RISK MANAGEMENT

The BowTie method

 Today’s Outline

• The Bowtie method

• A Bowtie Workshop

• Bowtie analyses in Risk Management

 What is Risk Management?
• Risk Analysis:
– Source Identification
– Risk Estimation
• Risk Treatment:
– Avoidance
– Optimization
– Transfer
– Retention
• Risk Acceptance
• Risk Communication
 Why Qualitative Risk Management?

• Complexity of the world

• Multi Causality in previous incidents

• Involvement of & Relevance to the Workforce

 Why BowTie?

• The full picture

• Visual overview

• Clear and understandable diagram

• Makes communication easy

• Extra focus on recovery, consequences

 Why BowTieXP?

• Links to your Safety Management System

• Internal assesment tool

• More then just risk management

• Efficient way to work with BowTie

Why is it called a Bowtie?
Why is it called a Bowtie?
Example Zoo
 Example Zoo

?
 ?

“Zoo blames new keeper in tiger escape”

4 steps in Risk Evaluation

Identify

Assess

Control

Recover
 Identify

Identify Hazard

Threat Consequence
Top
Event
Threat Consequence
 Identify Hazard

Threat Top
Consequence

Event
Threat Consequence
 Identify Hazard

Threat Top
Consequence

Event
Threat Consequence
 Assess

Hazard Assess

Threat Top Consequence

Event
Threat Consequence
 Control

Hazard

Threat Top Consequence

Event
Threat Consequence

Control
 Example Zoo

Lion in Cage

Lion
Escapes /
Loss of
Corrosion
Seperation
Designed & Build Corrosion
following Inspection
International
Standards
 Recover

Hazard

Threat Top Consequence

Event
Threat Consequence

Recover
 Example Zoo

Lion in Cage

Lion
Escapes /
Lion attacks /
Loss of
kills other
Seperation
animals in zoo
Search Plan Dart Gun
Risk Evaluation & Management

Identify

Assess

Control

Recover
 Identify
• Are people, environment, assets or reputation exposed to
potential harm?

• What could go wrong?

• What are the causes?

Identify Hazard

Threat Top
Consequence

Event
Threat Consequence
 Assess
• What are consequences?

• How likely is it?

• How bad will it be?

Hazard Assess

Threat Top Consequence

Event
Threat Consequence
 Control
• Can the causes be eliminated?

• Is there a better way?

• How can it be prevented?

• How effective are the controls?

Hazard

Threat Top Consequence

Event
Threat Consequence

Control
 Recover
• Can the potential consequences be limited?

• What recovery measures are needed?

• Are recovery capabilities suitable and sufficient?

Hazard

Threat Top Consequence

Event
Threat Consequence

Recover
 Bowtie in a nutshell

• Risk Assessment & Bowtie

• BowTieXP links controls to the Management

System

• Bowtie is a demonstration tool for detailed

analysis of significant risks
(after Hazard identification)
 History of Bowtie
• “Butterfly diagrams”
• Possibly evolved from Cause-Consequence-
Diagrams of the 70’s
• Assessing Hazards and Operational Risks

• Piper Alpha incident 1988

• The Royal Dutch / Shell Group 90’s
 Bowtie in Oil & Gas Nowadays

• IADC HSE Case Guidelines

– Demonstrate Internal Assurance
– Meet Stakeholders Expectations

Global Leadership for the Drilling Industry

 Bowtie Nowadays

• Oil & Gas

• Chemical
• Aviation
• Medical
• Financial
• Government
• IT
 Hazard identification

• Is done differently in every industry

– Oil & gas is very mature with respect to

Hazard identification
(“Hazard Registers & Checklists”)
 The concept of ALARP
‘As Low As Reasonably Practicable’

• Balancing reduction in risk against the time, trouble,

difficulty and cost of achieving it

• This level represents the point at which investing in

further reduction measures becomes unreasonably
disproportionate to the additional risk reduction
obtained
 The concept of ALARP

Risk can not be

identiefied save in
extra oridnary
Unacceptable risk
circumstances
Tolerable only if risk Risk is undertaken only if a
reduction is impractical or if benefit is desired.
its cost is grossly
dispropertionate to the
ALARP Tolerable if cost or
reduction would exceed
improvements gained the improvements gained
Necessary to maintain
assurence that risk remains at Acceptable
this level
risk
 ALARP

• Screening Criteria (minimum acceptance

criteria) met?
• Alternatives / additional controls considered?
• Plan to reduce risk where needed
• Cost Benefit Analysis
 What is your ALARP?

• Industry Codes & Standards

• Good Practice / Best Practice
• Engineering Judgment
• Risk Based Analysis e.g. QRA, CBA
• Company Values
• Societal Values
A Bowtie Workshop
12 steps
 A Bowtie Workshop

Identification

1. Identify Hazard
2. Define Top Event
3. Define Possible Causes

A Bowtie Analysis in 12 steps

 A Bowtie Workshop

Evaluate Risks
4. Define Potential Consequences

Risk Reduction Measures

5. Define Proactive Controls (pre TE)
6. Define Reactive Controls (post TE)

A Bowtie Analysis in 12 steps

 A Bowtie Workshop

7. Define Escalation Factors

8. Define Escalation Factor Controls

To the management system

9. Define Tasks / Activities
10. Define “Who – What - When”
11. Define Verification method
12. Demonstration of ALARP
A Bowtie Analysis in 12 steps
:
 Operational Risk Management

• BowTie for operational Risk Management:

– Demonstration of Risk

– Management of change

– Training

– Developement
Involve the right people!
 Step 1 – Identify Hazards

Hazard

Anything that has the potential

to cause harm
 Part of normal business
Stored Stored Dependence
Flammable Toxic on Personnel
Substances Substances

Working on Dependence on
Helicopter Digital
Height transport Information

Hazard
Anything that has the potential to cause harm
 Hazard (guidelines)

• Hazards are part of normal business

• Hazards exist; they do not happen
• Description in controlled /desired state
• Think of situational context & scale

Hazard
Anything that has the potential to cause harm
 Exercise: Identifying Hazards
In groups of two:

Define two Hazards that are part of your

workplace.

You can use the Guidelines!

5 Minutes...
 Hazard (guidelines)

• Hazards are part of normal business

• Hazards exist; they do not happen
• Description in controlled /desired state
• Think of situational context & scale

Hazard
Anything that has the potential to cause harm
 Step 2 – Define Top Event

Top
Event

The point in time when control over the

Hazard is lost
 Top Event (guidelines)

• Hazard no longer in the desired state

• Change of ‘state’ of the Hazard
• Control over Hazard is lost
• Not yet a catastrophe
• Hazards can have more Top Events
Top
Event
The point in time when control over the Hazard is lost
 Loss of Control
Stored Stored Dependence
Flammable Toxic on Personnel
Substances Substances

Loss Loss
of of Human Error
Strike
Contain- Contain-
ment ment

Working on Dependence on
Helicopter digital
Height transport information

Objects falling Inability to

reach Server
down
destination down
 Exercise: Define Top Events
In groups of two:

Define Top Events for the Hazards that we

ealier identified
(on screen)

You can use the guidelines!

5 Minutes...
 Top Event (guidelines)

• Hazard no longer in the desired state

• Change of ‘state’ of the Hazard
• Control over Hazard is lost
• Not yet a catastrophe
• Hazards can have more Top Events
Top
Event
The point in time when control over the Hazard is lost
 Step 3 – Define Threats

Threat

A possible cause that can release the Hazard

by producing the
Top Event
 Causality in BowTie

Cause Effect

Threat Top
Consequence
can lead to: Event can lead to:

Cause Effect

Threat
A possible cause that can release the Hazard
by producing the Top Event
 Direct Causes

Stored
Helicopter
Flammable
Substances transport

Corrosion Technical
tank Failure
Loss
Inability to
of reach
Contain- destination
ment

Human Error
(in-action) Very Bad
Weather
 Threats (guidelines)

• Threats need to be direct or sufficient

• Threats should act independently
• Each Threat should lead to each consequence
via the Top Event
• Control failures are not Threats

Threat
A possible cause that can release the Hazard
by producing the Top Event
 Exercise: Define Possible Causes

In groups of two:

Define a couple of Threats for the Hazard –

Top Event combination on screen.
You can use the Guidelines!

2 x 5 Minutes...
 Threats (guidelines)

• Threats need to be direct or sufficient

• Threats should act independently
• Each Threat should lead to each consequence
via the Top Event
• Control failures are not Threats

Threat
A possible cause that can release the Hazard
by producing the Top Event
 Step 4 – Define Consequences

Consequence

An unwanted event resulting from the release

of the Hazard
 Consequences (guidelines)

• Consequences are events, not losses

• Consequences directly result in loss or
damage
• Try to be as specific as possible!
• Consequences = the risks

Consequence
An unwanted event resulting from the release
of the Hazard
 Harm done / Losses

• Death or ill health and injury

• Damage to property or environment
• Production losses
• Loss of assets
• Increased liabilities

Consequence
An unwanted event resulting from the release
of the Hazard
 Assessing Inherent Risk

Consequence
An unwanted event resulting from the release
of the Hazard
 Exercise: Define Consequences

In groups of two:

Define a couple of Consequences for the

Hazard – Top Event combination on screen.
You can use the Guidelines!

2 x 5 Minutes...
 Consequences (guidelines)

• Consequences are events, not losses

• Consequences directly result in loss or
damage
• Try to be as specific as possible!
• Consequences = the risks

Consequence
An unwanted event resulting from the release
of the Hazard
 Step 5 & 6 – Defining Controls

Control

Measures taken to prevent or mitigate

certain events
 Step 5 & 6 – Defining Controls
Proactive

Elimination
Technical
Engineering
Controle

Prevention Design
Functioning
Procedures
Reduction Administration
Reactive

Policy

Mitigation
 Controls
Proactive

• Proactive (pre Top Event)

Controle

Reactive

• Reactive (post Top Event)

Control Measures taken to prevent or mitigate certain events

 Proactive Controls
• Proactive Controls (pre Top Event)
Proactive

Elimination Elimination of Threat

Controle

Prevention Prevention of TopEvent

Hazard
Reactive

Top
Threat Event

Control Measures taken to prevent or mitigate certain events

 Exercise: Define Controls

In groups of two:

Define a couple of Controls for the each of

Threats on screen.

You can use the Guidelines!

5 Minutes...
 Reactive Controls
• Reactive Controls (post Top
Event)
Proactive

Elimination
Controle

Prevention

Reduction Reduction of TopEvent

Reactive

Hazard

Mitigation Mitigation of Consequences

Top
Consequence
Event

Control Measures taken to prevent or mitigate certain events

 Exercise: Define Controls

In groups of two:

Define a couple of Controls for the each of

Consequences on screen.

You can use the Guidelines!

5 Minutes...
 Control types
• What TYPE of Controls has your organization
defined?
Proactive

Elimination
Technical
Engineering
Controle

Prevention Design
Functioning Procedures
Reduction Administration
Reactive

Policy

Mitigation

Control Measures taken to prevent or mitigate certain events

 Control Types (examples)
• Prevention, Control, Mitigation, Recovery
• Guarding, Separation, Reduction, Control of Energy
Release, Administrative, Procedural, PPE
• Perform & Monitor, Implement & Monitor, Establish
Governance
• Maintenance, Inspection, Operations, Design, Training
and competence
• Equipment, Organization, Human Factor
 Accountability

• Who is Accountable for the functioning of a specific

Control?
• Define & Communicate this!

Control Measures taken to prevent or mitigate certain events

 Enough Control?

• No Risk often means No Business

• As Low As Reasonably Practicable
• Your ALARP: enough control?
• Number of Controls not important ≠ “a
Numbers Game”
• Costs versus Benefits
 Step 7 – Define Escalation Factors

Escalation
Factor

A condition that defeats or reduces the

effectiveness of a Control
 Escalation Factors

• Abnormal operating conditions

• Maintenance, testing of equipment
• Operating outside design envelope
• Loss of services

Escalation
Factor A condition that defeats or reduces the effectiveness of a
Control
 Causality in BowTie

Cause Effect

Escalation
Factor Failed Control
Leads to:

Escalation
Factor A condition that defeats or reduces the effectiveness of a
Control
 Step 8 – Defining EF Controls

EF Control

A Control that acts upon an Escalation

Factor
 Escalation Factor Controls

• To Control Human Factors:

Training, Mentoring, Qualifications, Verification

• To Control Mechanical Failures:

Maintenance, Repairs, Inspection

EF Control A Control that acts upon an Escalation Factor

The Management System
 Step 9 – Defining Tasks

9
“What tasks do we do to make sure
the control continues to work?”
Include design, operations,
maintenance, management.

Tasks

Management System
 Step 10 – Defining WWW

Tasks
10
“Who does the tasks?”
“How do they know when to do the tasks?”
“How do they know what to do?”
Management System “Is there a procedure, checklist, instruction?”
 Step 11 – Define Verification

11
“How do we verify that the
tasks have been done?”

Tasks

Management System
 Assess Effectiveness

Very Good Good Unknown Bad Very Bad

• Taking into account all the Controls, their

Escalation Factors & Escalation Factor Controls
• Taking into account all Accountabilities, MS
Activities & Responsibilities
• Verify, Audit, Inspect, Interview…
 How to Assess Effectiveness?

Very Good Good Unknown Bad Very Bad

Think of:
– Availability
– Effectiveness
– FMEA
 Assessing Residual Risk

Consequence
An unwanted event resulting from the release
of the Hazard
 Step 12 – Demonstration of ALARP

Tasks

Management System
 Application of the Bowtie Method

• Communication

• Organizational Improvements

• Procedures and Competence

 Application of the Bowtie Method

• Critical Systems

• ‘Future proof’ Risk Management

• Ownership

• Auditable Trail
 Tips for Success

• Involve people
• Pitch at the correct level of detail
• Keep the end objective in mind
• Demonstrate risks are reduced to As Low As
Reasonably Practicable
• Use the method to its full potential
• Verify Controls and Tasks