The formal management of risk was an idea in its early stages of introduction into the National Health Service when this research started. In this thesis I document the development of my thinking as an acute hospital risk manager over the last five years as I developed the Trust's risk management system. Using Action Learning as the research approach, I explored theories and concepts and tested them in the fire of real world action and reflective questioning of experiences. The definition of risk is explored in relation to health care, as are the approaches used to manage these risks. A key finding is that risk management decision making does not generally fit into either programmed or non-programmed decision making models but neither do decision makers guess. Decision makers tend to use heuristics, which are simple rules of thumb, which generally help them make the right decision with minimum mental effort. However, heuristics also tend to be applied inappropriately and can result in an organisation being exposed to unacceptable levels of serious risk. A number of key heuristics are identified and they appear to fall into two general types, B-heuristics and E-heuristics. The B-heuristics are 'basic' in form and can be summarised as a simple sentence while, E-heuristics have an 'extended' form which can be summarised as a list of related simple sentences. Knowledge of heuristics helped in the design of the Trust's risk management which has been implemented and its effectiveness tested in the field. This field testing has demonstrated that the worst effects of heuristics can be mitigated by effective soft-system design.