DerpGRC

    Topics in this domain

    Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi

    Assessment methods · 1 min read

    Choosing a technique

    Matrix of techniques: bow-tie, fault tree, event tree, Delphi, Monte Carlo, root cause analysis, with what each does and when to use it.

    The bow-tie

    Causes, preventive barriers, risk event, mitigating barriers, consequences.

    The bow-tie puts the risk event in the middle. Preventive controls sit on the left, between the causes and the event; mitigating controls sit on the right, between the event and the consequences.

    Fault tree versus event tree

    • Fault tree: start with the failure and work back. Which combinations of causes (AND/OR) lead to it?
    • Event tree: start with the event and work forward. If each control works or fails, what outcomes follow?

    Getting good estimates

    • Delphi: anonymous rounds until the experts converge.
    • Structured interviews and workshops with clear scales.
    • Calibrating estimates against incident and industry data.

    Example. Estimates of a cloud outage’s likelihood swung wildly in an open workshop dominated by one senior engineer. A two-round Delphi exercise produced a tighter, better-supported range.

    How the exam asks about it

    If the question asks…The answer is usually…
    Technique showing preventive and mitigating controlsBow-tie
    Work backwards from a failure to causesFault tree analysis
    Avoid groupthink in expert estimatesDelphi technique
    Prevent an incident recurringRoot cause analysis

    In short

    • Bow-tie analysis shows causes and preventive controls on one side and consequences and mitigating controls on the other.
    • Fault tree analysis works backwards from a failure to the combinations of causes that produce it.
    • Event tree analysis works forwards from an event through control success or failure to possible outcomes.
    • The Delphi technique gathers anonymous expert estimates in rounds to avoid groupthink.
    • Root cause analysis finds the underlying cause so that fixes prevent recurrence.
    • Match the technique to the question you need to answer.

    Exam traps

    • Confusing fault tree (backwards to causes) with event tree (forwards to outcomes).
    • Using open group discussion where Delphi's anonymity is needed to avoid dominant voices.
    • Treating symptoms because root cause analysis wasn't done.
    • Choosing a complex technique where a simple workshop would do.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 2 · Assessment methods

    Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi

    The structured techniques risk practitioners use to analyse causes, consequences and controls, and to get reliable estimates from experts, with guidance on when to use each.

    1 / 8