In safety, environmental, and financial regulation the public are often asked to accept estimates of a concept, "risk", that they cannot directly perceive. Faith in these estimates is supported by logical reasoning but not by empirical evidence. Unfortunately, the evidence that does exist about risk phenomena indicates that human reasoning about risk is highly unreliable. In this paper we determine what properties must hold for Quantitative/Probabilistic Risk Assessment (QRA) to be fit for purpose. We identify these properties by considering how the outputs of QRA are actually used by engineers and regulators. We then consider what evidence could be realistically available to demonstrate these properties – i.e., to what extent can a particular QRA technique be validated against the properties? We discuss whether it is possible to directly test the properties, or at least to test the arguments made for and against the properties. Against this range of possible evidence, we determine what evidence does in fact exist. We find that whilst it is possible to test whether QRA has the properties expected of it, good evidence is not currently available. This conclusion should not necessarily be interpreted as evidence against the safety of industries using QRA, but does cast into doubt the extent to which QRA contributes to the achievement of safety. It also suggests that if there are benefits to QRA, there is no evidenced reason to believe that they arise from quantification rather than from the process of systematically analysing the sources of risk.