{"id":406,"date":"2026-10-14T16:10:06","date_gmt":"2026-10-14T16:10:06","guid":{"rendered":"https:\/\/ermf.co.uk\/?p=406"},"modified":"2026-10-14T16:10:07","modified_gmt":"2026-10-14T16:10:07","slug":"understanding-the-bow-tie-model","status":"publish","type":"post","link":"https:\/\/ermf.co.uk\/index.php\/2026\/10\/14\/understanding-the-bow-tie-model\/","title":{"rendered":"Understanding the Bow Tie Model"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If you&#8217;re new to Risk Management, one of the most useful tools I use is the <strong>Bow Tie Model<\/strong>.\u00a0 This is a tool used a lot in engineering environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Bow tie model helps you visualise the risk, understand what could cause it, what might happen if it occurs, and map the controls needed to manage it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look at it as a story with five parts to it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. The Risk Event<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the centre of the bow tie sits the risk event itself, this is the unwanted event that we are trying to avoid.&nbsp; Let\u2019s say for example it is \u201c<strong>unauthorised access to company confidential data<\/strong>\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. The Causes<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the left-hand side of the diagram, we identify what could go wrong, \u201c<strong>the threats or events<\/strong>\u201d that could manifest in the risk event.&nbsp; Let\u2019s say for this example one of the causes is \u201c<strong>Cyber attack<\/strong>\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. The Preventative Controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can now consider what <em>preventative controls<\/em> can stop these causes from leading to the risk event.&nbsp; For example, preventative controls might include staff awareness training, access restrictions such as firewalls, intruder detection systems, multi-factor authentication and security updates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. The Consequences<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the right-hand side, we consider the potential consequences if the risk event occurs. &nbsp;These might include financial losses, operational disruption, regulatory penalties or reputational damage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. The Corrective Controls<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here, we identify <em>mitigating or recovery controls<\/em> to reduce the severity of those consequences.&nbsp; Examples might include incident response plans, secure backups, disaster recovery arrangements and crisis communications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>We also need to include directive and monitoring controls for a complete picture.&nbsp; We also want the bow tie weighted more towards preventative controls, after all \u201c<\/strong><strong>prevention is better than cure<\/strong><strong>\u201d as they say.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>So, why is the Bow Tie Model so effective?<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It provides a clear, visual representation of a risk.<\/li>\n\n\n\n<li>It distinguishes between controls that prevent an event and those that limit its consequences.<\/li>\n\n\n\n<li>It helps identify gaps in existing controls.<\/li>\n\n\n\n<li>It supports discussions about control effectiveness, ownership and accountability.<\/li>\n\n\n\n<li>It helps communicate complex risks to people who may not have a risk management background.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The key lesson is this: <strong>identifying a risk is only the beginning. We also need to understand its causes, potential consequences, and whether our controls are effective.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Bow Tie Model provides a practical way to bring all these elements together and turn risk assessment into meaningful action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Does your organisation use Bow Tie analysis, or do you use another method to assess risks and evaluate controls?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re new to Risk Management, one of the most useful tools I use is&#8230;<\/p>\n","protected":false},"author":1,"featured_media":407,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,34],"tags":[],"class_list":["post-406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-risk-opportunity","category-trending"],"_links":{"self":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=406"}],"version-history":[{"count":1,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/406\/revisions"}],"predecessor-version":[{"id":408,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/406\/revisions\/408"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media\/407"}],"wp:attachment":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}