Healthcare risk management and patient safety: why yesterday’s controls may not protect tomorrow
Healthcare risk management can create a reassuringly static picture of a system that is anything but static. For NHS and independent healthcare organisations, that matters for patient safety, PSIRF, clinical governance and the assurance boards receive.
A risk is identified. Its likelihood and impact are assessed. Controls are documented and a residual score is agreed. It lives in Datix and feeds the Board's Assurance Framework. The risk is then reviewed periodically, perhaps moving from red to amber or amber to green as further actions are completed. But the system around that risk does not stand still: demand changes and staff become fatigued. Equipment ages, and because work as imagined doesnt align with work as done, teams adapt to get work completed, usually through workarounds. Constant turnover of staff means that the organisational memory fades and some lessons have to be re-learnt. Like in any complex system, controls interact with one another, and an intervention that initially produced a significant improvement may deliver progressively less each time it is repeated.
This leads to a question that I rarely hear raised explicitly in healthcare risk discussions:
Are we treating a non-ergodic risk as if it were ergodic?
I appreciate that this is not the most accessible language, and to be honest, it's most probably one that us 'Risk Geeks' think about at this stage. To some extent however, that's the point of this article. I understand that this term may feel unnecessarily academic, but I promise, it's not.
Ergodicity asks whether averaging observations across a group can tell us what one participant will experience over time. For a specified observable in an ergodic process, the long-run time average agrees with the corresponding ensemble average under the relevant mathematical assumptions. Where that equivalence fails, a favourable group average may be a poor guide to one person’s or organisation’s journey. In healthcare, this is a useful question to ask, not a label we can attach to a service without analysis.
That distinction can fundamentally change how we understand risk. Ergodic systems link well with where things like SPC charts have thrived. being able to understand a largly stable system, where the average experience does generally represent most experiences, means that a focus on reducing, or understanding variance means that everyone benefits. This isn't often the case for complex systems however, where the 'average' experience may actually represent very true experiences.
A die is relatively simple. Most organisations are not
Think about repeatedly rolling a fair six-sided die. The probability of rolling a six remains one in six. Rolling a six previously does not make the next six either more or less likely. Provided the die remains fair and the conditions do not change, each roll follows the same probability distribution. Sometimes, even in these circumstances, as humans we can get caught in the gambler's fallacy (I've rolled the die 5 times and not got a six, therefore the next one has to be a six)
There are many important caveats, but this gives us an approximate example of a stable, repeatable process.
Organisational controls rarely work like that. Consider a service experiencing a sustained capacity problem. Adding extra staff may provide a substantial initial benefit. Adding further temporary staff might still help, but not necessarily to the same extent. Eventually:
there may be too few experienced people to supervise them;
induction and coordination may consume existing capacity;
physical space or equipment may become the limiting factor;
continuity may deteriorate;
communication pathways may become more complex; and
the service may become dependent on temporary staffing rather than addressing the underlying design problem.
The same intervention has been repeated, but its effect has changed because the state of the system has changed.
Strictly speaking, diminishing returns and non-ergodicity are not the same concept. Diminishing returns describe how the additional benefit of an intervention may reduce as more of it is applied. Non-ergodicity describes a system in which group averages do not reliably represent the path experienced through time. However, diminishing returns, feedback, accumulated strain and path dependency should all alert us to the possibility that a risk cannot be understood as a sequence of independent, identical events. The die is being rolled in a system that is changing the die.
Complicated is not the same as complex
A complicated task may contain many parts and require considerable expertise, but the relationships between those parts can be sufficiently understood to support a reliable method. Technical calibration performed to a validated specification is a useful example. Complexity is different. People and organisations respond to one another, adapt to pressure and change the conditions in which the next decision is made. Outcomes emerge from those interactions, rather than simply from adding up the parts.
Healthcare contains both. A device may need a standardised technical procedure; the service using it must also coordinate patients, staffing, information, competing priorities and changing demand. Calling the service complex does not make standards optional. It means a standard is not the whole safety system. Nor does complexity, by itself, prove non-ergodicity: these are different ideas, useful for asking different questions.
The practical question is not whether we need a process. It is whether we have understood the work well enough to know where standardisation helps, where judgement and adaptation are necessary, and how we will notice when conditions change. That is also the challenge explored in our article on safety cases in healthcare: assurance should expose the assumptions behind a claim of safety, not simply confirm that a document exists.
One hundred people taking a risk once is not the same as one person taking it one hundred times
Nassim Nicholas Taleb uses a casino example to explain the distinction between an ensemble and a journey through time. Imagine 100 people visiting a casino once. Some win, some lose and perhaps one person loses everything. That person’s ruin does not prevent the remaining 99 people from playing. We can calculate the average outcome across the group.
Now imagine one person visiting the casino on 100 consecutive days. If that person is ruined on day 28, there is no day 29. The average outcome across 100 different people does not describe what happens to the one person moving sequentially through time.
This is the importance of an absorbing barrier: an outcome that ends the person’s or organisation’s ability to continue. In healthcare, the equivalent is not always organisational ruin. It may be:
an irreversible patient injury;
the death of a patient;
the permanent loss of a specialist service;
burnout or departure of critical staff;
loss of public trust;
regulatory action;
unrecoverable data loss; or
a financial position from which the organisation cannot realistically recover.
A risk may appear acceptable when averaged across several organisations, wards, patients or years. That does not make it acceptable for the individual patient, team or service that must survive its particular sequence of events.
Ole Peters has argued that conventional expected-value reasoning can become misleading where a system is non-ergodic, because the mathematical average across possible outcomes is not necessarily the outcome experienced by a participant over time.
Nobody experiences the average pathway. People and organisations experience one pathway, in a particular order, through time.
Everyday examples of ergodic and non-ergodic risks
These categories should be treated as practical approximations. Real systems may be ergodic under one set of assumptions and non-ergodic under another.
Approximately ergodic: repeated sampling from a stable process
Examples might include:
repeatedly rolling a genuinely fair die;
repeatedly drawing and replacing a ball from a well-mixed container;
measuring a stable manufacturing process operating under tightly controlled conditions; or
observing a large number of independent components whose failures do not affect one another or alter the wider system.
In each case, the underlying conditions must remain sufficiently stable, outcomes must not alter future probabilities, and failure must not prevent continued participation. Those are significant assumptions.
Non-ergodic: personal finances
A group of investors may achieve a positive average return while some individual investors become unable to continue after an early sequence of losses. Sequence, exposure and the risk of ruin matter. The group’s average return does not describe every investor’s journey.
Non-ergodic: physical health
A population estimate remains valuable evidence, but it does not guarantee the same outcome for each patient or at each point in time. Differences between people and changes within a person matter. Those differences warrant attention; they are not, on their own, a mathematical demonstration of non-ergodicity.
Non-ergodic: organisational workload
A team may cope with high demand successfully on nine occasions. That does not mean the tenth period of pressure presents the same risk.
The earlier periods may have depleted staff resilience, created maintenance backlogs, delayed training, consumed financial reserves, increased reliance on workarounds or prompted experienced staff to leave. The tenth event occurs in a different system from the first.
Non-ergodic: repeatedly postponing maintenance
Each individual deferral may appear manageable. However, the effects accumulate. Components age, dependencies increase and the range of recoverable options narrows. Eventually, the organisation may cross a threshold at which failure becomes much more likely or recovery considerably more difficult.
The absence of failure so far is not evidence that another deferral is equally safe.
What might non-ergodicity look like in healthcare?
1. Repeated short staffing
A staffing model may describe each shift as a separate risk exposure. In reality, short staffing today may influence tomorrow through fatigue, sickness absence, missed training, reduced supervision and staff turnover.
If a team completes ten understaffed shifts without serious harm, it is tempting to conclude that the risk was overstated. Yet the team may have succeeded by borrowing capacity from the future.
Staff skipped breaks. Senior clinicians stayed late. Administrative work was deferred. People worked faster. Training was cancelled. Goodwill filled the gap.
These adaptations may make performance look resilient while progressively weakening the system.
The eleventh shift is not another roll of the same die.
2. Reliance on checking
When an error occurs, organisations frequently introduce an additional check.
The first check may reduce risk. A second check may provide some further protection. But continuing to add checks does not necessarily continue to reduce risk at the same rate.
Extra checking may increase workload, become ritualised, diffuse responsibility, create alert or checklist fatigue, encourage superficial compliance or divert attention from the design conditions producing the error. The control may remain recorded as present while its practical effect changes over time.
3. Temporary funding as a repeated control
Providing additional money can release capacity, tackle a backlog or stabilise a service. But repeatedly “throwing money at the problem” does not guarantee the same outcome each time.
If the constraint is leadership capacity, physical space, recruitment supply, technology, workflow design or organisational trust, further expenditure may produce progressively smaller benefits. Money may still be necessary. It is simply not infinitely effective.
4. A successful workaround
A workaround may allow care to continue when formal processes do not meet operational reality. Initially, it may look successful because it avoids delay and no patient is harmed.
As it becomes normalised, dependency on individual knowledge grows; formal records may become less reliable; new staff may copy the adaptation without understanding its limits; the original design problem becomes less visible; and the organisation becomes increasingly exposed to the absence of key individuals.
What appears to be repeated success may actually be an accumulation of hidden vulnerability.
5. The “average patient”
A treatment may create a modest average benefit across a population while producing much larger benefits, no meaningful effect or adverse consequences for different individuals.
This does not make population evidence unhelpful. It means the population average and the individual’s changing response answer different questions. The emerging application of ergodicity to evidence-based medicine emphasises the need to consider both differences between people and variation within the same person over time.
Taleb, Black Swans and the danger of reassuring histories
Ergodicity is one part of a wider challenge in Nassim Nicholas Taleb’s work: how do we make sensible decisions when our knowledge of the world is incomplete? His Black Swan concept brings together an event outside regular expectations, an extreme impact and our tendency to construct a convincing explanation afterwards. The point is not that every bad outcome is unknowable. It is that a persuasive account after an event does not demonstrate that our model could have predicted it beforehand.
There is an important qualification for healthcare governance. An outcome should not be called a Black Swan simply because it was severe, embarrassing or missing from a risk register. Known staffing pressures, recurring equipment failures and concerns repeatedly raised by patients or staff are not made unforeseeable by being ignored. Uncertainty is a reason to strengthen preparedness, not an excuse to disregard what is already known.
Taleb’s warning about the ludic fallacy is relevant here: the clearly defined probabilities of a game are not a faithful model of an open, changing organisation. A run of successful shifts does not prove that the next one is safe. Nor should we let the neatness of a retrospective explanation obscure the conditions in which decisions were made. Our article on healthcare investigations, PSIRF and the power of the pen explores that danger of turning a messy system into an overly tidy story.
Fragility asks a different question from prediction: what happens to this system when conditions worsen? If small increases in pressure produce disproportionately larger losses, a reassuring average may conceal the exposure that matters most. Spare capacity, alternative routes and recoverable options can look inefficient on a spreadsheet while being essential when the primary plan fails. The question is not whether every contingency can be predicted, but whether the organisation can continue safely when an important assumption proves wrong.
Antifragility goes beyond withstanding a shock: it describes gaining from variability or disruption. In healthcare, this must not become a justification for exposing patients or staff to preventable harm. A responsible application is to learn through simulation, near misses and carefully governed, reversible testing, then demonstrate that the resulting changes improve the system. Repeatedly exhausting people is not antifragility. It is depletion with a more impressive name.
Two further ideas are useful. Via negativa encourages us to examine what can safely be removed: duplicated entry, conflicting instructions or an unnecessary approval that creates delay without reducing risk. Removal still needs assessment; a safety-critical check is not waste simply because it takes time. Skin in the game asks who benefits from a decision and who carries its downside. For healthcare leaders, that is a reason to bring patient and staff experience into decisions and retain clear accountability for the consequences of system design.
Why understanding this matters
Risk scores can conceal the journey
A conventional risk score usually offers a snapshot. It may tell us an organisation’s assessment of likelihood and consequence at the time of review. It rarely tells us whether the risk is increasing or decreasing; what earlier events have done to the system; whether a control is losing effectiveness; how close the organisation is to an irreversible threshold; whether success depends on exceptional human effort; or whether the same control is producing diminishing returns.
Two services can have the same residual score while travelling in completely different directions. One may be recovering. The other may be approaching failure.
Averages may hide concentrations of risk
A hospital-level average can appear stable while a particular ward, shift, pathway or patient group experiences repeated exposure. Likewise, a system may record a low overall incident rate while the same people repeatedly carry the risk. Averaging across the organisation can conceal the pathway experienced by those individuals.
Past success can be falsely reassuring
Organisations often treat successful recovery as evidence that controls are effective. Sometimes it is.
Success may also result from people stretching, adapting and absorbing pressure. If the organisation does not distinguish designed capacity from human compensation, it may interpret the absence of failure as proof of safety.
Controls require maintenance and adaptation
Evidence concerning the sustainability of healthcare improvement shows that gains do not simply maintain themselves. Continued effort, local integration, coordination, organisational context and active maintenance influence whether improvement endures.
A control should therefore not be treated as a permanent object. It is part of a changing system and its effectiveness needs to be observed through time.
What does this mean for PSIRF and patient safety learning?
The Patient Safety Incident Response Framework (PSIRF) is not an ergodicity model, and Taleb’s work is not a replacement for NHS England’s requirements. The connection is practical: PSIRF emphasises compassionate engagement, systems-based learning, proportionate responses and supportive oversight. It applies to services provided under the NHS Standard Contract, including independent providers delivering those services. The useful question is what a learning response tells us about the system now, not simply whether it explains one event.
A systems-based response should explore how earlier pressures shaped the work, which adaptations allowed care to continue and what those adaptations cost. Bring together incident insight, complaints, patient and family experience, staff concerns, audit findings and operational information. Looking across time may show that apparently separate incidents share a dependency, or that the same service is repeatedly absorbing the exposure hidden by an organisation-wide average.
That should change the safety action conversation. What is the action expected to change? Who owns delivery? How will we observe its effect, check for unintended consequences and know when the control needs adapting? Completion of an action plan is evidence of activity, not automatically evidence of safer care. This is the argument developed in PSIRF, Human Factors and patient safety governance: moving from learning to action.
Boards need the same line of sight: from insight, to a decision, to a change in the work system, to evidence that the change is helping. A proportionate response is not a smaller report by default; it is an appropriate response to the learning and improvement need, while meeting applicable requirements. Our PSIRF training and PSIRF implementation, evaluation and healthcare governance support connect that learning with practical oversight.
How should risk management change?
Recognising non-ergodicity does not require organisations to abandon risk registers, likelihood scores or controls. It requires them to stop treating these as complete descriptions of reality.
1. Move from risk snapshots to risk trajectories
Ask not only: What is the current risk score? Also ask how the risk has changed over time; what direction it is travelling in; whether improvement is accelerating, slowing or reversing; whether resources needed later are being consumed; and what evidence would show that the organisation is approaching a threshold.
A sequence of moderate-risk events may be more significant than one isolated high-risk event if that sequence shows progressive system degradation.
2. Distinguish population risk from experienced risk
Where possible, examine how risk is distributed between sites, wards, professional groups, shifts, demographic groups, pathways and individual patients.
The organisational average may be mathematically correct while remaining a poor description of what some people experience.
3. Test whether controls remain effective
For each important control, consider:
What mechanism makes this control effective?
What assumptions must remain true?
Can its effect weaken with repeated use?
Does it transfer workload or risk elsewhere?
Is compliance being measured, or actual effectiveness?
What happens when demand increases?
What evidence would tell us that the control has become ritualised?
This reflects a wider Human Factors perspective, in which performance is understood through interactions between people, tasks, technology, environments and organisational conditions. Systems approaches such as SEIPS support analysis and redesign of care. Our action design and implementation training develops the practical link between understanding those conditions and selecting stronger, more sustainable safety actions.
4. Identify absorbing barriers and irreversible outcomes
Every significant risk assessment should ask: What outcome would end our ability to recover through normal management action?
This might include death, irreversible harm, loss of a licence, permanent data loss, collapse of a specialist workforce or insolvency. Low-probability events deserve particular attention where the consequence is irreversible. A favourable average cannot compensate the individual who encounters ruin.
5. Look for accumulated exposure
Add questions such as:
How many times has this team absorbed the risk?
What has each recovery cost?
Which actions have been postponed?
Are people becoming dependent on workarounds?
Is the control building capacity or merely consuming resilience?
If no serious harm has occurred, what prevented it?
This is closely connected to recognising weak signals. Repeated minor concerns, adaptations and near misses may reveal how the system is changing before conventional outcome measures do. I explore this further in weak signals, patient safety and governance. A quiet reporting system may be reassuring. It may also mean that we have stopped hearing what we need to hear.
6. Model sequences, not only individual events
Scenario analysis should explore combinations and order:
What if demand rises after a period of staff depletion?
What if the digital system fails during a high-demand weekend?
What if the usual expert is unavailable after several months of reliance on informal knowledge?
What if an apparently minor failure occurs after other controls have already weakened?
Risk is often found in the interaction between events, not simply in the probability of each event considered separately.
7. Design for adaptation, not permanence
A good control should have:
a clear purpose;
an identified owner;
an explanation of how it reduces risk;
effectiveness measures;
review triggers;
limits and failure conditions; and
a process for adaptation or retirement.
This is part of getting risk management right by design, not luck.
8. Strengthen governance around movement and thresholds
Boards and committees should receive information about direction of travel, accumulated exposure, control effectiveness, proximity to critical thresholds, the distribution of risk, dependency on human adaptation and the organisation’s remaining capacity to recover.
The governance conversation should therefore move beyond whether controls exist and ask whether they remain effective in the system as it now operates.
Readers considering how published findings translate into oversight may also find our analysis of the Thirlwall Inquiry report’s implications for PSIRF, governance and just culture useful. It is a report commentary, not the original inquiry report. The wider question remains: are warning signs reaching people who can act, and is action changing the conditions that created the risk?
Questions for boards and leadership teams
The following questions provide a practical starting point:
Which of our risks are being treated as a series of independent events when their effects actually accumulate?
Where might an organisational average be concealing repeated exposure for a particular patient, team or service?
Which controls rely on staff absorbing pressure through goodwill, adaptation or additional effort?
What has to remain true for each major control to continue working?
Where are we seeing diminishing returns from repeated investment or intervention?
Which outcomes would be irreversible or would remove our ability to recover?
Are our indicators showing the current state of risk, its direction of travel, or both?
What have previous periods of pressure taken out of the system?
What evidence would tell us that a control had become ritualised rather than effective?
Are we learning from how work is actually done, or relying on how the control is described on the risk register?
Final thoughts
Ergodicity can sound like an abstract mathematical concept. Its practical lesson is much more straightforward: The average is not always the journey, and the next event does not always occur in the same system as the last.
Risk controls are not infinitely repeatable units of protection. Their effectiveness may grow, diminish or change as people and systems adapt. They may consume capacity, create new dependencies or move risk somewhere less visible.
This does not mean that conventional risk management is without value. It means that a static description of a dynamic system will always be incomplete.
If we want to understand the risks facing an organisation, we must look beyond the score. We need to understand the pathway, the accumulated exposure, the changing effect of controls and the points beyond which recovery may no longer be possible.
The question is not simply: “What is the risk today?”
It is: “What journey is this system on, and will our controls still protect it when it reaches tomorrow?”
If your organisation needs to connect patient safety learning, risk control effectiveness and board assurance, Promethean HD supports NHS and independent healthcare providers through Human Factors-informed governance and improvement. Talk to us about PSIRF evaluation, governance support or a facilitated risk discussion. The aim is not a more impressive risk register. It is getting it right by design, not luck.
References:
1. Peters, O. (2019). “The ergodicity problem in economics.” Nature Physics, 15, 1216–1221.
2. Taleb, N. N. “The Logic of Risk Taking.”
3. Hans, U. (2026). “Beyond the Average Patient: The Ergodicity Problem in Evidence-Based Medicine and a Proposal for Individual-Dynamic Medicine.” Journal of Evaluation in Clinical Practice.
4. Lennox, L. et al. (2020). “Making change last? Exploring the value of sustainability approaches in healthcare: a scoping review.” Health Research Policy and Systems, 18, 120.
5. Moon, S. E. J., Hogden, A. and Eljiz, K. (2022). “Sustaining improvement of hospital-wide initiative for patient safety and quality: a systematic scoping review.” BMJ Open Quality, 11, e002057.
6. Bowie, P. et al. (2024). “Using Human Factors Science to Improve Quality and Safety of Healthcare.” Global Journal on Quality and Safety in Healthcare.
Taleb, N. N. The Black Swan (2007),
Taleb, N. N. Antifragile (2012)
Taleb, N. N. Skin in the Game (2018),
Plsek and Greenhalgh (2001), “The challenge of complexity in health care”, BMJ, 323, 625–628,
Comments