Risk Assessment: A Practical Guide to Assessing Operational Risk Chapter 9: Bow-Tie Risk Assessment Methodology 11/8/2018

Bow-Tie Risk Assessment Methodology Objectives Introduction History and Overview Review Methodology Provide Guidance on the Use of Bow-tie Methodologies Examine the Use of Bow-tie Methodologies, their Strengthens and Limitations 11/8/2018

Bow-Tie Risk Assessment Methodology Introduction Bow-Tie Analysis is a relatively new and simple tool that is used to analyze and communicate risk pathways and controls in selected hazard scenarios. It is one of many ‘barrier-type’ risk models available to assist in the identification and management of risk. The “Bow-Tie” name is derived from the shape of the diagram created in the analysis. One of the benefits of a Bow-Tie diagram is that it gives an overview of multiple plausible scenarios and associated controls and consequences, in a single picture that would be difficult explain otherwise. 11/8/2018

Bow-Tie Risk Assessment Methodology Introduction The International Organization of Standards (ISO) 31010 nationally adopted by American National Standard Institute ANSI/ASSE 690.3-2011 Risk Management Techniques standard describes Bow-Tie Analysis as “a simple diagrammatic way of describing and analyzing the pathways of a risk from causes to consequences.” This Power Point presentation will demonstrate the use of the Bow-Tie method and its applications in SH&E hazards analysis and interventions. Simple cases studies and more innovative practical uses of the methodology as well as practical examples and benefits of this versatile tool will be presented. 11/8/2018

Bow-Tie Historical Prospective The origins of Bow-Tie Analysis are unclear, however, one of the earliest documented uses can be found in course notes from a lecture on HAZAN (Hazard Analysis) at the University of Queensland, Australia in 1979. Following the 1988 disaster on the Piper Alpha Platform, the oil and gas industry was under great pressure to exert more efforts in systemic hazard analysis and risk assessment of their operations. As a result, the Bow-Tie methodology began to appear. The Royal Dutch/Shell Group was one of the first global companies to effectively integrate Bow-Tie Analysis into its business practices. The Bow-Tie method has since spread outside of the oil and gas industry and is used by aviation, healthcare, military/defense, mining, chemical, maritime, and other industries. 11/8/2018

Bow-Tie Overview The Bow-Tie Analysis methodology is used to communicate risk by providing a clear road map for risks and their controls. As a barrier- based approach to risk, the Bow-Tie method follows James Reason’s ‘Swiss Cheese’ Model of Defenses. In his model, he illustrates how barriers have weaknesses and gaps that under specific circumstances can align and allow a hazard exposure to occur, such as the holes in Swiss cheese. Should escalating factors cause the barriers weaken, and align allowing a hole to form, the hazard can penetrate the defenses and cause harm. The Bow-Tie method is unique in that it combines the use of a simplified fault tree analysis (left-hand side of bow-tie) to analyze causation of a hazardous scenario or event (the center knot); and a simplified event tree analysis of the resulting consequences (right-hand side). 11/8/2018

Bow-Tie Diagram Example 11/8/2018

Purpose and Use A Bow-Tie Analysis provides a clear understandable view of the existing ‘barriers’ to prevent the causes of hazards, and ‘reactive’ measures to mitigate or reduce the severity of the consequences should the hazardous event occur. Such diagrams demonstrate the critical connection between hazards, preventive barriers, risks, mitigation controls and the business consequences. The preventive and mitigating measures can be linked to tasks, procedures, responsible individuals and systems. 11/8/2018

Purpose and Use Bow-Tie Analysis can be used to qualitatively, semi-quantitatively and quantitatively demonstrate controls, countermeasures, risk reduction measures and can be applied in many industries, services and business sectors. The methodology can be used as an important element of an operational risk management system, and included in the development of an effective business case for SH&E interventions. 11/8/2018

Strengths of a Bow-Tie analysis The method visually illustrates the hazards, their causes and consequences, and the controls to minimize the risk. It is simple to understand and gives a clear graphic representation of the problem. Bow-Tie diagrams present the big picture and can capture previous incidents as well as future state of hazards and consequences after SH&E interventions. The modified Bow-Tie diagrams can add another layer of complexity and provide better visualization of the Severity and Probability of the hazards and consequences. The modified Bow-Tie methodology can identify where resources should be focused for risk reduction 11/8/2018

Strengths of a Bow-Tie analysis Cont. The method could potentially reduce the time and extent of SH&E hazards analysis. The method can illustrate the Hierarchy of Controls that are currently in place (Current State) and the need for additional “Layers of Protection”. Bow-Tie diagram can visualize the links between the elements of the organization’s management system to specific controls and provide a platform for continuous improvement and future SH&E interventions. Bow-Tie methodology provides a logical and structured approach to consider all aspects of the risk management and potential areas for risk reduction. The method can also be used to identify gaps and issues that are missed by other risk assessment techniques. Bow-Tie diagram can also be used for desirable consequences. 11/8/2018

Bow-Tie Analysis Limitations Execution of Bow-Tie methods can be time consuming. The analysis is generally limited to qualitative measures. A Bow-Tie diagram usually cannot depict where multiple hazards or exposures occur simultaneously, therefore it is not effective in addressing potential synergetic effects of such hazards and exposures. The methodology can sometimes over-simplify complex situations, particularly where quantification is attempted. If the purpose is to model complex relationships between prevention controls, additional risk assessment methodologies are required. 11/8/2018

Bow-Tie Methodology Example A conventional Bow-Tie diagram for the Bhopal disaster is presented above 11/8/2018

Important questions to consider when developing a Bow-Tie diagram what are the hazards and their causes what occurs when control is lost what are the potential consequences how can the hazard event be avoided how can the organization recover should the event occurs how can the likelihood and/or severity be limited how might controls fail or effectiveness be reduced how are control failures prevented 11/8/2018

Steps for conducting a conventional Bow-Tie Analysis Select Hazard Scenario Identify Hazards Identify Causes Link Causes to Hazard Scenario Identify Escalating Factors Identify Preventive Controls Identify Consequences Identify Mitigating Controls Identify Control Influences 11/8/2018

Practical Application A Bow-Tie Analysis primarily focusses on the control factors: preventive controls or barriers used to prevent the event from occurring; and the mitigating controls to reduce the impact should the event occur. Multiple risk assessments tools may be used to identify, analyze, evaluate, control and communicate the risks. Bow-Tie Diagrams are a useful component in such a process providing a clear visual of the pathways between hazards, controls and consequences. In simple systems, a Bow-Tie Analysis may be adequate on its own. 11/8/2018

Case Study #1 – Spray Paint Operation Sequence of hazard analysis and risk assessment tools used in the spray paint booth case study 11/8/2018

Case Study #1 – Spray Paint Operation Preliminary Hazard Analysis for Paint Booth Example 11/8/2018

Case Study #1 – Spray Paint Operation Risk Assessment Matrix Example adapted from ANSI Z590.3-2011 11/8/2018

Case Study #1 – Spray Paint Operation Preliminary Hazard Analysis with RF column 11/8/2018

Case Study #1 – Spray Paint Operation Business Risk Assessment Matrix Example 11/8/2018

Case Study #1 – Spray Paint Operation Bow-Tie diagram incorporating semi-quantitative risk factors for severity and probability example 11/8/2018

Case Study #1 – Spray Paint Operation Proposed Interventions Hierarchy of Controls adapted from ANSI/ASSE Z590.3-2011 The proposed solutions includes minor modifications of the process. 11/8/2018

Case Study #1 – Spray Paint Operation Risk Assessment Matrix with Proposed Interventions 11/8/2018

Case Study #1 – Spray Paint Operation Preliminary Hazard Analysis with updated RF scores. After EHS interventions. 11/8/2018

Case Study #1 – Spray Paint Operation Business Risk Assessment Matrix after the EHS interventions. 11/8/2018

Case Study #1 – Spray Paint Operation Modified Bow-Tie diagram with proposed SH&E interventions. 11/8/2018

Case Study #2 – Bhopal Disaster The Bow-Tie method can be combined with other techniques to address more sophisticated risks. In this case study FMEA and Bow-Tie are combined. FMEA rating scale with numerical grading is used for Severity (S), Probability Occurrence (O), and Prevention Effectiveness (PE) as described in Chapter 8. Regarding Prevention Effectiveness (PE) scales - higher effectiveness translates to lower risk, and therefore a lower PE number. Likewise, less effectiveness of controls will result in higher risk, and a higher PE number. Insufficient preventive measures will result in the higher PE scores, leading to higher Risk Priority Numbers (RPNs) 11/8/2018

Risk Factor Rating Scales Example Case Study #2 - Example of Severity, Probability, and Prevention Effectiveness rating scales Risk Factor Rating Scales Example 11/8/2018

Case Study #2 – Bhopal Disaster Only three hazards were selected for evaluations Sevin (pesticide chemical) Hazard - The severity (S) resulting from worker exposure to Sevin is rated at 4 (Critical), as the exposure may result in disabling injury or serious illness. Probability of occurrence (O) is rated at 4, since exposure will “probably occur several times”. Prevention effectiveness (PE) is rated at 3 (Moderate), since some administrative controls were available as well as Personal Protective Equipment (PPE). Methyl Isocyanate Hazard - Similarly, Methyl isocyanate (MIC) storage severity is rated at 5 (Catastrophic) due to explosion hazards, possibility of total system loss, or a chemical release with lasting environmental and public health impact. However, probability of occurrence is rated at 2 (Seldom). Prevention Effectiveness is rated at 3 (Moderate), since warning signs were in place. MIC Reaction/Release Hazard - MIC reaction resulting in a release of Sevin to the community is considered in this case. Severity is rated at 4 (Critical) due to the distance to the populated area. Probability of occurrence is rated at 1 (Unlikely). However, Prevention Effectiveness is rated at 5 (None), since no preventive measures for community exposures were considered. 11/8/2018

Case Study #2 – Bhopal Disaster Bhopal Disaster FMEA & RPN Example 11/8/2018

Case Study #2 – Bhopal Disaster Modified Bow-Tie with RPN and LOPA Example 11/8/2018

Summary The Bow-Tie Analysis method enables visualization of the relationship between hazards and their causes, existing preventive measures, the event scenario, and the mitigation measures to limit their consequences. It provides a “30,000 ft.” overview of the evaluated system, and its controls. The structure of the Bow-Tie approach forces an assessment of how effectively preventive barriers and controls are on preventing the hazard from occurring, and how well-prepared the organization is to recover should undesirable event occur. The method is relatively simple, and frequently identifies gaps and issues that are missed by other techniques. 11/8/2018

Summary Bow-Tie methodologies are extremely versatile and are used for various applications in most all industries. It is highly recommended that a multidisciplinary team is formed to successfully apply the risk assessment process early in the design phase. Such multidisciplinary team will identify the potential hazards and potentially evaluate the proposed barriers based on the Hierarchy of Controls. As demonstrated in the Bhopal example, more than one barrier per hazard may be proposed. Multiple mitigation measures may be proposed to limit undesirable events consequences. 11/8/2018