Evaluating controls using function, type and criticality

Control function 

As described in the Bowtie Elements section, controls can be categorised according to the role they perform within the bowtie model.

The four control functions most commonly used are:

• Elimination – works to eliminate the threat, so that the threat is not present
• Prevention – prevents the threat from developing into a top event if the threat becomes “live”
• Reduction – reduces the likelihood of the top event developing into a consequence
• Mitigation – mitigates the severity of the consequence.

Identifying the function of a control helps users understand how risk is being managed and where effort is being applied. For example, it can highlight whether controls are primarily focused on preventing threats from occurring or reducing the consequences should an event take place.

Assigning control functions also improves communication by providing a clearer picture of how individual controls contribute to the overall management of risk.

Control Type

Control types provide a high-level classification of how controls manage risk. Reviewing the mix of control types within a bowtie can help identify strengths, weaknesses, and any over-reliance on a particular type of control, such as training or human intervention.

Industry Policies and Procedures
Controls that establish requirements, standards, and processes, including operational procedures and emergency response arrangements.

Operational Equipment, Infrastructure and Facilities
Controls relating to the design, maintenance, serviceability, and operation of equipment, facilities, and supporting infrastructure.

Warning Systems
Systems that provide alerts or warnings of developing hazards, enabling timely action to prevent an event or consequence.

Human Intervention
Controls that rely on effective human action to prevent, detect, or respond to hazards and risks.

Automated Corrective Systems
Automated systems that detect and correct errors, failures, or hazardous conditions to reduce the likelihood or impact of an event.

By assessing control types, organisations can gain a better understanding of how risks are managed and identify opportunities to strengthen their safety management system.

Control criticality

Control criticality is the determination of a control’s importance relative to the other controls present in a risk scenario.

Not all controls contribute equally to the management of a threat or consequence. Some controls play a particularly important role in preventing an unwanted event or mitigating its effects.

Identifying critical controls can help organisations:

• Focus attention on the controls that are most important to managing risk.
• Support communication with stakeholders.
• Prioritise assurance and monitoring activities.
• Identify where a greater level of detail may be required when considering escalation factors and control effectiveness.

Controls that are not classified as critical should not be considered unimportant. Standard controls still contribute to risk management and often work alongside other controls to provide resilience within the system. The failure of several standard controls may have an impact equivalent to the failure of a single critical control.

Assessing Control Criticality

When determining whether a control should be classified as critical, consider the potential impact if the control were absent or performing poorly.

Questions that may assist include:

• Would the operation still be considered acceptable if the control did not exist or was ineffective?
• Would the absence or poor performance of the control be likely to result in a significant regulatory finding?
• If the control is related to technical equipment, would its failure render the operation unsafe or prevent it from continuing?

These questions are intended to support discussion and decision-making. There is no single test that determines whether a control is critical. Instead, organisations should consider the role the control plays in managing risk and apply their judgement when assigning criticality.