One in a Million: How we choose what risk is acceptable

What is an acceptable risk? We, as individuals, can adopt different operational heuristics for handling risk in our daily lives, when it comes to personal, financial or health choices. But environmental and pollution issues affect whole communities, or even the whole planet, so we have to arrive at some common agreement of what level of risk is acceptable. In this essay we explore the roots of the logic behind such acceptable-risk levels.

In our previous essay in this series we examined the history behind toxicological safety for humans. Certain chemicals are considered safe below a certain dose, because they are excreted or digested, and in experiments there are no measurable negative effects. That can be an artifact of the generally small statistical power of biological experiments, but still we can assume that some chemicals are benign in small dosages. Others, however, have a cumulative effect. The prime example is radioactive elements causing cancer.

I. No safe dose

Since 1929, the Advisory Committee on X-Ray and Radium Protection set exposure limits for the doctors and technicians who handled X-rays and radium. By its own account the committee "functioned effectively until the advent of atomic energy, which introduced a large number of new and serious problems." In December 1946 it was enlarged and renamed the National Committee on Radiation Protection, and its roster now drew in the armed services and the weapons program: the U.S. Air Force, the U.S. Army, the U.S. Atomic Energy Commission, and the U.S. Navy sat alongside the radiologists. [NCRP, 1954]

In its 1954 handbook the committee recognized that radiation is different from ordinary poisons; where an ordinary poison might have a safe level of exposure, radiation-caused mutations accumulate, and there was no safe level to find.

The concept of a tolerance dose involves the assumption that if the dose is lower than a certain value—the threshold value—no injury results. Since it seems well established that there is no threshold dose for the production of gene mutations by radiation, it follows that strictly speaking there is no such thing as a tolerance dose when all possible effects of radiation on the individual and future generations are included… the expression "permissible dose" is much to be preferred. [NCRP, 1954]

Acknowledging the absence of a safe dose, the committee proposed "to make this risk so small that it is readily acceptable to the average individual; that is, to make the risk essentially the same as is present in ordinary occupations not involving exposure to radiation." [NCRP, 1954]

Risk, then, counted as acceptable when it matched the everyday hazards people already carry. Two decades later the International Commission on Radiological Protection turned that comparison into a specific figure. The worker's dose limit should be set so that "the calculated rate at which fatal malignancies might be induced by occupational exposure to radiation should in any case not exceed the occupational fatality rate of industries recognized as having high standards of safety." [ICRP, 1977]

ICRP defined "safe" through comparison with other jobs: those "in which the average annual mortality due to occupational hazards does not exceed 10⁻⁴ [that is 1 in 10,000]". [ICRP, 1977]

This number was estimated from labour statistics in a companion report leaning heavily on British occupational-mortality data [ICRP Pub. 27, 1977]. One of the hazardous occupations it referenced was mining, roughly 3.4 × 10⁻⁴ per worker-year. Notably, British mining has since grown about forty times safer — near 10⁻⁵ per worker-year by 2024/25 [HSE, 2025]. Meaning, that now it is 10 times safer than 10⁻⁴ level introduced in 1977.

Reviewing the U.S. Army's guidance for chemical hazards to soldiers, the National Academies wrote:

The acceptable risk of excess cancer resulting from exposures to chemical carcinogens is 1 × 10⁻⁴ regardless of route of exposure… averaged over a lifetime from a 1-year deployment… The selection of an acceptable risk level is a policy decision, and the subcommittee does not believe it would be appropriate for it to make a judgment about how much risk the military should accept. [NRC, 2004]

So the choice of appropriate or acceptable levels of risk has been a policy decision from the beginning, and an artifact of what was perceived as "safe" in the 1970s in the military and the mining industry.

II. The Delaney clause

In the US, the policy has been battling over this issue of no threshold.

In 1958, James J. Delaney of Queens wrote the anticancer clause, section 409(c)(3)(A) of the Federal Food, Drug, and Cosmetic Act (added by the Food Additives Amendment), that still bears his name: no additive shown to cause cancer in man or animal may be added to food. The Act had also given manufacturers a grace period to prove the old ones safe.

The grace period was expiring in 1961. A U.S. House subcommittee took up a question: how much longer could the food industry keep selling additives it had never tested?

To Delaney the dose was not negotiable:

Efforts will be made to weaken this law and to make its enforcement difficult. This must not be allowed to happen. The public interest demands that the law and its enforcement be strengthened rather than relaxed. All of us have a serious responsibility in this field… My main objection to H.R. 3980 is that it permits "open end" time extensions… Mr. Chairman, having won ground in our fight to protect the consumer, we can afford no retreat. An open end bill would be a retreat. [Delaney, 1961]

III. From One in a Hundred Million to One in a Million

In 1961, two biostatisticians at the National Cancer Institute, Nathan Mantel and W. Ray Bryan, published a paper that founded quantitative cancer-risk assessment. They proposed a "virtually safe dose," and acknowledged its arbitrariness:

How safe is safe? Absolute safety can never be unquestionably demonstrated… we have taken the position that a virtually safe dose is one which is so low that the risk of cancer is virtually nonexistent… a risk of 1/100 million is so low as to constitute "virtual safety." Other arbitrary definitions of "virtual safety" may be employed as conditions require. [Mantel & Bryan, 1961]

In 1973 the FDA first wrote a carcinogen risk number into a proposed rule, and repeated that the level was both arbitrary and conservative:

Absolute safety can never be conclusively demonstrated experimentally. The level defined by the Mantel-Bryan procedure is an arbitrary but conservative level of maximum exposure resulting in a minimal probability of risk to an individual (e.g., 1/100,000,000). [FDA, 1973]

However, in 1977, the final rule raised the acceptable life-long risk to one in a million:

Consequently, the final regulations establish the maximum risk to be used in the Mantel-Bryan calculation as 1 in 1 million. [FDA, 1977]

It went on to compare it with "the average risk of fatality by motor vehicle accident per year [which] is approximately 1 in 4,000". That works out to a lifetime risk of about 1 in 40 (1 in 76 today), and they argue that it is much larger than 1 in a million.

Still, why did the FDA change it from 1 in a hundred million to 1 in one million? The 1979 reproposal said:

The 1973 proposal suggested that an acceptable level of risk for test animals, and thus for man, could be 1 in 100 million over a lifetime. Many comments argued that this level of risk was unnecessarily conservative… the Commissioner concluded that the 1 in 100 million level of risk was unduly limiting without substantial compensation in terms of public health. Consequently, the notice established the maximum risk to be used in the Mantel-Bryan calculation as 1 in 1 million… In the Commissioner's opinion, the acceptable risk level should (1) not significantly increase the human cancer risk and (2)… be as high as possible in order to permit the use of carcinogenic animal drugs and food additives… It is difficult to choose between 1 in 1 million and 1 in 10,000 but the agency chose the more conservative number in the general interest of protecting human health. [FDA, 1979]

So the risk number was set high enough to keep the products legal. And the decision was between one in a million and a military-grade number of 1 in 10,000.

The man who shifted the risk from 1 in 100 million to 1 in a million was the FDA's general counsel, Peter Barton Hutt, a food-and-drug lawyer. Joseph V. Rodricks, then an FDA scientist and later a founder of one of the first risk-consulting firms, ENVIRON (now Ramboll), was in the room:

After extensive discussions with me and other scientists, Hutt proposed that "safe doses" for carcinogens such as DES could be defined as those associated with lifetime risk levels of less than 1 in 1 million, when these risks were estimated using a linear, no-threshold model. [Rodricks, 2019]

By 1987 one in a million was coded as risk to a test animal, not a human:

That concentration corresponds to a maximum lifetime risk of cancer to the test animal on the order of 1 in 1 million. [FDA, 1987]

The test animals appear here because, by FDA's standards, a compound is tested in two test animal species to estimate how much it increases cancer risk.

As we wrote before, the conversion between animal and human toxicity is in itself a questionable and very uncertain procedure. And, again, a justification to make the number high was "to permit the use of carcinogenic animal drugs." [FDA, 1987] The rule governed drugs and feed additives given to food-producing animals — growth promoters like DES, the synthetic estrogen fed to cattle — that cause cancer and leave traces in meat and milk.

IV. Is this arbitrary number too big or too small?

That the number is arbitrary is not a secret.

Toxicologist Kathryn Kelly, a risk consultant later seated on the board of the industry-aligned American Council on Science and Health, set out to trace 10⁻⁶ to its origin in her report The Myth of 10⁻⁶. She interviewed the officials who relied on the figure, and she found "no scientific or regulatory basis". One told her it "sounded like such a nice phrase," another that it was "doable," another that "you really shouldn't be asking these questions." Mantel, co-author of the original method, when asked about the original one in a hundred million, answered: "we just pulled it out of a hat." [Kelly, 1991]

For Kelly the arbitrariness proves the number is far too cautious, a standard that costs billions to satisfy. Her image is a car forced to a crawl:

As 10⁻⁶ seemed like a reasonably conservative level (or "doable," according to many), it was adopted first for a few chemicals and exposure pathways, then more chemicals and exposure pathways, and so forth. Not until the rule came into widespread use — or until everyone was limited to one mile per hour on the freeway, so to speak, and it was costing billions of dollars to eliminate risk — did it become readily apparent that the "zero risk" screening criterion was not intended to be interpreted as "acceptable risk." [Kelly, 1991]

Kelly's report might have been a reaction to the tool built by the FDA that turned a risk number into a permitted concentration. [Flamm & Rulis, 1987] The idea of de minimis (a concept that if an amount of chemical is smaller than a certain threshold its safety does not need to be considered) was introduced. And when Curtis Travis, a risk analyst at Oak Ridge National Laboratory, tried to derive the level from how regulators actually behaved, he found it was not a property of chemicals:

the de minimis level varies from 10⁻⁴ to 10⁻⁶, depending on the size of the population impact… the regulatory process combines many economic, social, and political factors into an implicit expression of society's willingness to accept risk. [Travis & Richter, 1987]

The FDA's Mary Frances Lowe said as much in print, calling the move "a common sense de minimis interpretation of the 'Delaney clause,'" and warning that the alternative, the no-safe-dose premise taken literally, meant "extremely conservative assumptions that will unquestionably tend to overestimate risk, perhaps by many orders of magnitude." [Lowe, 1989] Delaney's absolute had become the thing to manage around, through a doctrine of de minimis that Frawley would carry furthest, and that we take up another time.

V. Risk, Assessed Elsewhere

The question of arbitrary acceptable risks was not unique to the U.S. or to toxicology. The German sociologist Ulrich Beck published the book Risk Society, whose release coincided with the Chernobyl disaster of 1986. He argued that our industrial civilization had begun distributing its poisons the way it distributes its wealth, and the official "acceptable level" was the instrument that let it. Such limits, he wrote, "may indeed prevent the very worst from happening, but they are at the same time 'blank checks' to poison nature and mankind a bit." [Beck, 1992]

Here we explore a few more episodes where rounded risk numbers turned out to be contradicted by reality itself.

The Soviets Refuse the Word

In the words of the Soviet radiation scientist I. V. Filyushkin of the Institute of Biophysics in Moscow, Soviet public-health doctrine rested on "unconditional recognition of a threshold for inducing all types of effects and an equally categorical rejection of the existence of any risk from low levels of exposure." He documents the clash between the ideology and the concept of "acceptable risk":

Any departure from the threshold principle inevitably leads to adopting the concept of "acceptable risk"… notions about "socially acceptable risk" stand in contradiction to evolutionary theory and to the principles of public health in a socialist society. [Filyushkin, 1991]

After Chernobyl nuclear power plant exploded in 1986 and contaminated rural areas where hundreds of thousands lived, the USSR's radiation-protection body nonetheless had to set a number: a lifetime intervention dose of 350 millisieverts. The dose it imposed on its contaminated citizens was far looser than anything in the West. Filyushkin wrote:

a lifetime dose of 350 mSv would impose on an individual an average annual risk of the order of 10⁻⁴ y⁻¹, which is lower than the annual individual risk due to nonradiation causes prevailing in many areas in the USSR… we conclude that the lifetime dose limit of 350 mSv, as an intervention level, actually may be far too low, in contrast to the notion that has gained credence among the public that it is far too high and therefore "inhumane." [Filyushkin, 1991]

One in ten thousand a year is close to the American soldier's neighborhood. Refusing the words "acceptable risk" did not lead to a safer standard.

The Dutch Adopt a Universal Risk

The Netherlands may have been the first state to write the acceptable-risk number into national policy.

On the night of 31 January 1953 a North Sea storm surge broke sixty-seven water management dikes in the southwestern delta and drowned more than eighteen hundred people, most of them asleep. The government appointed a Delta Committee under A. G. Maris to determine how high the dikes should be. The old answer had been to build above the highest flood on record. But Dutch engineers had given that rule up. In the words of the mathematician the committee enlisted, David van Dantzig, "to every height there belongs a positive 'exceedance probability.'" [van Dantzig, 1956]

Van Dantzig turned the dike height into an economic calculation: weigh the cost of building higher against the cost of the floods that height would prevent, summed over the years to come. How much can a human life cost? He was frank in proposing "not to evaluate human lives themselves, but to see how much the state is willing to spend in order to save a given number of human lives." The last margin, he wrote, was not a thing arithmetic could settle: "This factor cannot be determined on mathematical, statistical, or economic grounds. Its determination requires a decision by the responsible authorities rather than by scientists." [van Dantzig, 1956]

So the authorities decided. Van Dantzig's own calculation came to a flood expected once in a hundred and twenty-five thousand years; the Committee set the dikes instead against one expected once in ten thousand. [Deltacommissie, 1960] Two historians, Samuël Kruizinga and Pepijn Lewis, working through the Committee's minutes, found that the looser figure was the more sellable one, and that the probabilities behind it, as well as their uncertainties, were deliberately kept out of the reports the public read. [Kruizinga & Lewis, 2018] The round number became the design basis around 1960 and, in time, the law. [Flood Defences Act, 1995]

The number spread from dikes to chemical plants, and by 1989 the government set a single such number for every hazard. The cabinet paper Premises for Risk Management (Omgaan met risico's, laid before parliament with the National Environmental Policy Plan) has two numbers for the individual. Above the maximally tolerable risk of one in a million per year, an activity would not in principle be allowed; below the negligible risk level, a hundred times lower, it needed no further attention; in the grey band between, the rule was ALARA, as low as reasonably achievable. [Health Council (NL), 1995] Note, however, that this is a uniform risk of one in a million per year, not the lifetime risk the FDA used.

That uniformity of risk estimate drew objection from the country's own scientists. In 1995 the Health Council of the Netherlands produced a report: Not All Risks Are Equal. [Health Council (NL), 1995]

It presented two major arguments. First, that "individual risk" mixes at least three different things: the chance of being killed in an industrial accident, an added lifetime chance of dying of cancer when exposed to a carcinogen or radiation, and — for a non-carcinogenic substance — not a probability of death at all, but whether a toxic effect occurs. The first is a direct probability of death, the second is modelled, the third is not a risk of death at all. A numerically equal limit, therefore, does not mean the level of protection is equal.

The second argument is that a single threshold hides the circumstances that should decide whether a risk is tolerable at all. What is the benefit of the activity? Is the exposure voluntary? Can the individual control it? How is the harm distributed, and how is it perceived?

Collapsing all of these factors into one probability of death, the committee wrote, "suggests a non-existent homogeneity in situations which vary very widely in terms of the advantages, nature and seriousness of the risks and the perception of those risks by the people involved," and leaves no room to weigh what actually differs. [Health Council (NL), 1995]

The Shuttle

Another catastrophe of 1986 was NASA's Challenger explosion. Before it happened, NASA management put the odds of losing a shuttle and crew at about one in a hundred thousand, "much closer to that of commercial jets," a New York Times review later noted. [Broad, 2005] Richard Feynman, the Caltech physicist on the commission that investigated the disaster, asked the working engineers what they thought, and set the gap down in an appendix:

It appears that there are enormous differences of opinion as to the probability of a failure with loss of vehicle and of human life. The estimates range from roughly 1 in 100 to 1 in 100,000. The higher figures come from the working engineers, and the very low figures from management. … A risk of 1 part in 100,000 would imply that one could put a Shuttle up each day for 300 years expecting to lose only one… it would appear that, for whatever purpose, be it for internal or external consumption, the management of NASA exaggerates the reliability of its product, to the point of fantasy. [Feynman, 1986]

Elisabeth Paté-Cornell, a Stanford engineering-risk scholar, later traced management's figure to its source, nowhere in particular:

These experts… estimated the probability of a Solid Rocket Booster (SRB) failure at 10⁻⁵ per flight without any formal systems analysis needed to support such an estimate. It is on that basis that early risk analyses for the shuttle system indicated a probability of [loss of vehicle and crew] in the order of one in several thousand per flight. Consequently… they significantly underestimated the failure risk. [Paté-Cornell, 2001]

She also noted that the probabilistic number fought the same instinct that ran through toxicology, the safety factor:

…notions of failure risk and failure probability often clashed (and still do) with the engineering culture, primarily based on safety factors… the problem with safety factors is that they are not directly linked to the probability of system failure. [Paté-Cornell, 2001]

After the Challenger incident the number was changed. By the Times' account, NASA's own estimate stood at one in 50 when flights resumed in 1988; as confidence returned, the agency's figure drifted back to one in 254 in 1998, and later new studies pulled it back to one in 123. When Columbia broke up on re-entry in 2003, NASA settled lower:

With a new realism born of disaster, NASA says that the risk of catastrophic failure during the space shuttle Discovery's mission is about 1 in 100… (The actual rate of catastrophic failure—as opposed to the calculated risk—now stands at 2 flights in 113, or 1 in 57.) … "You'd like to go to 1 in 1,000," [a NASA official] said. "But you're never goin[g to]." [Broad, 2005]

The initial estimate had been optimistic by a factor of a thousand. In the appendix of his report, Feynman wrote:

For a successful technology, reality must take precedence over public relations, for nature cannot be fooled. [Feynman, 1986]

VI. What is next

The risk levels described in this essay were arbitrary, and they were arrived at with little or no open consultation about the level of risk a public would actually find appropriate in each case. In the Netherlands the numbers came with probabilities and uncertainties that were, on the record, deliberately kept out of the public's sight. In the United States the level was also negotiated and chosen without public weighting in. Once set, a figure is easily internalized and becomes a default. So much regulation rests on it now, that it can hardly be challenged.

But these numbers were fixed a long time ago, and now we understand the nature behind those risks better, and have also developed more experience managing risks in general. Reassessing something this basic does not mean distrusting the whole concept; examining it openly is how we might reach a more honest and self-consistent way to decide its value. The shuttle story is a warning of how good-faith, wishful arithmetic can drive the risk down and give us a collective false sense of safety. The Soviet story tells us that ideological reasoning does not necessarily lead to maximizing the safety of individuals. And the Dutch story shows us that in the rush to make regulation consistent, we can lose sight of the reasoning underneath it.

While science cannot hand us the acceptable number from first principles, what it can do is help us revise it in agreement with our changing understanding of the physical world, and our evolving perception of the value of our own and our neighbours' lives.