Incident Investigation & Risk Management Glossary
RiskoPilot is an AI-powered incident investigation and risk management platform. This glossary defines the core vocabulary used across Tripod Beta, BowTie, STEP and barrier-based methodologies.
- Tripod Beta
- Tripod Beta is an incident-investigation methodology developed by Shell that traces causation through trios of agent, hazard and target, identifies failed barriers, and links immediate causes to underlying preconditions and Latent Failures grouped under General Failure Types.
- BowTie
- A BowTie diagram visualises a single Top Event with threats on the left, consequences on the right, and barriers in between. It is widely used in oil & gas, aviation and process industries to communicate risk control posture in a single page.
- Barrier
- A barrier is any control, defence or safeguard — physical, procedural or behavioural — that prevents a threat from reaching a top event or escalating into a consequence. Barriers are classified as intact, failed or missing during incident analysis.
- Top Event
- The Top Event is the moment of loss of control over a hazard — for example, a hydrocarbon release, an uncontrolled energy transfer or a person entering a danger zone. It sits at the centre of every BowTie diagram.
- GFT (General Failure Type)
- General Failure Types are eleven organisational categories — Hardware, Design, Maintenance Management, Procedures, Error-enforcing Conditions, Housekeeping, Incompatible Goals, Communication, Organisation, Training, and Defences — used in Tripod Beta to classify the latent failures behind incidents.
- Latent Failure
- A latent failure is a hidden organisational weakness — flawed procedures, training gaps, conflicting goals — that lies dormant until combined with active triggers to produce an incident. Latent failures are the deepest layer Tripod Beta investigates.
- Immediate Cause
- An immediate cause is the unsafe act or condition that directly preceded the incident. In Tripod Beta it forms the Active Failure layer of the trio, distinct from preconditions and underlying latent failures.
- Precondition
- A precondition is the situational factor — fatigue, time pressure, poor lighting, missing tools — that made the immediate cause more likely. Tripod Beta places preconditions between the active failure and the underlying latent failures.
- STEP Chart
- A Sequentially Timed Events Plotting (STEP) chart maps each actor's actions on a horizontal timeline, exposing convergence points where multiple actors interact at the same moment. It is essential for multi-party incidents like vessel collisions or process upsets.
- HET Trio (Hazard–Event–Target)
- The HET trio is the atomic Tripod Beta unit: a Hazard releases energy through an Event onto a Target. Every barrier failure is plotted against one trio, making causation auditable rather than narrative.
- Root Cause
- A root cause is the deepest controllable factor whose removal would prevent recurrence of the incident. Modern methodologies like Tripod Beta reject single-root thinking and instead identify multiple latent failures across organisational layers.
- Incident Investigation
- Incident investigation is the structured process of gathering evidence, reconstructing the sequence of events, identifying causal factors and producing recommendations to prevent recurrence — typically using a recognised methodology such as Tripod Beta, ICAM or TapRoot.
- Risk Management
- Risk management is the coordinated set of activities to identify, assess, treat and monitor risks across an organisation. In HSE contexts it combines hazard registers, BowTie diagrams, barrier health monitoring and lessons-learned from incident investigations.
- Barrier Analysis
- Barrier analysis evaluates each preventive and mitigative control along an incident pathway, classifying it as intact, failed or missing. It is the bridge between BowTie risk modelling and Tripod Beta causation analysis.
- RAM (Risk Assessment Matrix)
- A Risk Assessment Matrix scores incidents and risks on a severity × likelihood grid, typically 5×5. It standardises prioritisation across an organisation and is required by ISO 45001 and most major operator HSEMS.
- 5 Whys
- The 5 Whys is a root cause analysis technique that asks 'why' iteratively until an underlying cause is reached. Fast and simple, it produces a linear causal chain but tends to terminate at human error and cannot reveal organisational failures the way Tripod Beta does.
- Fishbone (Ishikawa) diagram
- A Fishbone or Ishikawa diagram clusters potential causes of a problem under categories such as Methods, Machines, Materials, Manpower, Measurement and Environment. It is useful for brainstorming but is descriptive rather than analytical and does not classify organisational failure modes.
- Fault Tree Analysis (FTA)
- Fault Tree Analysis is a top-down deductive method that decomposes a top undesired event into combinations of basic failures through Boolean AND/OR gates. Widely used in nuclear, aerospace and process safety to quantify failure probabilities and identify minimal cut sets.
- Event Tree Analysis (ETA)
- Event Tree Analysis is a forward, inductive method that traces all possible consequences of an initiating event through a sequence of barrier successes and failures. ETA complements Fault Tree Analysis and underpins the right-hand side of a BowTie diagram.
- HAZOP (Hazard and Operability Study)
- A HAZOP is a structured node-by-node review of a process using guide words (No, More, Less, Reverse) applied to design parameters to identify deviations, causes, consequences and safeguards. It is mandated by Seveso III, OSHA PSM and most major-operator MOC procedures.
- LOPA (Layer of Protection Analysis)
- LOPA is a semi-quantitative risk analysis that evaluates the independence and reliability of protection layers (BPCS, alarms, SIS, relief, mitigation) between an initiating event and a consequence. It calibrates Safety Integrity Levels (SIL) and complements HAZOP findings.
- ICAM (Incident Cause Analysis Method)
- ICAM is an incident analysis method developed by BHP that classifies contributing factors under absent/failed defences, individual or team actions, task or environmental conditions and organisational factors. Widely used in mining, it shares conceptual ground with Tripod Beta and Reason's Swiss Cheese model.
- Swiss Cheese Model
- James Reason's Swiss Cheese Model represents organisational defences as slices of cheese with holes; an accident occurs only when active failures and latent conditions align across all layers. It is the conceptual foundation of Tripod Beta, ICAM and most modern barrier-based methods.
- Near-miss
- A near-miss is an unplanned event that had the potential to cause harm but did not, because a barrier held or chance intervened. Investigating near-misses with the same rigour as accidents is a leading indicator of HSE maturity and a core IOGP Report 456 KPI.
- Corrective Action (CAPA)
- A corrective action is a SMART, time-bound measure taken to eliminate the cause of a non-conformity or incident and prevent recurrence. Under ISO 45001 §10.2, every investigation must produce traceable corrective actions, owners and verification of effectiveness.
- ISO 45001
- ISO 45001:2018 is the international standard for occupational health and safety management systems. Clause 10.2 mandates structured incident investigation, root cause identification, corrective action and verification — the workflow RISKOPILOT automates end-to-end.
- Causation path
- A causation path is the traced sequence of events, decisions and barrier failures linking an initiating cause to the Top Event of an incident. In Tripod Beta, every HET trio sits on its own causation path, making organisational contribution explicit and auditable.
Related: BowTie
Related: Tripod Beta
Related: Risk Management
Frequently Asked Questions
See also: Tripod Beta · BowTie · About