming with a cross-functional team helps capture causes and outcomes that a single department might miss. On the left, you list every realistic cause of the top event. On the right, you list the range of possible impacts.
Third, you identify barriers for each pathway. For every line connecting a threat to the top event, ask what controls exist to break that chain. Do the same for each line from the top event to a consequence. Barriers can be hardware (alarms, valves, interlocks), procedures (permits, checklists), or human actions (supervision, emergency response).
Fourth, you assess barrier quality. A barrier on paper is only useful if it actually works. This step involves checking whether each barrier is properly designed, maintained, and monitored. Teams look for redundancy (multiple barriers on the same pathway) and diversity (barriers that work through different mechanisms so a single failure mode can’t defeat all of them).
Finally, you assign ownership. Each barrier needs a responsible person or team, along with documentation, maintenance schedules, and a plan for verifying that the barrier remains effective over time. This is what turns a diagram into a living risk management tool rather than a one-time exercise.
Why Bowtie Works as a Communication Tool
The biggest advantage of bowtie analysis over other risk methods is visual clarity. It merges the logic of fault tree analysis (which traces causes) and event tree analysis (which traces consequences) into a single two-dimensional picture. A fault tree alone can become deeply nested and hard for non-specialists to follow. A hazard and operability study (HAZOP) produces detailed tables but doesn’t give you a bird’s-eye view. Bowtie does both, showing causes, controls, and consequences in one place.
This makes it especially effective for communicating with people who aren’t risk specialists. A plant manager, a board member, or a regulator can look at a bowtie diagram and immediately see which hazards carry the most risk, where the barriers are, and where gaps exist. That accessibility is a major reason the method has spread far beyond its origins.
Where Bowtie Analysis Is Used
The method traces back to hazard analysis course notes at the University of Queensland, Australia, around 1979. It gained serious momentum after the Piper Alpha disaster in 1988, when an explosion on an offshore oil platform in the North Sea killed 167 workers. That catastrophe forced the oil and gas industry to rethink how it visualized and managed risk. In the early 1990s, Royal Dutch Shell adopted the bowtie method as its company standard for risk analysis, and the approach spread quickly across the sector.
Today, bowtie analysis is standard practice across multiple high-risk industries. Oil and gas companies use it for drilling operations, offshore platform safety, and pipeline integrity management. Airlines use it to manage in-flight emergency risks, maintenance hazards, and airport safety procedures. Healthcare organizations apply it to patient safety, medication error prevention, and infection control. Financial institutions have adopted it for cybersecurity risk, regulatory compliance, and fraud detection. IT departments use it for data security, system failure planning, and disaster recovery.
Adding Quantitative Data to the Diagram
A standard bowtie diagram is qualitative. It shows relationships and barriers but doesn’t assign probabilities. For organizations that need numerical risk estimates, bowtie analysis can be combined with quantitative methods like Layer of Protection Analysis (LOPA). This hybrid approach assigns failure probabilities to each barrier and calculates the overall likelihood of a consequence occurring, while still maintaining the visual structure that makes bowtie diagrams easy to understand.
Recent work in process safety has developed unified hazard assessment techniques that combine HAZOP, LOPA, and bowtie analysis into a single framework. These methods allow teams to quantify risk for scenarios with multiple causes and multiple consequences inside a single diagram, something that was difficult to achieve with older tools used in isolation.
Software for Bowtie Analysis
While you can sketch a bowtie on a whiteboard, dedicated software makes it possible to manage complex diagrams and keep them updated over time. Bowtie software typically lets you attach management information to each barrier: who is responsible for it, how effective it is, what tasks are required to maintain it, reference documents, criticality levels, and human factors that could affect performance. This metadata turns a static diagram into a dynamic system where barrier health can be monitored, audited, and reported on across an entire organization.