The process of utilising risk assessment as the basis for a managed fire safety programme is at first sight simple but further examination reveals issues of complexity which are often not well understood.
Origins
Part of the perceived problem almost certainly arises from a reliance on UK/European processes and principles which are inevitably skewed to meet legislative requirements. It is therefore worth starting this explanation with the changes in the UK (and most of Europe) from prescriptive fire legislation to performance-based legislation (See Box 1). Prior to 1997, UK fire legislation was largely governed by the Fire Precautions Act 1971 and its subsidiary legislation. Where the Act applied it specified very clear requirements in respect of means of escape, fire alarm provision and so on. At the same time, fire safety in new buildings was governed by building regulations which also closely specified basic fire safety provisions. However in 1997 the UK was compelled to fully implement the fire safety elements of the EU Framework1 and Workplace2 Directives. This resulted in the promulgation of the Fire Precautions (Workplace) Regulations 19973 followed by the Fire Precautions (Workplace) (Amendment) Regulations 19994. Significantly, these provided for a minimum standard of fire safety in all workplaces and UK amended its health and safety legislation to require, in addition to risk assessments for health and safety, fire risk assessments. The Amendment Regulations were necessitated because the earlier version was deemed not to be compliant with the EU Directives.
- UK law requires that a fire risk assessment be undertaken in all workplaces for life safety
- In many industrial and commercial sites the process is complicated by the need to consider the impact on buildings and/or contents
- So consideration must be given to the impact of fire/heat/smoke/firefighting water on plant, equipment and product
- Consideration should be given to the environmental impact of fire fighting water run-off
Prescriptive v Performance – based Codes
Historically, most fire safety regulations and codes used to set out specific criteria to be complied with. For example, NFPA 101 Life Safety Code specifies acceptable maximum travel distances, widths of doorways and maximum occupation numbers for given types of buildings. Such prescriptive measures offer the advantage of being simple to verify and comply with. However they are inflexible and tend to be difficult to use for unconventional buildings.
As an alternative, the performance-based approach focuses on desired, measurable outcomes, rather than prescriptive processes, techniques, or procedures. Performance-based regulation leads to defined results without specific direction regarding how those results are to be obtained. So, for example, the present UK fire safety regulations5 simply state that buildings must be designed and managed so that the occupants are safe from fire and that they are able to leave the premises quickly and safely if a fire should occur.
Origins – Risk Management
It’s probably reasonable to suggest that risk assessment owes its existence to the concept of risk management as practised by the insurance industry and its clients. At its most basic, the assessment of risk allows for an understanding of the hazards and threats facing an enterprise allowing amelioration of these. Box 1 shows the basis on which most risk management is undertaken6.
Box 1 Basics of Risk Management
Examining each potential risk/hazard,
determine whether it can it be:
- Eliminated
- Protected against
- Transferred to another party
- Financed
- Avoided
- Accepted (understand the risk and accept any consequences)

The Conventional Fire Risk Assessment
Where a fire risk assessment is primarly being undertaken for life safety purposes then different emphasis applies. Box 2 shows the usual approach to life safety assessments as recommended in UK guidance documents.
Box 2 Five Steps to Fire Risk Assessment
- Identify fire hazards
- Identify people at risk
- Evaluate, remove, reduce and protect from risk
- Record, plan, inform, instruct and train
- Review
However, this approach is more complex than it looks as each of the 5 Steps conceals a series of other actions. Figure 1 shows the full procedure as set out in UK guidance.
Note that the procedures contain nothing relating to the need for the protection of the building, its contents or the processes therein. This shortfall has been frequently criticised and is weekly justified by the relevant government departments who respond that ‘property protection is a matter for the owner and his insurers’. This of course, ignores completely the need for national resilience in respect of essential services and activities and the impact of fires on local employment, prosperity and provision of services.
Risk Ratings
Perhaps one of the most overlooked aspects of undertaking an FRA is the application of a ‘risk rating’ – that is, an indicator of the level of fire risk presented by the premises or organisation. At its most simplistic, this will be a one word description such as ‘low’, ‘normal’ or ‘high’. It’s the author’s view that such designations are rarely helpful. There can be few properties where the fire risk is truly ‘low’ (see below) and most properties will, by definition, be ‘normal’ risk. The risk category indicators in Box 3 should make this clear.

Box 3 Risk Category Indicators
Low risk:
- There is minimal risk to life safety and;
- The risk of fire occurring is negligible and;
- The risk of fire, smoke, or fumes spreading is negligible
Normal Risk:
- A fire is likely to remain localised or, at least, to spread so slowly as to allow people to escape to a place of safety
- There is little risk of the building or its contents easily catching fire, or of producing such large quantities of smoke, so as to constitute a serious hazard to life
- There is an effective automatic means for detecting and giving warning of fire, or an effective automatic suppression system (i.e. a sprinkler system)
High risk
- Sleeping accommodation
- People in large numbers, the elderly, the very young, with disabilities
- Processes (reactives, flammables, heat)
- Materials (solvents, synthetics)
- Unsatisfactory structural features:
- A complete lack of, or insufficient, fire-resisting compartmentation
- Vertical or horizontal openings through which the fire could spread, and which would allow the movement of toxic smoke and gases from one part of the building to another
- The use of non fire-resistant glass in separating walls, or in vision panels in fire doors
- Wooden staircases or floors on wooden joists
- Long or complex escape routes especially those involving access to other properties/buildings
- Large areas of flammable or smoke-producing surfaces on walls and ceilings
The Fire Engineered Approach
A more considered approach can be found in the ‘fire engineered’ approach to fire safety management. Box 4 details the necessary steps.
Box 4 The Fire Engineered Approach
- Assess the risks
- Consider arson/sabotage
- Manage the hazards
- Ignition and heat sources
- Employees
- Contractors
- Fuels
- Improve levels of protection
- Compartmentation/segregation
- Minimise exposures
- Detection
- Intervention
- Suppression
Note that the primary concerns here are not only to manage the hazards (including possible causes of fire) but also to provide adequate levels of protection etc. It should be remembered that if the building is better protected then the occupants will also benefit.
Proper scrutiny will extend to consideration of handling the impact of fire water run-off (whether caused by fixed fire protection systems or fire fighting/civil defence intervention). This may require extensive civil work provision in the case of manufacturing sites or locations processing or using hydrocarbons or synthetics

The Highly Protected Risk
The Fire Engineered Approach features prominently in the ‘Highly Protected Risk’ concept.
This is a (mainly) insurance industry term applied to the best protected undertakings or buildings where both the frequency and severity of potential fire loss has been addressed. The risk assessment informs the necessary counter measures which will usually include:
- The installation of high quality compartmentation/segregation,
- Comprehensive fire detection,
- Fire fighting equipment such as risers, hydrants and hose
- Extensive automatic fire suppression systems throughout – including water spray systems on flammable liquid risks
These, plus an effective fire safety management regime in place, can attract low premium rates. A number of insurers specialise in risks of this nature and all feature close participation with the insured by experienced loss prevention engineers. The fire risk assessment undertaken by such specialists is significantly more demanding than those undertaken for legal compliance.
Risk Assessment for Business Continuity Planning
Undertaking the development of a business continuity plan (BCP) will also trigger a risk assessment process which must involve considerations of property protection and which should be undertaken before any significant activity is directed at developing plans for business or infrastructure resilience.
Like the ‘5 Steps’ process above, the protocols to be followed can be broken down into self-contained stages. Box 5 lists these.
Box 5 The Risk Assessment for Business
Continuity Planning
- Stage 1: Threat Assessment – what external/internal incidents could affect the organisation?
- Stage 2: Risk Assessment – make a formal assessment of the business functions and processes (including industrial and technical processes) and decide how the incidents identified in in Stage 1 might affect these
- Stage 3: Risk reduction/elimination – what risks can be eliminated, managed out or protected against
- Stage 4: Hazard Impact Analysis – what is the probability and likely impact of the threats remaining after Stage 3? How long will it be before key functions or processes are impaired and what effect will this have on the organisation?
- Stage 5: Resource Analysis – what resources will be needed for the organisation to continue to operate
- Stage 6: Hazard Impact Analysis Matrix – draw up a matrix containing the information collected in Stages 4 and 5
- Stage 7: Plan Development – prepare plans to deal with consequences of the more serious/damaging threats
- Stage 8: Documentation – record and verify the decisions reached and the reasons for these and chart progress. Repeat the process when circumstances change.
Fire Risk Assessment for Construction Sites
FRA’s for construction projects differ in several ways from ‘conventional’ FRA’s for occupied buildings. Perhaps the most obvious difference is that in an occupied building the risks will be essentially static and change only rarely while in construction risks are dynamic – changing perhaps daily. Construction site assessments will certainly cover the safety of personnel but will also usually be required to take into account the impact of a fire on the project – a reflection of the importance of the role of the insurer in construction7.
Criteria which should be considered as part of the FRA must include:
- Dynamic risks – changing daily
- Nature of materials being used (eg combustible membranes, timber framing and composite cladding panels with combustible cores)
- Workforce changes frequently from site formation through to fitting out
- Inherently dangerous processes are inherently dangerous
- Physical hazards abound – shafts, incomplete staircases, scaffolding, holes in floor slabs
- Flammable liquids and gases everywhere
- Temporary electrical supply and hard-used tools
- No fire separation, signage, lighting, fire detection/protection as would be expected in an occupied building
- Housekeeping and combustible waste
- The risk of and from arson
- Combustible structures close to or within the building undergoing construction
- May be adjacent to or even part of occupied building
The construction site FRA also demands greater attention should also be paid to the processes for updating the risk assessment. The management of fire safety may also be more demanding than in a conventional FRA. For example, the following will be critical:
Liaison with fire/civil defence authority as the project progresses – in particular:
- Water supplies for fire fighting (critical in tall buildings)
- Access to the site
- Familiarisation visits
- Location of high hazard areas
- Training/induction of workforce including sub contractors
- Hot work controls
- Smoking controls
Conclusions
The fire risk assessment (FRA) can be a more complex process than is sometimes thought, but when properly applied can provide significant benefits as part of a structured fire safety management programme. In some jurisdictions, FRA’s need only cover the risks to occupants and those who may be affected by a fire. However this restriction will inhibit the real benefits of understanding the nature of the risks of and from fires.
For more information, go to www.risk-consultant.com
References
1. 89/391 EEC
2. 89/654 EEC
3. SI 1997/1840
4. SI 1999/1877
5. For example, the Regulatory Reform (Fire Safety) Order 2005. Note that UK building codes are essentially still prescriptive although there are other ways of complying with these.
6. Note that this approach has echoes of the contents of Schedule 1, Part 3 of the Fire Safety Order and Schedule 1 of the Management of Health and Safety at Work Regulations 1999.
7. Most civil law jurisdictions require contractors to purchase and maintain insurance cover for the duration of projects.
About the Author
Stewart Kidd MA, MSc, FIFireE, FIFSM, FSyI, FSA (Scot), CPP is a Chartered Security Professional. He has worked in security and fire protection since 1974 and now combines consultancy with expert witness assignments. He has a particular interest in the protection of national patrimony and built heritage, and he lectures and writes extensively on this subject. He is the author of eight books on fire and security topics including the Historic Environment Scotland’s Guide for Practitioners No 7, the Scottish Building Standards ACOP.
