Skip to content
Bowtie risk templates

Bowtie — Undeclared Allergen in a Ready Meal

Food safety bowtie for undeclared allergen reaching a retail ready meal, ranking barcode reconciliation at the packing line as the one barrier whose removal multiplies residual risk almost fourfold.

Template previewBowtie risk
Undeclared allergen reaches a retail ready mealHAZARDMilk, gluten and nut allergens handled on shared p…THREATSPREVENTIVE BARRIERSRECOVERY BARRIERSCONSEQUENCESSecond-tier supplier substitutionis invisible to usAnnual supply chain mapping tothe second tierContractual specificationchange notification60% · controlGoods-in certificate ofanalysis check55% · detectionClean shortened to recover a latescheduleChangeover clean signed off byshift quality onlyValidated allergen cleanbetween products85% · controlProtein swab verificationbefore restart70% · detectionAllergen-sequencedproduction schedule50% · controlBarcode reconciliation oflabel to work order90% · detectionLabel reel change witnessedby a second operator45%Three-stage artworkproofing with technicalsign-off75% · controlPre-launch allergendeclaration audit50% · detectionConsumer care line triageand medical escalation40% · recoveryRapid point-of-salewithdrawal within 4 hours65% · recoveryRework batches break thetraceability chainRework logged against thereceiving batch onlyTraceability to one hour ofproduction80% · recoveryRetailer recall noticewithin 24 hours60% · recoveryCorrective action planagreed with technicalmanager45% · recoveryDocumented due diligencedefence pack40% · recoverySupplier changes arecipe withoutnotifying us1.2/yr → 0.216/yrCross-contact duringa line changeover6/yr → 0.135/yrWrong label appliedat the packing line3.5/yr → 0.1925/yrArtwork errorsurvives the approvalchain0.8/yr → 0.1/yrAnaphylaxis in anallergic consumersev 5 · risk 0.6757National productrecallsev 4 · risk 0.2059Delisting by theretailersev 3 · risk 1.06Prosecution underfood informationregulationssev 3 · risk 1.16Product reachesretail with anundeclared…0.6435/yrtop-event frequencyTop event0.6435/yrinherent 11.5/yrResidual risk3.1inherent 173Risk reduction98.2%threat side 94.4%Barriers154 threats · 4 consequencesDominant threatSupplier changes a recipe without notif…33.6% of the top eventResidual risk 3.1 against an inherent 173 — the barriers remove 98.2% of it. 2 things are probably not what was meant — every path and every escalation factor was checked.Barrier criticality — residual risk if that one barrier were removed1. Barcode reconciliation of label to work order+8.35 ×3.72. Validated allergen clean between products+3.69 ×2.23. Contractual specification change notification+1.56 ×1.54. Protein swab verification before restart+1.52 ×1.55. Three-stage artwork proofing with technical sign-o…+1.45 ×1.56. Goods-in certificate of analysis check+1.27 ×1.4FindingsConsequence "Delisting by the retailer" rests on ONE barrier. Defence in depth is the claim a bowtie is drawn to make, and a single barrier is a single point of failure: the day it fails is the day the consequence lands in full…Consequence "Prosecution under food information regulations" rests on ONE barrier. Defence in depth is the claim a bowtie is drawn to make, and a single barrier is a single point of failure: the day it fails is the day the cons…Each of the 4 consequences is credited the full top-event frequency of 0.6435/yr — the model here is that one top event produces all of them, so the residual score of 3.1 adds 4 outcomes to one event. That is right when they ha…

Make it your own.

title "Undeclared allergen reaches a retail ready meal"
hazard "Milk, gluten and nut allergens handled on shared production lines"
top "Product reaches retail with an undeclared allergen"
unit "/yr"

threat "Supplier changes a recipe without notifying us" likelihood: 1.2 {
  barrier "Contractual specification change notification" effectiveness: 0.6 type: control {
    escalation "Second-tier supplier substitution is invisible to us" {
      control "Annual supply chain mapping to the second tier"
    }
  }
  barrier "Goods-in certificate of analysis check" effectiveness: 0.55 type: detection
}

threat "Cross-contact during a line changeover" likelihood: 6.0 {
  barrier "Validated allergen clean between products" effectiveness: 0.85 type: control {
    escalation "Clean shortened to recover a late schedule" {
      control "Changeover clean signed off by shift quality only"
    }
  }
  barrier "Protein swab verification before restart" effectiveness: 0.7 type: detection
  barrier "Allergen-sequenced production schedule" effectiveness: 0.5 type: control
}

threat "Wrong label applied at the packing line" likelihood: 3.5 {
  barrier "Barcode reconciliation of label to work order" effectiveness: 0.9 type: detection
  barrier "Label reel change witnessed by a second operator" effectiveness: 0.45
}

threat "Artwork error survives the approval chain" likelihood: 0.8 {
  barrier "Three-stage artwork proofing with technical sign-off" effectiveness: 0.75 type: control
  barrier "Pre-launch allergen declaration audit" effectiveness: 0.5 type: detection
}

consequence "Anaphylaxis in an allergic consumer" severity: 5 {
  barrier "Consumer care line triage and medical escalation" effectiveness: 0.4 type: recovery
  barrier "Rapid point-of-sale withdrawal within 4 hours" effectiveness: 0.65 type: recovery
}

consequence "National product recall" severity: 4 {
  barrier "Traceability to one hour of production" effectiveness: 0.8 type: recovery {
    escalation "Rework batches break the traceability chain" {
      control "Rework logged against the receiving batch only"
    }
  }
  barrier "Retailer recall notice within 24 hours" effectiveness: 0.6 type: recovery
}

consequence "Delisting by the retailer" severity: 3 {
  barrier "Corrective action plan agreed with technical manager" effectiveness: 0.45 type: recovery
}

consequence "Prosecution under food information regulations" severity: 3 {
  barrier "Documented due diligence defence pack" effectiveness: 0.4 type: recovery
}