Managing Major Accident Hazards in Oil & Gas: Moving Beyond Paper Bowties

How digital Critical Control Management strengthens barrier assurance

Major Accident Hazards (MAHs) sit at the very top of the risk hierarchy in Oil & Gas. Loss of well control, hydrocarbon releases, explosions, structural failures, and toxic exposures are low-frequency but high-consequence events—capable of causing catastrophic harm to people, assets, the environment, and organisational reputation.

Over the past two decades, bowtie analysis has become the dominant method for visualising these risks. Bowties are now embedded in safety cases, process safety management systems, and regulatory submissions across the industry.

Yet despite widespread adoption, major accidents continue to occur. Investigations repeatedly reach the same conclusion:

The hazards were known. The controls existed on paper. But they were not working as intended at the time they were needed most.

This is where many organisations are now reassessing a difficult truth: paper bowties alone do not provide assurance.

‍

The limits of paper bowties

Bowties are excellent risk communication tools. They help teams visualise:

• Credible threat pathways

• Preventive and mitigative barriers

• Escalation factors that can weaken controls

However, traditional bowtie implementations suffer from several structural weaknesses:

1. Bowties often freeze risk in time

Most bowties are created during workshops or major project milestones. Once approved, they are reviewed annually—or only after an incident. Meanwhile, operations change daily: assets age, procedures drift, staffing changes, and environmental conditions evolve.

2. Controls are described, not proven

Paper bowties typically answer what the controls are, but not:

• Whether they are present

• Whether they are effective

• Whether they are degrading

• Whether anyone would know if they failed

3. Verification is disconnected from operations

Inspection results, maintenance backlogs, permit deviations, training gaps, and incident precursors often live in separate systems. As a result, there is no single, real-time view of barrier health.

4. Assurance is retrospective

Evidence is usually compiled after the fact—for audits, regulators, or investigations—rather than being continuously available.

In short, paper bowties explain risk, but they do not manage it.

From bowties to Critical Control Management (CCM)

Critical Control Management (CCM) emerged to close this gap.

Rather than treating controls as static concepts, CCM treats them as operational safeguards that must be actively monitored, verified, and assured.

At its core, CCM asks four simple but powerful questions:

1. Which controls are truly critical to preventing or mitigating a MAH?

2. What must be true for each control to work as intended?

3. How do we verify that this is actually happening?

4. How quickly do we detect and respond when it is not?

In Oil & Gas, this approach aligns closely with barrier management principles and regulator expectations around demonstrating effective control of MAHs.

Why digital CCM changes the game

Digital CCM platforms take the logic of the bowtie and embed it into day-to-day operations.

Instead of sitting in a PDF or slide deck, critical controls become living, measurable elements of the safety management system.

1. Controls are linked to real-world data

A digital CCM system connects critical controls to operational evidence such as:

• Inspections and audits

• Maintenance activities

• Permit-to-work conditions

• Training and competency records

• Incident and near-miss reports

This allows organisations to see control performance, not just control intent.

2. Barrier health becomes visible

Rather than asking “Do we have a pressure relief valve?”, digital CCM asks:

• Has it been inspected on time?

• Were defects found?

• Are temporary overrides in place?

• Are assurance tasks overdue?

Barrier health can then be visualised through dashboards, alerts, and trends—highlighting early signs of degradation before failure occurs.

3. Weak signals are detected earlier

Major accidents are rarely sudden. They are preceded by weak signals: small deviations, minor failures, near misses, and workarounds.

By analysing data across multiple controls and sites, digital CCM helps surface patterns that would otherwise remain invisible—especially in complex, distributed operations.

4. Accountability is explicit

Each critical control can be clearly assigned:

• An accountable owner

• Defined performance standards

• Escalation thresholds

This removes ambiguity around who is responsible for ensuring controls remain effective.

5. Assurance becomes continuous, not episodic

Instead of scrambling to assemble evidence for audits or regulators, organisations maintain a living assurance record—demonstrating, at any point in time, how MAH risks are being controlled.

Strengthening regulator and board confidence

Regulators are increasingly focused not on whether organisations say they manage MAHs, but whether they can demonstrate effective control.

Digital CCM supports this shift by enabling:

• Traceability from MAH → critical control → verification activity

• Evidence-based demonstrations of ALARP

• Clear escalation pathways when controls degrade

• Consistent assurance across assets and sites

For boards and executives, this translates into:

• Clear visibility of top-tier risk exposure

• Confidence that safety reporting reflects reality

• Early warning before MAH risk escalates beyond tolerance

Moving beyond paper: a mindset shift

Importantly, moving beyond paper bowties is not just a technology change—it is a mindset change.

It requires organisations to accept that:

• Controls can and do degrade

• Compliance does not equal effectiveness

• Assurance must be continuous, not annual

• Learning must occur before catastrophe, not after

Digital CCM provides the structure and visibility to support this shift—but its real value lies in changing how organisations think about risk control.

The future of MAH management in Oil & Gas

As Oil & Gas operations become more complex, geographically dispersed, and data-rich, the limitations of static risk tools will only become more apparent.

The future of MAH management lies in:

• Living bowties connected to operational reality

• Real-time barrier health monitoring

• Early detection of weak signals

• Evidence-based assurance for regulators and boards

Paper bowties will always have a place as communication tools. But when it comes to preventing the next major accident, they are no longer enough on their own.

Major accidents are rarely caused by unknown hazards. They occur when known controls quietly stop working—and no one notices in time.