M9 · UNCERTAINTY
The false precision of a single number.
Module 8 ended with a triumph: a model that takes a trial and turns it into a single lifetime ICER — say, £24,000 per QALY. Clean, precise, decisive. And quietly dishonest.
That one number was built from dozens of inputs — a survival curve's extrapolation, a utility value, a drug price, a discount rate, the cost of managing progression. Not one of them is known exactly. Each is an estimate with a plausible range: the utility might be 0.6 or 0.7, the survival gain might be four months or nine. The ICER inherits every one of those uncertainties — and then displays none of them. It looks like a fact. It's the tip of a cloud.
So before anyone acts on £24,000, the honest question is: how much would that number move if the inputs we guessed at turned out differently? Answering it is the whole of Module 9, and the simplest answer starts here.
Wiggle one input.
The plainest way to probe an uncertain input is to poke it and watch. Take one parameter — the utility in the progressed state, say. In the model it sits at its central estimate; call that the base case. Now:
- Set it to its plausible low value and recompute the ICER.
- Set it to its plausible high value and recompute the ICER.
The ICER moves — maybe from £19,000 to £31,000. You've just done a one-way sensitivity analysis on that parameter: you varied one input across its range, held everything else at the base case, and measured how far the result travelled. That travel — the distance between the low-ICER and the high-ICER — is the parameter's swing. A big swing means the answer is sensitive to that input; a tiny swing means the input barely matters, however uncertain it is.
Do it for every input.
One parameter tells you a little. The power comes from repeating it across the board: take each uncertain input in turn, swing it low-to-high, recompute the ICER each time — always with every other input pinned at its base-case value. One at a time, down the whole list.
Now each parameter carries a swing: the survival gain might move the ICER from £16,000 to £38,000; the discount rate only from £22,000 to £26,500. Some inputs, when wiggled, throw the answer around wildly. Others hardly nudge it. You've turned a single ICER into a table of ranges — one range per input — and buried in that table is the thing you actually want to know: which handful of inputs is running the show? You just need a way to see it at a glance.
Stack them into a tornado.
That way to see it is one of the most recognisable pictures in health economics: the tornado diagram.
Draw one horizontal bar per parameter, stretching from its low-ICER to its high-ICER — the bar is the swing. Stack the bars with the widest at the top and the narrowest at the bottom, and the outline funnels inward: a tornado. Add two vertical lines — one at the base-case ICER (where every bar is anchored through), one at the cost-effectiveness threshold — and the diagram tells its whole story in a glance:
- The bars at the top are the value drivers. The result is most sensitive to these; they're where the argument lives, where evidence matters most, where scrutiny should go first.
- The bars at the bottom barely matter. However uncertain those inputs are, they can't move the verdict much.
- Any bar that crosses the threshold line is decision-relevant uncertainty. For that parameter, part of its range says "cost-effective" and part says "not" — the verdict flips depending on where the truth lies.
Read the tornado.
Below is a tornado for our £24,000 base-case ICER — five inputs, each bar spanning the ICER from that input's low value to its high value, sorted widest-first. Drag the threshold line. Any bar it passes through turns red: that input, on its own, can flip the verdict.
Threshold £30,000 · Base-case ICER £24,000 (cost-effective) · Bars crossing the threshold: 2 of 5 — Survival gain (treatment effect), Progressed-state utility
Two things jump out. First, the ranking: the survival gain dwarfs everything below it — get that input wrong and the answer swings by £22,000, while the bottom three barely twitch. That's where you'd demand the best evidence. Second, slide the threshold to £30,000 and only the top two bars cross it: the base case is comfortably cost-effective, and stays cost-effective under one-way variation of every input except those two. The decision is fragile in exactly two places — and now you know which.
Now you.
In a tornado, one input's ICER runs from £18,000 at its low value to £34,000 at its high value.
What is the swing — the width of that input's bar? (Enter it in pounds, a plain number.)
What one-way analysis can't see.
The tornado is powerful and honest about one thing — but it has a limitation so fundamental it's the reason the next lesson exists. Read the method's own definition again: vary one input, holding all others at the base case.
That "all others at the base case" is the catch. Real uncertainty isn't one input going wrong while the rest behave perfectly — it's many inputs being off at the same time. One-way analysis never lets them move together. Suppose the survival gain is a little worse than expected and the utility is a little lower and the drug turns out costlier — each is well within its own range, and each bar alone might stay under the threshold, yet their combined effect could push the ICER well past it. The tornado can't show that, because it only ever moves one lever at a time.
It also ignores correlation: in reality some inputs move together (a sicker modelled population might have both lower utility and higher costs), and one-way analysis treats every input as if it lived in isolation. The upshot is blunt and important: one-way sensitivity analysis systematically understates total uncertainty. A result can look robust to every input individually and still be fragile when they vary jointly. Capturing that joint variation is precisely the job of probabilistic sensitivity analysis, next lesson.
The tornado is only as honest as its ranges.
There's a second thing to watch, and it's where an assessor earns their keep. Every bar's width depends entirely on the range chosen for that input — and those ranges are a choice, not a fact.
A parameter's range might come from a 95% confidence interval, from a plausible ±20%, or from expert opinion about the highest and lowest credible values. Widen the range and the bar grows; narrow it and the bar shrinks. Which means the tornado can be quietly engineered: assign a value driver a suspiciously narrow range and its bar collapses to the bottom of the diagram, making a genuinely influential — and genuinely uncertain — input look settled and unimportant. A bar that would have crossed the threshold can be shrunk until it doesn't.
So the tornado is never read at face value. The questions are always: where did each range come from, are they consistent across inputs (a tight range on the value driver next to a generous one on a trivial parameter is a red flag), and — for the inputs that matter most — are the ranges wide enough to reflect what we honestly don't know? A tornado with hand-picked ranges is an argument dressed as a diagnostic.
What's the flaw in that conclusion?
A manufacturer's tornado diagram shows that when each input is varied one at a time, no bar crosses the £30,000 threshold. They conclude: "The result is robust to uncertainty." What's the flaw in that conclusion?
Why this matters for HTA
The tornado is usually the first uncertainty analysis you'll reach in a dossier, and it rewards a trained eye in three ways:
- Go straight to the top bars. The parameters at the wide end are the value drivers — the inputs the whole conclusion rides on. Those are where you concentrate scrutiny: is the survival gain's evidence solid, is the utility value defensible? The bottom bars you can largely set aside.
- Check the ranges before you trust the shape. A tornado is only as honest as the ranges feeding it. Ask where each came from, and be suspicious of a value driver assigned an implausibly tight range — that's the classic move for shrinking an inconvenient bar below the threshold.
- Never read a clean tornado as "robust." No bar crossing the threshold means the result survives inputs varied one at a time — nothing more. Joint uncertainty can still flip it. Treat a tidy tornado as a reason to ask for the probabilistic analysis, not as a substitute for it.
A tornado diagram is a ranking of what could go wrong, one thing at a time. It's the right first question and the wrong last one — because the world rarely does you the courtesy of only going wrong in one place at once.
One-way sensitivity analysis, in one breath.
- A model's ICER is a point estimate resting on dozens of uncertain inputs. One-way sensitivity analysis probes it by varying one input across its plausible range, holding all others at the base case, and measuring how far the ICER moves — its swing.
- A tornado diagram stacks those swings widest-first: the top bars are the value drivers the result is most sensitive to, and any bar crossing the threshold marks an input that can flip the verdict on its own.
- Its hard limit: it moves one input at a time, so it can't capture inputs varying jointly or correlated — it understates total uncertainty. A clean tornado is necessary, never sufficient.
- And it's only as honest as its ranges, which are chosen — narrow ranges can hide a value driver or a threshold-crossing bar, so always check where the ranges came from.
One-way analysis opens the cloud around the ICER through a single narrow slit — one input at a time. Useful, but it's still one slit. The next lesson opens the whole sky at once.
That "everything at once" is probabilistic sensitivity analysis: instead of swinging inputs one by one between fixed extremes, we draw all of them simultaneously from their uncertainty distributions, thousands of times over, and watch where the ICER actually lands. That's next.