Bow-Tie vs FMEA vs HAZOP: Which Fits Process Risk?

A process-risk team can use three respected methods and still make the wrong decision if it asks each method to answer a question it was never designed to answer. OSHA's Process Safety Management rule, 29 CFR 1910.119, requires a process hazard analysis for covered operations, while ISO explains in ISO 31010:2019 that risk assessment techniques should be selected for the purpose and context rather than treated as a single universal winner.

This comparison separates Bow-Tie, FMEA, and HAZOP by decision purpose, evidence quality, timing, and leadership use so an EHS manager can choose the method that changes the risk decision instead of producing another thick report.

Evaluation criteria: what should the method help you decide?

The first criterion is the decision horizon. A design team reviewing a new process needs structured discovery, a maintenance group needs failure prioritization, and an operating leader needs to know whether critical barriers can prevent a credible top event. Treating those as one problem creates false precision.

The second criterion is the unit of analysis. HAZOP examines deviations from design intent, FMEA examines component or function failure modes, and Bow-Tie connects causes, a top event, consequences, and preventive or mitigative barriers. Each method therefore exposes a different slice of the same risk picture.

Use four additional tests before selecting a workshop: can the team define the system boundary, can it bring people who understand the work, can it record assumptions, and can someone verify the controls in the field? HSE describes in HSG254 how process safety indicators can provide assurance that controls operate as intended, which makes documented intent weaker than evidence that operating controls remain available.

Andreza Araújo's Safety Culture Diagnosis is useful here because diagnosis begins with the quality of the decision process, not the number of forms completed. A method earns its place when it improves a decision that a supervisor, engineer, or executive must make under real operating pressure.

Bow-Tie: best for explaining barrier logic around a critical event

Bow-Tie is strongest when the organization needs a concise visual explanation of how threats can lead to a top event and how barriers should prevent escalation or reduce consequences. It is particularly effective for major accident hazards, loss of containment, high-energy work, and other scenarios where leadership needs to see barrier ownership rather than a long list of hazards.

The method is not a complete hazard-discovery exercise. Its value depends on choosing a credible top event, defining the causes without collapsing them into vague labels, and naming barriers that are specific enough to test. Training is not automatically a dependable barrier. A barrier needs an owner, a performance expectation, a failure signal, and a recovery action.

Across 25+ years leading EHS at multinationals, Andreza Araújo has emphasized the gap between declared protection and protection that survives the work. That distinction is central to Bow-Tie. A barrier marked green in a workshop can still be unavailable when isolation records, staffing, alarms, or emergency response are weak.

Use Bow-Tie after the team understands the credible scenario, then connect each critical barrier to a field verification plan. The related barrier degradation assessment helps a manager distinguish a documented barrier from one that is delayed, bypassed, degraded, or absent.

For executive review, the Bow-Tie should show more than a central event and several arrows. It should show which barriers are preventive, which are mitigative, who owns each one, how performance is checked, and what happens when the check fails. That turns the diagram into a control conversation rather than a presentation slide.

FMEA: best for prioritizing failure modes in equipment and functions

FMEA is the better choice when the decision concerns how a component, subsystem, or function can fail and which failure modes deserve design or maintenance attention. Its structure forces the team to ask what can fail, what effect follows, what causes the failure, and how existing controls detect or prevent it.

FMEA produces useful detail, but its scoring can create an illusion of mathematical certainty. A ranking built from severity, occurrence, and detection is a prioritization aid, not a probability model. If the team cannot explain why a score changed, the number is decorating uncertainty rather than reducing it.

FMEA is also sensitive to granularity. If the team lists pump failure as one mode, it may miss seal degradation, loss of lubrication, incorrect reassembly, or a control-system fault. If it breaks the equipment into hundreds of microscopic entries, the review becomes slow and loses the decision-maker.

Apply FMEA when the asset or function is concrete, the failure boundary is known, and the output will change a design, inspection interval, spare-parts decision, or proof-test plan. When the concern is a major accident sequence that crosses several systems, transfer the material into a Bow-Tie or use a broader process hazard study first.

A useful review cadence is to revisit high-priority failure modes after a design change, a repeated defect, a serious near miss, or a maintenance strategy change. The number of calendar months between reviews should follow the risk and change profile, not an arbitrary annual ritual.

HAZOP: best for discovering deviations from design intent

HAZOP is strongest during design review, modification review, or a structured examination of a process whose intent can be expressed through parameters such as flow, pressure, temperature, level, composition, or sequence. Guide words help the team challenge what happens when the process is different from the intended condition.

The method's distinctive benefit is disciplined questioning across nodes. It can reveal interactions that a component-centered FMEA overlooks, especially when the initiating cause sits in one part of the process and the consequence develops somewhere else. OSHA requires under 29 CFR 1910.119(e) that a process hazard analysis address hazards, previous incidents with catastrophic potential, engineering and administrative controls, human factors, and facility siting.

HAZOP becomes weak when the team treats attendance as competence. A polished workshop with no operator, maintainer, process engineer, or instrument specialist can produce complete-looking minutes while missing the way work is actually performed. The method should expose uncertainty, not hide it behind guide-word vocabulary.

Use HAZOP before a new design is frozen and whenever a change alters the process boundary, safeguards, materials, operating envelope, or human interaction. For a practical companion, the existing HAZID versus What-If versus LOPA comparison explains how early screening differs from deeper process analysis.

What the facilitator must protect

The facilitator should protect the boundary of the study before protecting the calendar. A two-hour review that excludes a credible operating mode is not efficient, because the missing assumption will return later as an action, an incident, or an emergency decision.

Record the reason for exclusion whenever a node, function, or consequence falls outside the review. This creates a traceable limit that a manager can challenge, especially when a contractor, temporary configuration, startup condition, or shutdown state is not represented in the normal operating description.

For each recommendation, identify whether the action changes design, maintenance, procedure, competence, emergency response, or leadership attention. That classification prevents the common failure in which every problem becomes a training action even though the real weakness sits in equipment, sequencing, staffing, or decision authority.

Decision matrix: which method fits which decision?

The matrix below is a selection aid, not a substitute for competent analysis. A method is appropriate when its output can be connected to a decision owner, a due date, and a verification record.

How to combine the methods without duplicating work

Combining methods is sensible when each one answers a different question. A new high-hazard process might begin with HAZOP to challenge the design intent, use FMEA on selected protective functions or critical equipment, and then express the most important accident scenarios in Bow-Tie form for barrier ownership.

The sequence matters less than the handoff. The team should preserve the initiating cause, consequence, safeguard, assumption, and action reference as material moves between methods. Otherwise, the second workshop quietly rewrites the first one and creates a false sense of completeness.

Set a maximum of three layers of evidence for each critical action: the analysis record, the accountable owner, and the field or test evidence that shows closure. The risk scenario, control test, and decision record framework gives leaders a way to connect analytical output with acceptance decisions.

Andreza Araújo's Safety Culture: From Theory to Practice supports the same principle from a cultural angle. A mature safety system does not confuse participation in a workshop with control of risk. It makes the reasoning visible, gives people permission to challenge weak assumptions, and keeps ownership alive after the meeting ends.

When the methods disagree

Disagreement is not automatically a quality failure. HAZOP may identify a deviation that FMEA does not model, while FMEA may expose a component failure that the process-level discussion treats as too remote. The discrepancy should trigger a boundary review rather than a vote.

Ask whether the methods used different operating states, consequence definitions, or assumptions about safeguard availability. If they did, preserve both results and state the condition under which each applies. This is more honest than forcing one ranking to absorb the other method's uncertainty.

Recommendation by context: choose for the decision, not the method label

Choose HAZOP when a design or modification team must discover deviations before the operating envelope is accepted. Choose FMEA when a defined asset or function needs failure prioritization that will change reliability, inspection, or design action. Choose Bow-Tie when leadership needs to understand a critical scenario and verify whether its barriers are actually available.

For a process plant with a new design, a practical sequence is HAZOP first, targeted FMEA second, and Bow-Tie for the scenarios that can produce severe consequences. For a mature operation facing repeated control failures, begin with Bow-Tie and barrier verification, then use FMEA only where a specific equipment or function is driving the weakness.

Do not choose a method because it is familiar, fast to schedule, or easy to score. The better question is whether the analysis will change a permit, a design, an inspection plan, an emergency response, or a resource decision within a defined time. That is where technical risk management becomes operating discipline.

If your team needs to compare methods, train facilitators, or turn analysis into dependable field controls, Andreza Araújo's Safety School and ACS Global Ventures provide structured support for safety culture and EHS transformation. Visit Andreza Araújo's official site to choose the right starting point.

That discipline also improves handover quality. A future reviewer can see what the original team believed, which evidence supported it, and what must be checked before the risk is accepted again.

Conclusion: the right method is the one that changes the next decision

HAZOP finds deviations, FMEA prioritizes failure modes, and Bow-Tie clarifies barrier logic. The strongest process-risk program uses those differences deliberately rather than presenting one method as a universal answer.

Start with the decision, name the boundary, involve the people who understand the work, and require evidence that the selected controls function in practice. Safety is about coming home, and the analysis only matters when it improves the conditions that make that possible.