Bowtie OneWhat is a bowtie diagram?
A bowtie diagram is one picture of one dangerous activity. The ways it can go wrong sit on the left. The moment you lose control sits in the middle. What happens to people sits on the right. Everything you rely on to stop harm is drawn in between, exactly where it sits.
The shape looks like a bowtie. That is where the name comes from. Nothing mystical about it.
People use bowties heavily in oil and gas, mining, rail and construction. The reason is simple: the picture is legible to a supervisor, a director and a new starter without a day’s training.
Why bother with another picture?
Most workplaces already have risk assessments, procedures and permits. Those documents often say the risk is “controlled”. They do not always show what is doing the controlling, or whether you would bet someone’s life on it.
A bowtie forces that conversation onto one page:
- What activity are we talking about?
- What could realistically go wrong?
- What controls stand in the way of each path?
- What happens if we lose control anyway?
- What limits the harm after that?
If a control only exists in a procedure nobody has read, the board makes that obvious. Thin spots stop hiding.
The six parts, in order
A bowtie reads left to right, like the job itself. Here is the whole of it.
1. The activity (hazard)
The job with the potential to hurt someone. Working in an excavation. Entering a tank. Lifting over a live area. Working at height.
In bowtie language this is often called the hazard. It sits at the top of the picture. Keep it concrete. “Construction” is too wide. “Working in an excavation” is usable.
2. What could go wrong (threats)
The realistic ways the job turns bad. Each threat gets its own line into the middle.
For an excavation that might be: sides left unsupported, spoil stacked at the edge, plant working too close, groundwater weakening the face. These are threats — causes that can drive you toward loss of control.
Write threats as things that can actually happen on your site, not abstract categories.
3. What stops it (preventive controls)
Everything you rely on to keep each threat from reaching the centre. The trench box. The permit. The exclusion zone. The pre-start check. Competence for the people doing the dig.
These are your controls (sometimes called barriers). This is usually the first time people see them all written down in one place, against the specific threat they are meant to stop.
A control that sits against the wrong threat is a control that will not help when it matters.
4. The moment it goes wrong (top event)
The point where you have lost control of the job. The excavation collapses. The atmosphere in the tank becomes unsafe. A load swings into a live area.
This is the top event. It is not the injury yet — it is the event itself. It sits in the knot of the bowtie. Everything on the picture is arranged around it.
If you cannot name the top event in one plain sentence, the rest of the board will wander.
5. What limits the harm (mitigative controls)
Controls that only matter once the top event has already happened. The standby person. The rescue plan. Detection and alarms. Emergency isolation. First aid and trauma kit ready for the real injuries you might see.
They cannot prevent the event. They decide how badly it ends.
6. What happens to people (outcomes)
The realistic outcomes if those last controls fail too — a worker buried, someone crushed by plant, someone overcome in a confined space.
Each outcome should carry severity in language people recognise. The picture should end with the thing that actually matters: harm to people (and, where relevant, environment or asset — but start with people).
How long should a first board take?
About an hour for one activity, if the people who know the job are in the room. You do not need a safety specialist to produce the first draft. You need people who understand how the work is done. A specialist is useful for reviewing it, not for inventing the threats from a blank page.
Start with activities that could kill someone, not the ones that happen most often. Height, confined space, excavations, hot work, lifting, energy isolation, vehicle and pedestrian interaction. Most organisations find they have somewhere between eight and fifteen that deserve this treatment. Start with one.
What a good bowtie is not
- It is not a wall of every minor hazard on site.
- It is not a copy-paste of your risk assessment matrix into a prettier shape.
- It is not finished on the day you draw it. Controls change. Ground conditions change. Inspections get deferred. The board should be reviewed, not laminated and forgotten.
Some tools let you record what defeats a control — the conditions under which a control that exists on paper is not there when it matters. That is often where the honest conversation starts.
Bowties and risk assessments
They work together. A risk assessment usually tells you the risk is controlled. A bowtie shows you exactly what is doing the controlling. Use the bowtie as the picture underneath the paperwork — the thing people remember when they are standing at the edge of the hole.
For a fuller comparison, see Bowtie vs risk assessment.
How to try one without buying software
You can sketch a bowtie on a whiteboard. Columns are enough: threats → preventive controls → top event → mitigative controls → outcomes, with the activity named at the top.
If you want to build in a browser, Bowtie One lets you map an activity with no account. Building is free. You only need an account when you want cloud save, share, or export on the Pro plan.
For a worked example that matches the kind of board used on the Bowtie One homepage, see Excavation bowtie example.
FAQ
What does the centre of a bowtie represent?
The top event — the moment you lose control of the activity. Not the injury, the loss of control itself (for example, excavation collapse).
Is a bowtie the same as a fault tree or event tree?
Related ideas, different job. Fault trees and event trees are often quantitative and specialist-heavy. A bowtie is built to be readable: threats, controls and outcomes on one picture for the people who run the work.
Do I need software to make a bowtie?
No. Paper and a whiteboard work. Software helps when you want to keep boards, colour by control strength or risk, record defeaters, and share them with others.
Which activity should we bowtie first?
Pick one that could kill someone. If you only have time for one board this month, make it the activity you would least want to explain after an incident.
Who should build the bowtie?
The people who know the job, with a facilitator if that helps. Review it with someone who will challenge weak controls. Do not outsource the whole thing to a person who has never stood on the job.
How is this different from a risk assessment?
A risk assessment scores and records. A bowtie shows the control story. You still need both for most management systems. See Bowtie vs risk assessment.