Fire Risk Assessment Explained: The 5-Step Guide Every Responsible Person Needs to Know

Fire Risk Assessment Explained: The 5-Step Guide Every Responsible Person Needs to Know
Fire risk assessments are not optional. Under the Regulatory Reform (Fire Safety) Order 2005 (the FSO), every non-domestic premises in England and Wales must have a suitable and sufficient fire risk assessment in place. Whether you manage an office block, a residential building with common parts, a warehouse, or a school, the legal obligation falls squarely on the responsible person to ensure one is carried out and kept up to date.
Yet despite being a cornerstone of UK fire safety law for over two decades, fire risk assessments remain widely misunderstood. Many responsible persons treat them as a tick-box exercise completed once and filed away, rather than a living process that actively protects people and property.
This guide walks through the established 5-step methodology for conducting a fire risk assessment, explains what the law requires, and provides practical advice for doing it properly.
What Is a Fire Risk Assessment?
A fire risk assessment is a systematic analysis of a premises and its activities to identify anything that presents a fire hazard — that is, anything with the potential to cause a fire. Once fire hazards are identified, the assessment evaluates the risk they pose in terms of harm to human life, damage to property, and loss of other assets.
The purpose is not simply to document hazards. It is to drive action: to eliminate risks where possible, reduce them where elimination is not feasible, and put protective measures in place to keep people safe if a fire does occur.
Who Is the Responsible Person?
The FSO places the duty to carry out and maintain a fire risk assessment on the "responsible person." In practice, this is:
- The employer, for any workplace where people are employed
- The building owner or landlord, for common areas of residential buildings, or premises where the occupier does not have control
- Any other person who has control of the premises, such as a managing agent or facilities manager
If you fall into any of these categories, the fire risk assessment is your legal responsibility. You cannot simply assume someone else is handling it.
Can You Do It Yourself?
For low to normal risk premises — a typical office, a small retail unit, a standard residential common area — there is no legal requirement to appoint an external fire risk assessor. The responsible person can carry out the assessment themselves, provided they have sufficient understanding of fire safety principles and the specific risks present in the building.
However, competence is the critical factor. For more complex premises — buildings with higher occupancy, multiple floors, sleeping risks, hazardous materials, or complex layouts — engaging a suitably qualified and experienced fire risk assessor is strongly recommended. The consequences of an inadequate assessment can be severe, both in terms of safety and enforcement.
The 5-Step Fire Risk Assessment Methodology
The 5-step methodology is the standard approach recommended by UK fire safety guidance, including the series of guides published by the government for different premises types. Each step builds on the previous one to create a comprehensive picture of fire risk and the measures needed to manage it.
Step 1: Identify Fire Hazards
The first step is to carry out a structured survey of the premises to identify everything that could contribute to a fire starting and spreading. This is grounded in the fire triangle — the principle that three elements must be present simultaneously for a fire to occur:
1. Fuel — any combustible material that can burn
2. An ignition source — anything with enough heat energy to ignite the fuel
3. Oxygen — present in atmospheric air and therefore available in virtually every building
Your task in Step 1 is to identify the fuel sources and ignition sources present in your premises, and to consider how they might come together.
#### Identifying Fuel Sources
It is often easier to think about what in the building will not burn than what will. Furniture, soft furnishings, paper and stationery, textiles, timber, packaging materials, waste and recycling — all of these are combustible and will burn readily. In a typical workplace or residential common area, combustible materials are everywhere.
Beyond everyday combustibles, you must also identify higher-risk materials:
- Flammable liquids and gases — cleaning products, solvents, paints, adhesives, cooking oils, LPG cylinders
- Highly or extremely flammable substances — petrol, acetone, certain aerosols
- Explosives — though uncommon in most premises, certain industrial or storage settings may hold explosive materials
- Oxidising agents — chemicals or medical/industrial gases that provide additional oxygen and can accelerate combustion
Document where these materials are stored, how much is present, and how they are managed.
#### Identifying Ignition Sources
Next, consider what could provide enough heat energy to ignite the fuel sources you have identified:
- Electrical equipment — faulty wiring, overloaded sockets, damaged cables, portable heaters, equipment left running overnight
- Lithium-ion batteries — charging of e-bikes, e-scooters, laptops, and power tools has become a significant and growing fire risk in recent years
- Cooking equipment — hobs, ovens, deep fat fryers, toasters
- Heating systems — boilers, radiators, portable heaters placed too close to combustible materials
- Smoking materials — cigarettes, matches, lighters, particularly in or near areas where smoking is not permitted
- Arson — deliberate fire-setting, particularly relevant for buildings with poor security or accessible waste storage
- Hot works — welding, cutting, grinding, or any process that generates sparks or high temperatures
- Friction and mechanical heat — from machinery, equipment, or processes
For each ignition source, consider whether current controls are sufficient to prevent it from coming into contact with fuel sources.
Step 2: Identify People at Risk
A fire risk assessment is fundamentally about protecting people. Step 2 requires you to identify everyone who could be affected if a fire occurs, and to consider their specific needs.
#### Total Numbers
The number of people in and around the premises has a direct impact on evacuation planning. A building with hundreds of occupants, visitors, or members of the public requires a very different evacuation strategy to a small office with ten staff. Consider:
- Employees and regular occupants
- Visitors, customers, and members of the public
- Contractors and maintenance workers
- People in neighbouring premises who could be affected
Think about how numbers fluctuate. Peak occupancy times, events, deliveries, and shift patterns all affect the number of people at risk at any given moment.
#### Vulnerable Individuals and Groups
Certain people are at greater risk in a fire and require specific consideration:
- People with mobility impairments who may be unable to use stairs during evacuation
- People with visual impairments who may not see fire safety signage or emergency lighting
- People with hearing impairments who may not hear fire alarms
- People with cognitive or learning disabilities who may need additional support to understand and follow evacuation procedures
- Children and young people, particularly in educational or childcare settings
- Elderly people, who may have reduced mobility, hearing, or vision
- People unfamiliar with the building, such as visitors, guests, or new employees
- Lone workers, who may have no one to raise the alarm or assist them
For each vulnerable individual or group identified, you should consider whether a Personal Emergency Evacuation Plan (PEEP) is required. A PEEP is a tailored plan that sets out exactly how a specific person will be assisted to evacuate safely. This is not optional — it is a legal expectation under the FSO.
Step 3: Evaluate the Risk and Take Action
With fire hazards and people at risk identified, Step 3 is where you evaluate the overall level of risk and determine whether your existing fire safety measures are adequate. If they are not, you must act to address the shortfalls.
This step covers two interconnected areas: fire prevention (stopping fires from starting) and fire protection (protecting people and property if a fire does start).
#### Fire Prevention
The logic of fire prevention is straightforward: if the three sides of the fire triangle can be kept apart, a fire cannot start. In practice, fire prevention in the workplace means:
- Controlling ignition sources — maintaining electrical equipment, enforcing hot work permits, managing lithium-ion battery charging in designated areas, enforcing no-smoking policies
- Controlling fuel sources — proper storage of flammable materials, good housekeeping to prevent accumulation of combustible waste, keeping combustible materials away from heat sources
- Managing the interface — ensuring that fuel and ignition sources are physically separated wherever possible
#### Fire Protection
Even with robust prevention measures, fires can still occur. Fire protection strategies ensure that when a fire starts, it is detected quickly, people are alerted, and they can evacuate safely. Evaluate your arrangements in each of the following areas:
Detection: How will a fire be detected in its early stages? Options range from relying on human observation (only appropriate in very small, constantly occupied premises) to automated systems using smoke detectors, heat detectors, or flame detectors. The type and coverage of detection should be appropriate to the premises and its occupancy pattern. An unoccupied building at night, for example, cannot rely on human detection.
Alarm: Once a fire is detected, how is the alarm raised? In small premises, a simple shout may suffice. In larger premises, an automated fire alarm system linked to the detection system is essential. Consider whether the alarm is audible in all parts of the building, including areas with high background noise. Visual alarm devices (flashing beacons) may be needed where hearing-impaired people are present.
Firefighting Equipment: While the priority in any fire is safe evacuation, there may be situations where early intervention with portable fire extinguishers can contain a small fire before it develops. Decisions must be made about:
- Whether to provide portable fire extinguishers and what types (water, foam, CO2, dry powder, wet chemical) are appropriate for the risks present
- Whether staff will be trained to use them, or whether the policy is to evacuate immediately and leave firefighting to the fire and rescue service
- Whether more sophisticated fixed firefighting systems (sprinklers, gas suppression, dry risers) are required
Escape Routes: Are there sufficient escape routes for the number of people in the building? Are they:
- Free from obstructions at all times
- Clearly signposted with compliant emergency exit signage
- Provided with emergency lighting that activates during a power failure
- Of adequate width for the expected number of evacuees
- Leading to a place of safety (outdoors, at ground level, away from the building)
Assembly Points: Where will people go once they have evacuated? The assembly point must be at a safe distance from the building, clearly identified, and known to all occupants. Procedures must be in place to account for everyone — roll calls, visitor sign-in systems, or other headcount methods.
#### Acting on Shortfalls
If your evaluation reveals that any of these measures are missing, inadequate, or not properly maintained, you must take action. Prioritise issues based on risk: anything that could directly prevent safe evacuation or leave people unaware of a fire should be treated as urgent.
Step 4: Record, Plan, and Train
#### The Written Record
If your premises employs five or more people, you are legally required to record the significant findings of your fire risk assessment in writing. Even if you employ fewer than five, a written record is strongly recommended — it serves as evidence of compliance and a practical management tool.
Your written record should include:
- The fire hazards identified
- The people at risk and any specific needs identified
- The fire safety measures in place and their condition
- Any shortfalls identified and the actions required to address them
- The date of the assessment and who carried it out
#### The Fire Action Plan
Separate from the risk assessment itself, you need a documented fire action plan that sets out:
- What to do on discovering a fire
- How to raise the alarm
- The procedure for calling the fire and rescue service
- Evacuation procedures, including specific arrangements for vulnerable people
- Assembly point locations
- Responsibilities of designated fire wardens or marshals
- Arrangements for meeting the fire and rescue service on arrival
The fire action plan should be displayed prominently throughout the premises and communicated to all occupants.
#### Training and Drills
Everyone in the building needs to understand the fire safety procedures and their role within them. Fire safety training should cover:
- The actions to take on hearing the fire alarm
- The location and use of escape routes and exits
- The location of assembly points
- The roles and responsibilities of fire wardens
- Basic fire prevention awareness
Fire evacuation drills are essential for testing your procedures and ensuring that everyone knows what to do. For most premises, drills should be conducted at least twice per year, though higher-risk premises or those with high staff turnover may require more frequent drills. Record the date, time, conditions, and outcomes of every drill, including any issues identified and corrective actions taken.
Step 5: Review and Update
A fire risk assessment is not a one-time exercise. It must be reviewed and updated to remain valid. There are three triggers for review:
#### Planned Changes
If you are making changes to the premises, its layout, its use, its occupancy, or its equipment, the fire risk assessment should be reviewed before those changes take effect. Examples include:
- Refurbishment or building works
- Changes to the building layout (new partitions, removed walls, altered escape routes)
- Changes to the type of work or activities carried out
- Introduction of new materials, particularly flammable or hazardous substances
- Significant changes in the number or type of occupants
#### Unplanned Events
Incidents and near misses are learning opportunities. If there is a fire, a false alarm, a blocked escape route, or any event that reveals a gap in your fire safety arrangements, the risk assessment should be reviewed in light of what happened. Investigations should be thorough, and lessons learned should be incorporated into the assessment and action plan.
#### Periodic Review
Even if nothing has apparently changed, it is good practice to schedule a regular review — typically annually — where you pull out the assessment, walk through it systematically, and confirm that it is still fit for purpose. This acts as a safety net, catching any changes that may have crept in without a formal review being triggered. If everything is still current, document the review and move on. If changes have been missed, this is the opportunity to update the assessment before the gap becomes a safety or compliance issue.


Complete building inspections 3x faster with AI
AnyInspect uses AI to transcribe walkthroughs, extract key findings, and auto-generate compliant inspection reports.

Common Mistakes to Avoid
Even when following the 5-step process, certain pitfalls frequently undermine fire risk assessments:
- Treating it as a paperwork exercise rather than a practical process that drives real safety improvements
- Failing to identify all fuel and ignition sources — a superficial walkthrough misses risks hidden in storage areas, plant rooms, and service voids
- Ignoring vulnerable people — failing to identify individuals who need PEEPs is a common enforcement finding
- Not testing arrangements — fire alarms, emergency lighting, extinguishers, and escape routes all require regular testing and maintenance, not just documentation
- Leaving the assessment to gather dust — an out-of-date assessment offers no protection, either to people or against enforcement action
- Underestimating the competence requirement — attempting a fire risk assessment for a complex building without sufficient knowledge and experience is both dangerous and a legal risk
Enforcement and Penalties
The FSO is enforced by local fire and rescue authorities, who have powers to:
- Issue alterations notices requiring the responsible person to notify the authority before making changes
- Issue enforcement notices requiring specific actions within a set timeframe
- Issue prohibition notices restricting or prohibiting the use of all or part of a premises where there is a serious risk to life
- Prosecute responsible persons who fail to comply, with penalties including unlimited fines and, in the most serious cases, imprisonment
Following the Grenfell Tower tragedy and subsequent legislative changes — including the Fire Safety Act 2021 and the Building Safety Act 2022 — enforcement activity has increased significantly. Fire and rescue authorities are conducting more audits, issuing more notices, and pursuing more prosecutions than at any point in the FSO's history. A robust, current fire risk assessment is your first line of defence.
Making Fire Risk Assessment Work in Practice
The 5-step methodology is deliberately structured to be logical and comprehensive. It is not meant to be complicated. For low to normal risk premises, a competent responsible person can work through it methodically, document their findings, and maintain the assessment as a living document.
For more complex premises, or where the responsible person lacks confidence in their own competence, investing in a qualified fire risk assessor is money well spent. The cost of a professional assessment is a fraction of the potential cost of enforcement action, civil liability, or — most importantly — the human cost of a fire in a building where the risks were not properly managed.
Whatever the approach, the key is that fire risk assessment is treated as an ongoing process, not a one-off task. Premises change, occupants change, risks evolve. The assessment must evolve with them.