Forget fancy theories. Risk isn’t about what might happen, it’s about what will happen if you don’t act. The Bowtie method forces you to think in straight lines. No fluff, just clarity.

What is Bow tie analysis?

It’s another sort of cause-and-effect diagram that shows how risks unfold. It links threats to a central risk event, a hazard, and maps out consequences. It forces you to identify barriers that can prevent or mitigate damage.

What is a hazard?
A hazard is a source of potential harm. It exists before anything goes wrong. It is not the incident itself but the condition that makes failure possible. A hazard sits at the root of all risks.

Example: In cybersecurity, a hazard could be sensitive customer data stored on a vulnerable system. It is not yet compromised, but the potential for damage exists. It could be a slippery floor, unlicensed software, etc.

When to use Bow tie analysis?
 1. Before disasters happen, not after.
 2. When assessing operational, financial, or strategic risks.
 3. In industries where failure isn’t an option aviation, healthcare, cybersecurity.

Use case Cybersecurity breach
A bank fears a data breach instead of vague “risk assessments,” they build a Bowtie diagram.

 1. Identify the hazard, Sensitive customer data (valuable but exposed).
 2. Define the top event, Unauthorized access (hacker intrusion) due to insider or external breach.
 3. List threats, Weak passwords, phishing, insider threats.
 4. Add barriers, multi-factor authentication, staff training, data encryption, firewalls.
 5. Map consequences, Financial loss, reputational damage, regulatory fines.
 6. Apply recovery measures, Incident response, insurance, backup, PR strategy. Remember, apply the appropriate response to each threat.

Bow tie step-by-step process

 1. Identify the central hazard.
 2. Define the critical failure event.
 3. List all possible threats leading to failure.
 4. Identify preventive barriers.
 5. Map consequences if failure occurs.
 6. Assign recovery controls.

Risk management isn’t about reacting. It’s about controlling the domino effect before the first tile falls. If you don’t map it, you don’t manage it.