Bowties That Teams Actually Use

Have you ever been handed a bowtie diagram so large and unwieldy that you can't even read it — one that won't fit on an A3 page, let alone make sense to the person standing at the plant? Bowties were developed as a visual tool to take the detailed information buried in a HAZOP, a LOPA, or a risk analysis, and present it in a format that operators and managers can actually understand. That's the whole point of the tool. And the most important test of a visual tool is simple: can you read it? If a bowtie isn't readable, it isn't serving its purpose — no matter how technically complete it is.

Start with the objective

Before you draw anything, be clear about what you're using the bowtie for. Are you communicating with your operational team, who need to know what to check and why it matters on shift? Or are you communicating with management, who need assurance that the major hazards are understood and controlled? A bowtie built to satisfy both audiences equally often satisfies neither — the level of detail an operator needs to do a control check is different from what a manager needs to know their risk profile is sound. Deciding your primary audience up front is what should guide how much information goes on the page.

Where the tool came from

The earliest known bowtie-style diagrams trace back to ICI course notes from a 1979 hazard analysis lecture at the University of Queensland, though the exact origins of the method are murky. ICI was a major contributor to process safety more broadly — HAZOP and HAZAN both came out of the company before it was later absorbed into Akzo Nobel and Huntsman. The real catalyst was Piper Alpha in 1988. Lord Cullen's inquiry into the disaster found a poor industry-wide understanding of hazards and how seemingly unrelated events and conditions combine to cause them — which created the push for a more systematic way of understanding and controlling that causality.

Shell picked up the bowtie method in the early 1990s as part of its Hazards and Effects Management Process (HEMP), and it's Shell's work from there that really shaped the tool as we know it today. Shell invested heavily in researching how to use and apply them, and found the real value was in documenting common major hazard scenarios and their associated controls — so they could ensure consistency in risk management across a large, dispersed business.

The tool originated in oil, gas, and chemical processing, and has since spread into other high-hazard industries: aviation, mining, minerals processing, power generation. The recurring challenge is translation — carrying the purpose of the tool across into industries it wasn't originally built for. Miss that translation, and you get the misuse that erodes the tool's value: bowties that are technically thorough but practically unreadable.

A bowtie visualises risk — it doesn't assess it

The amount of information you put on a bowtie should be governed by its objective, not by how much analysis you've done. The key thing to remember is that a bowtie is a visualisation of a major hazard scenario that should already have been assessed through a more detailed risk analysis methodology. A bowtie is not, traditionally, the tool you use to do the risk assessing itself — it's what you build afterwards, to communicate what that analysis found.

Document your rules

It's worth having the rules for how you build your bowties clearly documented, and there's good industry guidance to draw on rather than reinventing it. I'd recommend the Energy Institute's Bowties in Risk Management concept book as the most detailed reference available. For process safety in mining and minerals, ICMM's Critical Control Management: Good Practice Guide (recently updated in 2026) also covers bowties, though in less depth than the Energy Institute guidance.

Define your control clearly

What actually makes a bowtie practical — as opposed to just detailed — is having a clear, consistent definition of what counts as a control (sometimes called a barrier). Which definition you use will depend on your industry. I tend to use the ICMM guidance, which has a clear definition of controls and critical controls, when working in mining and metals. If you're in oil and gas, you'll most likely stick with the Energy Institute's definitions instead.

Get the top event right

The other place bowties commonly go wrong is the top event — the "knot" in the middle of the bowtie. This is the point at which you lose containment or lose control of the hazard: the moment the thing with the potential to cause harm is no longer being held in check. Getting this definition right is what makes the rest of the diagram make sense. Following the Energy Institute's guidance, I'd suggest building your bowtie in this order:

1. Identify your consequences without controls — your worst-case, inherent, maximum-credible outcome (the terminology varies by organisation, but the idea is the same: what happens if nothing stops it).
2. Identify your causes or threats — what could initiate the top event.
3. Add your controls — preventative controls on the left-hand side of the bowtie, mitigative controls on the right-hand side.

The bowtie is downstream of your analysis

It's worth repeating: everything on your bowtie should trace back to a more detailed piece of hazard identification and risk analysis. For process safety, that's typically a HAZID, HAZOP, or LOPA. For consequence modelling, it might be a fault tree analysis. Whatever tool is appropriate to your major hazard scenario, the bowtie is the communication layer that sits on top of it — not a substitute for it.

Get these fundamentals right — a clear objective, a disciplined definition of control, a correctly defined top event, and information genuinely sourced from your underlying risk analysis — and you'll end up with a bowtie that's actually readable, and actually used.