See how teams reduce incidents and manage risk faster     See It in Action  →
Book a Demo

Best Risk Management Tools For EHS Professionals

Bowtie Methodology

Together, increased regulatory scrutiny and a plateauing fatality curve are pushing EHS professionals to rethink how they identify, score and monitor risk. Counting incidents after they happen is no longer enough to satisfy regulators or to move the needle on outcomes that have flatlined for years. The programs breaking through that plateau share a common trait: they identify hazards early, track the effectiveness of their controls in real time and give insight into where risk is building. 

However, as EHS professionals push for a more structured, evidence-based way of working, it’s important to make sure the foundational knowledge of risk management isn’t forgotten. The tools below serve as the foundation for a proactive, successful risk management program. 

The Risk Matrix

Often used alongside risk assessments, a risk matrix is a tool used to help prioritize risks and identify which ones require the strictest mitigative controls. grid plots risk likelihood on one axis and severity on the other.  

One axis of the matrix measures the likelihood that the hazard will occur, and the other axis measures the severity of the incident if it does. Together, they determine the overall consequence of a workplace risk.  

Risk matrix graphic

While a risk matrix provides a good starting point to help prioritize risks and identify which hazards require the strictest critical controls, it is important to point out their flawed nature. Risk matrices rely on human judgement and, whether subconscious or conscious, bias. Therefore, it’s important to use risk matrixes in conjunction with other risk management tools and reduce bias in the assessment process. 

The Risk Bowtie

A risk bowtie is a diagram built to illustrate the threats, preventative barriers, consequences and mitigation controls of any given hazard. The diagram gets its name from its shape: two triangles meeting at a center point, resembling a bowtie once every part is added: 

  • Hazard and top event: In the center of the bowtie lies the hazard and top event. The hazard is something with the potential to cause harm, such as a stored chemical or work at height. The top event represents the specific moment control over that hazard is lost, like a loss of containment or a fall from height. Every other part of the diagram builds outward from this point. 
  • Threats and preventive barriers: The left side of the bowtie maps out any threats that could trigger the top event. Each threat line carries one or more preventive barriers, or the controls meant to stop that particular cause from reaching the top event. 
  • Consequences and mitigative barriers: The right side of the bowtie shows the consequences that follow if the top event occurs. Each consequence line carries its own mitigative barriers, meant to limit the damage of a lost control. 
Bowtie Methodology

An important part of the bowtie risk methodology is that creating this diagram helps identify which controls are “critical,” meaning the absence of them significantly increases the likelihood of a serious injury or fatality.  

Risk Register

A risk register is a structured log of every identified risk facing an organization or site, along with its description, potential severity, current controls and the responsible owner.  

A well-built register typically documents: 

  • A clear description of the risk and the activity or asset it’s tied to 
  • The likelihood and severity ratings, often pulled straight from a risk matrix 
  • Existing controls and their current effectiveness 
  • A risk owner who is accountable for the item 
  • Planned actions, deadlines and status updates 
  • A review date 

Registers create an audit trail that regulators and insurers increasingly expect to see, showing that a risk was identified, assessed, assigned and tracked over time.  

The most common failure with risk registers is letting them go forgotten. While it may be easy to document a risk and move on, effective risk registers serve as the catalyst for corrective and preventative actions.  

Learn how to properly manage outstanding actions -> 

Key Risk Indicator

A key risk indicator, or KRI, is a metric that signals whether a specific risk warrants corrective or preventative actions. Common EHS KRI examples include: 

  • Overdue corrective action rate 
  • Near-miss reporting rate 
  • Permit-to-work compliance rate 
  • Training compliance rate 
  • Critical control verification rate 
  • Numbers of bypassed controls   
  • Frequency of alarm triggers   

KRIs work best by setting a threshold for each indicator that triggers a specific response. For example, if overdue corrective actions cross 15 percent, that should automatically trigger a management review. This ensures and encourages a proactive approach to risk management. 

Risk Assessment

A risk assessment is the process of identifying hazards, evaluating how likely they are to cause harm and how severe that harm could be. It’s the starting point for almost every other tool on this list.  

Most formal risk assessments follow a similar sequence: 

  1. Identify the hazard and the task, equipment or process it’s connected to 
  2. Determine who or what could be harmed and how 
  3. Rate the likelihood of the event occurring 
  4. Rate the severity of the consequences if it does 
  5. Combine those ratings to produce an overall risk score, rating or measurement 
  6. Identify existing controls and decide whether additional controls are needed to reduce the score 
  7. Document the assessment and set a review date 

There are two main types of risk assessments: qualitative and semi-quantitative. Learn about their differences here. 

Bringing These Tools Together

None of these tools work in isolation. Key risk indicators measure whether a risk hits the threshold for review. A risk assessment and matrix score that hazard consistently. A risk bowtie identifies the barriers that matter most for a given hazard. A risk register keeps it visible and assigned to an owner. 

EHS leaders who build this kind of connected system spend less time reacting to incidents and more time proactively controlling risk. That’s the real shift happening across the profession right now: demonstrating, with real data, that workplace risk is under control. 

Want to learn more? For more information, consult our library of risk management resources:  

Table of Contents

About the author

Team Evotix

This article was developed by Evotix’s team of health and safety professionals. With backgrounds across EHS&S, our experts collaborate to share practical insights and proven strategies to help organizations strengthen their EHS&S programs.

Share

Want to learn more?