Risk Bow Tie

The first step to addressing a risk is to understand the risk. Organizing your thoughts about something that could happen – a “risk event” – can help you better understand the potential risk. With that deeper understanding, your organization can take action to address the risk. The Risk Bow Tie is a powerful tool, because you need to think about a risk event across time and identify actions that can happen in advance to minimize risk.

What is the tool: A way to visualize a risk event as well as identify proactive and reactive response options

When to use the tool: When strategizing about a specific risk facing your organization

How to use the tool: Completing a Risk Bow Tie involves asking five questions.

1. 1. What is one risk event for your organization? Describe the risk event in as much detail as possible.
   2. What are some of the underlying causes or circumstances that would cause this risk event to happen? Consider completing the “5 Whys” exercise to reveal root causes. After identifying your risk event, ask “why?”. When you have your first answer, ask “why?” again, and continue until you ask “why?” five times.
   3. What are the potential positive and negative outcomes of this event happening?
   4. What preventative controls can be put in place? (What could be done in advance to prevent this event from happening?)
   5. What corrective controls can be put in place? (What could be done in advance to minimize impact once the event happens?)

For the “bow tie” portion of the graphic tool, the left side covers the time before the event happens and the right side covers what happens after the event.