Understanding the Bow Tie Model

If you’re new to Risk Management, one of the most useful tools I use is the Bow Tie Model.  This is a tool used a lot in engineering environments.

The Bow tie model helps you visualise the risk, understand what could cause it, what might happen if it occurs, and map the controls needed to manage it.

Look at it as a story with five parts to it.

1. The Risk Event

At the centre of the bow tie sits the risk event itself, this is the unwanted event that we are trying to avoid.  Let’s say for example it is “unauthorised access to company confidential data”.

2. The Causes

On the left-hand side of the diagram, we identify what could go wrong, “the threats or events” that could manifest in the risk event.  Let’s say for this example one of the causes is “Cyber attack”.

3. The Preventative Controls

We can now consider what preventative controls can stop these causes from leading to the risk event.  For example, preventative controls might include staff awareness training, access restrictions such as firewalls, intruder detection systems, multi-factor authentication and security updates.

4. The Consequences

On the right-hand side, we consider the potential consequences if the risk event occurs.  These might include financial losses, operational disruption, regulatory penalties or reputational damage.

5. The Corrective Controls

Here, we identify mitigating or recovery controls to reduce the severity of those consequences.  Examples might include incident response plans, secure backups, disaster recovery arrangements and crisis communications.

We also need to include directive and monitoring controls for a complete picture.  We also want the bow tie weighted more towards preventative controls, after all “prevention is better than cure” as they say.

So, why is the Bow Tie Model so effective?

• It provides a clear, visual representation of a risk.
• It distinguishes between controls that prevent an event and those that limit its consequences.
• It helps identify gaps in existing controls.
• It supports discussions about control effectiveness, ownership and accountability.
• It helps communicate complex risks to people who may not have a risk management background.

The key lesson is this: identifying a risk is only the beginning. We also need to understand its causes, potential consequences, and whether our controls are effective.

The Bow Tie Model provides a practical way to bring all these elements together and turn risk assessment into meaningful action.

Does your organisation use Bow Tie analysis, or do you use another method to assess risks and evaluate controls?