Purpose of Bowtie Analysis in Aviation SMS Programs
Bowtie analysis is one of the most thorough aviation risk management tool. It analyzes safety events from all essential risk management viewpoints, including root causes, hazards, risks, controls, and consequences. If you are not using bowtie analysis, here are some of it's common uses:
- Risk scenario analysis;
- Demonstrating potential costs of a scenario to executive management;
- Demonstrate the importance of compliance;
- Teach what risk management is;
- Safety incident management;
- Risk control and root cause analysis; and
- Safety event summary.
Creating quality bowties takes practice. Here are the 6 steps to perform bowtie analysis in aviation SMS. Bowtie’s visual framework, inspired by the James Reason (Swiss Cheese) Model, helps safety managers map complex risk scenarios, making it ideal for high-stakes incidents like runway incursions or equipment failures. However, its time-intensive nature (10–20 hours per analysis) can be a barrier. SMS Pro’s PHAT streamlines similar analyses with automated data points, such as risk assessment history and assigned managers, saving 20–30 hours/month, as seen in regional airlines.
Step-by-Step Guide to Performing Bowtie Analysis
Performing a Bowtie analysis requires careful planning and execution to ensure accuracy and actionable insights. Below is a detailed 6-step walkthrough, expanded to provide practical guidance and integration with SMS Pro tools.
Step 1: Establish Top Event
Step one is the most critical step. You need to choose the Top Event. The Top Event is:
- The risk event (similar to hazard, depending on how you define hazard);
- The point at which safety control is/was lost; and
- The point that root causes lead to, and that eventually results in damages.
It's extremely important to find a good point at which safety control is lost, as the rest of the bowtie will depend on it. For example, in a runway incursion scenario, the Top Event might be “aircraft breaches runway threshold without clearance.” This event marks the critical moment where safety is compromised, serving as the pivot for upstream causes and downstream consequences. Use SMS Pro’s Issue Reporting to identify Top Events from reported hazards, ensuring data-driven selection. Misidentifying the Top Event can skew the entire analysis, so validate it with stakeholders via Meeting Manager.
Step 2: Establish Preceding Events and Root Cause Threats
Now what needs to be done is to work backwards, listing each event step by step that lead to the Top Event. As each event is listed, ask “But why did this happen?” Eventually we are looking for the root cause threats. This is a similar process to the 5-Whys root cause analysis. A good indication that you have arrived at root causes is when your answer to the question is, “Just because.”
The purpose of this activity is to document the link between root causes and the Top Event. This will help clarify:
- Which risk controls failed;
- How Human Factors and behavior played a role in the elevation of danger; and
- What the root causes.
Notice that distraction and Human Error are perfectly valid root causes, as sometimes we simply are distracted or make mistakes for no “good reason.” For some reason, some organizations seem to feel that Human Error is not a valid root cause. This is an erroneous belief and will hinder root cause analysis. For example, in a runway incursion, preceding events might include “pilot misread clearance” and “ATC provided ambiguous instructions,” leading to root causes like “fatigue” or “inadequate training.” SMS Pro’s PHAT enhances this step by automating root cause analysis with historical data and Issue Manager integration, reducing errors by 25%, as seen in FBOs.
Step 3: Establish Consequences After the Top Event
Next we need to look at what the direct consequences of breaching the runway are. These consequences are the intermediary events before our Top Event and final Impacts, or damages. In our scenario, the direct consequences were:
- Rolled onto the runway;
- Reported in press; and
- Terrified passengers.
It’s important to distinguish between consequences and Impacts. Consequences do not cause Impact damages themselves, but lead directly to damages. For instance, “terrified passengers” is a consequence that may lead to “reputation damage” (an Impact). This step requires careful mapping to avoid conflating immediate effects with ultimate damages. Use SMS Pro’s Risk Analysis Charts to visualize consequence chains, ensuring clarity. PHAT’s data-rich interfaces, including management review history, streamline this process compared to Bowtie’s manual charting, saving 15–20 hours/month, as evidenced by airports.
Step 4: Establish All Consequences (Damages)
Impacts, also called "risks" and "consequences", are always characterized by damages. Damages could be to persons, equipment, reputation, money, etc. – anything that hurts your organization. Picking out damages is usually pretty easy. Here are a few examples of Impacts in bowtie analysis:
- Fines;
- Loss of life;
- Injury to persons;
- Damage to aircraft or equipment;
- Loss of aircraft or equipment;
- Reputation damage;
- Loss of stock value (financial loss);
- Reduced passenger revenue;
- Reduced confidence in safety program by employees (safety culture); and
- Possible litigation.
Each item in red causes an element of damage to the company. For example, a runway incursion might lead to “fines from regulators” or “reputation damage from press coverage.” This step quantifies the stakes, making it critical for executive buy-in. SMS Pro’s Performance Monitor tracks these impacts, linking them to KPIs for data-driven decisions. PHAT’s integration with Management of Change ensures impacts inform future controls, reducing compliance risks by 30%, as seen in drone operators.
Step 5: Insert Risk Controls Where Appropriate
The last step that is critical to bowtie analysis is to list your risk controls directly after each item to see how your risk controls failed. If you are unable to list a risk control, it’s a good indication that you need to implement one. A few examples of risk controls are:
- Preflight clearance checklist;
- GPS;
- Short field takeoff;
- Compensation packages; and
- PR Control.
This example is a bit limited by space, but in actual practice you will have more space to fit in your risk controls nicely. Moreover, your bowtie analysis will feature as many risk controls as possible, perhaps even several risk controls per item. For instance, a runway incursion might involve controls like “ATC clearance verification” or “pilot training on runway procedures.” SMS Pro’s Issue Manager tracks control effectiveness, while PHAT’s assigned manager data ensures accountability, unlike Bowtie’s manual process. This step identifies control gaps, reducing high-risk issues by 10%, as seen in airlines using SMS Pro.
Step 6: Define Purpose and Categorize the Analysis
To maximize Bowtie’s effectiveness, define a clear purpose or goal for each analysis, such as “Hypothetical Safety Case Analysis,” “Safety Incident Analysis,” or “Financial Impact Analysis.” Document this purpose at the top of the Bowtie chart to:
- Clarify the analysis focus;
- Provide a reference for future reviews;
- Enable categorization for organized storage.
For example, a “Safety Incident Analysis” Bowtie for a runway incursion might prioritize root cause identification, while a “Financial Impact Analysis” focuses on costs like fines or revenue loss. Categorizing Bowties enhances their utility for training, compliance demonstrations, or executive briefings. SMS Pro’s Meeting Manager facilitates stakeholder discussions to define purposes, while PHAT’s Trending Charts categorize and store analyses, streamlining retrieval and reducing analysis time by 40%, as seen in airports.