More details how to build a BowTie diagram to assess risk in your business -
Visualising HACCP with BowTie barrier risk
management - video part 2. Find out more about our Bowtie services here.
Andrew Collins: “Welcome to our second part on visualising HACCP
Bowtie barrier risk management. I am here with Alistair Cowin from CGE Risk and I am Andrew Collins
from Campden BRI. In this session, we will be discussing the building of the Bowtie diagram. But
before we do that, we need to establish the context of mapping out what we are trying to do.”
Alistair Cowin: “Since you are building a model, this is critical.
Depending on what you are modelling,
you might need one or two models or depending on the audience, you might need to add filters. It’s first
about setting the scope and context which is particularly relevant in the food industry, as it could be
used by SMEs or huge corporations that manufacture thousands of products a day. It is all about setting
the scene for who we are and what we are modelling.
Andrew Collins: “In terms of the objectives, obviously it is about
producing safe food. The external and internal parameters could be due to regulatory requirements,
commercial standards, BRCGS, or the FSSC 22000. The scope, such as knowing the point when I lose control
of the process, or the way to manage the hazards and evaluate the risk while I have control and so on.
But also, the criteria such as what I am assessing it against, what information is available to help me
So how does the structure of the Bowtie diagram allow us to establish all
Alistair Cowin: “Bowtie is a very simple modelling technique composed of
eight building blocks with its key element, already well understood in the food industry, the hazard.
The Bowtie diagram also introduces an extra concept, called the top event, which provides more of a
description and helps understand how big the problem is.
The top event is an extremely important element because it is the point
at which we lose control. It helps understand what is tolerable, what is acceptable, and leads us into
the consequences, meaning if the hazard occurs, what will happen? Again, we talk about this in terms of
being descriptive and adding details about who will be hurt and how will they be hurt. But not only harm
in terms of people, business risks as well. It is very generic in terms of what you can add.
Now that I have got an understanding of what can happen and the sense of
that loss of control, I want to think about the threats or the causal events that will lead to that loss
of control. We add those in to form the basis of the of the Bowtie model.
Then the next important thing to us is how not to lose control. For
that, we add barriers, which prevent the threat transmitting or traveling through. However, in case I
suffer that loss of control, let’s say a breach or an unwanted foreign body for example, how do I
recover that situation so we don't get to the negative consequences on the right-hand side?
As alluded in the first video, James Reason’s model depict how barriers
don't always work as intended. Therefore, we need to be able to highlight that, and show people that we
understand the elements that threaten the barriers so we add escalation or degradation factors that show
how the barriers can be weakened. Finally, we have extra barriers that protect us against those
escalation factors. For example, if I have a smoke detector and sprinkler system installed in my
building and, we decide to add new electrical equipment. I will have to take the power off and by doing
that, I will be losing those barriers, the smoke detector and sprinkler system. So, what I could do
during the installation period, is have a battery-powered smoke detector in place, so that the threat of
planned maintenance which could have expose me to a problem is solved with a battery-powered piece of
equipment, the extra barrier, as a temporary fix.
All these describe the eight Bowtie blocks, a visual and informative
Andrew Collins: “The key things about it are the hazard and the top
event. It is not just about compiling a comprehensive list of hazards that may be in the product or in
the process. It is about being specific, about understanding the sources or the threats and for the food
industry to understand the potential consequences. So, it is crucial that we understand and clearly
define the hazards.
Codex gives us this sort of very clear instruction about the likelihood
of occurrence, and the likelihood of the severity of the adverse health effect for the consumer who, as
a result, is potentially going to be ill. It is also recognising what are the acceptable levels of that
hazard in the food, and those could be regulatory, and the level of contamination at which it might
cause harm. We also have to factor in the human element which brings some uncertainty. For example, the
inability of human to detect hazard by sampling. Looking at this approach, it is understanding the
components, the elements, and the steps, that will allow to be much more confident in the outcome and,
not have to rely on historically activities such as end-product testing.
You mentioned about the top event, and this is the additional thing you
highlighted, so how would you think about the top event?
Alistair Cowin: “We always talk about the top event as a loss of control.
However, it is not an accident, it is not a bad event, it is just the point where your day turns tricky.
I love the example of the fish jumping out of its bowl. Normally, the fish would be in the bowl,
swimming around happily however, when it jumps out of the water, you might probably be thinking, I have
made some poor decisions, but nothing bad has yet happened. I could catch the fish, I could put it back
in, if I find the fish on the floor, it will still have some minutes. These situations are still at a
state where you can recover from, it is not like, my cat has just found the fish.
So, the idea of the hazard and the top event, is to push that extra level
of detail. Since we know that the hazard cannot be removed from the business, what I am really
interested in is, at what point does this become a problem for me. However, I want to understand it soon
enough so that I can intervene and fix it. And this is the real trick with the Bowtie model, getting the
hazard description and the top event description aligned, then everything else fit in much more easily
once you have got that level of detail and understanding.
Andrew Collins: “And putting that into the food context, where we have
identified the hazard as an allergen, and it's not necessarily allergens themselves, but about the top
event, the point at which we lose control. It could be for example, the introduction of an undeclared
allergen, so something that should not be there or is potentially not going to be on the label, but also
we can think about the top event being the unintentional consumption of this food by an at-risk
individual. Both are top events with valid statements, and this is one of the other things I see as a
benefit with this model, it requires us to be very focused and very specific about at what point in the
chain or what point in time do we lose that control.
Alistair Cowin: “I think this is a really key point Andrew, and we are
going to discuss that in the following slides.
Andrew Collins: “Alistair, you talked about looking at the threats and
the consequences so, looking at our allergen model, on the right-hand side, consequences could be,
people, asset, operations, environment but also, reputation, and at this stage, all very top-level
consequences. On the left-hand side, threats could be people, equipment, material, process, environment,
or methods, again very top level.
Once we have identified our threats and the consequences at top level,
the next step is to add details to create something a lot more specific. For example, we have now
identified a number of threats related to people, such as people bringing food, people not washing their
hands correctly. On the right-hand side, detailed consequences could be regulatory and, or legal action,
reputational damage, market share with share values going down.”
Alistair Cowin: “I think it is really key, we now start to understand
that there is a real risk to the business, and that lots of factors contribute to the overall risk. This
is no longer just about the product, businesses need to think about HSE problems to do with their staff,
product issues related to consumers, business risks and more, all of which are in the mix. Consequently,
Bowtie diagram is a very powerful tool that allows businesses to focus either in one particular area or
expand it to include all of them.
Andrew Collins: “And then, by putting barriers against all those threats
and consequences, we add value to the model by adding key information.
So, if I zoom on the threats on the left-hand side, on the unintentional
addition or adulteration of an undeclared allergen, the tool allows you to see all of the barriers that
the business has in place to stop that threat from happening. It is also easy to see that thanks to its
common language, the Bowtie diagram can be used in other areas of the business, making it a sort of
First steps would be the elimination of risks, however, we may not be
able to do so. Instead, we might need substitution, but this will depend upon the nature of the product.
Consequently, a lot of our controls are action controls that are going to be process steps or procedures
or, at the lower level, labelling. It means that if we don't make it safe or if we are not the people
who are making it safe, labels are added on products to provide instructions, e.g. at what temperature
and for how long you should be cooking a chicken. This label becomes the risk communication tool for a
manufacturer to the consumer.
Alistair Cowin: “And with this hierarchy, we can start building the
framework. In the first part video, we talked about the three questions, understanding the threats or
the risks that I have within the business, understanding what I am doing to protect myself and having
assurance that all these elements are working effectively. Well, the first two questions are answered by
building the top model view of the Bowtie, providing us with an understanding of our risks, but also the
tool to transmit that information to the people.
Andrew Collins: “The third question, the assurance piece, will be
discussed in our third and final video. In the meantime, if you want more information, then please don't
hesitate to get in contact with myself or Alistair. We look forward to seeing you in the next session.