Fire risk assessment: what the law requires, the five steps, and what the record must show

01

What a fire risk assessment is, and the law that requires one

In England and Wales the duty is in article 9 of the Regulatory Reform (Fire Safety) Order 2005, the Fire Safety Order: "The responsible person must make a suitable and sufficient assessment of the risks to which relevant persons are exposed for the purpose of identifying the general fire precautions he needs to take." The precautions, their maintenance, the emergency plan and training all follow from it.

The responsible person is defined in article 3 of the Fire Safety Order: for a workplace, the employer, if it is to any extent under their control; for other premises, the person who controls them in connection with a trade, business or other undertaking, or otherwise the owner. A shared building usually has several, each for the parts they control. GOV.UK's Workplace fire safety: your responsibilities puts it more simply: you are responsible for fire safety in business or other non-domestic premises if you are an employer, the owner, the landlord, an occupier or anyone else with control of the premises.

The Order covers almost every non-domestic premises, from offices, shops and warehouses to schools, hotels and care homes, and the common parts of residential buildings. Section 1 of the Fire Safety Act 2021 made clear that where a building contains two or more sets of domestic premises, the Order applies to its structure and external walls, including windows, doors and balconies, any common parts, and all doors between the flats and the common parts. It does not apply inside an individual flat.

From 1 October 2023, section 156 of the Building Safety Act 2022 tightened the duty in England and Wales, as the Home Office's Fire safety responsibilities under Section 156 of the Building Safety Act 2022 explains. Every responsible person must now:

• record the fire risk assessment in full, including all the findings, as soon as practicable after it is made or reviewed. Before then only those with five or more employees, a licence or an alterations notice had to record anything. Article 9 requires the record to include "the findings of the assessment, including the measures which have been or will be taken" and any group of people identified as especially at risk;
• record the name, and any organisation, of anyone engaged to carry out or review the assessment;
• record their fire safety arrangements for planning, organising, controlling, monitoring and reviewing the precautions, under article 11;
• share a UK address with other responsible persons and residents, take reasonable steps to find out whether there are other responsible persons in the premises, and hand the assessment and its records to anyone who takes over from them.

Scotland has its own law. Under section 53 of the Fire (Scotland) Act 2005 an employer must assess the workplace to identify any risks to employees' safety from fire, and under section 54 anyone with control of relevant premises must assess the risks to the people there. Regulation 8 of the Fire Safety (Scotland) Regulations 2006 requires the significant findings to be recorded where the duty holder employs five or more people, the premises need a licence or registration, or an alterations notice requires it. Northern Ireland's Fire Safety Regulations (Northern Ireland) 2010, made under the Fire and Rescue Services (Northern Ireland) Order 2006, have the same three triggers.

02

The five steps of a fire risk assessment

Government guidance sets out the assessment in five steps, on GOV.UK's page on fire risk assessments in the workplace and in the Home Office's Fire safety risk assessment: 5-step checklist, updated in January 2025 for the simplest premises in England.

1. Identify the fire hazards. A fire needs a source of ignition, fuel and oxygen. Look for ignition sources, such as electrical equipment and machinery, heaters, cooking, smoking, contractors' hot work and arson, and for fuel: packaging and stock, waste, furniture, flammable liquids and the bins outside against the wall.
2. Identify the people at risk. Employees, visitors, contractors and the public; people working alone or out of hours; anyone sleeping in the building; and those especially vulnerable, such as children, older people and disabled people who may need help to escape.
3. Evaluate, remove or reduce the risks, and protect people. Remove or reduce the hazards you can, then decide whether the fire safety measures already in place are adequate: escape routes, fire doors and compartmentation, fire alarms and detection, emergency lighting, signs, and firefighting equipment such as fire extinguishers.
4. Record, plan, inform, instruct and train. Write down the findings and the action taken, prepare an emergency plan with clear evacuation procedures, tell the occupants what they need to know, give staff fire safety training and hold fire drills.
5. Review. Keep the assessment up to date, and review it when it may no longer be valid or something significant has changed.

Conduct a fire risk assessment as a walk round the whole property, including plant rooms, store rooms and the outside of every final exit, not as a desk exercise.

03

What the written assessment should contain: a template

The law prescribes what the record must include, not its layout, so any fire risk assessment template is only a starting point. A record that meets article 9 and the 2023 changes usually holds:

• The premises: address, use, size and floors, the usual and greatest number of occupants, hours of use, and any other occupiers.
• The responsible person, with a UK address, and the assessor: their name, organisation and the date.
• The fire hazards found: sources of ignition, fuel, any dangerous substances, and anything that would help a fire start or spread.
• The people at risk, naming any group especially at risk, such as people who would need help to evacuate.
• The fire precautions and their condition: means of escape, fire doors and compartmentation, fire alarms and detection, emergency lighting, signs, firefighting equipment and fixed installations.
• The fire safety arrangements: who is responsible for what, how the precautions are tested and maintained, what fire safety training staff receive and how contractors are controlled.
• The emergency plan: how the alarm is raised, the evacuation plan for how people leave and where they assemble, and how people who need help are evacuated.
• The action plan: each finding with its priority, an owner and a date.
• The review: when it is next due, and what would bring it forward.

For professional assessors, BSI publishes PAS 79-1:2020 Fire risk assessment – Premises other than housing – Code of practice, which gives recommendations and examples of documentation for undertaking and recording the significant findings of fire risk assessments in non-domestic premises. It superseded PAS 79:2012. For housing, BSI withdrew PAS 79-2:2020 and replaced it with BS 9792:2025 Fire risk assessment – Housing – Code of practice. For small, simple premises in England, the Home Office's 5-step checklist is the government's own fire risk assessment checklist.

A checklist prompts; it does not assess. Every box ticked and no findings is unlikely to be suitable and sufficient.

04

Who can carry out a fire risk assessment

The responsible person can carry out the assessment themselves. GOV.UK says you can do it yourself using the standard guides, or appoint a competent person, such as a professional risk assessor, if you lack the expertise or time. The offices and shops guide adds that if you decide you are unable to apply the guidance, "you should seek expert advice from a competent person."

Section 156 also inserts a new article 9A into the Fire Safety Order: a responsible person must not appoint anyone to help make or review the assessment unless they are competent, meaning they have "sufficient training and experience or knowledge and other qualities to enable the person properly to assist in making or reviewing the assessment." Unlike the rest of section 156, that requirement did not start on 1 October 2023: the Home Office says it will be brought into force at a later date, and meanwhile recommends that anyone you employ to do the assessment is competent. The law names no particular qualification. In practice, ask the assessor or their company for relevant training, experience of premises like yours, membership of a professional body or register, and a sample report.

Bring in a professional fire risk assessor for anything beyond simple premises: large or tall buildings, anywhere people sleep, high-risk processes, and the common parts of blocks of flats. Appointing an assessor does not hand over the duty: the responsible person remains accountable for the assessment and for acting on it.

In a shared building, each responsible person assesses what they control: typically the landlord or managing agent the common parts and base-building systems, and each tenant its own space. They must co-operate, and the offices and shops guide says you must "inform them of any significant risks you find and how you will seek to reduce/control those risks". Agree in writing who assesses what, and share the findings both ways.

05

How often to review it, and closing the action plan

Article 9(3) of the Fire Safety Order requires the assessment to be "reviewed by the responsible person regularly so as to keep it up to date", and particularly if there is reason to suspect it is no longer valid or there has been a significant change. Scotland's regulation 3 says the same. The law sets no fixed interval, so the assessment should say when it will next be reviewed; a change in the building brings it forward. The offices and shops guide lists changes that should prompt a review, including:

• alterations to the building, including the internal layout, or new equipment and work processes;
• the introduction, change of use or increase in storage of hazardous substances;
• the failure of fire precautions;
• a significant increase in the number of people present, or the presence of people with some form of disability.

Findings only reduce the risk when they are acted on. Each action needs an owner, a date and a way of showing it was done: a contractor's certificate, a photograph of a cleared store. At each review, go through the last action plan line by line. An action carried forward unchanged from one assessment to the next is a sign that the assessment is being written but not acted on, and is the first thing a reviewer will look for.

Much of an assessment also assumes the building stays as the assessor found it: escape routes clear, fire doors closing, the alarm tested weekly. Article 17 requires fire safety facilities, equipment and devices to be "subject to a suitable system of maintenance" and kept "in efficient working order and in good repair." That is the work of the routine fire safety checks, such as fire door checks and the weekly fire alarm test, and of the fire log book that records them.

Local fire and rescue authorities enforce compliance with the Order. Their inspectors can issue an alterations, enforcement or prohibition notice, and GOV.UK's page on enforcement, appeals and penalties says minor penalties can be up to £5,000, and major penalties can be unlimited fines and up to 2 years in prison. Since October 2023, failing to comply with an inspector's requirements, such as producing the fire risk assessment, carries an unlimited fine rather than a maximum of £1,000.

06

Where the record fails, and what SiteClara does about it

The assessment itself is rarely where things go wrong. The failure comes afterwards: actions with no owner carried from one review to the next; a store room that filled up again a month after it was cleared; a fire door that stopped closing. At the next review the assessor asks for evidence and finds a log book with gaps, or one filled in neatly a page at a time.

SiteClara is aimed at that gap between the assessment and the routine. The building puts a printed QR poster, with an NFC tag if staff prefer to tap, at the places the assessment depends on: the fire alarm panel, the fire doors on each stair, the final exits, the store room. Staff scan with their own phone, with no app to install, and see the checks due there. They mark each one done, or say what stopped them, with a photo when one is asked for, such as a final exit clear outside. The time and the named person are recorded as it happens.

A problem found on a check, such as a wedged fire door or a blocked exit, is reported there with a photo and goes on the team's list of jobs until someone closes it; a job that needs the building manager can be escalated to them. A supervisor sees which checks are due, done and missed, and records the reason for a miss. Each day the supervisor approves a report that goes to nominated management or client contacts the next morning. At the next review, that record shows which checks were done, where, by whom and when, and which faults were raised and put right.

07

Questions people ask

Is it a legal requirement to have a fire risk assessment?

Yes, for almost every business and other non-domestic premises, and for the common parts of residential buildings. In England and Wales article 9 of the Regulatory Reform (Fire Safety) Order 2005 says the responsible person "must make a suitable and sufficient assessment of the risks to which relevant persons are exposed", and GOV.UK's Workplace fire safety: your responsibilities says they must carry out a fire risk assessment of the premises and review it regularly.

Can I do a fire risk assessment myself?

Yes. GOV.UK's page on fire risk assessments in the workplace says you can do it yourself with the help of the standard fire safety risk assessment guides, and that if you do not have the expertise or time you need to appoint a competent person to help, such as a professional risk assessor.

What qualifications do you need to carry out a fire risk assessment?

No particular qualification is required by law. Article 9A of the Fire Safety Order, inserted by section 156 of the Building Safety Act 2022, will require anyone appointed to help make or review the assessment to have "sufficient training and experience or knowledge and other qualities" to do it properly. The Home Office's Fire safety responsibilities under Section 156 of the Building Safety Act 2022 says that requirement will be brought into force at a later date, and recommends meanwhile that anyone you employ to do it is competent.

08

Further reading, and a list to take away

The Home Office publishes a series of fire safety risk assessment guides for different premises, from offices and shops to educational premises, sleeping accommodation and places of assembly, with a guide on means of escape for disabled people and short guides for small premises. The Welsh Government publishes its own guidance on the Section 156 changes. The Scottish Government and the Northern Ireland Fire and Rescue Service publish their own guidance. Your local fire and rescue service will usually answer questions about your own building.

Before the next review of your fire risk assessment, check that:

• you know who the responsible person is for each part of the building, and each has the others' contact details;
• the assessment is complete and recorded in full, with its findings, the groups especially at risk and the name and organisation of whoever carried it out;
• your fire safety arrangements are written down;
• every action in the plan has an owner and a date, and the ones closed have evidence;
• the routine checks the assessment relies on are done and recorded, with faults and what was done about them;
• anything significant that has changed has been passed to the assessor;
• the assessment says when it will next be reviewed.