How to customise the bowtie templates

Reviewing the BowTie Structure

Review each element of the bowtie to determine whether it is applicable to your organisation and modify it where necessary. This includes:

• Threats
• Consequences
• Controls
• Escalation Factors
• Escalation Factor Controls

Add, amend, or remove content as appropriate to ensure the model reflects your organisational context.

Tip: Some controls included within the template may be managed entirely by external stakeholders. Consider whether these remain relevant to your operation and how they should be represented within your bowtie.

Reviewing Additional Information

In addition to the bowtie structure, organisations should review and customise supporting information associated with controls, including:

• Accountable post holders
• Control effectiveness ratings
• Control criticality
• Assurance and monitoring information

This information helps organisations understand who is responsible for managing risk and where weaknesses or vulnerabilities may exist.

Tip: Avoid defaulting to mid-range effectiveness ratings. Applying ratings honestly and consistently will provide a more accurate representation of how effectively risks are being managed and can help identify areas requiring improvement.

Tip: Assign accountable post holders to controls that are managed within your organisation to provide clear ownership and accountability.

Tip: Review escalation factors and escalation factor controls before assigning effectiveness ratings, as this will provide a more informed view of control performance.

Controls Managed by External Stakeholders

Where controls are delivered or managed by external organisations, consider:

• Retaining the baseline effectiveness rating provided within the template;
• Adjusting the rating based on operational experience and evidence; or
• Engaging directly with the relevant stakeholder to establish an informed assessment of control effectiveness.

The approach adopted should reflect the level of visibility, assurance, and confidence your organisation has in the control.