A fire risk assessment has five steps: identify the fire hazards; identify the people at risk; evaluate, remove or reduce the risks; record your findings, prepare an emergency plan and provide training; and review and update it regularly. If you are an employer, building owner, landlord or occupier in England or Wales, you are the “responsible person” under the Regulatory Reform (Fire Safety) Order 2005 and you must carry one out. Since October 2023 you must keep a written record of it — regardless of how many people you employ.
This guide walks through each step in plain English, explains who can legally do the assessment, how often to review it, and where a written record is now compulsory rather than optional.
What law requires a fire risk assessment?
In England and Wales the governing law is the Regulatory Reform (Fire Safety) Order 2005, usually shortened to the Fire Safety Order or the RRO. Article 9 places the duty squarely on the responsible person to make a “suitable and sufficient” assessment of the risks to which relevant persons are exposed.
Two later pieces of law changed what that means in practice. The Fire Safety Act 2021 clarified that the Order covers a building’s structure, external walls and flat entrance doors in multi-occupied residential buildings. The Building Safety Act 2022 then amended the Order so that, from 1 October 2023, every responsible person must record their fire risk assessment in writing. The old exemption for employers with fewer than five staff is gone.
Who is the “responsible person”?
For a workplace, it is the employer, so far as the premises are under their control. Elsewhere it is the person with control of the premises — an owner, landlord, occupier or managing agent. A building can have more than one responsible person, and where it does, the Order requires them to co-operate and co-ordinate.
Importantly, the duty cannot be delegated away. You can pay a consultant to carry out the assessment, but the legal responsibility for having a suitable and sufficient one stays with you.
Step 1 — Identify the fire hazards
Fire needs three things: a source of ignition, a source of fuel, and oxygen. Step one is walking the premises and writing down where each of those exists.
- Sources of ignition — heaters, cooking equipment, faulty or overloaded electrics, hot work, smoking, lighting, machinery that gets hot, and deliberate ignition
- Sources of fuel — paper and packaging, waste, textiles, furniture, flammable liquids and gases, plastics, and anything stored in bulk
- Sources of oxygen — natural airflow, air conditioning and ventilation, and oxidising materials or oxygen cylinders
The most common finding in real assessments is mundane: cardboard and waste accumulating near an electrical intake, or stock stored in a corridor that also happens to be an escape route.
Step 2 — Identify the people at risk
Everyone lawfully on the premises is a “relevant person”, but the assessment has to single out those at particular risk. That typically includes people working alone or in isolated areas, night workers, visitors and contractors unfamiliar with the layout, children, and anyone whose mobility, sight, hearing or cognition would slow their escape.
Where someone would need help to evacuate, the accepted approach is a Personal Emergency Evacuation Plan (PEEP) agreed with that individual. “Wait for the fire service” is not an evacuation plan.
Step 3 — Evaluate, remove or reduce the risks
This is the step that does the actual work, and it has a clear order of preference. First remove the hazard entirely where you can. Where you cannot, reduce it. Only then do you rely on protective measures.
Practical examples: replace a flammable solvent with a water-based one; store the flammables you must keep in a proper cabinet away from ignition sources; fix the overloaded extension lead rather than writing a procedure about it. Then consider the protective measures — detection and warning, means of escape, emergency lighting, signage, firefighting equipment and maintenance regimes.
Escape routes deserve particular attention, because they are where most enforcement action starts. Routes must be adequate for the number of people, kept clear, adequately lit, clearly signed, and lead to a place of total safety.
Step 4 — Record, plan, inform, instruct and train
Since 1 October 2023 the record must be written, and it must include the significant findings, the measures you have taken or will take, and details of anyone identified as being especially at risk.
The emergency plan sets out what happens when the alarm sounds — how people are warned, the escape routes, where the assembly point is, who calls the fire service, and who has a specific role such as sweeping a floor or assisting an individual.
Article 21 of the Order requires you to provide adequate fire safety training to employees at the time they are first employed and again when risks change. What “adequate” means is set out in more detail in our guide to what fire safety training UK law actually requires.
Step 5 — Review and update
The Order does not set a fixed interval. It requires review where the assessment is no longer valid or there has been a significant change. In practice most organisations review annually as a matter of routine, and immediately after any of the following:
- A change of layout, occupancy, process or storage
- Building work, refurbishment or a change of use
- A fire, a near miss, or a failed drill
- New people at particular risk joining the premises
- A change in the law or in the guidance for your building type
Can I do the fire risk assessment myself?
Legally, yes — the Order requires the responsible person to appoint one or more “competent persons”, and that can be you if you have sufficient training, experience and knowledge for the premises in question.
That qualification matters. A small, simple, single-storey office is a very different proposition from a care home, a hotel, an HMO or a high-rise residential block. For complex or higher-risk premises, or any building where people sleep, the sensible course is a competent external fire risk assessor. Awareness training helps you understand and act on an assessment; it does not by itself make someone a competent fire risk assessor for a complex building.
What happens if you don’t have one?
Fire and rescue authorities enforce the Order. They can issue an alterations notice, an enforcement notice requiring specific work, or a prohibition notice that restricts or stops use of all or part of a building — the last of these takes effect immediately. Serious breaches are criminal offences, and prosecutions carry unlimited fines and, in the most serious cases, imprisonment.
The practical point is that a written fire risk assessment is usually the first document an inspecting officer asks for. Not having one shapes everything that follows.
Related guides
- Fire safety training: what UK law requires and what it does not
- Risk assessment: the five steps explained
Fire safety awareness training
Our Fire Safety Awareness course covers how fire starts and spreads, the common causes in UK workplaces, what to do when the alarm sounds, and how the fire risk assessment fits together. £9 per course. CPD accredited, 100% online, verifiable e-certificate. Pay for 2, get 3 — any 3 courses for £18.
General information, not legal advice. Fire safety duties depend on your building, its use and its occupants, and the law differs in Scotland and Northern Ireland. This article covers England and Wales. Nexis CPD courses are CPD-accredited awareness training, not Ofqual-regulated qualifications, and do not by themselves make anyone a competent fire risk assessor. Where a building is complex or people sleep on the premises, use a competent fire risk assessor.