Bowtie vs risk assessment — how they work together

What a risk assessment is for

In UK workplaces, risk assessment is how you show you have thought about what can hurt people and what you will do about it. Typical content:

• Activity or task
• Hazards
• Who might be harmed
• Existing controls
• Risk rating (often likelihood × severity)
• Further action
• Who owns the action and by when

Done well, it drives decisions: stop the job, change the method, add a control, train people, maintain equipment. Done badly, it becomes a form that exists to satisfy an audit trail.

A risk assessment is good at:

• Covering many tasks in a consistent format
• Feeding permits, method statements and briefing sheets
• Recording residual risk after controls
• Showing a trail for regulators and clients

It is weaker at:

• Showing which control sits against which path to failure
• Separating prevention from mitigation
• Making thin controls visible at a glance
• Helping a new starter “see” the job’s critical risk in one view

What a bowtie is for

A bowtie diagram is one picture of one dangerous activity. Threats on the left. Top event in the middle. Outcomes on the right. Controls in between.

It is good at:

• Naming the loss-of-control moment clearly
• Mapping each threat to the controls that stop it
• Showing what limits harm after things have already gone wrong
• Supporting conversations about control strength, ownership and what defeats a control

It is not a replacement for your full risk assessment register. You will not bowtie every slip or trip on site. You bowtie the handful of activities that could kill or permanently disable someone.

Side by side

If your risk assessment says “excavation collapse — controlled by shoring, permit, exclusion zone”, the bowtie asks: which of those stops unsupported sides? Which stops spoil at the edge? Which only helps after collapse has started?

That split matters.

How to use them together

1. Let the risk assessment choose the candidates

From your register, pick activities with serious injury or fatality potential. Height, confined space, excavation, hot work, lifting, isolation, vehicle–pedestrian interaction. Those become bowtie candidates. See also SIF and critical controls.

2. Build the bowtie with the people who do the work

Threats and controls should come from how the job is really done, not only from the written procedure. An hour in a room with a supervisor and two experienced hands beats a solo rewrite of the RAMS.

3. Feed the picture back into the paperwork

When the board shows a threat with one weak administrative control and nothing else, your risk assessment action list should say so. When mitigative controls are missing (no rescue plan, no standby), the method statement should change — not just the diagram.

4. Use the bowtie in briefings

Crews remember pictures. Walk the left side (“what we’re stopping today”) and the right side (“if it still goes wrong, this is how we limit harm”). Keep the full risk assessment available; do not read it aloud line by line at the hole.

5. Review both on the same trigger

Change of method, change of ground, incident or near miss, overdue inspection, new contractor. Update the board and the assessment together so they do not drift apart.

Common failure modes

Risk assessment only. Everything looks “medium” or “controlled”. Nobody can point to the control that would actually stop the worst path.

Bowtie only. A beautiful diagram with no link to actions, owners, permits or review dates. It becomes wall art.

Copy-paste. Dumping every line of the risk assessment onto a bowtie without naming a clear top event. The picture turns into spaghetti.

Wrong altitude. Bowtie for “site safety” instead of “working in an excavation”. Too wide to be useful.

A practical workflow for one activity

1. Open the existing risk assessment / RAMS for the activity.
2. Write one sentence for the top event (“excavation collapse”, not “someone gets hurt”).
3. List realistic threats that can drive that event.
4. Place preventive controls on each threat line — only controls that actually interrupt that path.
5. Place mitigative controls on the right — only controls that matter after the top event.
6. Name outcomes in human terms.
7. Mark weak or defeatable controls and turn them into actions in the risk assessment.
8. Brief the crew from the picture; file both documents together.

For a concrete walkthrough, use Excavation bowtie example.

Where Bowtie One fits

You can do all of this on a whiteboard. Software helps when you want control strength and type on the board, initial and residual risk on outcomes, and a way to keep the picture alive.

Bowtie One is free to map with no account. Autosave stays in your browser until you choose otherwise. Pro is for cloud save, sharing with colleagues, PDF export and review dates — the “keep it and review it” part that matches how risk assessments already work in a management system.

FAQ