What is a fire risk assessment?
A fire risk assessment is a structured evaluation of fire hazards, the people exposed to them, and the controls needed to reduce risk to an acceptable level. It is not a form you fill out once and file away. Think of it as a working document that reflects the real, current state of your building and the people inside it.
The process follows five core steps:
- Identify fire hazards: ignition sources (faulty wiring, open flames, hot work), fuels (combustible materials, flammable liquids), and oxygen contributors
- Identify people at risk: occupants, visitors, contractors, and anyone with limited mobility or unfamiliarity with the building
- Evaluate risks and implement controls: remove or reduce hazards, then add engineering and administrative safeguards
- Record findings and prepare an emergency plan: document everything and train your people
- Review and update regularly: treat the assessment as a living document, not a one-time exercise
Standards from the National Fire Protection Association (NFPA) and the Occupational Safety and Health Administration (OSHA) underpin every credible assessment in the United States. NFPA 1 (Fire Code) and NFPA 101 (Life Safety Code) set the technical benchmarks; OSHA regulations set the employer obligations. Together, they define what “good enough” actually means in a legal and operational sense.
Why fire risk assessments matter for your building
The core value of a fire hazard assessment is straightforward: it finds problems before a fire does. Hazard identification lets you act on a blocked exit or a combustible dust accumulation before either becomes a tragedy. That proactive posture also translates directly into regulatory compliance, which carries its own weight.
Key benefits include:
- Life safety: identifying and removing hazards reduces both the likelihood of ignition and the severity of any fire that does start
- Legal compliance: OSHA and NFPA standards require documented hazard identification and emergency planning; a thorough assessment is the clearest way to demonstrate both
- Business continuity: a fire that shuts down operations for weeks costs far more than the assessment that might have prevented it
- Resource prioritization: not every hazard carries equal risk; a proper assessment ranks them so you spend money and effort where they matter most
- Emergency preparedness: the assessment feeds directly into your evacuation plan, warden assignments, and drill schedule
Fire incidents carry consequences well beyond physical damage. Regulatory penalties, litigation exposure, and reputational harm all follow a preventable fire. A documented assessment is your evidence that you took the hazard seriously.
How to conduct a fire risk assessment: the five-step process
Step 1: Identify fire hazards
Every fire needs three things: an ignition source, a fuel, and oxygen. Your job in this step is to identify fire hazards by mapping where those three elements exist and where they could come together.
Ignition sources include electrical faults, heating equipment, hot work, smoking areas, and friction from machinery. Fuels range from paper and cardboard to flammable liquids, combustible dust, and upholstered furniture. Oxygen is everywhere, but poor ventilation control or the presence of oxidizing agents can make it a bigger factor than you expect.
Common hazards that assessors flag most often include:
- Blocked or obstructed exit routes
- Combustible dust accumulations near machinery
- Improperly stored flammable liquids
- Overloaded electrical circuits or damaged wiring
- Heat-producing equipment without proper clearance
Step 2: Identify people at risk
This step goes beyond counting heads. You need to know where people are, what they are doing, and whether any of them face elevated risk. Employees working in isolated areas, visitors unfamiliar with the layout, contractors in non-public spaces, and anyone with a mobility limitation all require specific consideration.
OSHA’s fire prevention standards require employers to inform workers of fire hazards upon initial job assignment, which means your people-at-risk analysis directly shapes your training obligations.
Step 3: Evaluate risks and implement controls
Once you know the hazards and who is exposed, you evaluate the likelihood and consequence of a fire, then apply controls in priority order. The hierarchy runs from elimination (remove the hazard entirely) through substitution, engineering controls (sprinkler systems, fire-rated compartmentation), administrative controls (housekeeping procedures, hot-work permits), and finally personal protective equipment.
Engineering controls tend to be the most reliable because they do not depend on human behavior in the moment. A properly designed fire sprinkler system suppresses a fire whether or not anyone is paying attention.
Step 4: Record findings and prepare an emergency plan
Documentation is where many assessments fall short. Your written record should capture every significant hazard found, the controls implemented or planned, who is responsible for each action, and the target completion date. Under OSHA 29 CFR 1910.39, employers with more than 10 employees must maintain a written fire prevention plan, kept in the workplace and available for employee review.
The emergency plan covers evacuation routes, assembly points, warden assignments, and procedures for employees who need assistance. OSHA guidance recommends having enough wardens available during working hours to provide adequate direction during an evacuation.
Pro Tip: Assign a named owner and a deadline to every corrective action in your assessment. An unassigned action item is an action item that will not get done.
Step 5: Review and update regularly
A fire risk assessment that was accurate 18 months ago may be dangerously out of date today if your building has been renovated, your occupancy has changed, or new equipment has been installed. Regular review is required as a minimum standard; specific triggers require immediate reassessment.
Legal requirements and compliance in the US
US fire safety compliance sits at three levels: federal (OSHA), model codes (NFPA), and local (the Authority Having Jurisdiction). Understanding all three is the only way to stay genuinely compliant.
OSHA obligations:
- 29 CFR 1910 (General Industry) covers fire protection, emergency action plans, and fire prevention plans for most workplaces
- 29 CFR 1926 covers construction sites under Subpart F (Fire Protection and Prevention)
- Employers with 10 or fewer employees may communicate their fire prevention plan orally; all others must maintain a written plan accessible to workers
- OSHA does not use the phrase “fire risk assessment” in its standards, but a formal written assessment is the clearest way to demonstrate compliance with hazard identification and emergency planning requirements during an inspection
NFPA standards:
- NFPA 1 (Fire Code) addresses fire prevention, suppression, and hazardous materials across occupancy types
- NFPA 101 (Life Safety Code) governs means of egress, occupant notification, and building construction requirements
- Both are model codes, meaning they carry legal weight only when adopted by a state or local jurisdiction, which most have done in some form
The Authority Having Jurisdiction (AHJ):
The local AHJ, typically the fire marshal or fire prevention bureau, has final say on what constitutes an acceptable risk level in your building. Meeting NFPA standards alone does not guarantee AHJ approval because local amendments can supersede model codes. Build a relationship with your local fire marshal before an inspection, not during one.
Consequences of non-compliance:
Failure to maintain required documentation or correct identified hazards can result in OSHA citations, fines, mandatory shutdowns, and personal liability for responsible parties. A documented, up-to-date fire risk assessment is your primary defense in any enforcement action.
Who should conduct a fire risk assessment?
The responsible person for a fire risk assessment is typically the employer, building owner, or facility manager. That person may conduct the assessment directly or delegate it, but they cannot delegate the accountability.
For straightforward, lower-risk occupancies such as small offices or retail spaces, a trained internal staff member with solid knowledge of NFPA standards and local code requirements can often handle the assessment competently. The key qualifications are practical knowledge of fire behavior, familiarity with the specific occupancy type, and the ability to recognize hazards that are not obvious.
For complex or high-risk environments, including industrial facilities, healthcare settings, high-rise buildings, and properties with hazardous materials, an external fire safety professional or certified risk assessor is the right call. These environments involve quantitative risk analysis, sensitivity testing, and code interpretations that go well beyond what most internal staff can reliably handle.
Regardless of who conducts the assessment, coordination with the local fire authority and code officials is part of the process. An assessment completed in isolation, without any engagement with the AHJ, misses a critical layer of local context.
Expert insights: what experienced assessors know that checklists miss
That framing, drawn from the Society of Fire Protection Engineers (SFPE), captures the single most common failure mode in organizational fire safety: treating the assessment as a box to check rather than a process to maintain.
Experienced assessors consistently flag a category of hidden risks that routine walk-throughs miss entirely. Poor compartmentation, where fire-rated walls have been penetrated by cable runs or HVAC modifications without proper firestopping, is one of the most frequent. Compromised service risers in multi-story buildings are another. Neither shows up on a standard checklist because neither is visible without knowing where to look.
Industrial and large-scale properties add another layer of complexity. Quantitative risk analysis at these sites incorporates sensitivity and uncertainty analyses to estimate risk more precisely, accounting for variables like process upsets, equipment failure rates, and occupant response times. This is a different discipline from a standard qualitative walk-through, and conflating the two produces assessments that look thorough but are not.
Pro Tip: Integrate your fire risk assessment findings into your organization’s broader operational risk register. Fire risk does not exist in isolation from equipment maintenance schedules, contractor management, and change-control processes. Connecting them surfaces dependencies that a standalone assessment will miss.
How and when to review your fire risk assessment
Annual review is the accepted minimum, but several specific events should trigger an immediate reassessment regardless of when the last review occurred:
- A fire or near-miss incident in the building
- Structural renovations or changes to the floor plan
- Changes in occupancy type or a significant increase in occupant numbers
- Introduction of new equipment, processes, or hazardous materials
- A scheduled inspection that reveals previously unidentified hazards
- Changes in applicable NFPA codes or local ordinances
- Feedback from emergency drills that reveals gaps in the evacuation plan
When you conduct a review, update the written record to reflect what changed, what was found, and what action was taken. A review that produces no written output is not a review in any meaningful sense. Tie your review cycle to your emergency drill schedule so that drill observations feed directly into the next assessment update.
Monitoring regulatory changes is an ongoing obligation, not a periodic one. NFPA updates its codes on a three-year cycle, and local jurisdictions adopt amendments on their own schedules. Assign someone to track those changes and flag when they affect your assessment.
What a fire risk assessment report looks like in practice
A completed fire risk assessment report is a structured document, not a narrative essay. Most follow a consistent format that makes findings easy to act on and easy to present during an inspection.
Typical report sections include:
- Property details: address, occupancy type, building age, number of floors, and approximate occupant count
- Assessment scope: areas covered, areas excluded, and the date of the physical inspection
- Hazard inventory: a table listing each identified hazard, its location, the current control in place (if any), and the residual risk level (commonly rated low, medium, or high)
- People at risk: a summary of occupant groups and any individuals requiring special consideration during evacuation
- Action plan: a prioritized list of corrective actions, each with a named responsible person and a target completion date
- Emergency plan summary: evacuation routes, assembly points, warden assignments, and alarm procedures
- Review date: the date by which the assessment must be reviewed or the trigger events that would require an earlier review
Free and official template resources:
OSHA’s website provides guidance documents and compliance checklists aligned with 29 CFR 1910 requirements. The NFPA offers occupancy-specific inspection checklists and code references through its website. The US Fire Administration (USFA), part of FEMA, publishes workplace fire safety resources at usfa.fema.gov that include planning guides suitable for smaller organizations.
For a step-by-step walkthrough of conducting a fire risk assessment, Reliable-fire-protection provides practical guidance tailored to both residential and commercial properties. If your assessment identifies gaps in detection or suppression, understanding how fire alarm systems work is the logical next step before specifying controls.
Reliable-fire-protection serves Houston-area residential and commercial clients with fire alarm installation, sprinkler systems, suppression systems, and fire extinguisher services. If your assessment has identified gaps in your current fire protection setup, contact Reliable-fire-protection for a free quote and a conversation about what your building actually needs.
Key Takeaways
A fire risk assessment is a structured, ongoing process that identifies hazards, evaluates risk to occupants, implements controls, and requires documented review to remain legally and operationally valid.
| Point | Details |
|---|---|
| Five-step process | Identify hazards, identify people at risk, evaluate and control, record and plan, then review regularly. |
| OSHA documentation rule | Employers with more than 10 employees must maintain a written fire prevention plan accessible to all workers. |
| AHJ authority | The local Authority Having Jurisdiction can impose requirements beyond NFPA model codes; engage them early. |
| Annual review minimum | Reviews must happen at least yearly, with immediate reassessment after fires, renovations, or occupancy changes. |
| Hidden risks | Poor compartmentation and compromised service risers are among the most commonly missed hazards in routine inspections. |