Step 6: Identify Recovery Controls

Similarly, to prevention controls, on the right-hand side of the top event, controls are added that show how the scenario is to be managed to stop the consequence from occurring.

These controls are in place to reduce the likelihood of the top event developing into a consequence as well as mitigating the severity of the consequence.

In our example of driving a car on a busy motorway, a reduction control would be anti-lock braking system (ABS) to constrain the loss of control parameters to not affect other motorway users. A mitigating control could be an airbag activation acting against the fatal severity of the consequence.

Additional guidance (relevant to prevention and recovery controls)

Parallel versus Sequential Controls

Controls will often operate sequentially, meaning that if one control fails, another may come into effect further along the risk pathway. However, some controls have an "either/or" relationship and are known as parallel controls.

For example, consider the threat of a driver entering a motorway journey with an unsafe tyre condition. There are several ways in which tyre condition might be assessed before travel:

1. Driver performs a visual tyre inspection.
2. Vehicle tyre pressure monitoring system (TPMS) alerts the driver to a problem.
3. Vehicle maintenance inspection identifies the issue before use.

These could be represented within the BowTie as separate controls. However, for any particular defect, only one of these controls may actually identify the issue before the journey begins. They are therefore examples of parallel controls.

BowTie diagrams do not specifically distinguish between parallel and sequential controls. This is a deliberate trade-off that prioritises simplicity and ease of understanding. As a result, controls may appear to operate sequentially even when they represent alternative methods of achieving the same outcome.

When building or reviewing a BowTie, it is important not to assume that all controls are sequential. This is one reason why simply counting the number of controls present is not a reliable method for determining the adequacy of risk management.

Independence of Controls

It is also common for controls to be represented that are not entirely independent of one another.

This can occur when separate parts of a control system are shown individually to illustrate different escalation factors or management actions.

For example, consider a vehicle fire:

• A driver detects smoke or a fire warning indication.
• A fire extinguisher is then used to tackle the fire, where appropriate.

These are often represented as separate controls. However, they are not truly independent. Detecting the fire does not, by itself, stop the event from developing, while the fire extinguisher is unlikely to be used unless the fire has first been detected.

As with parallel controls, these dependencies reduce the value of simply counting controls as a measure of protection. The effectiveness of a BowTie depends not only on the number of controls present, but also on how those controls function and interact within the overall risk management system.

See Prevention controls for traps and tips relevant to recovery control.