The question of when people may impose risks on each other is of fundamental moral importance. Forms of “quantified risk assessment,” especially risk cost-benefit analysis, provide one powerful approach to providing a systematic answer. It is also well known that such techniques can show that existing resources could be used more effectively to reduce risk overall. Thus it is often argued that some current practices are irrational. On the other hand critics of quantified risk assessment argue that it cannot adequately (...) capture all relevant features, such as “societal concern” and so should be abandoned. In this paper I argue that current forms of quantified risk assessment are inadequate, and in themselves, therefore, insufficient to demonstrate that current practices are irrational. In particular, I will argue that insufficient attention has been given to the cause of a hazard, which needs to be treated as a primary variable in its own right. However rather than reject quantified risk assessment I wish to supplement it by proposing a framework to make explicit the role causation plays in the understanding of risk, and how it interacts with factors which influence perception of risks and other attitudes to risk control. Once an improved description of risk perception is available it will become possible to have a more informed debate about the normative question: how safety should be regulated. (shrink)