There might be some who read my posts who are also Doctor Who fans and get the reference to bow ties being cool. However, even if you don't watch Doctor Who, you can still appreciate the benefits from using a bow-tie analysis to help improve the certainty of achieving your goals.
Risk management has changed over the years and in many ways has now become an optimization process to increase the certainty of achieving outcomes. And nothing demonstrates this more than using a bow-tie analysis.The first thing that people notice when using a bow-tie analysis is that it looks like an actual bow tie particularly in its simpler form:
This provides a great visual when considering how to address risks. However, what makes it so powerful is that it incorporates causal and consequence trees along with control analysis all in one tool.
To illustrate how the bow-tie analysis can be used let's consider risks associated with achieving a relatively simple objective of getting to work. We can simplify this even further by only considering a risk scenario that involves getting from the parking lot to the office building. The path has a significant hole in the pavement that developed over the winter and is now a meter wide wide and several meters deep.
This hole is referred to as a hazard which threatens the ability to achieve the objective of getting to work. However, it should be noted that not all holes represent threats only the ones that are in the way between us and our objective. As in the words of, Dr. David Hillson (The Risk Doctor), that's how you know which risks really matter.
The goal of a bow-tie analysis is to optimize controls addressing both prevention and recovery to reduce the treated risk to below a given risk tolerance. For each cause an evaluation is made of the prevention controls effects on the likelihood of the risk event occurring, which in our example is falling in the hole. In a similar fashion, an evaluation is made of the effects of the recovery controls to reduce the impact of not achieving the objective.
The following list contains brief definitions for key elements of our bow-tie example :
Objective: This is what is being aimed or sought after (i.e. getting to work)
Causes: these are conditions that may result in falling in the hole. In our example, three causes have been identified: walking down the path, running down the path, and walking while being distracted. Each one will have their own likelihood of falling in the hole.
Consequences: these are the results of falling in the hole which affect whether or not we get to work. They are uncertain as they depend on the whether or not a person falls in the hole. Three consequences have been identified: cuts and bruises, broken bones, and fatalities.
Prevention: these are controls to prevent falling in the hole. Each one has their own level of effectiveness
Recovery: these are controls that mitigate the effects of falling in the hole should they happen. Each one has their own level of effectiveness.
After optimizing the prevention and recovery controls to reduce residual risk below the risk tolerance, a risk plan can be developed by creating risk statements for the cross product of causes and consequences. Here I am using the risk meta-language proposed by Dr. Hillson and others:
A bow-tie analysis is effective not only with qualitative considerations but can be (an often is) extended to include quantitative measures on both causal and prevention logic trees. In addition, by considering both prevention and recovery efficacy in isolation and in relationship with other controls, a preliminary assessment (LOPA) of the layers of defense can be obtained to gauge overall coverage.
A bow-tie analysis can also be applied to opportunities where instead of prevention and recovery the focus is on enabling opportunity events and exploiting them should they materialize. By considering both threats and opportunities a holistic approach to addressing uncertainty in the achievement of objectives is possible.
Download our free PowerPoint Bow-Tie / ISO 31000 Template here
