A Bowtie diagram at a Malaysian major hazard facility can pass its annual audit three years running — barriers listed, escalation factors noted, signed off each time — while one or more of those barriers has quietly stopped functioning as described. This isn’t a rare failure of diligence. It’s a predictable consequence of what most Bowtie audits actually check, versus what the underlying duty actually requires.
What an Audit Typically Checks
A standard Bowtie audit verifies that the diagram exists, is complete, and reflects the hazard scenarios the site has identified. It confirms barriers are listed against each threat and consequence pathway, that escalation factors are noted, and that the document has been reviewed and signed within the required cycle.
What this kind of audit rarely tests is whether each individual barrier listed on the diagram is still functioning as described — physically, operationally, and under the specific conditions the site currently runs. A diagram can be complete, current by date, and formally correct, while describing barriers that no longer match reality on the ground.
How the Gap Develops
The gap usually opens gradually, through changes that never individually looked significant enough to trigger a Bowtie review. A feedstock substitution. A modification to a scrubber or containment system that one of the listed barriers depends on. A process change that alters the conditions a detection barrier was originally calibrated for. Each change, taken on its own, is often classified correctly as minor from an engineering standpoint — because the classification process is asking whether the change is structurally sound and compliant, not whether it intersects with a barrier’s coverage or activation conditions.
None of these changes necessarily gets flagged for a Bowtie review, because the Bowtie review cycle is usually tied to a calendar — annually, or at the next audit — rather than to the process changes that actually determine whether the diagram is still accurate.
The Regulatory Position
For major hazard installations in Malaysia, the Control of Industrial Major Accident Hazards Regulations 1996 (CIMAH) place an ongoing duty on operators to demonstrate that safeguards remain effective against current process conditions — not merely that they were effective when originally commissioned and documented. This is a meaningful distinction. A Bowtie diagram that was accurate at the point it was drawn, and has simply never been updated against subsequent process changes, is not automatically compliant with that ongoing obligation — even if it passes every scheduled audit in the meantime.
Barrier Verification Versus Diagram Audit
The distinction that matters here is between two different questions. “Is the diagram complete and accurately drawn?” is what a standard audit answers. “Does every listed barrier still function, under current conditions, the way the diagram describes?” is a different question entirely — and it’s the one the underlying duty is actually built around.
A fixed fire suppression system, for example, can remain Specific (discharging at its rated parameters) and still lose Effectiveness if a subsequent modification changes the physical layout of the space it was designed to cover. The monthly function test confirms the mechanism activates. It doesn’t simulate whether the coverage still reaches every point in a room that’s since had a cable tray, a racking addition, or an equipment relocation placed inside it.
Closing the Gap
The structural fix is a connection between the site’s Management of Change (MoC) process and its Bowtie diagrams — a step, before any modification is approved, that checks whether the change intersects with the physical environment of a listed barrier. For most modifications the answer is clearly no, and the check adds negligible time. For those that do intersect, the check triggers a barrier effectiveness review before the modification proceeds, rather than after an incident reveals the gap.
The Practical Test
For any Bowtie diagram currently on file, ask whether the last review checked that the diagram was complete, or whether it checked that every listed barrier still functions under current site conditions. If it’s the former, the diagram may be technically up to date and still quietly describing a plant that no longer exists.
Want your Bowtie diagrams to reflect what’s actually functioning on site, not just what was true at commissioning? Cikgu Barrier’s Barrier Management: Bowtie Analysis programme teaches teams rigorous barrier validation, Management of Change integration, and CIMAH compliance for major hazard facilities. Available in-house and as a public workshop across Malaysia.