Having been exposed to some complex and rather user-unfriendly risk assessment techniques, it was a joy to behold the simplicity yet comprehensive nature of the bow-tie risk analysis technique. The technique has been around for some time with origins attributed to the oil and gas sector ,and I have listed some useful online resources for further consideration at the end of this post.
Why is it still attractive? My sense is that risk management has created its own opacity through its language and complex models which can all have a detrimental impact on two key stakeholders in any organisation – the very top and the operational level. On the working assumption that risk management is looking to encourage risk conversations and thinking, then its tools need to lend themselves to participative discussion at different levels across the organisation, something which bow-tie analysis has proven through its continued use.
Bow-tie assessment takes its name from the shape of the model that is produced through the analysis. At the centre of the bow tie is the risk event or “loss of control” incident. Analogies are often used to bring this alive by comparing it with a “tiger in the cage” with the loss of control being the tiger escaping from the cage. Clearly, wildlife parks have to manage this hazard in order to run a successful business. Another analogy used is that of driving a car and “losing control over the car”.
Bow Tie Analysis – high level architecture
To the left of the risk event, the analysis considers the potential causes; in the car analogy this could be caused by excessive alcohol or a slippery road. In my view it is worth making a distinction between the cause and the catalyst. I’ve run a lot of business continuity surveys in the past and often causes and catalysts are listed together (my own fault!), so I think there is greater clarity to be won in making the distinction. One often quoted example of this is the end of the Roman Empire: was it the Visigoths who caused the end of the Roman Empire? Historians will often talk about Rome being divided as the cause of its demise and the Visigoths as catalyst. The same can be said of the end of the feudal system in Prussia, it was not the Napoleonic wars that caused the beginning of the end of that system, it was that the economic rationale behind the feudal system had outlived its usefulness. So “causes” are likely to be internal vulnerabilities rather than purely external factors.
The right-hand side of the bow-tie considers the consequences of the risk event occurring. In the high-level model, that I have put forward there are two levels to the consequences – the immediate operational consequences and, if uncontained, the wider business consequences or impact. These impacts could be categorised using an existing ERM taxonomy prevalent in the organisation in order to ready the output of the analysis for risk reporting and governance.
Clearly, after a brainstorm of catalysts, causes and impacts, the next phase is going to consider what measures are in place to reduce the likelihood of such causes creating the risk event, and should these controls fail, what contingencies (or mitigating controls) are in place to reduce the impact. A worst case scenario can therefore be assessed and the business case for introducing risk management is clear from the start. This process will generate a great conversation around what is in place (i.e. gap analysis), and what testing or exercises should be introduced to assess capability. Another potential benefit is an understanding of how risks can interact and cascade across the organisation. I also think that this model lends itself well to taking the outputs of horizon scanning and gaming changes in a highly visual way.
Finally, some useful links to find out more about bow-tie analysis:
http://www.youtube.com/watch?v=P7Z6L7fjsi0
http://www.r4risk.com.au/Bow-tie-Analysis.php
http://www.erm.com/en/News-Events/Platform/Ten-rules-for-smart-bowtie-analysis/
The Resilience Monitor 