Using Bow Tie Controls in the Risk Register and Incident Investigations

Before assigning control types:

• Confirm the Risk and its control measures accurately reflect the work being carried out.
• Consider the unwanted event that sits at the centre of the Risk.
• Identify which controls are intended to prevent that event.
• Identify which controls are intended to reduce harm or recover after the event.
• Avoid classifying a control solely by its name. Consider what the control is intended to do.
• Review Risks that do not contain both preventative and recovery controls.

Bow Tie control types help organise and review the control strategy. They do not replace the Risk assessment or the need to confirm that controls are suitable, implemented and effective.

1. Go to Health & Safety > Risk Register.
2. Create a new Risk or update an existing Risk.
3. Add the applicable control measures.
4. Assign each control measure a Control Type of Preventative or Recovery.
5. Save the Risk.
6. Use Control Coverage on the Risk Register listing to find Risks without preventative or recovery controls.
7. During an Incident investigation, link the Incident to the applicable known Risk.
8. Review and link the related control measures.
9. Go to Reports > Critical Risk Control Report to review critical controls linked to Incidents.

Bow Tie thinking places an unwanted event at the centre of the Risk.

On the left are the threats or circumstances that could cause the event. Preventative controls sit between those threats and the unwanted event.

On the right are the possible consequences if the event occurs. Recovery controls sit between the unwanted event and those consequences.

This creates a simple control strategy:

• Preventative controls reduce the likelihood of the unwanted event occurring.
• Recovery controls reduce the severity or extent of the consequences after the event has occurred.

For example, for a loss-of-containment Risk:

• Inspection and preventative maintenance may be preventative controls because they help stop the loss of containment.
• Spill response equipment and an emergency response procedure may be recovery controls because they help limit the consequences after the loss occurs.

Some control measures may appear capable of serving both purposes. Assign the type that reflects the control's primary role within the particular Risk and review the wording where that role is unclear.

The control type describes where the control sits in the Risk pathway. It does not, by itself, confirm that the control is:

• Present
• Working
• Effective
• Being inspected
• Being followed
• Sufficient for the level of Risk

Control classification should be used alongside normal Risk review, control verification and Incident investigation processes.

From the left-hand menu, go to:

Health & Safety > Risk Register

Create a new Risk or open the applicable Risk for updating.

The functions available depend on your Engage authorities and the current status of the Risk.

Complete the Risk information and add the control measures used to manage the Risk.

Each control measure should describe a specific control rather than a broad intention.

For example:

• Daily pre-start inspection completed using the approved checklist

provides clearer control information than:

• Take care and inspect equipment

Clear control descriptions make later coverage reviews and Incident investigations more useful.

For each control measure, select the applicable Control Type:

• Preventative – the control is intended to reduce the likelihood of the unwanted event occurring.
• Recovery – the control is intended to reduce the consequences if the unwanted event occurs.

Consider the purpose of each control within this Risk rather than relying only on the control's general description.

A control used as preventative in one scenario may serve a recovery role in another, depending on the event and consequence being managed.

Review the Risk and save the record.

Confirm that:

• The unwanted event is understood.
• The main threats and consequences have been considered.
• The control measures are specific and relevant.
• Each control has the appropriate Control Type.
• The Risk contains a suitable balance of preventative and recovery controls.

The presence of both control types does not automatically mean that the Risk is adequately controlled. The controls must still be appropriate for the Risk and operating as intended.

Return to the Risk Register listing and review Control Coverage.

Control Coverage provides a quick way to identify Risks that do not have preventative controls, recovery controls or both control types recorded.

Use this information to prioritise Risks requiring review.

A gap in Control Coverage may mean:

• A required control has not been recorded.
• An existing control has not yet been classified.
• The current control strategy relies too heavily on prevention.
• The current strategy relies on recovery after the event rather than preventing it.
• The Risk requires further assessment to determine whether additional controls are needed.

Control Coverage identifies a recording or coverage gap. It does not automatically determine which new control should be added.

Open each Risk identified through Control Coverage and review the Risk with the appropriate operational and Health & Safety people.

Do not add a nominal control simply to make the coverage indicator look complete. A beautifully green dashboard is of limited comfort when the underlying control exists only as decorative data.

Confirm whether:

• An existing control needs to be classified.
• The control description needs to be clarified.
• A genuine additional control is required.
• The Risk assessment needs broader review.

Where an Incident relates to a Risk already recorded in Engage, open the Incident investigation and link it to the applicable Risk.

Select the option indicating that the Incident relates to a known Risk, then select the relevant Risk Register record.

Only link the Incident where there is a genuine relationship to the Risk.

When the Incident is linked to a Risk, Engage displays the Risk's related control measures and their Control Types.

This allows the investigator to review whether the Incident involved:

• A preventative control
• A recovery control
• Multiple controls
• A possible gap in the existing control strategy

Link the control measures that are relevant to the Incident and the investigation findings.

The fact that a control is related to an Incident does not automatically prove that the control failed. The investigation should determine whether the control was:

• Absent
• Not implemented
• Not followed
• Inadequate
• Unavailable
• Ineffective
• Working as intended but unable to prevent the particular outcome

Record the evidence supporting the investigation conclusion rather than assuming that association equals failure.

Where the Incident raises concerns about the Risk or its controls, review the Risk Register record.

Consider whether:

• The Risk description remains accurate.
• The threats and consequences remain complete.
• The control measures are adequate.
• The Control Types remain appropriate.
• Additional preventative or recovery controls are required.
• Existing controls require verification, corrective action or monitoring.

Linking the Incident to the Risk keeps the event connected to the control strategy, but it does not replace the formal review and update of the Risk.

From the left-hand menu, go to:

Reports > Critical Risk Control Report

The report uses the control information linked through Incident investigations and displays the applicable Control Type.

The report displays the five critical controls most frequently linked to Incidents.

Use this information to identify controls that may warrant closer review.

Frequent links can indicate:

• Repeated exposure to the same critical Risk
• A control that is regularly relevant during investigations
• A possible weakness in how the control is implemented or monitored
• A recurring operational issue
• A need for further investigation or assurance activity

Frequency alone does not prove that a control failed. Review the underlying Incidents and investigation evidence before reaching that conclusion.

Where a critical control appears frequently, consider:

• Reviewing the linked Incidents
• Confirming whether the control was present and available
• Checking whether the control was followed
• Reviewing control verification or inspection evidence
• Confirming that workers understand the control
• Assessing whether the control remains suitable
• Creating corrective Actions where work needs to be assigned and tracked

The report provides a starting point for review. It should be used with the Risk records, Incident findings and available control evidence.

These functions answer different questions:

• Control Coverage identifies Risks that do not have preventative controls, recovery controls or both recorded.
• Incident control links show which Risk controls were relevant to an Incident investigation.
• Critical Risk Control Report highlights the critical controls most frequently linked to Incidents.

Together, they help identify gaps in the documented control strategy and areas that may require deeper operational review.

I cannot create or update a Risk
Your Engage authorities may not allow you to manage the Risk Register. Speak with your Engage administrator.

I cannot see Control Type against a control measure
Confirm that you are using the current Risk format. Older Risk records or screens may not display the same functionality.

I do not know whether a control is preventative or recovery
Identify the unwanted event. If the control acts before the event to reduce its likelihood, it is preventative. If it acts after the event to limit the consequences, it is recovery.

A control appears to serve both purposes
Assign the type that reflects its primary role within the particular Risk. Clarify the control description or separate it into distinct control measures where that provides a more accurate representation.

Control Coverage shows a gap
Open the Risk and check whether existing controls have been classified. If the classification is complete, review whether a genuine additional preventative or recovery control is required.

The Incident does not display the Risk controls
Confirm that the Incident has been linked to the applicable known Risk during the investigation.

A control appears in the Critical Risk Control Report
This means the control has been frequently linked through Incident investigations. Review the underlying Incidents before concluding that the control failed.

I cannot find Control Type in Report Builder
Control Type is not currently available as a Risk Register column in Report Builder.

• Creating and Managing Risks in the Risk Register
• Recording, Investigating and Managing Incidents
• Understanding and Maintaining Your Safety Approach
• Managing Actions