LOPA vs QRA vs Bow-Tie: Which Method Fits a Major-Hazard Decision?

A major-hazard leader should not choose a risk method because its report looks more technical. The useful question is narrower: what decision must the analysis support, and what evidence can the operation defend?

LOPA, QRA, and Bow-Tie are often placed in the same discussion because all three address serious process risk. They do not do the same job. LOPA tests protection layers around a defined scenario, QRA estimates risk across a system, and Bow-Tie makes the barrier logic visible to the people who must own and verify it.

This comparison is for process safety managers, engineering leaders, and plant directors who need to choose an assessment method without confusing analytical detail with control quality. In more than 250 cultural transformation projects supported by Andreza Araujo, the recurring leadership test has been practical: can the analysis change a decision, clarify ownership, and survive contact with the field?

The decision question comes before the method

LOPA, QRA, and Bow-Tie become confused when the organization starts with a favorite template. The method should follow the decision. A design team deciding whether safeguards are sufficient needs a different tool from a board reviewing cumulative major-accident exposure, while a supervisor preparing barrier checks needs a format that can be read during work.

ISO 31000:2018 describes risk management as a process connected to decision-making, and IEC 31010:2019 provides a range of risk assessment techniques rather than declaring one universal method. That distinction matters because a method can be valid and still be a poor fit for the question in front of the team.

The choice should therefore be tested against four conditions. Define the scenario, identify the decision owner, state the evidence available, and decide how the result will be verified after the meeting. If the team cannot answer those questions, changing methods will not repair the analysis.

Evaluation criteria for a major-hazard assessment

The best method is the one that makes the required judgment clearer without hiding uncertainty. Use the following criteria before commissioning a study or repeating an old one.

The criteria also expose a common trap. A plant may complete a sophisticated assessment while leaving the barrier owner, verification frequency, and escalation rule undefined. Andreza Araujo's work in executive EHS repeatedly points to the same conclusion: a risk decision becomes credible when the organization can show what changed after the analysis.

LOPA fits a defined scenario and a protection-layer decision

Layer of Protection Analysis is most useful when the team has a specific initiating event, a defined consequence, and a need to test whether independent protection layers reduce the scenario to an acceptable level. The method is structured and semi-quantitative. It asks the team to separate the initiating event from the safeguards that should interrupt the path to harm.

LOPA is a good fit when an engineering change raises a focused question. Does an independent shutdown function provide meaningful protection? Is an alarm with operator response being counted correctly? Does a relief device belong in the scenario, and is it genuinely independent from the initiating cause? These questions are easier to discipline in LOPA than in a broad narrative risk review.

The method is only as strong as its independence rules and scenario definition. A procedure, an alarm, and the same operator's response may not be three independent layers. A safeguard that is listed but not tested should not be treated as healthy merely because it appears in the design file.

Use LOPA when the decision is narrow, the scenario is stable enough to define, and the team needs a consistent challenge to safeguard sufficiency. Follow it with field verification, because the calculation does not show whether the valve strokes, the alarm is heard, the response is understood, or the bypass is controlled.

QRA fits system-level frequency and consequence questions

Quantitative Risk Assessment is the stronger fit when leadership needs a system-level view of major-hazard risk. QRA can combine scenario frequencies, consequence modelling, occupancy, escalation pathways, and uncertainty to support decisions about facility design, land use, emergency planning, or major investment.

Its value is breadth. A plant director may need to compare storage, loading, process, and utility scenarios rather than study one safeguard in isolation. A board may need to understand whether a proposed change shifts the installation's overall risk profile. QRA can organize that view, provided the assumptions and data sources are explicit.

Its weakness appears when the organization treats an output such as an individual risk estimate as a measurement of reality rather than a model shaped by inputs. Failure frequencies, weather assumptions, population data, equipment condition, and human response can materially affect the result. The report should show sensitivity and uncertainty instead of presenting a single number as if it were exact.

Use QRA when the decision crosses assets, scenarios, or populations and the organization can sustain the technical work required. Do not use it to avoid a simpler barrier conversation. If a critical isolation is bypassed today, the immediate need is control restoration and ownership, not a new system-wide model.

Bow-Tie fits barrier ownership and operational communication

Bow-Tie is the strongest fit when the organization needs to show how threats lead to a top event and how preventive and mitigative barriers should interrupt or limit the consequence. Its power is not visual decoration. It is the shared language it creates between engineering, operations, maintenance, emergency response, and leadership.

A useful Bow-Tie names the hazard, top event, threats, consequences, controls, owners, degradation factors, and verification activities. It can therefore bridge the gap between a hazard study and a field conversation. The supervisor can ask whether a barrier is present, the engineer can ask whether the design supports it, and the director can ask who receives the escalation when it is degraded.

Bow-Tie becomes weak when every control is given equal visual weight. A poster with twelve boxes does not tell the operation which barriers are critical, which are independent, or which need a check before work proceeds. The diagram should be connected to a critical-control register and to evidence from the field. The existing guide on Bow-Tie barrier visibility develops that discipline.

Use Bow-Tie when the main problem is fragmented understanding of the control story. It is particularly useful after a QRA or LOPA study, when the organization needs to turn analysis into named ownership and verification rather than store the result in an engineering archive.

Decision matrix: which method fits which need?

The matrix is not a ranking of methods. It is a way to prevent a category error. LOPA is not a smaller QRA, QRA is not a more impressive Bow-Tie, and Bow-Tie is not evidence that a barrier works. Each method earns its place when it answers a specific question.

Recommendation by operating context

For a new or modified process unit, begin with the hazard study and use LOPA where a defined scenario needs a protection-layer decision. Translate the resulting critical barriers into Bow-Tie language so operations and maintenance can see ownership, degradation factors, and verification requirements.

For a complex installation with several major-hazard scenarios, use QRA when leadership must compare the system-level picture or evaluate a significant investment. Keep the assumptions visible and use Bow-Tie to make the highest-consequence scenarios actionable at the front line.

For an operating site that already has studies but keeps finding bypassed, degraded, or poorly owned controls, do not begin with another model. Start with Bow-Tie review and field verification, then use LOPA or QRA only where the unresolved decision genuinely requires them. A control register that shows the owner, check, evidence, and escalation path may create more safety value than a longer report.

In Safety Culture: From Theory to Practice, Andreza Araujo connects culture to repeated decisions rather than declarations. The same principle applies here. A method matters when it changes what the organization funds, verifies, stops, or escalates.

What leaders should not confuse

Do not confuse a completed study with a controlled risk. Do not confuse a number with certainty. Do not confuse a barrier drawn on a diagram with a barrier that is available during the shift. James Reason's work on active and latent failures remains useful because visible events often sit on top of conditions that a single operator cannot repair.

Do not ask EHS to carry the entire result after the workshop. Engineering should own design assumptions, operations should own operating discipline, maintenance should own equipment reliability, and leadership should resolve cross-functional decisions that the worksite cannot settle alone. Andreza Araujo's experience across 30+ countries reinforces why accountability must follow authority.

When the result is presented to the executive team, ask three questions. Which decision did this analysis enable? Which critical control changed because of it? What evidence will show that the change remains effective next month? If the team cannot answer, the method has not yet completed its job.

Choose the method that leaves a decision trail

LOPA, QRA, and Bow-Tie are complementary tools, not competitors in a search for the most sophisticated report. LOPA fits a defined scenario and a protection-layer decision. QRA fits system-level frequency, consequence, and uncertainty questions. Bow-Tie fits barrier ownership and operational communication.

The strongest major-hazard programs connect them through a common scenario language, clear owners, and field evidence. The critical-control verification guide explains why activity counts do not prove barrier health, while the decision-log guide shows how to preserve the judgment behind a temporary acceptance or design choice.

Andreza Araujo's record of 25+ years in executive EHS, including a 50% accident-ratio reduction in six months at PepsiCo South America Foods, supports a practical standard for analysis. The value is not in producing a report that sounds rigorous. The value is in making the next safe decision clearer, owned, and verifiable.

For more guidance on risk management and safety culture, explore the English safety articles and the books in Andreza Araujo's store. The right method is the one that leaves the operation with a better decision trail than it had before the assessment.