Preventive versus corrective measures: the distinction that sharpens your bow-tie analysis in Risk Companion

Plenty of teams build bow-tie diagrams. Fewer build them in a way that actually changes how they manage risk. The difference, more often than not, comes down to one question: do you know which of your measures stop an event from happening, and which ones limit the damage once it has?

That distinction — preventive versus corrective measures in risk management — sounds straightforward. In practice, it gets blurred constantly. Measures end up on whichever side of the diagram felt right at the time, ownership is vague, and the resulting bow-tie looks thorough without telling you much about your real exposure.

The preventive versus corrective distinction in bow-tie analysis is not a semantic point. It determines whether you understand your risk profile or only think you do. An organisation that has loaded its bow-tie with corrective measures but few preventive ones is not well-protected against the risk occurring. It is well-equipped to deal with the aftermath. Those are not the same thing, and a register that treats them as equivalent is quietly misleading the people reading it.

What the two sides of a bow-tie actually represent

A bow-tie diagram has a specific structure. Causes sit on the left, the central risk event sits in the middle, and consequences spread to the right. Preventive barriers occupy the left side, between each cause and the central event. Corrective (or mitigating) barriers occupy the right side, between the event and each consequence.

The left side is about prevention. Each barrier there represents something that intercepts a cause before it can trigger the event. The right side is about recovery. Each barrier there represents something that limits how bad things get once the event has already occurred.

Picture a construction site where the identified risk is a scaffold collapse. On the left, preventive barriers might include a weekly inspection regime, a load-limit sign-off process, and a mandatory ground condition check before erection. On the right, mitigating barriers might include an exclusion zone, emergency response procedures, and site evacuation protocols.

Both sides matter. But they represent fundamentally different postures. If your bow-tie has four barriers on the right and one on the left, you are not managing this risk. You are managing its consequences. The scaffold still collapses — you are just more organised about what happens next.

Why organisations confuse the two

The confusion happens for a few reasons, and none of them are unusual.

The first is that workshops produce measures without pausing to ask which side of the event they belong on. Someone says "we have a safety briefing" and it goes into the register. Whether it stops the event or limits the damage depends on what the briefing covers, but that question rarely gets asked in the room.

The second is that corrective measures feel more tangible. Response plans, emergency contacts, and escalation paths are things people can point to. Preventive measures often involve process discipline and early-warning systems that are harder to see and easier to ignore until they fail.

The third is that many risk registers — and plenty of bow-ties — are built for auditors rather than for the people who manage the risks. A comprehensive-looking diagram passes a review. Whether it reflects reality is a different question.

We think this is one of the most underappreciated problems in operational risk management. A bow-tie that conflates prevention and correction does not just fail to communicate clearly. It actively gives decision-makers a false sense of where their protection sits.

Escalation factors add another layer

One concept that most bow-tie explanations mention briefly and then move past is escalation factors: conditions that can degrade or disable a barrier.

A preventive barrier that is undermined by an escalation factor is not really a barrier at all. The weekly scaffold inspection is a strong preventive control — unless inspection records are not reviewed, unless the inspector has not been trained to the current standard, or unless time pressure routinely causes checks to be skimmed. Any of those conditions turns a documented control into a line on a form.

Escalation factors matter most on the preventive side, because that is where a failure means the event happens. If a corrective barrier is degraded, the consequences are worse than planned. If a preventive barrier is degraded and you did not know it, the event occurs when your register said it should not have been able to.

Mapping escalation factors alongside your preventive barriers is worth the effort. It tells you which controls are genuinely robust and which are load-bearing only on paper. A measure attached to two or three escalation factors should prompt a conversation about whether it is actually doing the work you think it is.

What happens when you confuse preventive and corrective measures

Here is a realistic scenario. A logistics company identifies the risk of a serious data breach. The team builds a bow-tie. On the right side, they have an incident response plan, a customer notification process, and a regulatory reporting procedure. On the left, they have "access control policy" and "staff training."

The bow-tie looks balanced. But when you look closely, the access control policy is a document rather than a technical control, and the staff training runs once a year with no follow-up. Two nominal preventive barriers, both weak, sitting in front of a well-organised response apparatus.

What the organisation thinks it has: a risk with meaningful prevention in place. What it actually has: a response plan for a breach it has done little to prevent.

The distinction between these two risk profiles matters enormously when something goes wrong, and it matters now for the decisions you make about where to spend time and resource. A bow-tie that does not force this distinction allows organisations to overestimate their prevention capability and underestimate their residual exposure at the same time.

How Risk Companion makes this distinction actionable

Understanding the theory is one thing. Having a system that enforces the distinction in practice is something else.

In Risk Companion's bow-tie feature, every measure is classified at the point of creation as either preventive or mitigating. Preventive measures attach to the left side of the bow-tie, between a cause and the central event. Mitigating measures attach to the right side, between the event and a consequence. The classification is not optional, and it is not cosmetic: it determines where the measure sits in the diagram and how it is tracked.

Each measure carries a named owner, a due date, and a progress status. This means that at any point, you can see not just how many preventive barriers you have, but which ones are open, which are in progress, and which are overdue. A barrier without an active owner on a due date is not a functioning control. Risk Companion surfaces that rather than hiding it behind a tidy diagram.

You can read more about how measures are structured and tracked in the measure status and effectiveness documentation, and about the bow-tie feature itself in understanding bow-ties.

The practical effect is that your bow-tie stops being a static diagram you update before an audit and becomes a view of who is doing what, by when, to keep your risks in check. When a preventive measure slips past its due date, you see it. When a risk has three corrective measures and no preventive ones, that imbalance is visible rather than buried.

This is the difference between a bow-tie as a documentation exercise and a bow-tie as a management tool. The diagram alone does not do it. The measure classification, ownership, and status tracking are what make it live.

Reviewing the balance across your register

Once your bow-ties are built with this distinction properly in place, a useful exercise is to review the balance across your register rather than risk by risk.

A pattern of strong prevention on high-consequence risks and lighter prevention on lower-severity ones is healthy. A pattern where your most serious risks have the most corrective measures and the fewest preventive barriers is worth a hard conversation about where your real exposure sits.

Risk Companion's Mitigation Status dashboard surfaces risks without measures and flags overdue deadlines across the register. Combined with the bow-tie classification, this gives you a portfolio view: not just which risks have measures, but whether those measures are actually doing prevention work or just organising your response when things go wrong.

The distinction between preventive and corrective measures is not complicated in theory. What takes discipline is maintaining it under the pressure of real workshops, fast-moving projects, and the natural human preference for things that look complete over things that actually are.

Getting it right is what separates a bow-tie that makes you more confident about your risk posture from one that just makes you feel that way.

Risk Companion's free 14-day trial builds a demo project from your own organisation's profile, so you can see the preventive and mitigating measure classification working inside a real bow-tie before you commit to anything. No credit card needed.