A fire risk assessment is a structured review of a building or workplace to identify what could cause a fire, who could be harmed, and what measures are needed to prevent fire or keep people safe if one breaks out. In the UK, it is a legal requirement under the Regulatory Reform (Fire Safety) Order 2005 for virtually all non-domestic premises, including offices, shops, factories, restaurants, schools, and shared areas of residential buildings. Failing to carry one out can result in unlimited fines or up to two years in prison.
Who Is Legally Responsible
The law places the duty on a “responsible person.” In a workplace, that is the employer if they have any control over the premises. For other buildings, it is whoever controls the premises in connection with a business or undertaking, whether for profit or not. If no one fits that description, responsibility falls to the building’s owner.
The responsible person does not have to carry out the assessment personally. The law also requires appointing one or more “competent persons” to help manage fire safety. A competent person needs sufficient knowledge of fire risks, practical experience managing safety measures, and the confidence to act in an emergency. For simple, low-risk premises like a small office, the responsible person can often do the assessment themselves using government guidance. For complex buildings, hiring a professional fire risk assessor is the more practical choice.
A 2024 government survey of fire risk assessors in England found that 46% held a certification from a registered scheme, 40% were non-certified members of a professional body, and about 11% held neither. There is no single mandatory qualification, but certification provides evidence of competency and ongoing professional development.
The Five-Step Process
The UK government outlines a five-step checklist that forms the backbone of any fire risk assessment. Each step builds on the last, moving from hazard identification through to ongoing review.
Step 1: Identify Fire Hazards
This step involves walking through the premises and spotting anything that could start or fuel a fire. You are looking for three categories: ignition sources (things that produce heat or sparks), fuel sources (anything that burns), and oxygen supply (usually just the air in the room, but also includes stored compressed oxygen or oxidising chemicals).
Common ignition sources include electrical equipment, cooking appliances, heating systems, open flames, welding and grinding tools, portable generators, and even vehicles parked in or near the building. Fuel sources range from the obvious, like flammable liquids and gases, to things people overlook: stacked cardboard, dust buildup, foam furnishings, and waste bins. Smoking materials and arson are also considered hazards, particularly in buildings with public access. Poor housekeeping, where combustible materials accumulate near heat sources, is one of the most frequently identified risks.
Step 2: Identify People at Risk
Not everyone in a building faces the same level of danger. This step asks you to consider how many people use the premises and whether any of them would struggle to react to an alarm or escape quickly. Categories of higher-risk individuals include:
- People with reduced mobility: those who are bed-bound, chair-bound, use mobility aids, or have a history of falls
- People with sensory impairments: those with hearing loss who might not hear a standard alarm, or vision loss that makes navigating escape routes harder
- People with cognitive difficulties: those living with dementia, learning disabilities, or mental health conditions that affect decision-making
- People unfamiliar with the building: visitors, customers, new employees, or members of the public
- Lone workers: anyone working alone who may not have someone nearby to raise the alarm
- People affected by substances: those dependent on alcohol or using prescription or recreational drugs that slow reaction time
Young children, elderly residents, and sleeping occupants (in hotels, care homes, or hostels) all fall into higher-risk groups as well. The assessment should note where these individuals are typically located in the building and what specific measures, such as personal emergency plans or vibrating alarm pads, are needed.
Step 3: Evaluate the Risks and Take Action
With hazards and people identified, you evaluate how likely a fire is to start and how serious the consequences would be. This is where you examine the physical layout of the building: how many floors and staircases it has, the number and location of exits, whether doors close properly, and whether escape routes are clear and well-lit. You also assess whether fire detection and warning systems are adequate, including fire alarms, emergency lighting, fire exit signs, and extinguishers. The goal is to decide whether existing precautions are sufficient or whether improvements are needed, like better separation of combustible materials from ignition sources, additional fire doors, or upgraded alarm systems.
Step 4: Record, Plan, and Train
If your business has five or more employees, the assessment must be recorded in writing (though recording it is good practice regardless of size). This step also involves creating a clear emergency plan so everyone knows what to do if a fire breaks out: the evacuation procedure, assembly points, and who is responsible for assisting vulnerable people. Staff need fire safety training, and you should run regular fire drills. The written record should include an action plan listing any improvements needed, with priorities and deadlines.
Step 5: Review Regularly
A fire risk assessment is not a one-time task. It must be kept up to date and reviewed whenever circumstances change. Triggers for a review include any physical changes to the building (renovations, new partitions, changed layout), a significant change in the number of occupants, a change in stock levels or materials stored on site, or after any fire or near miss. Even without these triggers, regular reviews ensure that fire safety measures remain maintained and effective.
What Happens If You Don’t Have One
Enforcement in England and Wales is handled by fire and rescue authorities, who have the power to inspect premises and issue notices. If an inspector finds that the lack of a fire risk assessment puts people at serious risk of death or injury in a fire, they can prosecute the responsible person directly. The maximum penalty is an unlimited fine in the magistrates’ court. In the Crown Court, penalties can reach an unlimited fine combined with up to two years of imprisonment.
Even before prosecution, enforcement authorities can issue three types of statutory notice. An alterations notice requires you to inform the fire authority before making changes to the premises. An enforcement notice demands that specific fire safety failings be corrected within a set timeframe. A prohibition notice restricts or completely stops the use of a building until the risk is addressed. Failing to comply with any of these notices is itself a criminal offence carrying the same maximum penalties.
How It Works Outside the UK
The five-step model described above is specific to England and Wales, with Scotland and Northern Ireland operating under separate but similar legislation. In the United States, fire safety requirements are set at the federal, state, and local levels rather than through a single national fire risk assessment law. The National Fire Protection Association’s Life Safety Code (NFPA 101) establishes fire protection requirements covering building construction, fire detection, and evacuation features. Healthcare facilities receiving Medicare or Medicaid funding must comply with these standards, though states with their own fire codes that meet federal standards can be exempted. Many US jurisdictions require fire safety plans and inspections, but the format and terminology differ from the UK’s structured five-step assessment.
Regardless of location, the underlying principle is the same: systematically identify what could cause a fire, determine who is at risk, and put proportionate measures in place to prevent harm. The specifics of how that is documented and enforced vary by jurisdiction.