Bowtie Analysis: Map Your Risks Visually

A risk register with two hundred rows tells you what can go wrong. It just doesn't tell you how. Which causes lead to that one risk? Which controls sit in between? And what happens if it goes wrong anyway? A bowtie analysis answers exactly those questions, in a single clear diagram that everyone at the table understands.

In this article you'll learn what a bowtie analysis is, how the model is built, when to use it, and how to create one yourself in six steps.

What is a bowtie analysis?

A bowtie analysis is a visual risk analysis method that maps the causes, consequences, and controls of a single central risk. The diagram is shaped like a bow tie: the causes sit on the left, the unwanted event sits in the middle, and the consequences sit on the right. Between those elements you place barriers, the controls that either prevent the risk from occurring or limit the damage if it happens anyway.

The method originally comes from the oil and gas industry, where safety risks can literally cost lives. Today the bowtie analysis is applied far more broadly: in construction and infrastructure, at water authorities, across manufacturing, and by organizations that work according to ISO 31000.

What makes the bowtie so effective is its simplicity. Where a fault tree or a quantitative analysis quickly becomes the territory of specialists, a project manager, site supervisor, or executive can read a bowtie diagram at a glance.

The structure of the bowtie model

A bowtie diagram has five fixed components. From left to right:

Causes (threats)

On the left side sit all the events or conditions that can lead to the central risk. For the risk "utility strike during excavation," think of causes such as an outdated utility locate, inexperienced equipment operators, or schedule pressure in the plan.

Preventive barriers

Between each cause and the top event you place preventive controls: anything that stops a cause from actually leading to the risk. For example, potholing to expose lines, a toolbox talk before work begins, or a second check on the utility locate data.

Top event (the risk)

In the middle, at the knot of the bow tie, sits the top event: the moment you lose control. This is the central risk you're analyzing. A good top event is concrete and specific. "Utility strike during excavation on segment 3" works better than "damage to cables and pipes."

Mitigating barriers

To the right of the top event you place the controls that limit the consequences if the risk does occur. Think of an emergency response plan, fast escalation lines to the utility company, or a communication protocol for nearby residents.

Consequences

At the far right sit the possible consequences: a power outage in the neighborhood, project delay, reputational damage, or injury. Naming the consequences explicitly makes it visible to everyone why the risk deserves attention.

When do you use a bowtie analysis?

You don't build a bowtie analysis for every risk in your register. That would be unworkable. The method is especially valuable for:

• Top risks with major impact. Risks that could seriously affect your project, organization, or surroundings deserve deeper analysis than a score in a matrix.
• Complex risks with multiple causes. When a risk can arise through several routes, the bowtie shows which route you haven't covered well enough yet.
• Communicating with a broad group. Do you need to explain a risk to executives, residents, or a bid team? A bowtie diagram makes it clear in a single picture what's at play and what you're doing about it.
• Testing your controls. The bowtie exposes exactly where barriers are missing. A cause with no preventive control stands out immediately.

The bowtie also fits neatly within the RiskChallenger 1-2-3 approach. You first decide what you want to protect, then map the risks, and then choose your controls. Along the way, the bowtie forces you to distinguish between preventive controls (aimed at causes) and mitigating controls (aimed at consequences). That distinction is missing from many risk registers, even though it determines how effective your approach really is.

How to create a bowtie analysis in 6 steps

Here's how to do it:

1. Choose the top event. Select a top risk from your risk file and frame it as a concrete event. Ask yourself: at what moment do we lose control?
2. Inventory the causes. Don't do this alone. Invite the whole team, from site supervisor to stakeholder manager. Every discipline sees different causes.
3. Map the consequences. Look beyond money and schedule. Consider safety, environment, reputation, and legal consequences too.
4. Name the existing barriers. Which controls are already in place? Put preventive controls on the left and mitigating controls on the right. Be honest about how well they work: an outdated procedure nobody knows about is not a barrier.
5. Find the gaps. Where does a cause sit with no control? Where are you leaning on a single barrier? These are your action items.
6. Assign owners and keep it alive. Every control gets an owner and a deadline. Schedule a moment to revisit the bowtie, for example at each phase transition in the project.

Benefits and limitations of the bowtie method

Benefits

The biggest benefit is communication power. A bowtie diagram tells the entire story of a risk on a single page, without the reader needing any background in risk management. On top of that, the method makes the difference between prevention and mitigation explicit, and you can see right away where your controls have weak spots.

Limitations

A bowtie analysis takes time. For a register of a hundred small risks, the method is too heavy; save it for your top risks. The bowtie is also qualitative by nature. If you want to quantify risks, for example for a probabilistic estimate, you combine the bowtie with other techniques such as a Monte Carlo simulation. And perhaps the most important pitfall: a bowtie built by one person at a desk misses the knowledge of the people who actually do the work.

The bowtie analysis as a conversation tool, not a checkbox exercise

This brings us to the heart of it. The value of a bowtie analysis lies not in the diagram itself, but in the conversation you have around it. When an equipment operator, work planner, and project manager look at the same picture together, you surface insights you won't find in any register. The operator knows that one barrier gets skipped in practice. The work planner knows a cause that isn't on any list yet.

That's communicative risk management: risk management as a dialogue, not a number. The broader and more varied the group thinking along, the better your analysis becomes. A bowtie session lends itself to that perfectly, especially when participants can join with a low barrier to entry, for example on their own phone, without the hassle of accounts.

In RiskChallenger you connect that dialogue directly to your risk file. You capture causes and consequences per risk, controls automatically get an owner and a deadline with reminders, and through the dashboards you track whether barriers are actually being followed up. That way your bowtie analysis stays a living part of your risk management instead of a one-off exercise.

Get started with the bowtie analysis

Start small. Take your biggest project risk, schedule a one-hour session with a mixed team, and build your first bowtie together. You'll find the conversation delivers at least as much as the diagram.