Critical risk control with bowtie analysis