Bowtie Risk Analysis

Bowtie analysis is a barrier-based method for understanding and communicating a single hazard. It is popular in aviation safety management because it puts an entire risk picture, from causes through controls to outcomes, onto one page that a non-specialist can read. ICAO's safety-management material presents it as a practical safety-risk-management technique, and both the UK Civil Aviation Authority and the Australian Civil Aviation Safety Authority publish ready-made bowtie templates for operators to adapt.

The anatomy of a bowtie is consistent. At the far left sits the hazard, a condition or activity with the potential to cause harm, described in neutral terms rather than as something inherently bad. At the center is the top event, the moment control of that hazard is lost, for example a runway excursion, a loss of separation, or an unstabilized approach continued to landing. Defining the top event precisely is the hardest and most important step, because everything else hangs off it. To the left of the top event are the threats, the credible things that could cause it, and between each threat and the top event are the preventive barriers (also called preventive controls), the measures intended to stop the threat from ever reaching the top event. To the right of the top event are the consequences, the harmful outcomes that could follow, and between the top event and each consequence are the recovery barriers (also called mitigating or recovery controls), which limit or contain the damage once the top event has occurred.

Two further elements make the picture honest. Escalation factors are conditions that weaken or defeat a barrier, for example fatigue undermining a monitoring control or poor weather degrading a visual barrier, and each escalation factor can itself carry an escalation-factor barrier. This forces the analyst to acknowledge that controls are not perfect and to think about what protects the controls themselves. The result reads as two fans of barriers spreading out from a central knot, which is the shape that gives the tool its name.

The appeal of the bowtie for a safety management system is that it is both analytical and communicable. Unlike a purely numerical risk assessment, it shows why a risk is or is not tolerable by making every barrier visible, and it exposes single points of failure where only one barrier stands between a threat and the top event, or between the top event and a severe consequence. It also assigns ownership, since each barrier can be attributed to a person, procedure, or piece of equipment, and it links naturally to safety assurance because each barrier becomes something to monitor for effectiveness. Bowties are typically built around an organization's most significant hazards rather than every minor one, and the CASA and UK CAA template libraries are organized around high-risk occurrence categories precisely so that operators can start from a proven structure instead of a blank page.

A bowtie is a qualitative, structured way of thinking, not a probability calculation. It complements rather than replaces other techniques such as the underlying hazard identification and safety risk assessment that feed it, and it pairs well with causation models like the Swiss cheese model, whose slices map directly onto the barriers a bowtie makes explicit.

For a flight school, ATO, or combined ATO/AOC operator building a safety management system, the bowtie solves a very practical problem: how to make risk analysis something the whole organization, not just the safety manager, can actually understand and act on. A page of tables and risk-matrix scores rarely changes behavior on the flight line, but a bowtie showing that only a single briefing stands between a fuel-planning threat and a diversion, or between an unstabilized approach and a runway excursion, makes the gap obvious to instructors and managers alike.

Because the UK CAA and CASA publish templates around common high-risk categories, a smaller operator does not have to invent the method from scratch; it can take a proven bowtie for a hazard such as runway excursion or loss of control and tailor the barriers to its own aircraft, procedures, and site. Doing this for the handful of hazards that matter most gives the school a defensible, auditable articulation of its top risks and, just as importantly, a shortlist of exactly which barriers its safety assurance activity needs to keep watching.

Aviatize's Safety Management module gives a school the place to house its hazard register and risk assessments, so the threats, top events, and consequences that a bowtie visualizes are backed by recorded hazard identification and analysis rather than living only in a diagram. Each barrier identified in a bowtie can be tied to the procedures, training, and checks that implement it, and to the occurrences that test whether it held.

Compliance & Auditing keeps the audit trail that lets a school demonstrate to its authority that its top hazards are analyzed and its barriers are real and monitored, while KPI Reporting & Dashboards can track barrier-related safety performance indicators over time, turning the static bowtie into a live view of whether the controls it depicts are actually working.