Quantitative Microbiological Risk Assessment (QMRA) is increasingly being used to complement traditional verification of drinking water safety through the absence of indicator bacteria. However, the full benefit of QMRA is often not achieved because of a lack of appropriate data on the fate and behaviour of pathogens. In the UK, statutory monitoring for Cryptosporidium has provided a unique dataset of pathogens directly measured in large volumes of treated drinking water. Using this data a QMRA was performed to determine the benefits and limitations of such state-of-the-art monitoring for risk assessment. Estimates of the risk of infection at the 216 assessed treatment sites ranged from 10(-6.5) to 10(-2.5) person(-1) d(-1). In addition, Cryptosporidium monitoring data in source water was collected at eight treatment sites to determine how Cryptosporidium removal could be quantified for QMRA purposes. Cryptosporidium removal varied from 1.8 to 5.2 log units and appeared to be related to source water Cryptosporidium concentration. Application of general removal credits can either over- or underestimate Cryptosporidium removal by full-scale sedimentation and filtration. State-of-the-art pathogen monitoring can identify poorly performing systems, although it is ineffective to verify drinking water safety to the level of 10(-4) infections person(-1) yr(-1).