Fire Risk Assessment and Code Compliance Process

Introduction and Context

Fire risk assessment is the systematic process of identifying fire hazards, evaluating the likelihood and consequences of unwanted fire events, determining whether existing controls are adequate, and specifying further actions. It connects technical fire-safety knowledge with legal duties, building management, emergency planning and continuous improvement.

A fire code or standard normally establishes minimum requirements for construction, occupancy, means of escape, fire detection, suppression, emergency access, inspection and maintenance. Compliance, however, is not achieved merely by possessing certificates or installing equipment. The responsible organisation must be able to demonstrate that significant risks have been identified, controls are appropriate, systems remain functional and occupants can respond effectively.

This chapter presents a practical process suitable for workplaces, educational buildings, commercial premises, industrial facilities and residential occupancies. Exact legal requirements vary by jurisdiction; therefore, the applicable national fire law, building regulations, occupational-safety legislation, authority guidance and adopted standards must always be confirmed before a final compliance decision.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose, scope and limitations of a fire-risk assessment.
2. Identify fire hazards, people at risk and relevant ignition, fuel and oxygen sources.
3. Apply likelihood–consequence analysis and a qualitative risk matrix.
4. Select controls using the hierarchy of controls.
5. Translate assessment findings into evidence-based code-compliance actions.
6. Prepare an assessment record, action plan and review schedule.
7. Recognise professional, ethical and governance responsibilities in fire safety.

1. Fundamental Concepts

1.1 Hazard, risk and control

A hazard is a source or situation with the potential to cause harm. Examples include an overloaded electrical circuit, combustible packaging stored beside a heat-producing appliance, an obstructed exit or an impaired sprinkler valve.

Risk describes the combination of the likelihood that a harmful event will occur and the severity of its consequences. Risk is not identical to hazard: a large fuel load in an isolated, protected room may present less immediate risk than a smaller fuel load in a crowded, poorly ventilated public area.

A control is a measure that removes a hazard, reduces the likelihood of ignition or fire growth, limits exposure, protects people during evacuation, or reduces the consequences of fire. Controls may be physical, procedural, organisational or behavioural.

1.2 Fire-risk assessment and fire-safety management

A fire-risk assessment is a structured evaluation at a particular time. Fire-safety management is the continuing system that keeps the assessment valid. It includes maintenance, training, testing, management of change, contractor control, incident learning and periodic review.

The assessment should consider:

• the building and its construction;
• occupancy, activities and hours of use;
• ignition sources;
• combustible materials and fire load;
• oxygen sources and ventilation;
• fire detection, alarm and suppression systems;
• compartmentation and fire-resisting construction;
• escape routes, exits and assembly arrangements;
• fire-service access and firefighting facilities;
• people who may be especially vulnerable;
• emergency procedures and communication; and
• inspection, testing and maintenance arrangements.

1.3 Compliance and residual risk

Compliance means meeting applicable legal and adopted technical requirements. Residual risk is the risk remaining after controls have been implemented. Compliance and risk are related but not interchangeable. A building may satisfy a prescriptive requirement and still be poorly managed; conversely, an alternative design may achieve an equivalent safety outcome but require formal approval by the authority having jurisdiction.

A competent assessor therefore asks two separate questions:

1. What does the law, code or standard require?
2. What credible fire scenarios remain, and are the controls adequate for them?

2. The Structured Assessment Process

A defensible assessment normally follows the sequence below.

Figure: The fire-risk assessment cycle, including review after implementation and during change.

Step 1: Define scope and assessment criteria

Record the premises, activities, boundaries, date, assessor, information sources and limitations. Identify the applicable legislation, building approval conditions, fire code editions, standards and internal policies. Establish the risk-rating method before scoring hazards so that the method is applied consistently.

The scope should include normal operations, foreseeable abnormal conditions, maintenance, shutdowns, construction work, storage changes, night occupancy and emergency conditions. If a specialist assessment is needed—for example, for hazardous chemicals, explosion risk, smoke control or structural fire engineering—this limitation must be stated rather than concealed.

Step 2: Collect information and inspect the premises

Useful evidence includes building drawings, occupancy data, process descriptions, electrical inspection records, hot-work permits, alarm and sprinkler test certificates, training records, incident reports and previous enforcement notices. A physical inspection should verify whether documented arrangements actually exist.

Photographs, annotated plans and equipment identification numbers improve traceability. Interviews with workers, security staff, cleaners, contractors and persons with disabilities often reveal hazards that are not visible during a short inspection.

Step 3: Identify hazards and people at risk

Hazard identification should be organised rather than based on general impressions. A practical structure is:

Consider employees, visitors, contractors, patients, residents, customers, emergency responders and neighbouring premises. Vulnerability may arise from age, disability, medication, language, unfamiliarity, working alone or the need for assisted evacuation.

Step 4: Identify existing controls

Controls should be described specifically. “Good housekeeping” is weak evidence; “cardboard waste is removed at the end of each shift and stored in a lidded external metal container” is verifiable. Distinguish between controls that prevent ignition, controls that detect and warn, controls that contain fire, and controls that support escape or firefighting.

Step 5: Assess likelihood and consequence

For many diploma-level assessments, a qualitative or semi-quantitative matrix is appropriate. The assessor assigns a likelihood score and a consequence score using defined descriptors. A common model is:

where:

• R is the risk score, dimensionless;
• L is the likelihood score, commonly from 1 to 5; and
• C is the consequence score, commonly from 1 to 5.

This multiplication is a prioritisation convention, not a physical law and not a statistically precise probability model. It is appropriate when the scoring definitions are documented and used consistently. It should not be used to imply that a score of 12 is exactly twice as dangerous as a score of 6.

An example scale is:

An organisation may classify scores of 1–4 as low, 5–9 as moderate, 10–16 as high and 17–25 as very high. These bands are illustrative; the organisation’s approved method and regulator’s expectations take precedence.

#### Worked example: blocked escape route

During inspection, combustible stock is found in a corridor serving 35 occupants. The corridor is sometimes obstructed, and smoke from a nearby fire could make the only available route unusable. Before corrective action, the assessor selects likelihood L = 3 (possible) and consequence C = 5 (catastrophic consequence is credible because delayed escape could cause fatalities).

The risk is therefore high under the illustrative bands. Removing the stock, maintaining a clear route, improving supervision and verifying emergency lighting may reduce likelihood. The consequence score may remain high because a fire in an occupied building can still be severe; risk reduction should not depend on artificially lowering consequence to produce a favourable score.

Step 6: Apply the hierarchy of controls

Controls should be selected in the following order, from generally more reliable to less reliable:

1. Elimination – remove the hazardous activity or combustible material.
2. Substitution – replace it with a less combustible, less toxic or lower-energy alternative.
3. Engineering controls – use separation, enclosure, compartmentation, detection, suppression, ventilation control or automatic isolation.
4. Administrative controls – use procedures, permits, inspections, training, signage and supervision.
5. Personal protective equipment – protect individuals from residual exposure during particular tasks.

PPE is important for emergency response and specialist work, but it is normally the least reliable primary control for a developing building fire because it depends on correct selection, availability and human action. A fire extinguisher beside an uncorrected ignition hazard is not an adequate substitute for eliminating the hazard or installing engineered protection.

Step 7: Translate findings into compliance actions

Each finding should become an action that is clear, assigned and verifiable. A useful action record includes:

Actions should distinguish non-compliance, deficiency, improvement opportunity and information gap. A missing inspection record is not always proof that inspection did not occur, but it is a governance deficiency that must be resolved.

Step 8: Implement, verify and review

Completion is not the same as effectiveness. After an alarm repair, for example, the system should be functionally tested, the result recorded and relevant staff informed. Review the assessment after a fire, near miss, significant building alteration, change in occupancy, new process, change in storage, enforcement notice or failure of a critical safety system. A periodic review should also be scheduled even when no obvious change has occurred.

3. Code Compliance as an Evidence Process

3.1 Prescriptive and performance-based approaches

A prescriptive code specifies features such as exit widths, fire-resistance periods, alarm categories or extinguisher types. A performance-based approach specifies safety objectives and demonstrates, through accepted engineering analysis, that the objectives are achieved. Performance-based solutions may use fire modelling, evacuation analysis, structural analysis or smoke-control calculations, but they require competent specialists and formal approval where required.

Assessors must not casually substitute personal judgement for a code requirement. If a deviation is proposed, it should be documented, technically justified, reviewed by a competent person and accepted by the authority having jurisdiction where applicable.

3.2 Compliance evidence hierarchy

Strong evidence normally combines:

• approved drawings and occupancy information;
• inspection observations;
• current certificates and test results;
• maintenance records;
• staff interviews and drill observations;
• training and attendance records; and
• photographs or other time-stamped records.

A certificate alone may demonstrate that a test was performed, but not necessarily that the system is currently operational or that defects were corrected. Evidence should be current, attributable, legible and connected to the specific asset or requirement.

3.3 Common compliance domains

The assessment should cross-check at least the following domains:

• Means of escape: travel routes, exit capacity, direction of opening, emergency lighting, exit signs, doors and assembly points.
• Detection and alarm: coverage, audibility, visual warning where needed, manual call points, zoning, monitoring and testing.
• Compartmentation: fire doors, fire-stopping, penetrations, shafts, concealed spaces and protected stairs.
• Suppression: extinguishers, hydrants, hose reels, sprinklers or special systems, including access, suitability and maintenance.
• Electrical and process safety: wiring, isolation, batteries, charging areas, hot work, cooking and machinery.
• Storage: separation, stacking height, aisle access, flammable-liquid cabinets and waste control.
• Emergency organisation: roles, alarm response, evacuation assistance, drills, communication and liaison with fire services.
• Management of contractors and change: permits, impairment procedures and approval of alterations.

4. Applied Case Study: Illustrative Packaging Warehouse

Background

The following is an illustrative case, not a report of a real facility. A 2,400 m² packaging warehouse operates two shifts and employs 28 people. It contains cardboard cartons, plastic wrapping and a small flammable-liquid cleaning store. A battery-charging area is located near a loading door. The building has an automatic alarm, portable extinguishers and a sprinkler system.

Problem

A routine assessment found cartons stored within 0.5 m of a heater, a damaged fire door, incomplete records for sprinkler-valve inspections, a partially obstructed exit and workers who were uncertain about the procedure for assisting a visitor who uses a wheelchair. A contractor also planned hot work during a weekend shutdown.

Analysis

The hazards were grouped as follows:

The matrix identifies priorities, but it does not replace professional judgement. The exit obstruction was treated as urgent because it directly affects life safety. The sprinkler record gap was also treated as significant even though it did not itself prove system failure.

Approach and solution

Management immediately removed cartons from the heater zone, cleared and marked the exit, and isolated the damaged fire door pending repair. A competent contractor repaired and tested the door. The sprinkler contractor produced missing inspection records and corrected a defective valve supervisory switch. A written hot-work permit system was introduced, including removal or protection of combustibles, a fire watch during the work and a post-work inspection.

The warehouse revised its emergency plan to identify trained evacuation assistants, provide visitor information at reception and include a contingency for a person who cannot use stairs. A short practical drill tested alarm audibility, route clearance, assembly accounting and communication with the fire-service contact.

Outcome

Follow-up verification confirmed the immediate hazards were corrected and evidence was filed against each action. The assessment was not closed merely because equipment was installed: staff interviews, an observation of the hot-work permit process and a repeat exit inspection were used to verify implementation. Residual risk remained because cardboard and plastic were intrinsic to the operation; therefore, housekeeping, storage separation, sprinkler maintenance and emergency drills were placed on a continuing programme.

Learning points

1. A risk assessment must examine work activities, not only building equipment.
2. A high score affecting escape may require immediate temporary controls.
3. Records are part of compliance because unverified maintenance creates uncertainty.
4. Administrative controls are valuable but should not replace feasible engineering controls.
5. Inclusive evacuation planning must address visitors and people needing assistance.
6. Closure requires evidence of effectiveness, not merely a management promise.

5. Limitations, Ethics and Governance

Risk matrices can create false precision. Scores depend on judgement, available evidence and the quality of descriptors. Rare catastrophic events may be underrated because their frequency is low. Conversely, multiplying scores can conceal the fact that a single uncontrolled hazard is unacceptable even when the numerical result appears moderate.

Assessors should record assumptions, uncertainty and disagreements. They must not downgrade a risk to meet a budget, occupancy or inspection target. Conflicts of interest should be declared, and significant limitations should be communicated to the responsible manager and, where necessary, the regulator.

Confidential information, security-sensitive plans and personal information about vulnerable occupants must be handled lawfully and only shared with those who need it. Digital systems and AI tools can help classify inspection observations, search large maintenance records or identify recurring defects, but the output must be checked by a competent professional. AI cannot inspect a concealed fire-stopping defect, determine legal responsibility reliably or replace authority approval. Data quality, cybersecurity and audit trails are essential when technology is used.

6. Best-Practice Checklist

A high-quality assessment should:

• define the premises, activities, assumptions and applicable requirements;
• involve people who understand operations and vulnerable occupants;
• inspect actual conditions rather than relying only on documents;
• identify ignition, fuel, oxygen, spread and human factors;
• assess normal, abnormal and maintenance conditions;
• use a documented and consistently applied risk method;
• prioritise elimination and engineering controls;
• identify legal non-compliance separately from optional improvements;
• assign every action to a responsible person with a due date;
• retain objective evidence of completion and verification;
• include impairment, contractor and change-management procedures; and
• review the assessment after change, incident, failure or a defined period.

Chapter Summary

Fire-risk assessment is a continuing management process that links hazard identification, likelihood–consequence analysis, control selection and code compliance. A competent assessment defines its scope, gathers reliable evidence, identifies hazards and people at risk, evaluates credible scenarios and records existing safeguards. The qualitative relationship R = L × C can help prioritise action, but it is a judgement-based screening tool rather than a precise probability law. The hierarchy of controls directs attention first to elimination and substitution, then to engineering, administrative controls and PPE. Compliance actions must be specific, assigned, time-bound and supported by verification evidence. Effective fire safety also requires management of change, inclusive emergency planning, ethical reporting, maintenance and periodic review.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and consequence of harm.

Fire-risk assessment: A systematic evaluation of fire hazards, exposure, controls and residual risk.

Residual risk: Risk remaining after controls are implemented.

Likelihood: An estimate of how probable an unwanted event is within defined conditions.

Consequence: The severity of credible harm or loss if an event occurs.

Risk matrix: A table used to combine likelihood and consequence scores.

Ignition source: Heat, flame, spark or energy capable of starting combustion.

Fuel load: The quantity and characteristics of combustible material in an area.

Compartmentation: Division of a building to restrict fire and smoke spread.

Means of escape: Routes and exits enabling occupants to reach a place of safety.

Hierarchy of controls: Ordered method for selecting controls from elimination to PPE.

Engineering control: A physical or automatic measure that reduces exposure or fire development.

Administrative control: A rule, procedure, training activity or management arrangement.

Residual risk: The remaining risk after safeguards are applied.

Authority having jurisdiction: The body legally empowered to approve, inspect or enforce requirements.

Impairment: A condition in which a fire-protection system is unavailable or degraded.

Competent person: An individual with appropriate knowledge, training, experience and authority for the task.

Management of change: A controlled process for evaluating safety effects of alterations.

Evidence of closure: Verifiable information showing that a corrective action was completed and effective.

Review Questions

Short Answer Questions

1. Distinguish between a fire hazard and fire risk.
2. What information should be defined before beginning an assessment?
3. State the qualitative risk relationship used in this chapter and define its variables.
4. Why should a blocked escape route normally receive urgent attention?
5. Name the five levels in the hierarchy of controls.

Long Answer Questions

1. Explain the complete fire-risk assessment and code-compliance process from scope definition to review.
2. Discuss how a risk matrix can support decision-making and explain its principal limitations.
3. Compare prescriptive and performance-based approaches to fire-code compliance.
4. Explain how evidence, inspection and maintenance records support a defensible compliance decision.
5. Describe how emergency planning should address vulnerable occupants, visitors and contractors.

Analytical / Application Questions

1. A workshop has an obstructed exit, poorly controlled hot work and a recently tested alarm. Develop a structured assessment, assign illustrative likelihood and consequence scores, and prioritise corrective actions.
2. A manager proposes using additional extinguishers instead of repairing damaged compartmentation. Evaluate the proposal using the hierarchy of controls and fire-spread principles.
3. A warehouse changes from daytime storage to 24-hour operation. Identify the assessment assumptions that must be revisited and propose a verification plan.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a hazard from a risk?

A. A hazard is the potential source of harm, while risk combines likelihood and consequence.

B. A hazard is always more serious than risk.

C. Risk is a physical object, while a hazard is a legal document.

D. There is no practical distinction between the two terms.

Correct Answer: A. A hazard is the potential source of harm, while risk combines likelihood and consequence.

Question 2

Using the relationship R = L × C, what is the risk score when likelihood is 4 and consequence is 3?

A. 7

B. 12

C. 16

D. 43

Correct Answer: B. 12

Question 3

Which is generally the highest-level control in the hierarchy of controls?

A. Personal protective equipment

B. Worker training

C. Elimination

D. Warning signage

Correct Answer: C. Elimination

Question 4

Which finding most directly concerns compartmentation?

A. A missing assembly-point register

B. A damaged fire door and unsealed service penetration

C. An employee without hearing protection

D. An unlabelled first-aid box

Correct Answer: B. A damaged fire door and unsealed service penetration

Question 5

What is the principal purpose of defining assessment scope?

A. To guarantee that no risk score exceeds 10

B. To establish the premises, activities, requirements and limitations being assessed

C. To replace the need for a physical inspection

D. To determine the price of fire insurance

Correct Answer: B. To establish the premises, activities, requirements and limitations being assessed

Question 6

Why should a risk matrix not be treated as a precise probability model?

A. Its scores are judgement-based prioritisation values rather than measured physical probabilities.

B. It can only be used for electrical hazards.

C. It never uses consequence ratings.

D. It automatically accounts for every uncertainty.

Correct Answer: A. Its scores are judgement-based prioritisation values rather than measured physical probabilities.

Question 7

Which item is strongest evidence that a corrective action has been closed effectively?

A. A verbal promise to complete it later

B. An undated general policy statement

C. A verified repair record supported by inspection or functional testing

D. A risk score copied from a previous assessment

Correct Answer: C. A verified repair record supported by inspection or functional testing

Question 8

A planned hot-work activity in a packaging warehouse should normally include which control?

A. Removing all emergency lighting

B. A permit, combustible-material controls, fire watch and post-work inspection

C. Storing additional cartons beside the work area

D. Disabling the alarm to prevent nuisance signals

Correct Answer: B. A permit, combustible-material controls, fire watch and post-work inspection

Question 9

When should a fire-risk assessment be reviewed?

A. Only after ten years

B. Only when an assessor changes employer

C. After significant change, incidents, system impairment and at planned intervals

D. Never, if the original document was signed

Correct Answer: C. After significant change, incidents, system impairment and at planned intervals

Question 10

What is the most appropriate role for AI in fire-risk assessment?

A. Replacing the authority having jurisdiction

B. Making final legal decisions without human review

C. Supporting record analysis while competent professionals verify the output

D. Approving deviations from fire codes automatically

Correct Answer: C. Supporting record analysis while competent professionals verify the output