What is a bowtie diagram?
A bowtie diagram is a visual risk assessment that maps a risk event from its causes to its consequences, with preventive and mitigating controls shown on the pathways in between.
The name comes from its shape. Picture a bowtie:
In one diagram, the causes, risk event, consequences and barriers are shown together so the structure of the risk can be reviewed in context.
The centre is the risk event. The left side shows the threats or causes that could lead to it, together with preventive barriers. The right side shows the consequences that could follow, together with mitigating barriers.
A simple real-world example
Consider a ransomware attack as the risk event.
The example shows how different threats can lead to a ransomware event, and how preventive and mitigating controls act on different parts of the risk pathway.
What a bowtie diagram shows
Causes and consequences in one view
The left side shows the threats or causes that can lead to the risk event. The right side shows the consequences that may follow if the event occurs.
Preventive and mitigating barriers
Preventive barriers act before the risk event. Mitigating barriers act after the event to reduce the likelihood or severity of the consequences that follow.
Weakly protected pathways
Because barriers are placed on the pathways they protect, gaps and dependencies are easier to identify and discuss.
A consistent structure across risk domains
The same bowtie structure can be applied to safety, cybersecurity, operational, environmental, security and other organisational risks.
How bowtie connects to barrier management
Bowtie analysis places barriers on the specific risk pathways they protect, which is why it is commonly used within broader barrier-management approaches.
For deeper barrier-management concepts — critical controls, escalation factors, independence, effectiveness and assurance — see our dedicated Barrier & Hazard Risk Management page.
Watch: Bowtie risk assessment explained
A visual introduction to bowtie risk assessment — the risk event, its causes, the preventive and mitigating controls, and how the pathways fit together.
Common questions
Is a bowtie diagram the same as a risk matrix?
No — they're complementary tools. A risk matrix rates risks by likelihood and severity. A bowtie diagram explains the structure of a single risk in detail. Many organisations use both: the matrix to prioritise which risks to focus on, and bowtie diagrams to analyse the high-priority ones in depth.
Do I need to be a risk professional to use bowtie diagrams?
No. The structure is straightforward: define the risk event, identify causes and consequences, then place preventive and mitigating controls on the relevant pathways.
How many bowtie diagrams do I need?
There is no fixed number. Bowtie diagrams are most useful where a risk warrants a more detailed view of its causes, consequences and barriers.
Are bowtie diagrams compliant with risk standards?
Bowtie analysis is widely used as a practical risk-analysis technique. It can support risk-management processes that are consistent with ISO 31000 and other organisational risk frameworks.
Can I build a bowtie diagram for free?
Yes. A basic bowtie diagram can be drawn by hand, in a presentation tool, or using dedicated bowtie software. BowTie Risk can be downloaded free to create and explore bowtie diagrams before upgrading to Premium features.
Summary
A bowtie diagram is a structured visual assessment of a single risk event. It shows the causes that can lead to the event, the consequences that can follow, and the preventive and mitigating controls that act on those pathways.
The method can be applied across different risk domains and can be used alongside risk matrices, risk registers and broader barrier-management processes.
To explore the software, see BowTie Risk for Mac, iPad and iPhone. For deeper control and barrier concepts, see our Barrier & Hazard Risk Management guide.
Used by risk professionals across 40 countries.