It’s no secret among those who know me well that I’m a visual person. Like many others of the same disposition, I learn concepts the best through any sort of picture, diagram, or some other type of visual aid.
Therefore, I was naturally intrigued by a 2022 Risk Awareness Week session by Graeme Keith entitled “My Love-Hate Relationship with Bow-Tie Analysis.” Graeme is Practice Lead for Risk Quantification at Archer Integrated Risk Management. The goal of Archer’s risk management software is to help organizations integrate quantitative risk assessment into their ERM programs.
Similar to using strategic scenarios to anticipate long-term risks and opportunities or Monte Carlo simulation to project the likelihood of a certain outcome, bow-tie analysis is another one of those tools that risk professionals can utilize if it fits their company’s culture and needs.
As the name implies, the “bow-tie” in the context we’re discussing resembles one of those neckties you see on someone wearing a suit or tuxedo.
In this session, Graeme begins by explaining that a bow-tie is an attempt to bring structure into risk analysis. Further into his presentation, he strikes on the core motivation or purpose behind the bow tie when he states:
Enterprises need a simple, flexible paradigm that straightens out what a risk, uncertainty, or potential category of events is that will have an effect on objectives, what those objectives are, and how would you go about avoiding or managing these events and ameliorating those consequences.
(Side note: for me, “ameliorating” is a word I don’t use very often, so think of it as improving the consequences or lessening the impact of a specific risk or category of events.)
Below is one example Graeme uses in his presentation of a bow tie for analyzing the risk of a building fire:
From left to right, the columns represent causes, controls, the event, mitigations, and consequences.
Graeme explains how the bow-tie articulates risks and controls and provides the right amount of structure for ensuring executives, managers, and other personnel are reporting risks appropriately across the organization.
Bow-ties can tell the company in one easy visual representation of a risk what is currently being done about it and what could be done about it in the future. From here, mathematical formulations can be built into this representation to quantify information and aggregate how often an event could take place as a function of the controls in place and impact(s) should the event occur.
Bow-ties impose a minimum level of risk analysis…
Zeroing in on the “cause” column of our example bow tie above, Graeme explains how causality is a central component of managing risk. Potential causes for what might happen need to be clearly understood.
In this regard, bow-ties are somewhat incomplete, especially when compared to more advanced tools like causal analysis or influence diagrams.
We naturally think that the cause of an event as being necessary for the event to take place, but this is just too broad. In our fire example, oxygen is one necessary condition, but oxygen is present everywhere all the time.
This brings us to the biggest drawback of bow ties according to Graeme…they are not causal by default. The event in our example above completely disconnects cause from effect. It’s assumed in a bow-tie that each consequence carries a similar significance.
This just isn’t true in the real world.
Therefore, bow-ties are really only useful for articulating a risk and not illustrating complex relationships to objectives.
However, as you can tell from the examples above, the bow-tie is a much simpler alternative to a causal analysis or influence diagram, which is why Graeme favors using them where possible.
This write-up here is just a brief overview. I strongly recommend watching the entire 26-minute presentation for an in-depth review of the pros and cons of the bow tie, along with a deeper explanation of causality.
You can watch Graeme’s session for free at RAW 2022 (registration is required).
Do you use bow-ties to articulate risks and controls to the broader organization? Has your company found them to be a helpful decision-making tool?
Thank you to Graeme and RAW 2022 for the insightful presentation. To share your thoughts, please leave a comment below or join the conversation on LinkedIn.
And if your company is searching for the best way to articulate and analyze risks, please don’t hesitate to reach out to me today to begin discussing your current status, goals, and what can be done to help get you there.
