Skip to main content
Mental Models

The Bowtie Diagram: Thinking through What Can Happen and What to Do about It

The Bowtie diagram is a visual tool for analyzing risks by considering threats, preventative measures, detective measures, and recovery measures. It helps think through what can go wrong and how to prevent or mitigate incidents, emphasizing the importance of a balanced system of protections.

THE IDEA

The Bowtie Diagram: Thinking through What Can Happen and What to Do about It

The Bowtie diagram was developed over 40 years ago in the chemical industry.[4] It sets out how you can picture an event that has gone wrong or might go wrong. It is a very useful way of helping you think through some of the most essential ideas in RCA. An example of a Bowtie is provided in [Diagram 1.1]:

A schematic diagram of bowtie.

[Diagram 1.1] Bowtie diagram (illustrative)

You read the diagram from left to right on the top row and then again on the bottom row, thinking about measures to ensure that incidents do not occur in the first place (e.g. through preventative and detective measures). Or, if they occur, they do not have significant adverse consequences (e.g. because of recovery measures that can be deployed after an incident).[5]

Let's consider travelling by air as a simple example. We can think about the ingredients that make up a Bowtie in this context:

  • A key objective is to travel safely without damage to the plane or injury to any passengers or crew.
  • The threats include the risk that an aircraft might hit something.
  • Preventative measures to avoid encountering threats in the first place include flight plans for each aircraft, air traffic control with radar, a competent crew who can steer the aircraft away from danger, a plane that is capable of manoeuvring safely, etc.
  • Detective measures to spot threats coming up include radar on aircraft, anti‐collision devices, the crew who will look out for other aircraft, etc.
  • Recovery measures include emergency procedures in case of an incident, trained crew capable of dealing with difficult events, air masks for passengers, etc.

Exactly what measures will be needed will depend on clearly understanding the threats the aircraft might face. But the overall message is that there should be, and are, multiple ways to keep an aircraft and its passengers safe, and this is one of the reasons flying is so safe because we are not relying on just one or two measures to protect us. Indeed, we have an entire system that is designed and operated, as much as possible, to support air travel and keep passengers safe.

When you think about air safety, prevention and detection are far preferable to recovery because there may be only so many things you can do after an incident occurs. Thus, the Bowtie reminds us to consider, in each context, the appropriate balance between prevention, detection and recovery measures.[6]

As well as using the Bowtie to think through aircraft and chemical plant safety, etc., it can be used for medical procedures and in a range of other domains.[7] Of course, in daily life we don't usually explicitly refer to preventative, detective or recovery measures, but much of what goes on in practice seeks to achieve those ends.

When to use it

  • Risk analysis in chemical plants and industrial processes

  • Safety management in aviation (airline operations, air traffic control)

  • Medical procedure safety (surgery, anesthesia, hospital protocols)

  • Cybersecurity incident response planning (preventing data breaches, detecting intrusions, and recovering from attacks)

FROM THEORY TO EVERYDAY LIFE

In practice

01

Air Travel Safety

Travelling by air: objective is safe travel without damage or injury. Threats include aircraft hitting something. Preventative measures: flight plans, air traffic control, competent crew, maneuverable plane. Detective measures: radar, anti-collision devices, crew lookout. Recovery measures: emergency procedures, trained crew, air masks.

02

Medical Procedure Safety

In a hospital setting, a surgical procedure has the objective of successful treatment without complications. Threats include infection, anesthesia errors, or instrument malfunction. Preventative measures: sterilization protocols, patient screening, qualified staff. Detective measures: vital sign monitoring, checklists, imaging. Recovery measures: emergency response teams, backup equipment, postoperative care.

✳

A MOMENT TO REFLECT

Put it to work.

  1. Consider a recent incident in your work or life. What were the preventative, detective, and recovery measures that were in place or could have been?

  2. How does the balance between prevention, detection, and recovery affect the overall safety of a system? Can you identify a situation where too much focus on recovery led to neglect of prevention?

  3. Map out a Bowtie diagram for a common risk you face daily (e.g., driving, cooking, or using technology). What threats and measures come to mind?

Connected ideas

Another lens can bring the same problem into focus.

CONTINUE THE CONVERSATION

Source texts

  • Beyond the Five Whys Root Cause Analysis and Systems Thinking (James C. Paterson)
← More mental models