The regulation and control of risks in high-risk arenas is a hot topic. Nuclear power stations, commercial airlines, intensive care units and chemical processing plants both manufacture and regulate risks that, if realised, can have devastating outcomes. Economic life is regularly punctuated by such events, resulting in fatal accidents, environmental damage, ruined reputations and financial loss. As such, the day-to-day control of risks in these high-risk arenas has received considerable research attention. Much of this literature is increasingly being framed in terms of organisational resilience (Sutcliffe and Vogus 2003). Organisational resilience loosely refers to the ability of organisations to contain, correct and recover from failures before these disable their operations and cause serious breakdowns (Collingridge 1996; Weick et al. 1999). The key ideas focus on decentralised processes of adaptation, flexibility and learning (Hollnagel et al. 2006; cf. Boin, Jennings and Lodge, this volume). These processes allow organisations to react to previously unforeseen risks, adapt to changing situations and accommodate unexpected disruptions. These ideas are being energetically explored, both in the literature and in practice. However, at first blush these strategies of resilience appear far removed from the ways in which notions of ‘risk’ are typically instituted in regulatory regimes and formal risk management systems. Indeed, key authors have explicitly distanced typical models of risk management from those of resilience in high-risk arenas (Rochlin 1993: 17–19; Wildavsky 1988). The regulation of risk is commonly seen as a precautionary and forward-looking enterprise (Short 1992).