Conducting risk assessments is a core part of running a safe vessel operation, but not all risk assessment tools are created equal. The bowtie model is straightforward to use,
identifies controls to known threats before an incident occurs, and presents mitigations to potential outcomes after an incident occurs. To show how it works, we’ll run through a scenario that most passenger vessel operators will recognize.
It’s a rainy summer morning and passengers are beginning to board. At a glance, the gangway looks fine, but there is needed maintenance that hasn’t been addressed. The non-skid surface has been degrading, and the handrail wobble is something the crew works around rather than report.
An elderly passenger reaches for the loose handrail, loses her footing, and falls, breaking her wrist. As the incident unfolds, the response is delayed due to crew being unaware of the location of the first aid kit. Unfamiliarity with the incident response procedures result in late U.S. Coast Guard notification resulting in a complaint filed against the operator. The hazards presented by the gangway were known and the gaps in the response were preventable. A bowtie risk assessment could have identified the hazards and the gaps in response before anyone got hurt.
The Bowtie Model
The bowtie risk assessment is a visual tool that maps risk in two directions at once. Originally developed in the oil and gas industry, the bowtie model has since been adopted across many maritime sectors.
On one side are the threats that could lead to an incident, on the other are the potential outcomes if the incident occurs. In the middle is the incident itself, what risk professionals call the top event. The diagram gets its name from its shape.
Threats and controls fan out to the left, mitigations and potential outcomes fan out to the right, and the top event sits in the center like the knot of a bowtie. Controls act as preventive barriers, stopping the incident from occurring. Mitigations act as reactive barriers, limiting the damage once the incident has occurred. The result is a single diagram that gives you a complete picture of a risk from cause to consequence. (See figure 1.)
Returning to the gangway scenario, the top event is the passenger fall. On the left, three threats contributed to it. A degraded non-slip surface, a loose handrail, and lack of a formal inspection process.
Controls are what come between those threats and the fall itself. A routine gangway inspection, scheduled maintenance plan, and crew hazard reporting could have prevented this entirely.
On the right side, the potential outcomes are shaped by what mitigations you have in place. Carrying a fully stocked first aid kit and training crew in the location and use of the first aid kit can treat an injury promptly. A documented incident reporting protocol ensures the Coast Guard notification is handled correctly. When clear passenger communication standards are in place, the situation is handled professionally, and the operation’s reputation is less likely to take a hit. (See figure 2.)
Passenger Vessel Applications
Most risk assessment models focus on identifying what could go wrong and putting controls in place to prevent negative outcomes. What sets the bowtie apart is that it also requires you to work through what happens after an incident occurs and whether your mitigations are adequate to handle the consequences. For passenger vessel operators, that second half is just as critical as the first because when members of the public are involved, how well you’ve prepared for the aftermath matters as much as prevention.
What sets the bowtie apart is that it also requires you to work through what happens after an incident occurs and whether your mitigations are adequate to handle the consequences.
This is also a tool that works well across mixed crews. Passenger vessel operations rely heavily on seasonal staff and crew members with varying levels of experience. A completed bowtie is visual, easy to brief, and easy to reference. When a crewmember can look at a diagram and see the controls in place and potential outcomes, the risk picture is a lot easier to understand than a written policy or a checklist.
A completed bowtie also supports regulatory compliance. With the Coast Guard continuing its focus on domestic passenger vessels, documented risk assessments are becoming an expectation rather than an option. Operators who can demonstrate a structured approach to risk management are in a stronger position during inspections and incident investigations. A bowtie satisfies that expectation in a format that is easy to present and walk through with an inspector. Following an incident, it demonstrates that risk management was being taken seriously and that both preventative and reactive measures had been formally assessed.
Furthermore, passenger vessel operators are responsible for members of the public who have no maritime training and minimal awareness of onboard risks, and the thoroughness of a risk assessment process in this context is significant.
Implementation
The bowtie isn’t the right tool for every risk decision, but for your highest-consequence scenarios it’s worth the extra effort. Scenarios where warning signs already exist but haven’t been formally assessed is a good place to start. This could include a near miss that is documented but never followed up on, equipment with a known problem that is worked around rather than fixed, a procedure that isn’t being followed in practice, or a recurring complaint from crew.
The captains and crew members who work closest to the scenario being assessed should be involved. The people working the vessel every day have firsthand knowledge of where the potential threats are and can give valuable input on what controls can be used. This information will inform the left side of the Bowtie model.
The right side of the bowtie requires more thought because you are forecasting what happens after a potential incident occurs, not just mitigating the risks that are already present. For each potential outcome, the question to ask is whether a mitigation is truly in place or just assumed to be. Having a first aid kit is only an effective post-incident mitigation if the kit is fully stocked and crew are aware of its location. An incident reporting protocol is only a mitigation if crew know it exists and can demonstrate how to use it. Going through each potential outcome and reviewing the mitigations can reveal procedural gaps that were not obvious or known before.
Once the risk assessment discussion is completed, documenting it into the bowtie structure shouldn’t be difficult. A clean diagram with the threats, controls, potential outcomes, and mitigations clearly labeled is sufficient. For operators already working within a framework like PVA’s Flagship SMS Program, the bowtie fits naturally as a risk assessment component that is intentional and thorough, adding more structure to the process. Crew members should be involved in the documentation of the bowtie assessment and made aware of their responsibilities regarding the controls and mitigations identified.
Review the bowtie risk assessment after an incident or near miss, when operations change, or when seasonal crew turnover means new personnel are responsible for the identified controls and mitigations.
The bowtie risk assessment won’t eliminate risk from passenger vessel operations, but it brings structure to how risk is identified and managed. It accounts for what could cause an incident and what follows if an incident occurs. Most operators have a good instinct for where their risks are, the bowtie outlines these risks in structured and accessible format for the whole crew to understand.
A completed bowtie informs the risk management process. The controls and mitigations identified in the assessment should directly relate to your procedures and training materials. For example, if a control depends on a crew member completing an inspection, that inspection belongs in your SMS. If a mitigation requires familiarity with emergency equipment, that belongs in your crew training. The bowtie tells you what your program needs to address and becomes a practical foundation for maintaining a safety management system that reflects the actual risks of your operation.
Paige Castagno
Associate Consultant, Safety Management Systems, LLCPaige Castagno is an associate consultant with Safety Management Systems, LLC. A 2018 graduate of Massachusetts Maritime Academy, she sailed for five years and holds a second mate license. Since joining SMS LLC, she has earned internal auditor certifications in ISM, ISPS, MLC, and ISO 9001:2015. She works with a diverse client base spanning shipping companies, ferry operators, cruise lines, and shipyards, conducting internal audits and developing safety management systems.