In the NHS, and more generally in healthcare, the notion of acceptable levels of risk is not well established. Safety management is largely driven by analysis of outcome measures in a reactive fashion. Where risks are identified in a proactive fashion, improvement teams are left to their own devices as to which risks they should address, and the extent to which risks should be reduced. As a result, practice is extremely variable across the health system, and it is lacking in consistency and transparency. While healthcare providers need to maintain a risk register they do not normally need to demonstrate that risks have been reduced to acceptable levels.