For almost every non-domestic building in England and Wales, the duty to carry out a fire risk assessment sits with the responsible person under the Regulatory Reform (Fire Safety) Order 2005 ("the Fire Safety Order"). That core duty is unchanged. What has changed since 2021 is the scope of the assessment in multi-occupied residential buildings (via the Fire Safety Act 2021), the prescriptive duties on responsible persons in higher-risk blocks (via the Fire Safety (England) Regulations 2022), and the regulatory regime for higher-risk buildings of 18 metres or more (via the Building Safety Act 2022). The 2022 changes also removed the previous threshold below which findings did not have to be written down. As of 2026, every responsible person must record the significant findings in writing, even a sole trader operating from a single unit.

Who the responsible person actually is

The Fire Safety Order names the responsible person as the employer for a workplace, or, for premises that are not a workplace, the person who has control of the premises in connection with carrying on a trade, business or other undertaking. In practice that includes the building owner, the managing agent, the leaseholder of common parts, and very often more than one party at once. The Order anticipates this: where there is more than one responsible person, each must cooperate with the others and coordinate their fire safety arrangements.

A consultant writing the fire risk assessment is not the responsible person. They are a competent person appointed under article 18 of the Order. The legal duty to act on the assessment, to keep it under review, and to record it, sits with the responsible person who instructed the assessor. Make that clear in the assessment cover.

The five-step method, with the post-2022 additions

Government guidance still teaches the five-step approach inherited from the original 2006 Communities and Local Government guides. The structure is sound. What is different now is what each step has to demonstrate.

  1. Identify fire hazards. Sources of ignition, sources of fuel, sources of oxygen. For most premises this is short. For premises with hot work, lithium-ion batteries on charge, or significant waste accumulation, this needs to be specific.
  2. Identify people at risk. Employees, contractors, visitors, the public, and any person identified as at particular risk. "Particular risk" includes people who would have difficulty self-evacuating, people who work alone, and, in residential premises, people who sleep on the premises.
  3. Evaluate, remove, reduce and protect from risk. Apply the hierarchy. Removing the hazard sits above protecting people from its consequences. Document why a hazard has been reduced rather than removed.
  4. Record, plan, inform, instruct and train. Record the significant findings in writing. Maintain the fire safety arrangements. Provide information to employees and to other relevant persons.
  5. Review. Keep the assessment up to date. Review immediately if there is reason to suspect it is no longer valid.

The two additions that the post-Grenfell reforms have effectively built into step 1 and step 2 are the structure-and-external-walls scope for multi-occupied residential (from the 2021 Act), and the fire door inspection regime in residential buildings above 11 metres (from the 2022 Regulations). Neither of these are optional and both are now common enforcement themes.

What counts as a "significant finding"

The Fire Safety Order requires the responsible person to record the significant findings of the assessment, including the measures taken or to be taken, any persons identified as at particular risk, and the cooperation arrangements where there is more than one responsible person. A defensible record sets these out explicitly. A poor record buries them in a free-text narrative.

The markers of a defensible record:

  • A list of identified significant fire hazards, not a generic table of hazards in alphabetical order.
  • A list of persons at particular risk, by role or characteristic, not by name where the assessment is shared.
  • For each significant finding, a stated action, an owner, and a target date.
  • A summary of fire safety arrangements: who calls the fire and rescue service, who sweeps the building, where the assembly point is, who is responsible for maintaining detection and alarm systems.
  • Plain confirmation of cooperation arrangements where the building has more than one responsible person.

If the building is multi-occupied residential

Most enforcement activity since 2022 has been in residential. If the building is two or more sets of domestic premises, the assessment must address the structure, the external walls, and the flat entrance doors of the common parts. For buildings over 11 metres, the Fire Safety (England) Regulations 2022 require a quarterly check of fire doors in common parts and an annual check of flat entrance doors as far as reasonable. For buildings of 18 metres or more, the Building Safety Act regime adds the principal accountable person, the safety case, and the registration duties through the Building Safety Regulator.

The PAS 79-2 classification (Type 1 to Type 4) is the standard way to describe the scope. Most assessments are Type 1 (common parts only, non-destructive). Going beyond Type 1 is usually triggered by a known or suspected compartmentation defect.

When to review

The Order requires the assessment to be reviewed regularly to keep it up to date, and immediately when there is reason to suspect it is no longer valid or when there has been a significant change to the premises, the people, or the work activity. There is no statutory annual interval. Annual is a defensible default for most premises. Earlier review is appropriate after alterations, change of use, refurbishment, change of occupancy, or after a fire-related incident or near miss. The review should be recorded even when the conclusion is "no change required".

Five things that commonly fail an audit

These are the five issues that most commonly cause a fire risk assessment to fail review by an enforcing authority or insurer:

  1. The cover dates are old and the building has changed. An assessment that pre-dates a refurbishment of escape routes is no longer valid.
  2. Persons at particular risk are not identified. "All staff" is not an answer. A lone night-shift cleaner, a mobility-impaired tenant, a child-minder on the first floor: these are the persons the Order is asking about.
  3. Significant findings are not separated from observations. An assessment that runs to 40 pages without a clear action list shifts the work back onto the responsible person and gets challenged on competence.
  4. Cooperation arrangements are missing. Multi-tenanted buildings where each occupier has their own assessment but nobody has documented the cooperation between them. Article 22 is clear about this.
  5. No record of review. An assessment two years old, no review notes, no covering note explaining why no review was needed. A short signed review note costs nothing and prevents the entire assessment being treated as out of date.

Frequently asked

Who is the responsible person for a fire risk assessment?

Under the Fire Safety Order, the responsible person is the employer for a workplace, or, for premises that are not a workplace, the person who has control of the premises in connection with carrying on a trade, business or other undertaking. For multi-occupied residential buildings, the Fire Safety Act 2021 and the Fire Safety (England) Regulations 2022 confirm that the responsible person's duties cover the structure, external walls and flat entrance doors of the common parts. The responsible person can appoint a competent person (often a fire risk assessor or H&S consultant) to carry out the assessment, but the legal duty stays with the responsible person.

How often should a fire risk assessment be reviewed?

The Fire Safety Order does not set a fixed interval. It requires the assessment to be reviewed regularly to keep it up to date, and immediately when there is reason to suspect it is no longer valid, or when there has been a significant change to the premises, the people, or the work activity. In practice, most assessors revisit annually as a default, sooner after any alteration, change of use, change of occupancy, or after a fire-related incident.

Do small businesses need a written fire risk assessment?

Yes. Since 2023, the Fire Safety Act 2021 amendments to the Fire Safety Order removed the previous five-employee threshold for written records. Every responsible person must now record the significant findings of the fire risk assessment in writing, regardless of how many employees they have. Smaller premises do not need a long document, but the findings, the actions taken, and the persons identified as at particular risk must all be recorded.

Does a fire risk assessment need to follow PAS 79?

PAS 79 is a publicly available specification, not a legal requirement. It is widely used as a template structure because it maps cleanly onto the Fire Safety Order steps and gives competent assessors a defensible methodology. The 2020 split into PAS 79-1 (non-residential) and PAS 79-2 (residential) reflects the post-Grenfell focus on multi-occupied residential premises. Using PAS 79 is not mandatory but it is a strong way to demonstrate competence.

What is the difference between a Type 1 and Type 4 fire risk assessment?

The Type 1 to Type 4 classification applies to multi-occupied residential buildings and is set out in PAS 79-2. Type 1 is a common-parts-only, non-destructive assessment and is the default for most residential blocks. Type 2 is a Type 1 plus destructive inspection of common parts. Type 3 extends to a non-destructive sample of flats. Type 4 extends to a destructive sample of flats. Going beyond Type 1 is usually driven by reason to believe there are construction defects or compartmentation failures that cannot be assessed from common parts alone.