Fire Risk Assessments: Legal Requirements, Frequency and What’s Included

The fire risk assessment is the cornerstone of every UK commercial fire safety regime. Article 9 of the Regulatory Reform (Fire Safety) Order 2005 makes it a legal requirement, and post-Grenfell legislation has tightened the expectations significantly — particularly around competence of the assessor, the depth of the assessment, and the requirement to record the findings in full. This article explains what the law requires, what a properly conducted FRA looks like in 2026, when reviews are triggered, and how to identify a competent assessor. If you need a qualified assessor to carry out an FRA on your premises, our fire safety and protection services include fire risk assessments delivered by a Vulcan Fire-trained Advanced Fire Risk Assessor with the credentials that insurers and enforcing authorities expect to see.

The legal requirement: Article 9 of the Fire Safety Order

Article 9 of the FSO requires the Responsible Person to make a suitable and sufficient assessment of the risks to which relevant persons are exposed for the purpose of identifying the general fire precautions needed. “Relevant persons” includes employees, visitors, contractors, and anyone else lawfully on or in the immediate vicinity of the premises.

Three elements of Article 9 are particularly important:

1. The assessment must be suitable and sufficient. This is a quality threshold. A tick-box exercise that misses significant hazards is not suitable and sufficient, and the courts have confirmed this in multiple prosecutions.
2. The assessment must be reviewed regularly and immediately following any significant change.
3. As of 1 October 2023, following the changes brought in by Section 156 of the Building Safety Act 2022, the assessment must be recorded in full, regardless of the size of the business. The previous five-employee threshold has been removed.

For more on the wider regulatory framework that the FRA sits within, see our companion article: Fire Safety Regulations Explained: A UK Business Owner’s Guide.

---

Who is responsible for carrying it out?

The duty under Article 9 sits with the Responsible Person. In a workplace, that is normally the employer. In other premises, it is the person who has control of the premises in connection with a business or trade. In multi-tenanted and multi-occupied buildings, there will be multiple Responsible Persons with overlapping duties — see Who Is the “Responsible Person” Under UK Fire Safety Law? for the detail.

The Responsible Person can — and in most cases should — engage a competent person to carry out the assessment on their behalf. What they cannot do is delegate the underlying legal duty. If the engaged assessor produces a poor or inadequate FRA, the legal liability remains with the Responsible Person.

---

The five-step methodology (PAS 79 and BS 9792)

The FSO does not specify a particular methodology, but the recognised UK benchmarks are PAS 79-1:2020 (premises other than housing) and BS 9792:2025 (housing — which superseded the now-withdrawn PAS 79-2:2020). Where external wall fire risk appraisal is required for residential buildings, PAS 9980:2022 provides the dedicated methodology. PAS 79-1 sets out a structured five-step process that maps closely to the equivalent housing-specific approach in BS 9792:

Step 1: Identify fire hazards

The assessor identifies sources of ignition (heaters, electrical equipment, hot works, smoking, naked flames, hot processes), sources of fuel (paper, packaging, furnishings, flammable liquids, gases, accumulated waste), and sources of oxygen (general ventilation, oxygen cylinders, mechanical ventilation systems).

Step 2: Identify people at risk

The assessor identifies who could be harmed and how. This includes employees, visitors, contractors, members of the public, and people with specific vulnerabilities — those with mobility, sensory or cognitive impairments, lone workers, sleeping occupants, young people, and anyone working in particularly hazardous areas.

Step 3: Evaluate, remove, reduce, and protect from risk

The assessor evaluates the likelihood of fire and the consequences if one occurs, then considers measures to remove or reduce hazards (replacing flammable materials, controlling hot works, improving electrical maintenance), and measures to protect people (detection, warning, escape routes, signage, emergency lighting, firefighting equipment, fire compartmentation).

Step 4: Record, plan, instruct, inform and train

The assessor records the findings in full (mandatory since October 2023), prepares an emergency plan, ensures fire safety information is provided to occupants, and confirms that adequate training is in place.

Step 5: Review

The assessor sets the review interval and identifies the triggers that would require an earlier review.

---

What a complete FRA report contains

A properly recorded FRA report should include:

• Premises particulars — address, occupier, Responsible Person, building use, occupancy figures, hours of use, sleeping risk
• Construction details — building age, structural form, compartmentation, external wall construction (post-Fire Safety Act 2021, this is mandatory for multi-occupied residential buildings)
• Fire hazards — sources of ignition, fuel and oxygen, with locations
• People at risk — including any specific vulnerabilities
• Existing fire precautions — detection, alarm, emergency lighting, escape routes, signage, firefighting equipment, compartmentation, fire doors
• Risk evaluation — likelihood, consequences, and overall risk rating
• Significant findings — the issues that the Responsible Person needs to address, prioritised by risk
• Action plan — specific actions, responsible parties, target dates
• Conclusions — whether existing fire precautions are adequate, and the date by which the assessment should next be reviewed
• Assessor details and competence — name, qualifications, registration, and a signed declaration

The action plan is the operational output. It is the document the Responsible Person will be asked to produce in the event of an inspection or post-incident investigation. Each action should be specific, measurable, assigned to a named person, and given a target completion date.

---

Frequency: how often does an FRA need to be reviewed?

The FSO requires the FRA to be reviewed regularly and immediately in certain circumstances. There is no fixed statutory interval, but Home Office guidance and industry practice converge on the following:

Annually as a minimum for the majority of commercial premises. Higher-risk environments (care homes, hotels, HMOs, premises with sleeping risk, complex industrial sites) typically warrant more frequent review.

Immediately following any of the following triggers:

• Significant changes to the premises (refurbishment, layout changes, structural alterations)
• Significant changes in the use of the premises (change of business activity, change of occupancy, addition of sleeping accommodation)
• Significant changes in the number of occupants
• Significant changes to the fire precautions (new alarm system, new compartmentation, removal of equipment)
• A fire or near-miss incident
• Identification of new hazards (battery storage installation, new processes, new chemicals on site)
• Changes to legislation or applicable standards
• Recommendations from the Fire and Rescue Service following an inspection

A useful rule of thumb: if a reasonable person would say “the building isn’t the same building it was when the last FRA was done”, a review is due.

---

Competence: the post-Grenfell standard

Before the Grenfell Tower fire, fire risk assessor competence was sometimes treated loosely. That has changed. The Grenfell Tower Inquiry highlighted serious failures in some assessments and the industry has tightened expectations significantly.

A competent assessor in 2026 is generally one who:

• Holds recognised fire safety qualifications (typically FPA, NEBOSH, IFE, or equivalent)
• Is registered on a credible third-party scheme — multiple separate registers exist, run by the Institution of Fire Engineers (IFE), the Institute of Fire Safety Managers (IFSM, which operates the National Fire Risk Assessors Register / NFRAR), and the International Fire Professionals Organisation (IFPO). For organisations carrying out life-safety fire risk assessments, BAFE SP205 is the recognised third-party certification scheme
• Meets the competence framework set out in BS 8674:2025 — Built environment. Framework for competence of individual fire risk assessors. Code of practice, which was published in 2025 in response to the Grenfell Tower Inquiry Phase 2 recommendations
• Has demonstrable experience in the type of building being assessed (a residential block of flats requires different expertise to a chemical works)
• Maintains continuous professional development
• Carries appropriate professional indemnity insurance

For complex or higher-risk buildings, the bar is higher. A multi-storey residential block with combustible cladding is not a building for an entry-level assessor. Insurers and enforcing authorities will increasingly expect to see evidence that the assessor’s competence matched the complexity of the premises.

---

Common findings on real-world assessments

Across thousands of FRAs carried out on UK commercial premises, certain issues recur:

• Fire doors propped open with wedges, fire extinguishers, or self-closing devices that have been disabled
• Inadequate compartmentation breaches caused by services penetrations (cables, pipes) that have not been fire-stopped
• Overloaded electrical sockets and accumulated extension lead daisy-chains
• Combustible storage in escape routes, plant rooms, and under stairs
• Inaccessible or obstructed firefighting equipment
• Out-of-date extinguisher servicing — see How Often Do Fire Extinguishers Need to Be Serviced? (BS 5306 Explained) for what good looks like
• Inadequate emergency lighting in escape routes
• Signage missing, faded, or contradictory
• Fire alarm system faults that have been silenced rather than repaired
• Personal Emergency Evacuation Plans (PEEPs) absent for occupants with mobility impairments
• Training records out of date or incomplete

None of these issues are exotic. Most are inexpensive to fix once identified. The role of the FRA is to identify them before a fire does.

---

What the FRA does not cover

It is worth noting what falls outside the scope of an FRA so that the Responsible Person doesn’t assume their compliance picture is complete:

• Fire risks within individual domestic dwellings in mixed-use buildings (the FSO covers common parts; what happens inside an individual flat is generally outside scope, save for the flat entrance door which the Fire Safety Act 2021 brought into scope)
• Specific construction-phase fire safety on live construction sites — this is governed by the Joint Code of Practice (JCoP) and HSG168, not directly by the FRA process
• Process-specific risks that require specialist hazard assessment (DSEAR for explosive atmospheres, COMAH for major-hazard sites)

A competent assessor will flag where the boundary of the FRA falls and recommend the parallel assessments required.

---

How Veritech Supports UK Businesses with Fire Risk Assessments

Veritech Security works with employers, building owners, managing agents, and principal contractors across the UK to deliver the fire risk assessments required under Article 9 of the Fire Safety Order, the Fire Safety Act 2021, and Section 156 of the Building Safety Act 2022. Our services relevant to fire risk assessment include fire risk assessments delivered by our in-house Vulcan Fire-trained Advanced Fire Risk Assessor for commercial premises, blocks of flats, mixed-use buildings, construction sites and vacant property; full PAS 79-aligned reporting with prioritised action plans; FPA syllabus fire warden and fire marshal training delivered by our FPA-trained trainer at our in-house training facility; fire extinguisher commissioning and ongoing servicing carried out to BS 5306-3:2017 and BS 5306-8:2023 by an experienced Fire Extinguisher Technician trained to the BS 5306 examination; temporary fire alarm system installation; and integrated manned guarding, CCTV monitoring and access control services that work alongside the fire safety regime on your site.

We are members of the Fire Protection Association and the Fire Industry Association, and we hold SIA Approved Contractor status (ACS Pacesetters), ISO 9001, ISO 14001, Constructionline Platinum, SafeContractor, CHAS, RISQS, Achilles and Cyber Essentials accreditations — the credentials that insurers and enforcing authorities expect to see.

If you need a qualified, accredited partner to carry out your fire risk assessment, speak to Veritech.

Call: 0800 799 9800 (available 24/7) Email: info@veritech-security.com Or request a fire risk assessment consultation online.

---

Related Articles

• Fire Safety Regulations Explained: A UK Business Owner’s Guide
• Who Is the “Responsible Person” Under UK Fire Safety Law?
• How Often Do Fire Extinguishers Need to Be Serviced? (BS 5306 Explained)