ISO 31000 blog series – Which factors should you consider during risk analysis?

3 – Complexity and connectivity

ISO 31000 states: “An event can have multiple causes and consequences and can affect multiple objectives”. The bowtie methodology lends itself well to support this part of risk analysis. As opposed to risk registers where it is often hard to understand which control, or barrier, is protecting us from which threat. As can be seen in the figure below, in the risk register it is hard to see if we have barriers for each threat/consequence line, whereas in the bowtie diagram it becomes immediately apparent.

4 – Time-related factors and volatility

The time-related factors can be considered a shortcoming of the bowtie methodology as it does not show just how much time a scenario would take to unfold. In addition, the volatility of certain events can sometimes be hard to capture in a bowtie other than by using the risk matrices.

5 – The effectiveness of existing controls

ISO explains that existing controls and their effectiveness and efficiency should also be taken into account when analyzing risk. By displaying the effectiveness of barriers through, e.g. color (see picture below), the final risk that will be assigned to a scenario in a risk matrix will be easier to understand and thus help to make decisions. For more information on defining effectiveness see our other blog: 3 pillars to define barrier effectiveness.

6 – Sensitivity and confidence levels

The bowtie methodology is incredibly effective at communicating risk to people in all layers of an organization due to its simplicity. As such, it is important to remember to add doubts and questions to your bowtie diagrams in instances of uncertainty. Simply adding a question mark or some words to the elements in a bowtie can already inform the decision makers of the uncertainty inherent in the scenario.

Join us in next week’s blog post to discover how to use BowTieXP to your advantage.