5 Reasons to take on bowtie analysis using bowtie software
In Australia, businesses have a pretty good handle on risk. We understand that it’s there, and we take steps to grapple with it. But why do we so often use simple, clunky tools to document it?
The simple answer is that we love simplicity. The old KISS aphorism: keep it safe and simple. But when it comes to safety risk, keeping it simple is not always safe. It might feel safe and familiar to use spreadsheets for risk registers, but do we gain real risk intelligence from them? Should we really be confident that critical risk scenarios are being controlled if we only use software that makes lists?
Methods of risk analysis such as bowtie analysis are often shied away from because they are challenging to work with. This is where bowtie software comes to your rescue. Bowtie analysis is one of the most rigorous approaches to risk analysis, particularly compared to simple spreadsheets. If you use a bowtie software package which also calculates likelihood, consequence and risk, you have a semi-automated risk analysis at your disposal. More importantly, bowtie analysis gives you visibility and understanding of your risk scenarios in a way that a spreadsheet can’t.
Here’s 5 reasons to consider bowtie analysis using bowtie software.
Risk scenarios only happen one way… except when they don’t
We can sometimes tend to visualise risk events as a simple story: like a book, the story unfolds in a particular way. This is what’s sometimes referred to as a linear narrative. Spreadsheets are good for capturing this kind of story: you have an unwanted event, which unfolds in a particular way and has particular consequences. Simple right?
Except that we all know that risk scenarios can unfold in different ways. There isn’t always a tidy linear narrative. There can be multiple causes of a particular risk event, multiple consequences, and multiple pathways that the story takes.
Office spreadsheets encourage you to simplify a risk scenario into a linear narrative that fits on one or two rows. If you want to really understand your critical risks, you need to face the reality of multiple pathways for risk events. Failing to do so potentially undermines your risk decision-making. A long list of risk controls does not help if you have not considered which pathways those controls actually influence.
This is where bowtie analysis work well. Good bowtie software helps you map out different pathways for a risk event or hazard. The software should reduce the time, effort and skill required to analyse different pathways. Bowties separate each risk event into a set of causes, the top event, and a set of consequences. When you take your risk assessment from a spreadsheet to a bowtie diagram, you may well find that your risk controls only reduce risk along one or two potential pathways for the risk event. This provides you with an opportunity to identify and explore different scenarios before they occur.
Let’s use a more tangible example of a bowtie diagram.
One risk scenario, one cause… or is it?
Very few risk events arise from a single cause. In the above example, we’ve identified just three. The risk event is a worker on foot being struck by moving plant or equipment. In a typical spreadsheet layout, we’d probably have a single line entry for the risk event.
If we take a bowtie analysis approach, there’s a few causes that could lead to the risk event occurring. The driver of the vehicle could have obstructed visibility, preventing him or her from seeing a pedestrian in the path of the vehicle. The pedestrian worker could be distracted by something else and not notice that they are moving into the path of an oncoming vehicle. The worker could have his or her back turned, and not hear a reversing vehicle approaching due to the amount of ambient noise at the work site.
When you unpack causes like this, you realise that risk controls affect particular causal pathways. A common control to prevent vehicle accidents is movement alarms, but does an alarm do anything to assist with obstructed visibility?
Bowtie software like RiskView allows you to populate bowties quickly and accurately. Adding a cause takes a few seconds, and the software automatically calculates the causal contribution to the likelihood of the risk event occurring.
One risk scenario, one consequence… really?
Risk events also rarely create a single consequence. The most common solution to this problem in spreadsheets is to pick the most serious consequence, or the “most credible worst-case scenario”. But exploring different consequences is a useful exercise.
In the above example, we’ve identified at least three potential consequences of a worker being struck by plant or equipment. Obviously the injury or fatality is the most concerning, but the temporary site shutdown (lost productivity) and bad press are also important. If this risk event occurred in the context of a government contract, for example, an at-fault fatality incident could result in the forfeiture of the contract, which is a substantial financial consequence.
Good bowtie software provides a guided process for creating bowties. In this example, there are pre-set categories for consequence with suggested levels of severity. This prompts the user to consider additional consequences that are worth exploration. Bowtie analysis allows you to confidently make decisions about where to implement risk controls, and where risk controls are not required. Your bowtie analysis backs you up if your decision comes into question (often after a particular consequence is suffered).
All risk controls are made equal… except when they aren’t
Spreadsheets tend to conflate risk controls together. Seeing a list of items inherently tends to lead to the assumption that the items are comparable. But when it comes to risk controls, those controls are not necessarily alike in how they reduce risk and how effective they are.
Bowtie analysis separates risk controls according to pathways. This helps to clarify how the risk control actually interacts with the event and the potential limitations on effectiveness. Risk controls that reduce the likelihood of a cause leading to a risk event are shown on the cause pathways. These are preventative controls (i.e. they reduce risk by preventing the risk event from occurring).
Risk controls that reduce the adverse impact of consequences are shown on the consequence pathways. These are mitigative controls (i.e. they reduce risk by mitigating the impact of the risk event when it occurs).
Adding risk controls to the bowtie diagram will bring down the overall likelihood and consequence of the risk event, in much the same way as a spreadsheet would display. The real power of bowtie diagrams comes from being able to visualise and model the risk event pathways. Bowtie software like RiskView makes it easy to model and understand these pathways.
Spreadsheets are easy to read… but what about understanding the risk?
This is where good bowtie software really trumps spreadsheets. In the example above, it is very easy to visualise and understand the risk scenario once you understand the layout. This particular bowtie diagram shows that the level of background noise at the work site is likely to cause an incident in which a worker is struck by moving plant. It also shows that vehicle movement alarms do not bring the likelihood down by much (shown by the thickness of the line leading from the cause to the risk event).
The findings will naturally depend on the information we input into the bowtie analysis. In this case, it looks like more work is needed to address the risk of workers not hearing approaching vehicles.
Good bowtie software is responsive and visually accessible. It should enable you to easily create bowtie diagrams and easily visualise where your risk exposure lies. The example bowtie above took less than 10 minutes to populate using bowtie software. It also highlighted the danger of ambient noise, which was not the causal path that we expected to turn out to be the most significant in terms of residual risk exposure.
Simple spreadsheets very rarely produce this kind of insight and intelligence. This is concerning, given our reliance on spreadsheets for risk decision-making. Simple spreadsheets are good for documenting risks (i.e. as a risk register), but should not be mistaken for an effective risk analysis tool. A one-line entry in a risk register showing likelihood, consequence and risk rating doesn’t give you much insight.
When you’re dealing with critical risks that have the potential for loss of life, decision-making should be backed up by more than a one-line entry in a spreadsheet.
If your business is dealing with multiple critical risks, how do you ensure that your risk analysis is robust? Do you use bowtie software or other software packages to analyse risk?