HAZOP vs Bow-Tie vs FMEA: choose the right method

IEC 31010 treats HAZOP, Bow-Tie and FMEA as risk assessment techniques, but the method chosen often decides whether a team sees a fatal exposure early or only documents it after the event. This comparison gives EHS managers and risk leaders a decision method for choosing the right tool before high-risk work becomes a spreadsheet exercise.

Why method choice changes the quality of risk decisions

HAZOP, Bow-Tie and FMEA answer different questions, so using them as interchangeable workshop formats weakens risk management. HAZOP asks what could deviate from design intent, Bow-Tie asks which barriers prevent or mitigate a top event, and FMEA asks how a component, task or process step can fail.

That distinction matters because a 320-employee plant can run three workshops, fill three action logs and still miss the exposure that could produce a Serious Injury or Fatality. As Andreza Araújo argues in Safety Culture: From Theory to Practice, compliance rituals only become safety culture when they change what leaders see, ask and verify in the field.

The practical test is not whether the method looks sophisticated. The test is whether it gives the accountable manager a sharper decision about design, controls, inspection, operating limits, maintenance readiness and residual risk acceptance.

1. Evaluation criteria for choosing a risk method

A useful comparison starts with the decision the team must make, because each method has a natural decision range. For process deviations, HAZOP is strongest; for barrier assurance around a known top event, Bow-Tie is stronger; for failure modes in equipment or procedural steps, FMEA usually gives the cleanest analysis.

Across 25+ years leading EHS at multinationals, Andreza Araújo has observed that weak risk assessments usually begin with an unspoken assumption: the team chooses the method it already knows rather than the method the exposure requires. That is how a permit-to-work issue becomes a generic checklist and how a design issue gets pushed into training.

Use five criteria before scheduling the workshop: uncertainty level, system complexity, need for barrier verification, need for ranking, and expected decision owner. If those criteria are unclear, pause the method debate and define the decision first.

5 criteria should be explicit before the workshop starts, otherwise the risk session tends to produce many actions and few decisions.

2. HAZOP fits deviations in process intent

HAZOP is the best fit when the operation depends on stable process parameters and the team needs to examine deviations from design or operating intent. It works especially well in chemical processing, utilities, energy, food manufacturing and any operation where flow, temperature, pressure, level, composition or sequence can drift into hazardous territory.

The strength of HAZOP is disciplined imagination. Guide words force the team to ask what happens when there is no flow, more pressure, less temperature, reverse flow, contamination or an unexpected sequence. What most companies underestimate is facilitation quality, because a poor HAZOP becomes a long meeting where senior engineers dominate and operators confirm assumptions instead of challenging them.

Use HAZOP when the question is, "What deviation could create a hazardous scenario?" Tie each finding to operating limits, alarms, interlocks, maintenance tasks and shutdown logic. If the finding cannot be translated into a design or operating control, the workshop has probably drifted away from its purpose.

HAZOP also links naturally to Management of Change, because process deviations often appear after startup, bypass, product change, raw-material variation or temporary operating mode.

3. Bow-Tie fits barrier thinking around a top event

Bow-Tie is strongest when the top event is already known and the organization needs to prove that preventive and mitigative barriers are real. It is a visual method for connecting threats, controls, escalation factors and consequences around a single loss-of-control point.

In more than 250 cultural-transformation projects supported by Andreza Araújo's team, one recurring pattern appears: leaders talk about critical controls as if they exist because they appear in a procedure. Bow-Tie challenges that illusion, because the diagram exposes whether a barrier has an owner, a performance standard, a verification routine and a response when it degrades.

Use Bow-Tie when the decision is about SIF prevention, major-hazard assurance or executive visibility. A strong Bow-Tie should drive field verification, not sit in a risk register. It should tell a supervisor which controls must be checked before the work starts and tell a director which barrier degradation deserves escalation.

This is why Bow-Tie should connect to critical control verification rather than remain only a workshop artifact.

4. FMEA fits failure modes in tasks, assets and steps

FMEA is the best fit when the team needs to break a task, asset, component or process step into possible failure modes. It is useful for maintenance planning, equipment reliability, procedural risk, ergonomic task analysis and operational readiness.

The trap is false precision. Many teams assign severity, occurrence and detection numbers, multiply them into a risk priority number and then debate decimals instead of redesigning the work. Andreza Araújo's critique of compliance theater applies here: the method should force better decisions, not create a beautiful ranking that protects the existing plan.

Use FMEA when the question is, "How can this step fail, and what control prevents or detects that failure?" Keep the scoring simple enough that operators and maintenance technicians can challenge it. If only the risk department understands the table, the analysis is already losing operational contact.

FMEA is often stronger when paired with the risk register, because each high-priority failure mode needs an owner, a control, a verification interval and a residual-risk decision.

5. Decision matrix for EHS and risk leaders

The right method is the one that matches the decision, not the one that appears most advanced. A high-risk organization may need all three methods, but it rarely needs all three for the same decision.

3 methods can examine the same exposure from different angles, but only one should lead the primary decision unless the scope is genuinely complex.

6. How to combine the methods without duplicating work

Combining HAZOP, Bow-Tie and FMEA works when each method has a separate role in the risk cycle. HAZOP can identify hazardous process deviations, Bow-Tie can translate selected scenarios into critical barriers, and FMEA can test the failure modes of equipment or tasks that support those barriers.

During the tenure at PepsiCo South America, where the accident ratio fell 50% in six months, the lesson was not that one method solves every exposure. The lesson was that leaders need a disciplined sequence from diagnosis to field action, because safety culture improves when the organization can see risk clearly and act before the weak signal becomes a loss.

A practical sequence is simple enough to govern. Use HAZOP for process deviations during design, modification or startup. Use Bow-Tie for the SIF scenarios that require executive assurance. Use FMEA for the task, equipment and maintenance failure modes that threaten the barriers shown in the Bow-Tie.

Each quarter without this separation adds noise to the risk program, while high-risk work continues with controls that may be listed, scored and approved without being verified.

7. The traps that make all three methods fail

All three methods fail when they become paperwork detached from ownership, field verification and residual-risk decisions. The most common failure is not technical ignorance; it is cultural tolerance for action lists that nobody treats as operational commitments.

Antifragile Leadership describes the leader's role in moments of uncertainty as a test of decision quality under pressure. That principle applies directly to risk assessment. If the method reveals a serious exposure and the organization still accepts a weak control because production is urgent, the method worked and leadership failed.

The first trap is choosing the familiar tool. The second is allowing the workshop to produce recommendations without accountable owners. The third is accepting administrative controls where the hierarchy of controls points to design, engineering or isolation. A fourth is treating PPE as evidence that the risk is controlled.

Compare each output with the risk matrix only after the team has named the scenario, the controls and the verification evidence. If the score appears before the exposure is understood, the number will hide more than it reveals.

Conclusion

HAZOP is for deviations, Bow-Tie is for barriers, and FMEA is for failure modes, which means the mature risk leader chooses the method by decision need rather than by habit. The strongest safety programs do not collect methods; they connect them to operating discipline, leadership accountability and SIF prevention.

If your organization needs to connect risk assessment with safety culture, critical control verification and executive decision-making, ACS Global Ventures can support the diagnostic and implementation plan. Start at Andreza Araújo and build a risk system that helps people come home.