A bowtie shows one hazard on one page: what could release it, what happens if it does, and every control standing in the way. In SafetyPulse the diagram is linked to the investigations, so what an incident reveals about a barrier lands back on the model.
What a bowtie shows. Threats are the things that could release the hazard. The top event is the moment control is lost, stated neutrally and without blame. Controls sit on both sides: on the left those that stand between a threat and the event, on the right those that limit the damage once it has happened, each with an owner, a type and an effectiveness rating. Escalation factors are the conditions that undermine a control while leaving it apparently in place.
Rate the hazard before and after the controls. Every diagram carries an initial rating for the hazard with no controls and a residual rating for the hazard as it stands today, both on your own matrix, with an approval line recording who signed the model off and when.
The loop most bowties never close: an ICAM investigation finds a barrier that failed, was missing, degraded or bypassed; the finding is linked to that exact barrier on the bowtie with its failure mode recorded; control health for that barrier is downgraded until somebody re-verifies it; the verification evidence closes the loop and the barrier's health recovers.
SafetyPulse is built by ICAM Australia, who publish a written guide to bow tie risk analysis and have trained more than 7,500 investigators.
SafetyPulse by ICAM Australia Pty Ltd. ICAM training and methodology.