Bowtie Analysis Explained: Linking Hazards, Barriers, and Consequences
You can list every control protecting your operation and still not know which ones actually stand between a hazard and a serious injury. A risk register tells you what controls exist. It rarely shows you where they sit in the chain of events, which ones do double duty, and where a single failure leaves you exposed. Bowtie analysis closes that gap by mapping the path from hazard to consequence and placing every barrier exactly where it functions — so you can see your defenses, and their gaps, on one page.
Map your risk controls in WhyTrace Plus. WhyTrace Plus structures incident investigations and risk assessments so causes, barriers, and consequences stay connected from finding to corrective action. Start free at whytrace.com →
What Bowtie Analysis Is and Where It Came From
Bowtie analysis is a visual risk assessment method that places a single hazardous event at the center of a diagram and shows, on the left, the threats that could trigger it and the preventive barriers that stop them — and on the right, the consequences that could follow and the recovery barriers that limit them. The shape of the completed diagram, narrow at the center and spreading on both sides, gives the method its name.
The technique traces back to hazard analysis work at Imperial Chemical Industries in the late 1970s, with the first documented bowtie diagrams associated with ICI's HAZAN methodology around 1979. It spread through the oil, gas, and chemical process industries, where regulators and operators needed a way to demonstrate that major-accident hazards were controlled. Today it is used well beyond process safety — in construction, aviation, healthcare, rail, and logistics — and it aligns directly with the risk management process described in ISO 31000.
What makes bowtie different from a written risk assessment is that it is causal and visual at the same time. It forces you to answer a specific question for every control: does this barrier prevent the central event, or does it mitigate the outcome once the event has occurred? Many organizations discover, partway through their first bowtie, that controls they assumed were preventive are actually recovery measures — and that a hazard they treated as well-defended has only one real barrier on the left.
A complete bowtie has six standard elements:
| Element | Position | What it answers |
|---|---|---|
| Hazard | Far left context | What dangerous condition or activity is part of normal operations? |
| Top event | Center (the knot) | At what moment is control over the hazard lost? |
| Threats | Left side | What could trigger the top event? |
| Preventive barriers | Between threats and top event | What stops a threat from causing the top event? |
| Consequences | Right side | What harm follows if the top event occurs? |
| Recovery barriers | Between top event and consequences | What limits or stops the harm? |
Reading the Diagram: Hazard, Top Event, Threats, and Consequences
The center of a bowtie is the most misunderstood part, so it is worth defining carefully. The hazard is a condition that is part of normal operations and carries potential for harm — working at height, storing flammable liquid, operating a forklift. The top event is the moment control over that hazard is lost. It is not yet the injury or the loss; it is the release point.
The distinction matters because the top event is where the diagram pivots. Get it wrong and the barriers fall on the wrong side. A reliable test: the hazard is something you accept as part of doing business, and the top event is the first thing that has unambiguously gone wrong.
Consider working at height as the hazard:
- Hazard: Worker performing a task at elevation
- Top event: Worker falls from height
- Threats (left): Unguarded edge, failure to use fall arrest, scaffold collapse, slip on elevated surface
- Consequences (right): Fatal fall, serious fracture, near-miss with no injury, dropped-object strike below
Each threat gets its own line into the top event, and each line carries the preventive barriers specific to that threat. The "failure to use fall arrest" line might carry barriers like a documented harness policy, supervisor verification before work begins, and anchor points engineered into the structure. The "unguarded edge" line carries different barriers — guardrails, hole covers, edge-protection inspection. This is the power of the layout: it stops you from treating one generic control as protection against every threat.
Falls remain the leading cause of death in construction. As of 2026, OSHA's fall protection standard for construction (29 CFR 1926.501) continues to require fall protection at elevations of six feet or more in general construction, and fall protection (general requirements) has held the top spot on OSHA's most-cited violations list for over a decade. A bowtie built around a fall hazard makes visible exactly which preventive barriers an organization is relying on to keep off that statistic.
From hazard map to action. Once your bowtie reveals a weak barrier, the next step is a tracked corrective action with a named owner and a verification date. WhyTrace Plus connects the analysis to the follow-through. See how it works →
Barriers and Degradation Factors: The Heart of the Method
Barriers are the controls that interrupt the path from threat to top event, or from top event to consequence. The discipline of bowtie analysis is in describing them honestly — a real barrier must be specific, capable of stopping the progression on its own, and possible to evaluate as present or absent.
Barriers fall into two functional groups:
- Preventive (proactive) barriers sit on the left and reduce the likelihood that a threat reaches the top event. Examples: machine guarding, permit-to-work systems, interlocks, pre-task verification.
- Recovery (reactive) barriers sit on the right and reduce the severity of a consequence once the top event has happened. Examples: emergency shutdown, fire suppression, spill containment, first-response medical capability.
A useful way to grade barrier strength borrows from the hierarchy of controls. Barriers higher on the hierarchy are more reliable because they depend less on human behavior:
| Barrier type | Reliability | Bowtie example |
|---|---|---|
| Elimination / substitution | Highest | Removing a confined space; substituting a non-flammable solvent |
| Engineering control | High | Interlock, guardrail, pressure relief valve |
| Administrative control | Moderate | Permit system, procedure, training |
| PPE / behavioral | Lowest | Harness use, respirator, "be careful" reminders |
The most valuable extension of the basic bowtie is the degradation factor (also called an escalation factor). A degradation factor is a condition that weakens or defeats a barrier. A guardrail is a strong barrier — but if it is removed for maintenance and not reinstated, it is degraded. Each degradation factor can carry its own degradation-factor barrier: in this case, a permit that requires guardrail reinstatement sign-off before the area reopens.
Degradation factors are where bowtie analysis earns its reputation as an advanced method. They model the uncomfortable reality that controls do not fail randomly — they are eroded by predictable conditions: maintenance windows, staffing shortages, alarm fatigue, deferred inspections. Mapping these forces you to defend not just against the hazard but against the slow decay of your own defenses.
When you find a barrier that appears on multiple threat lines, you have found a single point of dependency. If that one barrier degrades, several pathways open at once. Bowtie analysis surfaces these dependencies in a way a flat control list cannot.
Try AI-Powered Root Cause Analysis
A bowtie shows you where a barrier failed, but it does not automatically explain why it failed — that question belongs to root cause analysis. When an incident breaches one of your bowtie barriers, the fastest way to a defensible cause is to run a structured analysis on the event and feed the findings back into your barrier map.
When to Use Bowtie Analysis (and When Not To)
Bowtie analysis is the right tool when a hazard is significant, the consequences are severe, and multiple controls combine to manage the risk — and it is the wrong tool when an event is simple, single-cause, or low-consequence. Choosing it well depends on understanding where it sits relative to other risk and investigation methods.
Reach for a bowtie when:
- The hazard could cause a serious injury, fatality, or major loss (a "major accident hazard").
- Several threats can lead to the same loss-of-control event, and several controls are in play.
- You need to communicate risk to a non-technical audience — operators, executives, regulators — on a single page.
- You want to demonstrate to an auditor or regulator that controls are deliberate and assigned, not assumed.
- You are managing a risk over time and need a living picture of which barriers are degrading.
Choose something else when:
- The event has a single, obvious cause — a simple 5 Whys is faster and lighter.
- You need to quantify probabilities precisely — fault tree analysis with numerical data is more rigorous on the left side.
- You are investigating after the fact and need to find the root cause of one specific incident — bowtie is primarily proactive; it maps the system rather than dissecting a single event.
Bowtie analysis complements rather than replaces other techniques. It is common to use fault tree analysis to develop the left side of a complex bowtie in detail, and to use 5 Whys or fishbone analysis to investigate why a specific barrier failed after an incident. For a side-by-side look at how these methods differ in effort, output, and best use case, see our RCA method comparison guide, which places bowtie alongside 5 Whys, fishbone, and fault tree analysis.
The practical takeaway: bowtie is a barrier-management method. Its strength is showing whether your defenses are real, complete, and maintained. Its weakness is that it is not a quantitative or single-incident investigation tool, and treating it as one leads to disappointment.
How to Build a Bowtie Analysis Step by Step
Building a bowtie follows a fixed sequence, and working in order is what keeps the diagram clean. Skipping ahead — for example, listing barriers before the top event is settled — is the most common reason a first attempt becomes unusable.
- Identify the hazard. State the operational condition that carries potential for harm. Keep it as a normal activity, not an accident.
- Define the top event. Pin down the single moment control is lost. One hazard can have more than one credible top event; build a separate bowtie for each.
- List the threats. Brainstorm every plausible trigger that could cause the top event. Each becomes a line entering the center from the left.
- List the consequences. Identify the distinct outcomes that could follow the top event. Each becomes a line exiting to the right.
- Place preventive barriers. For each threat line, add the controls that would stop that specific threat from reaching the top event. Be honest about which are engineering versus administrative.
- Place recovery barriers. For each consequence line, add the controls that would reduce or stop the harm after the top event.
- Add degradation factors and their barriers. For critical barriers, ask what could defeat them, then add controls that protect the barrier itself.
- Assign ownership and verification. Every barrier needs a named owner and a way to confirm it is in place and working. A barrier no one owns is a barrier no one maintains.
A worked fragment, using a forklift-pedestrian hazard:
| Stage | Entry |
|---|---|
| Hazard | Forklifts and pedestrians sharing warehouse floor |
| Top event | Forklift makes contact with a pedestrian |
| Threat | Pedestrian enters traffic lane unseen |
| Preventive barriers | Physical segregation barriers, marked walkways, proximity-detection sensors, blind-corner mirrors |
| Degradation factor | Sensor disabled due to false alarms |
| Degradation-factor barrier | Monthly sensor function test with logged sign-off |
| Consequence | Crush injury / fatality |
| Recovery barriers | Speed limiters, emergency stop, on-site trauma first aid, defined emergency response |
Step 8 is where many organizations lose the value they built. A bowtie that lives in a slide deck decays the moment conditions change. A bowtie whose barriers are tied to owners, inspections, and corrective actions stays alive — and that connection is exactly where a structured platform earns its place over a static drawing.
Frequently Asked Questions
Q. What is the difference between a bowtie and a fault tree?
A fault tree is one-sided and quantitative: it works backward from a single top event through the combinations of failures that could cause it, often with probability data. A bowtie is two-sided and primarily qualitative: it shows both the causes (left) and the consequences (right) of a top event, with the barriers on each side. In complex cases, a fault tree is sometimes used to develop the left side of a bowtie in greater numerical detail. Bowtie favors communication and barrier management; fault tree favors probability calculation.
Q. Is bowtie analysis proactive or reactive?
Primarily proactive. Its main purpose is to map the controls protecting against a hazard before an incident, so you can confirm your defenses are adequate. It can support reactive investigation — when an incident occurs, you can mark which barriers failed — but for finding the root cause of a single past event, methods like 5 Whys or fishbone analysis are better suited.
Q. What is a degradation factor in a bowtie?
A degradation factor (or escalation factor) is a condition that weakens or defeats a barrier rather than directly causing the top event. Example: a guardrail (barrier) removed for maintenance (degradation factor). You manage it by adding a degradation-factor barrier — a control that protects the original barrier, such as a permit requiring guardrail reinstatement sign-off.
Q. Does bowtie analysis satisfy ISO 31000 or ISO 45001?
Bowtie analysis aligns with the risk management process in ISO 31000 and supports the hazard identification and control requirements in ISO 45001, but no method "satisfies" a standard on its own. The standards require a systematic process for identifying hazards, evaluating controls, and verifying their effectiveness. Bowtie is a recognized technique for doing that work, provided you assign ownership and verify barriers rather than just drawing them.
Q. How many barriers does a bowtie need?
There is no fixed number. The point is not to maximize barrier count but to confirm that each threat and each consequence has at least one credible, effective barrier — ideally with no single point of failure on critical lines. A threat line with only one weak (administrative or PPE-level) barrier is a finding, not a pass.
Key Takeaways
- Bowtie analysis maps the full path from hazard to consequence around a central "top event," placing preventive barriers on the left and recovery barriers on the right — a visual, causal picture of your defenses on one page.
- The method originated in process safety (ICI HAZAN work, late 1970s) and aligns with the ISO 31000 risk management process; it is now used across construction, healthcare, aviation, and logistics.
- The defining strength is the barrier-and-degradation-factor model: it forces an honest assessment of which controls are preventive versus recovery, how strong each is, and what could erode them.
- Use bowtie for major-accident hazards with multiple controls and severe consequences. For simple single-cause events use 5 Whys; for precise probability use fault tree analysis.
- A bowtie only stays useful if every barrier has a named owner, a verification routine, and a link to corrective action — otherwise it is a drawing, not a control system.
Related Resources
| Resource | Description | Best For |
|---|---|---|
| RCA Method Comparison: 5 Whys, Fishbone, Fault Tree, and Bowtie | Side-by-side comparison of the major root cause and risk methods, including where bowtie fits | Choosing the right method for a given hazard or incident type |
| Corrective Action Management: Stop Losing Track of Your CAPA Items | How to turn barrier gaps into tracked, owned, and verified corrective actions | Closing the loop after a bowtie reveals a weak control |
| Safety Management Trends 2026: AI, IoT, and Regulatory Changes | The shift from lagging to leading indicators and continuous risk monitoring | Connecting barrier management to a modern, data-driven EHS program |
Build living bowties, not static diagrams. WhyTrace Plus keeps your hazards, barriers, and consequences connected to real corrective actions with named owners and verification dates — so when a barrier degrades, you find out before an incident does. Start free at whytrace.com →