Regulation hub / Article
Fire risk assessments: the five-step process
A fire risk assessment is the legal foundation of everything else you do under the Fire Safety Order. Without a current one, no amount of extinguishers or alarms will save you from enforcement.
Who can carry it out?
The Responsible Person can carry out the assessment themselves, but for anything beyond a low-risk single-occupancy office, you should appoint a 'competent person'. Competency is demonstrated through training, experience and ideally third-party certification (e.g. IFE, FPA, BAFE SP205, IFSM). Insurers and Fire Authorities expect external assessment for care homes, HMOs, hotels and complex buildings.
The five steps
HM Government's Fire Safety Risk Assessment guides set out a consistent methodology:
- 1. Identify fire hazards — ignition sources, fuel and oxygen.
- 2. Identify people at risk — staff, visitors, vulnerable occupants, people working alone or out-of-hours.
- 3. Evaluate, remove, reduce and protect from risk — including means of escape, detection, warning and firefighting equipment.
- 4. Record findings, prepare an emergency plan and provide training.
- 5. Review and revise — at least annually, and after any significant change.
When to review
Review the assessment at least every 12 months, and immediately if there's a significant change: a refurbishment, a change of use, new equipment, a near-miss, or a change in occupancy. After Grenfell, reviewing 'paper-only' assessments is no longer acceptable for residential buildings above 11 metres.
What the document must contain
A defensible written assessment records: the building, the assessor, the date, identified hazards, persons at risk, existing controls, additional controls needed, an action plan with owners and dates, and the review date. Anything less is hard to defend.
The most common gaps Fire Officers find
Blocked or wedged-open fire doors, missing or out-of-date extinguisher servicing, fire alarm panel showing faults, untested emergency lighting, no evacuation drill in 12 months, contractors not signed in. Most of these are zero-cost fixes — they fail because no one's checking.