When the BowTie Looks Complete: Verifying That Safety Barriers Still Work

On many major hazard sites in Indonesia, a BowTie is kept somewhere: on the control room wall, in an appendix to a HAZOP report, or in the safety documents handed to a client during prequalification. The diagram is persuasive. A hazard sits in the centre, threats arrive from the left, consequences spread to the right, and rows of barriers stand in between. It gives the impression that the risk is under control.

Whether that impression is correct depends on a question the diagram cannot answer by itself. Are those barriers working today? A relief valve that has not been tested since the last turnaround, a gas detector whose calibration is overdue, or an emergency procedure that the night shift has never practised still appears on the diagram as a neat box. This article reviews what research and industry guidance say about the gap between barriers on paper and barriers in operation, why the gap opens, and how an organisation can measure barrier health in a form that management can act on.

Background: what a BowTie shows, and what it does not

A BowTie joins the logic of a fault tree on the left with an event tree on the right around one top event, the moment when control over a hazard is lost. In their review of the literature, de Ruijter and Guldenmund (2016) found that the method had become popular without a consistent approach. They distinguished quantitative bowties, which generally combine fault trees, event trees and barriers to estimate risk, from qualitative bowties, which use simpler cause and consequence scenarios to communicate risk to an audience.

Most BowTies drawn in industry belong to the qualitative family. That is useful for communication. It is a weakness for assurance, because a qualitative diagram records that a barrier is intended to exist. It says nothing about how well the barrier performs.

Barrier theory supplies the vocabulary needed to close that gap. Sklet (2006) observed that the term safety barrier was used in practice, in the literature and in legislation without a definition shared across sectors. He defined safety barriers as physical or non-physical means planned to prevent, control or mitigate undesired events or accidents, and proposed describing their performance through attributes such as functionality or effectiveness, reliability or availability, response time, the ability to withstand the conditions of the event, and the trigger that activates them. Reason (1997) approached the same problem from the organisational side. In his account, defences rarely fail all at once. They are worn down by latent conditions created by decisions on staffing, maintenance budgets, scheduling and production pressure, until an unsafe act or a technical fault finds a path through.

The concept book published by the Center for Chemical Process Safety and the Energy Institute (2018) tightened the rules for building a BowTie. According to a Hazards 28 paper that introduced the book, written by authors from CCPS, the Energy Institute and industry, a barrier must be able on its own to stop a threat from reaching the top event, must be independent of the threat and of the other barriers on the same pathway, and must be auditable (Johnson et al., 2018). Measures that fail these tests, such as general training or a supervision routine, can still be important. They belong elsewhere on the diagram, typically as controls on degradation factors, the conditions that weaken a barrier. Johnson et al. (2018) list a diagram crowded with too many barriers as a common pitfall, because it gives operations and management a false sense of security.

The International Association of Oil & Gas Producers pursued a similar aim through IOGP Report 544, which sets a standard vocabulary for barrier types and categories. The stated purpose is to help teams review bowties for clarity and completeness and to identify shortfalls consistently across many operations, so that trends and recurring causes of barrier failure become visible (International Association of Oil & Gas Producers, 2016).

The Indonesian legal framework is broader than any single method but points the same way. Government Regulation No. 50 of 2012 bases the planning of an occupational safety and health management system (SMK3) on hazard identification, risk assessment and risk control. SNI ISO 45001:2018 asks organisations to monitor and measure, among other things, the effectiveness of operational and other controls (Badan Standardisasi Nasional, 2018). Neither requires a BowTie. Both expect an organisation to show that its controls work.

Current findings: barriers are identified, but are they verified?

Indonesian studies

Indonesian researchers have applied the BowTie in laboratories, hospitals, ports and mines. Mulyani, Sukwika and Ramli (2025), writing in the Jambura Journal of Health Sciences and Research, used the method to map causes, consequences and controls in a chemical laboratory and concluded that it is effective for identifying causal relationships and for designing preventive and corrective controls.

An earlier study in the National Journal of Occupational Health and Safety took a different route. Deliani and Wirawan (2021) applied the BowTie retrospectively to incident investigation records for material hauling vehicles at a coal mining company over 2018 to 2020. They mapped threats, preventive controls, consequences, escalation factors and mitigating controls in order to find which barriers had failed. Their recommendations included reviewing the procedures, standards and risk identification documents behind preventive and mitigating controls, analysing the workload of field supervisors, strengthening the monitoring of human factors and improving the performance of technical preventive controls.

The second study shows a useful pattern. When a BowTie is drawn after incidents, it exposes barriers that were present on paper but did not work when they were needed. Several of the fixes concern organisational conditions such as supervisor workload, which in barrier terms are degradation factors and not barriers in their own right.

Mining data from 2025 and 2026

Data from the international mining sector shows the same gap at a larger scale. In a briefing on its members' safety data for 2020 to 2024, the International Council on Mining and Metals (ICMM) reported that ineffective implementation of critical controls was associated with 83 percent of fatalities in 2024 (International Council on Mining and Metals, 2025). Its benchmarking for 2025 recorded 39 fatalities across 26 member companies, down from 43 in 2024, and noted that the numbers have generally been increasing since 2021, which reinforces the need for a continued focus on critical control effectiveness (International Council on Mining and Metals, 2026b).

On 28 April 2026, ICMM published a revised Critical Control Management good practice guide. It consolidates two guidance documents developed more than ten years earlier and gives stronger direction on governance, accountability and leadership involvement, with an emphasis on confirming that controls work in practice (International Council on Mining and Metals, 2026a). Critical control management in mining and barrier management in the process industries come from different traditions. They have reached the same conclusion: identifying controls is now routine, and keeping them effective is where organisations struggle.

What North Sea regulation asks for

The Petroleum Safety Authority Norway, now known as Havtil, has long asked operators to treat a barrier as a function delivered by several barrier elements. Its 2017 barrier memorandum states that performance requirements must be set for each element, whether technical, organisational or operational, and gives competence, training and drills as examples for organisational elements and response time as an example for operational ones (Petroleum Safety Authority Norway, 2017).

This is the step most qualitative BowTies leave out. A box labelled "gas detection" carries little assurance value until someone has stated the detector coverage, the alarm set point, the required response time, the test interval and the action an operator must take after an alarm.

Recommendations: from diagram to barrier health

The following steps turn a BowTie from a picture into a working management tool. They suit a process plant, a mine or a large construction project.

• Clean the diagram first. Test every barrier against the criteria of effectiveness, independence and auditability. Move items that cannot stop a threat on their own, such as general training or a reminder in a toolbox talk, to the degradation control layer.
• Write a performance standard for each critical barrier. State what the barrier must do, how reliably and how quickly, under which conditions, and which elements make it up: hardware, the people who operate it and the procedure they follow.
• Give each barrier an owner and a verification method. Verification can be a function test, an inspection, a drill, an observation of the task as actually performed or a review of records. Its frequency should follow the consequence the barrier protects against.
• Pair leading and lagging indicators for each barrier. HSG254 recommends a dual approach in which every risk control system has a leading indicator for whether the control is being delivered and a lagging indicator for whether it achieved its outcome (Health and Safety Executive, 2006). The proportion of safety critical tests completed on time and passed is one example of a leading measure. Failures on demand and loss of containment events are examples of lagging measures.
• Treat a degraded barrier as a recorded operating state. When a barrier is impaired, bypassed or overdue for testing, log it, decide on temporary measures and escalate according to how many barriers remain on that pathway.
• Learn from barrier failures as well as from incidents. A failed test, a near miss or an alarm that nobody acted on is evidence about barrier health. The retrospective approach used by Deliani and Wirawan (2021) can also be applied in advance, to near misses and audit findings.
• Help the workforce understand the logic. Operators and supervisors who know which barriers protect their unit are better placed to notice when one starts to weaken. Training that lets them see the effect of a skipped test, without real exposure, supports that understanding.

Two cautions apply. A barrier health score is only as good as the verification data behind it, and a dashboard fed by self-declared statuses can reproduce the same false sense of security that an overcrowded diagram creates. Independent checks in the field remain necessary.

How this connects with Nusa Safety's work

Several Nusa Safety tools and services are built around this distinction between drawing barriers and verifying them. AIRA guides HSE professionals through a structured interview and turns their answers into a BowTie with threats, consequences, preventive and recovery barriers and escalation factors with their controls. Each barrier can be described by type, effectiveness, independence, IPL and SECE status and performance standards, and a monitoring module records the owner, verification method, implementation status and review date of every barrier. The assessor remains in charge of every element, and the field verification itself still has to be carried out by people on site.

PSM Simulator addresses the training side. Players install preventive and mitigation barriers on a live P&ID within a limited budget, and a barrier's reliability is credited only when its escalation factors are controlled through the right inspection, test or maintenance activity. The game ends with the player's own bow-tie. Organisations that want to bring barrier findings together with HAZOP, HIRADC and other assessments in one corporate register can use APEX Risk, which tracks corrective actions and control effectiveness across departments.

On the consulting side, our Engineering Studies and Risk Assessments service facilitates HAZOP, BowTie and related studies, and a Process Safety Management Review can test whether barrier performance standards, testing and management of change are working in practice. Simulator deployment is covered under Digital Safety Simulators, and dashboards tailored to a client's own barrier data under Custom HSSE Software and Risk Intelligence Platforms. To discuss a specific facility, please contact us.

Conclusion

A BowTie is good at showing how an accident could unfold and which defences stand in the way. It is weak at telling anyone whether those defences are in working order, and research from Indonesia and abroad, together with recent mining data, suggests that this weakness is where serious incidents tend to begin. The remedy lies in a smaller set of barriers that meet clear criteria, each with a written performance standard, an owner, a verification method and indicators that management reviews. When that discipline is in place, the diagram on the control room wall becomes a record of verified protection.

This article is general information and not legal advice; for questions on how specific regulations apply to your organisation, please consult a qualified advocate.

References

1. Badan Standardisasi Nasional. (2018). SNI ISO 45001:2018 Sistem manajemen keselamatan dan kesehatan kerja, persyaratan dengan panduan penggunaan. BSN.
2. Center for Chemical Process Safety, & Energy Institute. (2018). Bow ties in risk management: A concept book for process safety. Wiley.
3. de Ruijter, A., & Guldenmund, F. (2016). The bowtie method: A review. Safety Science, 88, 211-218. https://doi.org/10.1016/j.ssci.2016.03.001
4. Deliani, F. F., & Wirawan, M. (2021). Analisis insiden alat angkut material pada area hauling dengan menggunakan metode bowtie di PT. XYZ periode 2018-2020. National Journal of Occupational Health and Safety, 2(2). https://doi.org/10.59230/njohs.v2i2.5832
5. Health and Safety Executive. (2006). Developing process safety indicators: A step-by-step guide for chemical and major hazard industries (HSG254). HSE Books. https://www.hse.gov.uk/pubns/books/hsg254.htm
6. International Association of Oil & Gas Producers. (2016). Standardization of barrier definitions (IOGP Report 544). IOGP. https://www.iogp.org/bookstore/product/standardization-of-barrier-definitions/
7. International Council on Mining and Metals. (2025). 2020-2024 ICMM safety performance: Insights. https://www.icmm.com/en-gb/research/health-safety/2025/insights-2020-2024-safety-data
8. International Council on Mining and Metals. (2026a). Critical control management: Good practice guide. https://www.icmm.com/en-gb/guidance/health-safety/2026/ccm-good-practice-guide
9. International Council on Mining and Metals. (2026b). Safety performance: Benchmarking progress of ICMM company members in 2025. https://www.icmm.com/en-gb/research/health-safety/benchmarking-2025-safety-data
10. Johnson, M., Manton, M., Cowley, C., & Scanlon, M. (2018). Bow ties in risk management: Using the new CCPS-EI book to avoid pitfalls. In Hazards 28 (IChemE Symposium Series No. 163). Institution of Chemical Engineers. https://www.icheme.org/media/16937/hazards-28-paper-31.pdf
11. Mulyani, A. S., Sukwika, T., & Ramli, S. (2025). Analisis manajemen risiko keselamatan dan kesehatan kerja di laboratorium kimia menggunakan metode bowtie. Jambura Journal of Health Sciences and Research, 7(2), 247-258. https://doi.org/10.35971/jjhsr.v7i2.30883
12. Peraturan Pemerintah Nomor 50 Tahun 2012 tentang Penerapan Sistem Manajemen Keselamatan dan Kesehatan Kerja.
13. Petroleum Safety Authority Norway. (2017). Principles for barrier management in the petroleum industry: Barrier memorandum 2017. https://www.havtil.no/contentassets/d5a5ce4c45aa4bd9a5d45122ba374169/barriers-memorandum-2017-eng.pdf
14. Reason, J. (1997). Managing the risks of organizational accidents. Ashgate.
15. Sklet, S. (2006). Safety barriers: Definition, classification, and performance. Journal of Loss Prevention in the Process Industries, 19, 494-506. https://doi.org/10.1016/j.jlp.2005.12.004