Risk Assessment Techniques: HAZOP, FMEA & Bow-Tie Guide

Understanding HAZOP, FMEA, Bow-Tie, Fault Tree Analysis, and other techniques used globally for workplace and process safety

Risk assessment is the foundation of effective health and safety management. Every jurisdiction, from the UK's Health and Safety at Work etc. Act 1974 to the EU Framework Directive 89/391/EEC to US OSHA regulations, requires employers to identify hazards, assess risks, and implement appropriate controls. But the question of how to assess risks effectively requires understanding the range of techniques available and when to apply each one.

From simple qualitative approaches suitable for routine workplace hazards to sophisticated quantitative methods used in major hazard industries, risk assessment techniques have evolved over decades of industrial experience. Major incidents like Flixborough (1974), Bhopal (1984), Texas City (2005), and Deepwater Horizon (2010) have driven continuous improvement in how we identify, evaluate, and control risks. The techniques developed in process industries have influenced workplace safety practice globally.

For health and safety consultants supporting organisations across different sectors and jurisdictions, understanding this toolkit of techniques is essential. This guide provides a comprehensive overview of risk assessment methods, from basic approaches through to advanced process hazard analysis, explaining when and how each technique should be applied.

Risk Assessment Fundamentals: The Universal Framework

Before examining specific techniques, it is important to understand the common framework that underlies all risk assessment approaches. Regardless of the specific method used, risk assessment follows a logical sequence: identify hazards, identify who might be harmed and how, evaluate the risks and decide on controls, record findings and implement them, and review and update regularly.

Qualitative, Semi-Quantitative, and Quantitative Approaches

Risk assessment techniques can be categorised by how they evaluate risk:

Qualitative approaches describe risks in terms like 'high', 'medium', or 'low' based on professional judgement. They are fast, accessible, and appropriate for most workplace hazards.
Semi-quantitative approaches use numerical scales (such as 1-5 for likelihood and consequence) to calculate risk scores. They provide more structure while remaining practical.
Quantitative approaches calculate numerical probabilities and consequences, often expressed as individual risk or societal risk. They require significant data and expertise but enable comparison against defined tolerability criteria.

The choice of approach depends on the nature of the hazard, the complexity of the system, the availability of data, regulatory requirements, and the consequences of getting it wrong. For routine workplace hazards, qualitative or semi-quantitative approaches are usually appropriate. For major hazard facilities handling dangerous substances, quantitative risk assessment may be required.

Basic Risk Assessment Techniques

The Five Steps to Risk Assessment

The HSE's Five Steps approach is the foundation of workplace risk assessment in the UK and has been adopted widely internationally. It provides a simple, practical framework suitable for most workplace hazards:

Identify the hazards: Walk around the workplace, consult workers, review accident records, consider non-routine activities
Decide who might be harmed and how: Consider employees, visitors, contractors, vulnerable groups, members of the public
Evaluate the risks and decide on precautions: Compare against existing controls, apply the hierarchy of controls, prioritise actions
Record your findings and implement them: Document significant findings, communicate to those affected, implement controls
Review your assessment and update if necessary: Set review dates, update after incidents or changes, learn from experience

Risk Matrix

The risk matrix (also called risk rating matrix or likelihood/consequence matrix) is the most widely used semi-quantitative tool for risk assessment. It plots likelihood against consequence to produce a risk rating that guides prioritisation and decision-making. A typical 5x5 matrix uses scales such as: Likelihood from 'Rare' to 'Almost Certain'; Consequence from 'Insignificant' to 'Catastrophic'; resulting in risk ratings from 'Low' through 'Medium' and 'High' to 'Extreme'.

The strength of risk matrices lies in their simplicity and consistency. They enable different risks to be compared on a common basis and help organisations prioritise resources. However, they require careful calibration to the specific context. What counts as 'likely' or 'major' should be defined clearly, and organisations must guard against treating the numbers as more precise than they really are.

Checklists

Checklists are among the simplest hazard identification tools. They can be applied to virtually any aspect of a process: equipment, materials, procedures, workplaces, and activities. Their effectiveness depends on how well they are designed and how conscientiously they are applied. Checklists may become outdated and should be audited and updated regularly. They work best when combined with other techniques, ensuring that both known hazards (covered by the checklist) and novel hazards (identified through other methods) are captured.

What-If Analysis

What-If analysis is an informal brainstorming technique that encourages critical thinking and hypothetical scenario exploration. It is most effective during the early stages of process design or modification when detailed data may be limited. The technique involves posing questions such as 'What if a chemical spill occurs during transfer?' or 'What if the power fails during a critical operation?' and analysing the potential consequences. What-If analysis allows for qualitative examination of hazards and their potential impacts. It is flexible and can be applied quickly, but depends heavily on the knowledge and experience of those involved.

Process Hazard Analysis Techniques

Process Hazard Analysis (PHA) refers to a family of techniques used primarily in process industries to systematically identify hazards associated with chemical processes, operations, and facilities. These techniques are mandated by regulations such as OSHA's Process Safety Management standard in the US and the Control of Major Accident Hazards Regulations (COMAH) in the UK. Major incidents have consistently demonstrated that robust PHA is essential for preventing catastrophic events.

HAZOP: Hazard and Operability Study

HAZOP is the most commonly used and widely respected process hazard analysis technique. Developed by Imperial Chemical Industries (ICI) in the 1960s and first documented in 1974, HAZOP provides systematic rigour in challenging the design and operation of facilities. The technique is now standardised internationally through IEC 61882.

How HAZOP works:

The process is divided into sections called 'nodes', typically corresponding to equipment or process steps
For each node, the design intent is defined: what should happen under normal operation
Guide words (No, More, Less, Reverse, As Well As, Part Of, Other Than) are applied to process parameters (Flow, Pressure, Temperature, Level, etc.)
For each deviation (e.g., 'No Flow'), the team identifies possible causes, consequences, existing safeguards, and recommended actions
Findings are documented in worksheets and tracked through to completion

HAZOP requires a multidisciplinary team including a facilitator/leader, scribe, process engineer, instrumentation/controls specialist, operations representative, and maintenance representative. The technique is most effective when P&IDs (piping and instrumentation diagrams) are mature, typically at detailed design stage. For existing facilities, HAZOPs should be revalidated at least every five years or when significant changes occur.

The UK Health and Safety Executive has noted that HAZOP is weak in handling multiple cause events: teams find difficulty in holding together and tracing through the implications of a number of failures at once. This limitation has driven the development of complementary techniques like Bow-Tie analysis.

HAZID: Hazard Identification

HAZID is a qualitative brainstorming technique applied in the conceptual phase or early design stage, aimed at identifying hazards, environmental damage, or injury to human beings. It depends largely on expert opinion and team consultations as groundwork for subsequent, more detailed studies like HAZOP. The approach is less structured than HAZOP but provides broader coverage at earlier project stages when detailed design information is not yet available. The common advice is 'HAZID early, HAZOP later'.

FMEA: Failure Mode and Effects Analysis

FMEA is a systematic technique for identifying how components, systems, or processes can fail and what the effects of those failures would be. Originally developed in the aerospace and defence industries, FMEA is now used extensively across process industries, particularly for equipment reliability analysis and safety-critical systems.

The FMEA process involves:

Listing all components or process steps
For each, identifying potential failure modes (ways it can fail)
Determining the effects of each failure mode on the system and end users
Assessing severity, occurrence (likelihood), and detection (how likely the failure is to be detected before causing harm)
Calculating a Risk Priority Number (RPN) by multiplying these factors to prioritise actions

Where HAZOP identifies deviations at the process level, FMEA ensures the reliability of individual equipment. The techniques are complementary: HAZOP for process design review, FMEA for equipment reliability.

Bow-Tie Analysis: Visualising Risk Pathways

Bow-Tie analysis has become one of the most important risk assessment and communication tools in major hazard industries. The technique merges the principles of Fault Tree (causation) and Event Tree (consequence) analysis in a visual structure that stakeholders at all levels can understand.

The Bow-Tie diagram structure:

Centre (the 'knot'): The Top Event, representing the moment when control over the hazard is lost (e.g., loss of containment)
Left side: Threats (potential causes) that could lead to the Top Event, with preventive barriers that stop them
Right side: Consequences that could result if the Top Event occurs, with mitigating barriers that reduce their impact
Barriers: Controls that either prevent the Top Event or mitigate its consequences

This simple two-dimensional view allows teams to see the entire risk pathway from initiating events to possible outcomes in one picture. It serves as a powerful communication tool, helping both technical experts and non-technical stakeholders understand how risks are controlled, what safeguards are in place, and who is responsible for maintaining them.

Why Bow-Tie has become so important:

Engineers love HAZOP and FMEA for depth; executives love Bow-Tie for clarity and accountability
Auditors love Bow-Tie for showing barrier integrity and ownership at a glance
It is the only tool that makes risk visible, auditable, and actionable across all levels of an organisation
Bow-Tie can consolidate hundreds of HAZOP findings into a single diagram that leadership can understand

Modern software tools like BowTieXP enable 'live' Bow-Ties linked to maintenance management systems, allowing real-time visibility of barrier status. This supports effective management of change, since the impact on threats or barriers becomes more obvious.

Fault Tree Analysis and Event Tree Analysis

Fault Tree Analysis (FTA)

Fault Tree Analysis uses logic diagrams to map combinations of failures that could cause an undesired event (the 'top event'). Working backwards from the top event, FTA identifies the combinations of basic events (equipment failures, human errors, external events) that could lead to it. The diagram uses logic gates (AND, OR) to show how events combine.

FTA is highly quantitative, often used for probability modelling when failure rate data is available. It can calculate the probability of the top event occurring and identify the 'minimal cut sets' (smallest combinations of failures that would cause the top event). This makes it valuable for demonstrating that safety targets are met and for identifying where additional controls would be most effective.

Event Tree Analysis (ETA)

Event Tree Analysis works forwards from an initiating event to map the possible outcomes depending on whether safety systems and barriers work or fail. Each branch point represents a safeguard or barrier, with success leading one direction and failure leading another. The end points of the tree represent the range of possible outcomes, from successful control through to worst-case consequences.

When combined with probability data, ETA calculates the likelihood of each outcome scenario. Together, FTA and ETA provide the analytical foundation for Quantitative Risk Assessment. Bow-Tie analysis can be seen as combining both approaches in a single visual framework.

Layer of Protection Analysis (LOPA)

Layer of Protection Analysis is a semi-quantitative technique that evaluates whether the independent protection layers (IPLs) for a hazard scenario are sufficient to meet the organisation's risk tolerance criteria. LOPA typically follows a HAZOP study, taking the most significant scenarios and analysing them in more detail.

The LOPA process:

Select a hazard scenario (typically from HAZOP)
Determine the consequence severity and the initiating event frequency
Identify Independent Protection Layers: safeguards that can prevent or mitigate the consequence independently
Assign Probability of Failure on Demand (PFD) values to each IPL
Calculate the mitigated event frequency
Compare against risk tolerance criteria and determine if additional IPLs are needed

LOPA is particularly valuable for determining the required Safety Integrity Level (SIL) for Safety Instrumented Functions (SIF). It provides a structured, auditable basis for decisions about safety system design.

Choosing the Right Risk Assessment Technique

The selection of risk assessment technique depends on several factors. There is no single 'best' technique; the appropriate method depends on the circumstances. International health and safety consultants typically recommend blending techniques: HAZOP for process nodes, FMEA for vendor packages and equipment, LOPA for high-risk scenarios, Bow-Tie for communication and barrier management.

Factors to consider when selecting techniques:

Project lifecycle stage: HAZID and What-If in early stages; HAZOP when design is mature; LOPA and SIL analysis for safety system specification
Hazard type: Process hazards suit HAZOP; equipment reliability suits FMEA; security risks may need different approaches
Regulatory requirements: COMAH, Seveso, OSHA PSM may specify certain techniques
Available resources: Quantitative methods require more data, time, and expertise
Communication needs: Bow-Tie excels at communicating to non-specialists; HAZOP worksheets suit technical records
Consequence severity: Higher consequence hazards justify more rigorous analysis

Health and Safety Consultants and Software: Supporting Risk Assessment

Modern risk assessment increasingly relies on software tools to manage complexity, ensure consistency, and maintain documentation. Health and safety consultants and software platforms work together to provide the capabilities organisations need for effective risk assessment.

Software supports risk assessment through:

Risk register management and tracking
Standardised risk assessment templates and workflows
HAZOP and FMEA study management
Bow-Tie diagram creation and 'live' barrier monitoring
Action tracking through to completion and verification
Health and safety audit integration with risk assessment findings
Reporting and dashboards for management visibility
Multi-site and multi-jurisdictional risk data consolidation

For global health and safety consultants supporting organisations across different jurisdictions, integrated software enables consistent risk assessment approaches while accommodating different local requirements and languages.

How Arinite Can Help

At Arinite, we are experienced international health and safety consultants who help organisations apply appropriate risk assessment techniques to their specific circumstances. Our team of Chartered (CMIOSH) consultants provides comprehensive support across the UK and internationally, from basic workplace risk assessment through to advanced process hazard analysis.

Our risk assessment services include:

Workplace risk assessment across all sectors and hazard types
HAZOP facilitation and leadership for process industries
FMEA and equipment reliability analysis
Bow-Tie development and barrier management
Layer of Protection Analysis (LOPA)
Health and safety audits of risk assessment systems
Training on risk assessment techniques for your teams
Software selection and implementation support
International guidance on risk assessment requirements across jurisdictions

With experience supporting over 1,500 UK businesses and operations in more than 50 countries, we understand that the right approach to risk assessment depends on your industry, your hazards, and your regulatory environment. Whether you need straightforward workplace assessments or sophisticated process hazard analysis, our approach matches the technique to your needs. We call it "Keeping It Simple."

Need Support with Risk Assessment?

Whether you need workplace risk assessments, HAZOP facilitation, Bow-Tie development, health and safety audits, or guidance on the right techniques for your organisation, our Chartered consultants can help. Book a free 30-minute Gap Analysis Call to discuss your needs.

Risk Assessment Techniques: A Complete International Guide to Methods and Applications