The final step in terms of the bowtie’s main elements is the addition of information that describes how the escalation factors are managed.
These are similar to the other controls already described, the difference being that they function in a different part of the diagram e.g. they control the escalation factors.
In our driving a car on a busy motorway example with the driver lacking the knowledge of how to counteract the tyre blow out, a control for this could be advanced driver training is completed to obtain this knowledge.
“A control that manages the conditions which reduce the effectiveness of other controls.”
Once the escalation factors are identified, the next step is to look at what controls we have in place to manage them.
- Focus on the escalation factor you are managing and not on the related control.
- They don’t act on threats or controls directly, as the name implies, they are acting to manage a particular escalation factor.
- The principals are generally as per those for other controls.
Traps and Tips
- Trap: Whilst it is possible in theory to add escalation factors to the escalation factor controls (they are after all just another type of control), this approach adds an undesirable level of complexity and is generally not required.
- Tip: It is normal practice to build diagrams only to one level of escalation factor