A bow-tie is a picture of how a hazard could cause harm and what stands in the way. It shows coverage, not how well each barrier works. A competent person must judge the result.
What a bow-tie shows
- Hazard: the thing with the potential to cause harm.
- Top event: the moment control is lost, for example a forklift striking a pedestrian.
- Threats: the ways the top event could happen, on the left.
- Preventive barriers: what stops each threat reaching the top event.
- Consequences: what could follow the top event, on the right.
- Mitigating barriers: what limits the harm after the top event has happened.
The bow-tie method complements the Swiss cheese layers of defence tool. The bow-tie shows the paths and the barriers on each. The Swiss cheese tool tests how well a set of layers holds up, using check counts.
Rules the tool applies
- A barrier counts as in place only when its status is Verified, with a date within the last 12 months, not in the future, and a note of what was checked. Anything else is shown as not verified.
- Every threat and every consequence needs at least one verified barrier. A path with none is shown as a gap and the bow-tie is flagged as needing action.
- A path with only one independent verified barrier is flagged, because nothing else stops it if that barrier fails.
- Barriers given the same shared cause (for example, the same supervisor or the same power supply) count as one, because one failure can defeat them together.
- For a severity 4 or 5 hazard, a path that relies only on procedures or PPE is flagged. Look higher: eliminate, substitute or engineer the risk out.
- For a severity 4 or 5 hazard, each verified barrier should say what could make it fail and what protects it. Missing answers are flagged.
- A bow-tie needs an owner, a competent reviewer who is not the owner, and a review date.
- If you link a bow-tie to a risk in the Risk Register, the tool compares severities and shows the risk's rating. It never changes the register.
Limits
A green status means every path has at least two independent verified barriers. It does not mean the barriers are good enough, or that the picture is complete. Missing threats are the usual weakness, so ask people who do the job. Decision support only, not a substitute for a suitable and sufficient risk assessment by a competent person. Data stays in this browser unless you save a data file, and there is no sign-in, so it cannot prove who changed what.