Bow-Tie Diagram

Why it matters

A bow-tie diagram lays out a single hazard from end to end on one page. In the centre, a knot marks the top event — the moment control is lost. Fanning to the left are the threats that could cause it, each separated from the knot by the preventive barriers meant to stop it. Fanning to the right are the consequences that follow if it happens, each separated from the knot by the mitigative barriers meant to contain it. The two fans meet at the knot, and the shape — wide, pinched, wide — is a bow tie. Its whole job is to show, at a glance, every barrier standing between cause and harm, and exactly where one is missing or weak.

For example: a hospital worries about a patient receiving the wrong medication. The top event is “wrong drug reaches the patient.” On the left, threats — a misread order, a look-alike vial, a broken pump — each face their preventive barriers: electronic prescribing, barcode scanning, a pharmacist check. On the right, consequences — an adverse reaction, an ICU transfer, a death — each face their mitigative barriers: bedside monitoring, a rapid-response team, a reversal-agent protocol. Drawn this way, one gap jumps out: the look-alike-vial threat has a single barrier doing all the work, and the most severe consequence has no rehearsed response at all. Prose listing the same controls would have buried both.

  • What it shows. The complete prevent-and-mitigate barrier picture for one hazard — threats and the barriers before the event on the left, consequences and the barriers after it on the right — so missing and overloaded barriers become visible.
  • When to reach for it. A single, well-defined hazard worth analyzing in depth, where you want both sides at once: what could trigger it, what would follow, and what defenses stand on each.
  • How to read it. Start at the knot (the top event), read left along each threat to see whether enough preventive barriers interrupt it, then read right along each consequence to see whether enough mitigative barriers contain it.
  • What you’d miss without it. The single points of failure — one barrier carrying a whole pathway — and the uncovered gaps, the threat or consequence with no real barrier at all, both of which a flat list of controls hides.
  • Where it misleads. It draws each pathway as an independent line, so it hides barriers that fail together and threats that combine; and a barrier drawn on the page can look effective when it is only aspirational, never tested under load.

How to read it

Picture a bow tie drawn left to right. Dead centre, at the knot, sits the top event — the single moment control over the hazard is lost, stated as the loss itself, not its causes or its damage (“loss of containment of the storage tank,” not “corrosion” and not “explosion”). Everything to the left is the story of how you get to that moment; everything to the right is the story of what happens after.

On the left, the threats fan out — the distinct causes, each its own pathway running inward toward the knot. Across each pathway stand the preventive barriers: the controls that interrupt that threat before it reaches the top event. A threat with three barriers in its path is well defended; a threat with one barrier is leaning on a single line of defense; a threat with none runs straight to the knot unopposed. On the right, the consequences fan out — the distinct outcomes if the event occurs, usually ordered by severity. Across each of those pathways stand the mitigative barriers (also called recovery barriers): the controls that reduce or contain the damage after the event. The same reading applies — count the barriers on each consequence pathway and see which outcomes are contained and which are not.

Two things make the picture worth drawing. First, the knot forces a clean split between prevention and mitigation — left of the knot is everything you do to keep the event from happening, right of the knot is everything you do once it has. Teams usually reason about those two halves in separate documents, by separate people, so they never see whether the prevention spending and the containment spending are balanced; the bow tie puts them on one page and lets you ask, against a single picture, do we need more locks on the door or more sprinklers in the room? Second, a barrier is only as good as its state — a mature bow-tie marks each barrier as in place, degraded, or merely proposed, so the diagram shows not just where barriers exist but which ones you can actually count on. Read back, a good bow-tie shows the full defensive posture for one hazard and points straight at the thinnest place in it.

When to use it

The bow-tie belongs to the RISK family of diagrams — the ones that structure how harm arises and how it is contained — and within that family it is the single-hazard, both-sides tool: the one you reach for when one specific event is worth analyzing in full, causes and consequences and barriers together. That places it among several relatives, and knowing the boundaries is how you pick the right one:

  • A Fishbone Diagram maps causes only — every candidate cause of a problem, organized by category — with no consequences and no barriers. Reach for the fishbone to enumerate why something happens; reach for the bow-tie when you also need what follows and what defends against it.
  • A fault tree is the left-half specialist: it decomposes the logic of how a single failure can occur, down to combinations of root causes with their probabilities. The bow-tie is broader and shallower — it carries the right half too, and trades the fault tree’s quantitative depth for a barrier picture you can read at a glance.
  • An FMEA (failure mode and effects analysis) sweeps many failure modes across a system in a table, scoring each. The bow-tie goes the other way: one event, in depth, drawn rather than tabulated.

Reach for a bow-tie when the hazard is single and well-defined, when there are several plausible threats and several plausible consequences worth seeing together, and when the controls are diverse enough that prevention and mitigation deserve separate consideration. Skip it when the question is comparative across many risks (a risk register or heatmap is the right tool), when you need quantified failure probabilities (a fault tree), or when you only care about causes and not consequences (a fishbone). The bow-tie is the one-hazard deep dive, not the portfolio view.

How Ora builds it

Ora produces a bow-tie from a semantic spec — a structured description with a top event at the centre, an array of threats each carrying its preventive barriers, an array of consequences each carrying its mitigative barriers, and a state on every barrier (in place, degraded, or proposed). That spec is rendered left to right: the top event anchored at the knot, threats fanning to the left with their preventive barriers drawn across each pathway, consequences fanning to the right with their mitigative barriers across each, severity encoded with width as well as colour so it survives without colour. The accessibility layer describes the count of threats, the barriers on each pathway, the consequence-severity ordering, and the most- and least-covered pathways, since the fanning lines alone are not screen-readable.

The diagram is the visual face of Ora’s risk reasoning: when you ask “draw the bow-tie for this hazard,” the producing path is the Pre-Mortem (Fragility) mode (and the broader risk-analysis work it leads), which inventories the threats, stress-tests each barrier for single points of failure and hidden weakness, and renders the result as this artifact. The discipline it enforces — split prevention from mitigation, then hunt for the pathway no barrier truly covers — is exactly what the bow-tie was built to make visible.

The technique comes from the process-safety community: the bow-tie method grew out of hazard-analysis work in the chemical-process industry — its early development is associated with ICI and its institutionalization with Shell, which adopted it as a company-wide standard for major-hazard management and made it the field’s common form. It was later codified for the wider discipline by the Center for Chemical Process Safety (CCPS) and adopted across energy, aviation, and healthcare safety practice. The standard reference for current practice is CCPS’s Bow Ties in Risk Management: A Concept Book for Process Safety (2018).

  • Fishbone Diagram — the causes-only cousin: every candidate cause of a problem, organized by category, with no consequence side and no barriers.
  • Causal DAG — the formal causal member of the family: a directed graph for reasoning rigorously about which causes to control for when estimating an effect from data, where the bow-tie reasons about barriers rather than estimation.
  • Influence Diagram — the decision-under-uncertainty relative: it models what you decide, what is uncertain, and how the outcome is valued, where the bow-tie models how one hazard is caused and contained.
  • Pre-Mortem (Fragility) (mode) — the analytical operation this diagram renders: the threat inventory and barrier stress-test that becomes the bow-tie.