Back to overview

The Hierarchy of Controls and the Bowtie Model: A Reflective Perspective

The Hierarchy of Controls and the Bowtie

This article looks at the traditional perspectives relating to risk and the hierarchy of control. It addresses, how through understanding better the nature of a human being’s reflexes, what enhances and impairs it and why the traditional “last line of defence” is that very reflex action rather than personal protective equipment (PPE) which is actually the “last line of protection”. Building also on many years of practical and action-based research and working with many organizations around the world, the authors explain how working on developing and preparing workers to be more aware of their personal conditions and reactions can help prevent many serious incidents and accidents.

The traditional perspective on risk management and workplace safety positions personal protective equipment (PPE) as the last line of defense in the hierarchy of controls. This approach, while being intuitively sensible due to its tangible and demonstrable nature, may not encompass all scenarios, particularly those involving mechanical or kinetic energy. The reflex action, although significant in terms of the number of incidents it prevents, has been largely overlooked by safety professionals. However, once understood, it opens the door to exciting potential in terms of preventing serious injuries and fatalities.

To grasp the rationale behind PPE’s designation as the last line of defense, consider a workplace scenario involving a pump that operates at a hazardous noise level of over 85 decibels. Initially, efforts are made to keep workers away from the pump (isolating the worker from the hazard). If this isn’t feasible, enclosing the pump to reduce noise levels (isolating the hazard) is the next step. When maintenance requires a worker’s presence near the pump, PPE such as ear protection becomes essential. If the worker later suffers hearing loss, the employer can demonstrate that appropriate precautions were taken, a defensible position in legal contexts due to the tangible use of PPE.

A common misconception among safety professionals is that personal protective equipment (PPE) is the last barrier before an incident occurs. However, many pieces of PPE, such as seat belts and helmets, are actually escalation controls, meaning they only become useful after an incident has already begun. In these cases, PPE serves more as a line of protection than a line of defense. Certain PPE, like a face shield in front of a grinding wheel, can prevent incidents by blocking hazards directly. However, this type of PPE is not universally effective. For instance, a face shield won’t prevent a serious incident involving a forklift which is the #1 cause of in-plant fatalities1 . Furthermore, outside the controlled environment of the workplace, replicating protective measures is challenging. If someone steps out in front of a moving car or truck without looking, a sensor and armband are not going to prevent the incident.

In such scenarios, the outcome largely depends on whether the driver can react quickly enough to brake, or the pedestrian can notice and step out of the way in time. In scenarios like the above with a pump and operator, the Bowtie Model effectively maps the various sources of hazardous energy and potential outcomes, differentiating between preventative and mitigation controls. Unlike James Reason’s Swiss Cheese Model, which highlights deficiencies in control measures, the Bowtie Model delineates the sources of hazardous energy—mechanical, chemical, thermal, electrical, and biological. Notably, mechanical or kinetic energy accounts for the majority of serious injuries and fatalities (SIFs) . Moreover, when people make personal risk assessments, they do not do it based on whether the deficiencies in their control measures line up; they do it on the probability of something going wrong in the first place, for example: “it will be alright as long as nothing goes… (wrong)”, “it will be ok as long as we don’t make any… (mistakes)”, “it will be alright as long as we’re…(careful).”

Three Sources of Unexpected Events
Figure 1. Three Sources of Unexpected Events

Thus, it is widely understood that incidents arise from unexpected events. On a daily or weekly basis, the unexpected event can be attributed to one of three sources: oneself, another person, or the machinery/equipment. Personal injury reporting (over 4.5 million people in 76 countries) has revealed that more than 95% of the time, the unexpected event arises from the “self-area” (see Figure 1. Three Sources of Unexpected Events). This data is consistent with statistics from the Traffic Injury Research Foundation in the UK and the National Safety Council in America in which auto accident causation is attributed to driver error in over 90% of incidents. (Note: the other driver is someone else’s “self-area”).

Traditional safety paradigms suggest that the outcome of the unexpected event depends primarily on the total amount of hazardous energy involved, and luck. If only looking at data from lost time accidents, where there is roughly a 10:1 ratio of minor injuries (recordables) to major injuries (lost time), it is easy to understand why random chance or luck was assumed. However, upon examining a broader spectrum of incidents (which includes: small cuts, bruises, bumps, scrapes or unintentional pain) a ratio of approximately 1000:1 is revealed. This strongly suggests that assignable causes or an assignable cause, beyond luck, influence incident outcomes. Going one step further and considering serious close calls or near misses, it becomes evident that reflex actions play a critical role in preventing and mitigating incidents, from minimal and minor to serious and fatal injuries.

The focus on SIFs traditionally overlooks scenarios where reflexes could have averted incidents. In other words, the focus has been on incidents where a reflex would have been irrelevant. Higher-risk activities receive substantial attention by means of rules, procedures, and PPE, but medium to lower-risk activities often lack similar scrutiny. Data shows that approximately 900 workers in the U.S. die annually falling from heights, but 14-15,000 fatalities occur from slips and falls with over 50% being 6 feet/2 meters or less. Furthermore, in the examination of over 400 fatal workplace incident reports in the US, 47% could have been prevented or lessened significantly had the person had the benefit of a reflex. In only 29% of the cases would a reflex have been irrelevant. An additional 24% might have been prevented by a reflex, but the information on the report was ambiguous, typically because the worker was found dead and there were no witnesses. However, it was very likely that a reflex would have helped. This means that potentially 71% of SIFs could be prevented or lessened through a reflex action.

Reflexes are innate to humans and are tested shortly after birth to ensure their presence. However, the existence of reflexes does not guarantee their effectiveness or timeliness in real-world scenarios. The quality and efficacy of our reflexes are heavily influenced by our level of awareness and how regularly we practice them. Specifically, one’s mind being off task due to complacency is not inherently dangerous, because one’s reflexes can still prove effective, albeit not quite as fast as if the person was paying attention. However, if one’s eyes are also off task, the ability to react to something unexpected is left to auditory, olfactory, or tactile stimuli. Yet, waiting until you feel, hear, or smell something is by definition-reactive, and thus one may not be able to react in time to prevent the incident. Certainly, if there is no warning to alert one to the danger, and their eyes and mind remain off task, then they will not get the benefit of their reflexes and for that moment they are defenseless.

Unfortunately, human biology inherently limits continuous attention. The brain, consuming about half of blood glucose, conserves energy by switching to autopilot (the subconscious mind) unless something new, interesting, pleasurable or important demands attention. This automatic shift into complacency happens without conscious control, even around high-risk hazards, but especially around medium to low-risk activities (see Figure 2. Complacency Continuum). Additional states, such as rushing, frustration, and fatigue will cause further distraction from the task at hand.

Figure 2. Complacency Continuum

Rushing and frustration significantly contribute to a loss of focus, because our brain releases a mix of chemicals (norepinephrine, cortisol) that temporarily push the conscious mind aside. This reaction leads to tunnel vision, where the focus narrows exclusively on the immediate outcome or the obstacle. Fatigue affects our ability to focus differently. While in use, our brain consumes glucose and oxygen, generating energy but also producing waste products. These waste products build up in the brain throughout the day, progressively hindering the communication between brain cells. This accumulation is why it’s harder to think clearly or maintain attention toward the end of the day. Technology also exacerbates these issues. Mobile phones significantly increase distractions and reduce attention spans by conditioning our brains to experience and then expect brief periods of focus. Moreover, modern speeds far exceed those our ancestors had to deal with (our ancestors did not drive cars), and this further increases the need to see a potential source of danger like a slipping or tripping hazard or to see it coming if something is moving towards us.

To counteract the biological and technological challenges, it is imperative to develop habits and skills such as self-triggering that target rushing, frustration, fatigue, and complacency (See Figure 3. Critical Error Reduction Techniques). Self-triggering—recognizing and addressing these states in the moment—reduces critical errors. Selftriggering works best on rushing, frustration or fatigue, because these are states that you can feel and notice in the moment. Complacency, on the other hand, is a passive state. It is extremely difficult to recognize when you are complacent, because your mind is not thinking about what you are doing. It is, most likely, thinking about something else. Strong safety-related habits as mentioned before can compensate for mind not on task, and observing others for state-to-error patterns can fight complacency because it brings you back to the moment (when you see risk it makes you think about risk). And finally, analyzing close calls can help to motivate people to put some effort into these techniques if they think about how the close call could have been worse.

Critical Error Reduction Techniques
Figure 3. Critical Error Reduction Techniques

Mind on task is traditionally stressed as the key factor in preventing injuries. Generation after generation of parents have told their children to “be careful” or “pay more attention.” This is likely because nobody can think of a time in which they suffered an injury–whether minor or major–when they were thinking about what they were doing and the risk of what they were doing at the time of the incident (save for equipment or component failure or another person doing something unexpectedly). Given that we rarely make mistakes when deeply focused on something, it makes intuitive sense to suggest that the key to preventing errors is paying more attention. Yet, we know that full attention cannot be sustained for long durations. Therefore, messaging like “be more careful” (the repetitiveness itself begets complacency) is not reliable.

Building or improving habits that increase eyes on task can compensate for mind not on task, like leaving a safe following distance. Habits, given their nature, become part of our subconscious programming, meaning that we can perform them while in a subconscious mode (driving on auto-pilot). If the habit is to move your eyes first before moving your hands, feet, body or car, you will at least get a reflex, even if your mind is off task. This means that strong safety-related habits, specifically those related to eyes on task, are extremely important or perhaps the most important thing in terms of personal safety, because having your eyes on task gives you the opportunity to get the benefit of your reflexes. If you drive a car or motorcycle, just think about how many times your reflexes have helped you or saved you…

From an organizational perspective, it is also important to address these four states or human factors that are involved or are contributing factors in over 95% of all incidents and injuries. While they are primarily personal in nature, from a company perspective it is still necessary to avoid taking actions which will increase the level of rushing or frustration in the workplace. Providing nap areas, and ensuring employees are hydrating during breaks will also help to combat fatigue. Moreover, varying safety messaging can help reduce complacency; doing the exact same safety training every year will likely not increase favourable safety outcomes.

When considering human factors and the hierarchy of controls, it becomes apparent that the sources of hazardous energy are not the only inputs into the equation (See Figure 4. Bowtie model). Rushing, frustration, fatigue and complacency are also contributing factors to the outcome of the incident, because they lead to critical errors like eyes not on task, mind not on task, moving into or being in the line of fire, or losing your balance, traction, or grip.

These human factors, which cannot be entirely eliminated, substituted, engineered out, or prevented by the hierarchy of controls including PPE, determine whether or not we get the benefit of our reflexes. By using the critical error reduction techniques, we add an additional layer of defense or safety by being able to react to the unexpected event–whether that be before the incident (as a preventative measure) or afterward (as a mitigation control). As such, when the hazard is visible, our reflexes serve as the last line of defense, or the first line of protection… but only if our eyes are on task.

To conclude, this article has addressed the very significant aspect of reflex and human factors contributing to being a “real” last line of defence in preventing incidents and SIFs. This paradigm shift change is significant and has come from the deep reflective conversations that have taken place between both authors in the past 5 years. Building on much of the action based research through the work done through the SafeStart© company globally, and then augmented by the personal experiences and research of both authors, clearly organizations have a very good opportunity to prevent incidents and give workers, be they employees or contractors, a much better chance of preventing untoward incidents onto them – or at the very least reducing some of the potential consequences by using their reflexes leveraged by cognitive effectiveness through understanding better the cognitive “enhancing factors”

Download the article for free in the link below.