What-If Analysis vs JSA vs Bow-Tie: which review fits an operating change?

On the Headline Podcast, Andreza Araujo and Dr. Megan Tranter keep returning to one question that sounds simple and is not. Are we choosing the review that fits the decision, or are we choosing the review the organization already knows how to run? That difference matters most when an operating change reaches the field and people assume the paperwork already answered the risk.

What-If Analysis, JSA, and Bow-Tie are all useful. They are not interchangeable. What-If Analysis is strongest when the team is still testing scenarios. JSA is strongest when the task is already defined and the crew needs to break it down step by step. Bow-Tie is strongest when leaders need to see how a serious event can happen, which barriers stand between the crew and the event, and where the barrier logic is weak.

The mistake is not using one of them. The mistake is asking the wrong method to do the work of the others. In Sorte ou Capacidade, Andreza Araujo is blunt about this kind of confusion. Risk is managed with method, not bravado, and a good-looking review that does not change the next decision is only a professional decoration.

Key Takeaways

• Use What-If Analysis when the team needs to test scenarios before the change is fully defined.
• Use JSA when the task sequence is known and the crew needs a practical step-by-step control review.
• Use Bow-Tie when leaders need to see the serious-event pathway, the barriers and the consequence controls.
• Do not ask one method to answer all three questions, because that is how risk reviews become theater.
• For operating change, choose the method that changes the next decision, not the one that produces the prettiest worksheet.

Why the wrong review gets approved

Many organizations approve the wrong review because they begin with the template instead of the decision. A plant that is about to change a route, a sequence, an interlock setting or a temporary workaround does not need a generic risk ritual. It needs the method that can show where the change will break the current control set. If the review cannot do that, it should not be the lead method.

That is why operating change needs discipline. A leader may feel comforted by a familiar JSA, but a JSA is only as good as the task definition in front of it. If the change crosses interfaces, introduces a new exposure path or affects the barrier set, the team needs more than task steps. It needs scenario testing or barrier logic, and sometimes both.

In Cultura de Segurança: Da Teoria à Prática, Andreza Araujo argues that standards are boundaries of care, not boxes to tick. That idea fits this topic. A review is not valuable because it exists. It is valuable because it changes how people decide, who signs, who stops and what the field will do when the work meets reality.

What What-If Analysis is really for

What-If Analysis is the right tool when the question is still open. The team asks, "What if this valve fails closed?" or "What if the temporary access route blocks emergency movement?" and then uses the answers to shape the change before the risk hardens into routine. ISO 31010 places What-If among structured risk assessment techniques for exactly this kind of early scenario thinking.

The strength of What-If Analysis is speed with structure. It helps the team move through plausible scenarios without pretending the answer is already known. That makes it useful in management of change, pre-startup reviews, temporary field changes and early design discussions, especially when the team needs to decide whether a deeper study is needed.

The blind spot is depth. What-If can uncover weak points, but it may not show whether a serious event path is fully covered or whether a specific barrier has an owner and a proof standard. That is why the method works best when it opens the conversation rather than closes it. If the team is still uncertain after the What-If, the uncertainty is a signal, not a failure.

If your team needs a step-by-step version of that same discipline, the companion article on What-If Analysis: Run a 60-Minute Field Review is the right next read. It keeps the review close to the field instead of letting the worksheet drift away from the change.

What JSA is really for

JSA belongs when the task already has a shape. The crew knows the sequence, the supervisor knows the work package, and the team needs to break the job into steps, hazards and controls before execution. In that setting, JSA is practical because it forces a conversation about the real work, not the imagined work. It works best when the scope is narrow enough that the task map is stable.

The strength of JSA is specificity. It helps the supervisor and the crew ask where the error can happen, which step depends on another step and what control must be in place before the next move. That makes it especially useful for repetitive tasks, maintenance jobs, access work and work packages where the sequence is known but the field conditions can still shift.

The blind spot is scope. JSA can become a comfort tool when the change is broader than the task. If the problem is interface risk, temporary design change, multiple crews or a barrier set that could fail across several steps, the JSA may be too local. It still matters, but it is no longer enough by itself.

That is the point where the team should ask whether the risk sits in the task or in the system around the task. If it sits in the system, JSA should hand off to a wider review rather than pretending to be the whole answer.

What Bow-Tie is really for

Bow-Tie is the best of the three when leaders need to understand a serious-event pathway. It shows the threat side, the central event, the barrier set and the consequence controls in one picture. That makes it valuable for high-consequence exposures, major hazard management, executive risk committees and any review where the organization must explain how a loss can still happen even when several controls are already in place.

The strength of Bow-Tie is strategic clarity. It helps executives see that a serious event is not a single failure. It is a chain of failed prevention, missing ownership or weak recovery. That is why Bow-Tie often fits better at the top of the decision tree than at the start of a field checklist. It gives the board or senior team a common language for where the exposure lives.

The blind spot is proof. Bow-Tie can make a control look credible on paper even when the field has not verified it. A barrier map is not a barrier test. The organization still needs field evidence, ownership and a clear rule for when the barrier is considered weak. Otherwise the diagram becomes a polished story about protection, not proof of protection.

In Sorte ou Capacidade, Andreza Araujo keeps the point sharp. Luck does not hold up over the medium term, so leaders need method, proof and escalation. Bow-Tie is useful precisely because it exposes where luck is still being mistaken for control.

Decision matrix

If the change is still forming, What-If Analysis is usually the first pass. If the work is already defined, JSA gives the crew the best step-level discussion. If the decision is about fatal exposure, Bow-Tie belongs in the room because it shows whether the organization is managing the event pathway or just naming it.

For another angle on field-proof discipline, the article on Bow-Tie vs FMEA vs Critical Control Verification shows why a visual model alone is not the end of the work. That companion piece is useful if your team wants to separate pathway logic from verification logic.

How leaders should sequence the three

Leaders should start with the question, not the method. If the operating change is still vague, What-If Analysis should come first because it helps the team discover which scenarios matter. If the change is already defined enough to schedule work, JSA should come next so the crew can plan the task safely. If the change touches major hazard barriers or serious injury pathways, Bow-Tie should frame the executive view before anyone assumes the task review is enough.

The sequence matters because it prevents false confidence. A team that begins with JSA may lock itself into a narrow view before the broader risk picture is clear. A team that begins with Bow-Tie may waste time building a serious-event model before the task logic is understood. A team that uses What-If first can decide where the real work is, then move to the right level of detail without overbuilding the wrong artifact.

That sequence is also consistent with Andreza Araujo's wider editorial point in Safety Culture: From Theory to Practice. Culture is visible when leaders verify what they say they value. If they say the change is important, the review they choose should match the level of risk they are willing to carry.

What the board should ask next

The board does not need to know every technical detail of the review. It does need to know whether the review matches the decision. The right questions are simple. What changed? Which method was used first? What did that method prove? What did it not prove? Which controls were verified in the field before the work continued?

Those questions keep the board out of decorative safety and into decision quality. They also prevent the common mistake where a site says the risk was reviewed, while the board assumes the review covered the whole exposure. In reality, each method answers a different question, and the board should care about the question before it cares about the format.

That is also where Headline Podcast has an edge. A good leadership conversation does not stop at the tool. It asks whether the tool changed what the organization would do next. That is the standard worth keeping.

FAQ

Is What-If Analysis enough for operating change? Not always. It is a strong first pass when the change is still being shaped, but it may need a JSA or Bow-Tie follow-up when the exposure becomes more specific.

Should JSA replace Bow-Tie? No. JSA is a task review, while Bow-Tie is a serious-event pathway review. They answer different questions and should not be treated as substitutes.

When should Bow-Tie come first? Bow-Tie should come first when the change touches major hazard exposure, fatal risk or a barrier set that senior leaders must understand before approving the work.

Which method belongs in management of change? Usually What-If Analysis starts the conversation, JSA handles the task level, and Bow-Tie covers the serious-event pathway when the change is high consequence.

What should leaders do when the review feels complete but the field is still uncertain? Stop treating the review as proof. Ask for field verification, ownership and a clear escalation rule before the work proceeds.

The best review is the one that changes the decision in front of the leader. If the operating change is still forming, What-If Analysis earns the first pass. If the task is defined, JSA sharpens the crew conversation. If the risk is serious, Bow-Tie shows whether the control system is real enough to trust.

Follow Headline Podcast for more conversations where leadership and safety meet field reality.