Whether in the private, public, or third sector, most organisations of any size include risk assessment, risk rating, and risk management as part of good corporate governance. This includes government departments and arm’s length bodies responsible for health and social care policy and leadership. Once risks have been assessed and their likelihood and severity rated, a standard framework (embraced by the government itself) involves the “4 Ts” of terminating, tolerating, treating, or transferring them to other parties.1 The strengths of UK health systems include being universal, needs based, free at the point of care, efficient, and relatively free of upfront payments that can deter people from seeking help, while allowing a component of central planning and national initiatives, datasets, and improvement incentives. But they also attract criticism for being overly centralised and top-down, with decision making not sufficiently devolved to local service leaders or communities, and—by vi