Risk-Based Decision Making and Fire Safety Management

Introduction

Fire safety management is not simply the installation of alarms, extinguishers and fire-resisting construction. It is a continuing process of deciding which risks require action, how urgently action is needed, what level of control is reasonably practicable, and how performance will be verified. Risk-based decision making connects fire risk assessment with management priorities, legal duties, emergency preparedness, business continuity and continual improvement.

A fire safety decision is usually made under uncertainty. Information about ignition sources, occupancy, human behaviour, smoke movement, detection reliability and emergency response may be incomplete. Resources are also limited. Consequently, managers must compare alternatives rather than attempt to eliminate every conceivable risk. The central professional task is to reduce significant risk to a tolerable level and ensure that remaining risk is understood, controlled and monitored.

This chapter develops a practical framework for prioritising fire safety actions using tolerability criteria, ALARP/SFAIRP principles, cost-effectiveness, criticality and residual risk.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain how risk-based decisions differ from hazard-based decisions.
2. Apply tolerability, ALARP and SFAIRP concepts to fire safety decisions.
3. Rank corrective actions using risk reduction, criticality, urgency and cost-effectiveness.
4. Distinguish inherent, controlled and residual risk.
5. Integrate fire risk findings into audits, emergency planning, business continuity and safety management systems.
6. Recognise the ethical, legal and governance limits of economic decision tools.
7. Evaluate a fire safety improvement programme through an applied case.

1. From Fire Risk Assessment to Decision Making

A hazard is a source or situation with the potential to cause harm. Examples include combustible storage, overloaded electrical equipment, hot work, blocked escape routes and inadequate separation between processes. Risk combines the likelihood of an unwanted event with its consequences. A simple qualitative expression is:

Likelihood expresses the chance or frequency of an event under defined conditions; consequence describes the severity of harm if it occurs. The expression is a decision aid, not a precise law of nature. It is valid only when the scales are clearly defined, consistently applied and not used to conceal major uncertainties. Likelihood and consequence may be represented qualitatively, semi-quantitatively or quantitatively.

A risk assessment identifies hazards and estimates risk. Risk-based decision making goes further by asking:

• What must be done immediately?
• Which controls provide the greatest reduction in risk?
• Is the proposed control proportionate to the risk?
• Which people, assets or operations are most critical?
• What risk remains after controls are implemented?
• Who owns the action and how will completion be verified?

The distinction is important. A long list of hazards does not automatically provide a defensible action plan. Decisions require prioritisation, responsibilities, timescales and evidence.

Inherent, controlled and residual risk

Inherent risk is the risk before considering safeguards or controls. Controlled risk is the risk after existing controls are considered. Residual risk is the risk remaining after additional planned controls have been implemented and verified. In practice, the terms are sometimes used differently; an organisation should define them in its own risk procedure.

Controls may be classified using the hierarchy of control:

1. Eliminate the hazardous activity where practicable.
2. Substitute a less hazardous material or process.
3. Apply engineering controls, such as compartmentation, automatic detection or fixed suppression.
4. Apply administrative controls, such as permits, inspection and training.
5. Use personal protective equipment, which is generally the least reliable layer for preventing fire consequences.

For life safety, passive and engineered controls should not be replaced by training alone when a more reliable control is reasonably practicable.

2. Tolerability of Risk

Tolerability is not the same as acceptability. A tolerable risk may still be undesirable, but it may be permitted because further reduction is grossly disproportionate to the benefit, or because the risk is controlled within an established legal and organisational framework. Tolerability therefore implies continuing duties: controls must remain effective, assumptions must remain valid and significant changes must trigger review.

A common three-region model is:

The boundaries must not be treated as universal numerical thresholds. Legal requirements, national guidance, organisational policy, occupancy, vulnerable persons and the severity of possible outcomes influence the decision. A low-frequency event causing multiple fatalities cannot automatically be treated as acceptable merely because its calculated frequency is small.

ALARP and SFAIRP

ALARP means as low as reasonably practicable. SFAIRP means so far as is reasonably practicable. Both express a principle of reducing risk unless the sacrifice involved in further reduction is grossly disproportionate to the risk reduction gained, subject to the applicable legal regime.

The burden of argument normally rests with the duty holder. A decision to reject a safeguard should therefore show that:

• the hazard and exposed persons were identified;
• credible control options were considered;
• legal and authoritative guidance was reviewed;
• the expected risk reduction was assessed;
• implementation cost, time and disruption were examined;
• the sacrifice required was compared with the benefit;
• uncertainty and vulnerable occupants were considered; and
• the decision was approved by a competent person and recorded.

ALARP is not a licence to select the cheapest option. Nor is it satisfied by stating that a control is expensive. Cost must be considered in relation to the scale of risk reduction and the quality of available alternatives. Where a control is established as a recognised standard for a significant risk, departure requires a particularly strong justification.

3. Prioritising Fire Safety Actions

A practical prioritisation method combines risk magnitude with factors that a simple risk matrix may overlook.

3.1 Life-safety significance

Actions affecting the potential for death or serious injury normally take precedence over actions concerned only with property damage, appearance or convenience. Particular attention is required for sleeping occupants, children, older people, people with disabilities, unfamiliar visitors and persons who may require assisted evacuation.

3.2 Criticality

Criticality concerns the importance of a system, location or activity to life safety and organisational resilience. A fire door protecting a single escape route, a control room supporting emergency response, and a server room supporting essential services may have high criticality even if their ordinary fire frequency is low.

A useful qualitative criticality assessment considers:

• number and vulnerability of exposed people;
• dependence on the item for detection, alarm, suppression or escape;
• availability of alternative routes or systems;
• time needed to restore the function;
• consequences of interruption to essential operations; and
• potential for escalation or cascading failure.

3.3 Urgency and time dependence

An action becomes more urgent where exposure is continuous, temporary controls are weak, conditions are deteriorating, or a planned change will increase risk. A blocked final exit during occupied hours is an immediate control failure. Replacement of an obsolete alarm panel may require planned investment, but interim measures may be needed while procurement occurs.

3.4 Cost-effectiveness

Cost-effectiveness compares the resources required with the risk reduction achieved. A simple decision measure is:

The numerator must use a defined cost basis, such as whole-life cost. The denominator must use a consistent risk-reduction measure. The ratio is useful for comparing options addressing the same decision problem, but it must not override legal duties or justify exposing people to intolerable risk.

Where a monetary value is used for expected loss, the basic expected-loss model is:

Here, pᵢ is the probability of scenario i during the specified period, Cᵢ is its consequence expressed in monetary or other defined units, and the summation covers all relevant scenarios. The model assumes that scenarios are adequately identified and that probability and consequence estimates are meaningful. It is unsuitable as the sole basis for valuing life or deciding that a life-safety control is unnecessary.

For comparing two controls, an incremental measure may be used:

C₁ and C₂ are the costs of options 1 and 2; R₁ and R₂ are their corresponding risk-reduction measures. The result has units of cost per unit of risk reduction. It is meaningful only when the options have comparable boundaries, assumptions and time periods.

3.5 Action-ranking matrix

A decision register can combine these factors without pretending to produce false precision.

The register should identify the finding, risk owner, required action, responsible person, due date, interim control, verification evidence and residual-risk decision.

4. Residual Risk and the Risk Decision Cycle

Risk assessment is iterative. A control should not be credited merely because it appears in a policy or drawing. Its availability, reliability and suitability must be verified. For example, an emergency exit is not an effective control if it is locked, obstructed, poorly signed or unusable by people with mobility limitations.

The risk decision cycle is:

1. Define the activity, occupancy, boundaries and decision criteria.
2. Identify hazards, initiating events, exposed people and critical assets.
3. Assess existing controls and estimate controlled risk.
4. Generate additional options using the hierarchy of control.
5. Test legal compliance, standards, ALARP/SFAIRP and feasibility.
6. Select actions, owners, deadlines and interim arrangements.
7. Implement and verify controls.
8. Reassess residual risk.
9. Communicate the decision and monitor performance.
10. Review after incidents, near misses, changes, audit findings or new information.

A residual-risk statement should be specific. “Risk is low” is inadequate. A stronger statement identifies the scenario, controls, assumptions, remaining exposure, responsible owner and review trigger.

Worked example: selecting an improvement

A warehouse has two possible improvements for a high-rack storage zone:

• Option A: improve detection and housekeeping at a whole-life cost of £18,000, with an estimated risk-reduction score of 6 units.
• Option B: install a fixed suppression system at a whole-life cost of £72,000, with an estimated risk-reduction score of 12 units.

The simple ratios are:

Option A is more cost-effective on this measure. However, the decision cannot be made from the ratio alone. If the assessment shows that a rapidly developing fire could trap sleeping occupants in an adjacent area, or that suppression is required by law, insurer conditions or the adopted design standard, Option B may still be necessary. The correct conclusion is that Option A offers greater efficiency per estimated unit, while Option B may provide the level of protection required for tolerability and consequence control. Assumptions and uncertainty must be documented.

5. Integrating Risk Decisions into Management Systems

Fire safety audits

Audits provide systematic assurance that arrangements exist and work in practice. A risk-based audit programme should devote more attention to high-criticality systems and weak controls than to easily observed paperwork. Audit evidence may include:

• inspection and maintenance records;
• alarm and emergency-lighting test results;
• fire-door inspection data;
• evacuation drill performance;
• training and competence records;
• hot-work permits;
• housekeeping inspections;
• corrective-action closure evidence; and
• interviews and direct observation.

Audits should test effectiveness, not merely conformity. A completed checklist does not demonstrate that staff can hear the alarm, that visitors understand evacuation arrangements, or that a fire door closes correctly.

Emergency planning

Risk decisions determine the assumptions used in emergency plans. The plan should address alarm initiation, warning and communication, evacuation strategies, assistance for disabled persons, assembly arrangements, fire-service access, accountability, incident command, utilities isolation and post-incident recovery.

Emergency arrangements should be scenario-based. A plan for a small localised fire may not work for smoke contamination, loss of power, blocked escape routes, a fire during a night shift or simultaneous failure of communications. Exercises should test critical decisions and reveal dependencies rather than simply confirm that a drill occurred.

Business continuity

Business continuity extends the analysis beyond immediate life safety to the continuation and recovery of essential activities. Important questions include:

• Which functions must continue during an incident?
• What is the maximum tolerable period of disruption?
• Which premises, equipment, data, suppliers and people are dependencies?
• What alternative location or process is available?
• How will fire damage affect customers, regulators and the supply chain?

Fire prevention and protection controls can therefore be justified not only by direct life-safety benefits but also by reduced interruption, data loss, reputational harm and recovery time. Life safety remains the overriding ethical priority.

Safety management systems

Fire safety should be integrated into the organisation’s wider management system through a plan–do–check–act cycle:

• Plan: establish policy, objectives, risk criteria, responsibilities and resources.
• Do: implement controls, competence arrangements, maintenance and communication.
• Check: inspect, audit, measure, investigate incidents and review action closure.
• Act: correct failures, learn from experience and improve the system.

The responsible person or duty holder must have authority, competence and resources. Responsibilities should be clear across facilities, security, engineering, human resources, contractors and senior management. Outsourcing maintenance does not automatically transfer legal accountability.

6. Governance, Ethics and Regulatory Considerations

Fire safety decisions affect human life and must be governed transparently. Ethical decision making requires fairness to employees, contractors, visitors and members of the public, including people who are less able to protect themselves. Economic analysis should not assign a lower priority to people because they are inconvenient to evacuate or have disabilities.

The organisation should maintain:

• a clear fire safety policy;
• defined competence requirements;
• documented risk acceptance authority;
• independent escalation for unresolved high risks;
• change-management procedures;
• records that are accessible and auditable; and
• arrangements for consultation and reporting concerns.

Regulatory requirements vary by jurisdiction. The fire safety professional must consult applicable legislation, building requirements, recognised codes, insurer conditions, permits and authority guidance. A risk assessment is not a substitute for compliance with prescriptive requirements where those requirements apply. Conversely, compliance with a minimum rule does not prove that all site-specific risks are controlled.

7. Technology and Data-Supported Decisions

Digital tools can improve prioritisation when their limitations are understood. Computerised maintenance management systems can track overdue tests, repeated defects and critical assets. Building information models can identify compartmentation, equipment locations and access constraints. Sensors and connected alarms can provide early warning and trend data.

Artificial intelligence may assist in classifying inspection findings, detecting patterns in false alarms or identifying recurring housekeeping failures. It should not independently decide that a life-safety risk is tolerable. Data quality, model bias, cybersecurity, explainability and human oversight are essential. A dashboard can display a green status while a critical barrier is physically unavailable. Direct verification remains necessary.

Useful performance indicators include:

• percentage of critical inspections completed on time;
• number and age of overdue high-priority actions;
• proportion of fire doors passing inspection;
• alarm availability and false-alarm trends;
• evacuation time and accountability performance;
• completion and competence rates for training; and
• recurrence rate of significant findings.

Indicators should combine leading measures, such as inspection completion, with lagging measures, such as incidents and losses. Targets must not encourage concealment or superficial closure.

8. Illustrative Case: Riverside Distribution Centre

Background

Riverside Distribution Centre is a fictional two-shift warehouse storing packaged consumer goods. It contains high-bay racks, battery-charging facilities, a small maintenance workshop and offices. A recent assessment identified combustible packaging, charging equipment, damaged fire doors, incomplete contractor induction and inconsistent housekeeping near escape routes.

Problem

The site manager initially proposed replacing all portable extinguishers because this was visible and relatively inexpensive. The fire risk assessor argued that the proposal did not address the most critical weaknesses: blocked escape routes, defective fire doors and poor control of battery charging. The organisation needed to prioritise a limited capital budget.

Analysis

The assessment team considered credible scenarios rather than simply counting defects. A charging-area fire could produce rapid smoke spread and interrupt warehouse operations. Defective fire doors reduced compartmentation between the warehouse and offices. Blocked routes directly affected evacuation. Extinguisher replacement had value, but it was not the strongest first intervention because existing units were generally serviceable.

The team ranked actions as follows:

Approach and solution

Management authorised immediate removal of obstructions and restricted charging in the affected area until controls were improved. Fire doors were repaired by a competent contractor, and a documented functional check was introduced. Charging procedures were revised, combustible storage was separated, and staff received practical instruction. Contractors were required to complete induction and comply with hot-work controls. The emergency plan was revised to include a charging-area scenario, assistance arrangements and fire-service information.

The audit schedule was changed from a uniform quarterly checklist to a risk-based programme. Critical escape routes and fire doors received more frequent inspection. Action closure required photographic or maintenance evidence and independent verification. The extinguisher replacement was retained as a planned action but was not allowed to displace the higher-priority controls.

Outcome

The centre reduced immediate life-safety exposure, improved management visibility and linked corrective actions to operational continuity. A subsequent exercise identified that night-shift accountability was weak; this became a further action. The case demonstrates that the most visible or cheapest improvement is not necessarily the most important.

Learning points

1. Prioritisation must begin with life safety and critical barriers.
2. Temporary controls are necessary when permanent work is delayed.
3. Audit frequency should reflect risk and criticality.
4. Emergency planning and business continuity should use the same risk scenarios.
5. Action closure requires evidence of effectiveness, not merely a completion date.

9. Challenges and Limitations

Risk-based decisions have unavoidable limitations. Numerical scores can create false confidence, especially when likelihood data are weak. Different assessors may assign different ratings. Rare, high-consequence fires are difficult to estimate from local experience alone. Dependencies between controls may be missed: an alarm may depend on power, communications and maintenance; evacuation may depend on lighting, access control and trained staff.

Risk matrices can also produce the same score for a frequent minor event and a rare catastrophic event. These should not automatically receive identical treatment. Professional judgement, scenario analysis and explicit escalation rules are required. Uncertainty should be recorded rather than hidden inside a number.

Common failures include:

• treating ALARP as a cheapest-option test;
• accepting overdue actions without interim controls;
• relying on paperwork instead of field verification;
• ignoring contractors, visitors and vulnerable people;
• failing to reassess after organisational or building change;
• allowing production pressure to override critical safeguards; and
• closing findings without confirming residual risk.

Good practice is proportionate but conservative where uncertainty concerns life safety. Decisions should be explainable to workers, regulators, emergency responders and senior management.

Best-Practice Decision Checklist

Before approving a fire safety decision, ask:

1. What credible fire scenarios were considered?
2. Who could be harmed, and who is most vulnerable?
3. Which controls are critical barriers?
4. Is the current risk intolerable, tolerable only if reduced, or broadly acceptable?
5. Have ALARP/SFAIRP and applicable requirements been addressed?
6. Were reasonably practicable alternatives examined?
7. Are cost and benefit assumptions transparent and comparable?
8. What temporary controls apply until completion?
9. Who owns the action and what evidence will verify it?
10. What residual risk remains, who accepts it and when will it be reviewed?

Chapter Summary

Risk-based fire safety management converts assessment findings into justified, prioritised and verifiable decisions. Risk is commonly represented as likelihood multiplied by consequence, but the result is meaningful only when definitions, assumptions and uncertainty are clear. Tolerability distinguishes intolerable risks from risks that may be accepted only while further reduction is pursued and risks that are broadly acceptable under continuing control.

ALARP and SFAIRP require risk reduction unless the sacrifice is grossly disproportionate to the benefit, subject to applicable law. Cost-effectiveness can support comparison but cannot override life-safety duties. Criticality, vulnerability, urgency, barrier reliability and business consequences must supplement numerical scores. Residual risk must be reassessed after controls are implemented and verified.

Fire risk decisions should be integrated into audits, emergency plans, business continuity arrangements and the organisation’s plan–do–check–act safety management system. Effective governance requires competent ownership, transparent records, change management, ethical treatment of vulnerable people and escalation of unresolved high risks. Technology can support evidence and trend analysis, but professional judgement and field verification remain essential.

Key Terms

Hazard: A source or situation with the potential to cause harm.

Risk: The combination of likelihood and consequence of an unwanted event.

Inherent risk: Risk assessed before safeguards are considered.

Controlled risk: Risk after existing controls are considered.

Residual risk: Risk remaining after additional controls are implemented and verified.

Tolerability: The condition in which risk may be permitted within defined criteria and controls.

ALARP: As low as reasonably practicable.

SFAIRP: So far as is reasonably practicable.

Criticality: The importance of a function, asset or barrier to safety or continuity.

Risk owner: The person accountable for managing a defined risk.

Risk acceptance: A formally authorised decision to permit a stated residual risk.

Critical barrier: A control whose failure could allow a major fire consequence.

Cost-effectiveness: Comparison of control cost with the risk reduction achieved.

Whole-life cost: Acquisition, operation, maintenance, replacement and disposal cost over the relevant life.

Audit: A systematic, evidence-based examination of arrangements and effectiveness.

Emergency plan: Arrangements for responding to and managing an emergency.

Business continuity: The capability to continue or recover critical activities after disruption.

Competence: The combination of knowledge, skills, training and experience needed for a task.

Change management: A controlled process for assessing risks created by change.

Plan–do–check–act: A cycle for implementing, reviewing and continually improving management arrangements.

Review Questions

Short Answer Questions

1. Distinguish between inherent risk and residual risk.
2. What is meant by ALARP?
3. Why is criticality important when prioritising fire safety actions?
4. State two limitations of a conventional risk matrix.
5. Identify two types of evidence that may be used to verify corrective-action closure.

Long Answer Questions

1. Explain the three-region tolerability model and discuss how it influences fire safety decisions.
2. Describe how ALARP/SFAIRP should be demonstrated in a documented decision.
3. Explain how fire risk assessment findings should be integrated into emergency planning and business continuity.
4. Discuss the role of audits in confirming that fire safety controls are effective in practice.
5. Evaluate the benefits and limitations of using cost-effectiveness analysis for life-safety decisions.

Analytical / Application Questions

1. A hotel has a defective fire alarm panel, obstructed escape routes and incomplete staff training. Develop a prioritised action plan, including interim controls, owners and verification evidence.
2. Compare two proposed controls using cost-effectiveness analysis, then explain why the numerical result alone may not determine the final decision.
3. Following a warehouse layout change, identify the risk-management activities required before and after the change, including emergency planning, audit and residual-risk review.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk before any safeguards are considered

B. Risk remaining after additional controls are implemented and verified

C. The cost of installing a fire protection system

D. The risk recorded only after an incident

Correct Answer: B. Risk remaining after additional controls are implemented and verified

Question 2

In the three-region tolerability model, an intolerable risk normally requires which response?

A. Routine monitoring only

B. Acceptance by the nearest supervisor

C. Stopping, prohibiting or redesigning the activity

D. Replacing engineering controls with training

Correct Answer: C. Stopping, prohibiting or redesigning the activity

Question 3

What does ALARP require in a fire safety decision?

A. Selecting the least expensive available control

B. Reducing risk unless further sacrifice is grossly disproportionate to the benefit

C. Eliminating every conceivable hazard

D. Using only quantitative probability data

Correct Answer: B. Reducing risk unless further sacrifice is grossly disproportionate to the benefit

Question 4

Which factor most directly describes criticality?

A. The colour of fire equipment

B. The purchase price of a control

C. The importance of a system or asset to life safety and continuity

D. The age of the building alone

Correct Answer: C. The importance of a system or asset to life safety and continuity

Question 5

A control costs £20,000 and produces an estimated risk reduction of 5 units. What is its simple cost-effectiveness ratio?

A. £1,000 per unit

B. £4,000 per unit

C. £15,000 per unit

D. £100,000 per unit

Correct Answer: B. £4,000 per unit

Question 6

Which audit approach is most consistent with risk-based management?

A. Auditing every item with identical frequency regardless of risk

B. Auditing only documents and never observing conditions

C. Giving greater attention to critical systems and weak controls

D. Closing findings when a deadline is assigned

Correct Answer: C. Giving greater attention to critical systems and weak controls

Question 7

Why are temporary controls important?

A. They remove the need for permanent work

B. They control exposure while permanent corrective action is delayed

C. They prove that residual risk is zero

D. They transfer legal responsibility to contractors

Correct Answer: B. They control exposure while permanent corrective action is delayed

Question 8

Which statement about business continuity is correct?

A. It concerns only fire brigade tactics

B. It considers continuation and recovery of essential activities after disruption

C. It replaces the emergency evacuation plan

D. It applies only to financial institutions

Correct Answer: B. It considers continuation and recovery of essential activities after disruption

Question 9

Which is an appropriate use of artificial intelligence in fire safety management?

A. Allowing an algorithm to accept intolerable life-safety risk without review

B. Using pattern analysis to identify recurring inspection failures, with human oversight

C. Replacing all physical inspections with dashboard data

D. Ignoring data quality because automated results are objective

Correct Answer: B. Using pattern analysis to identify recurring inspection failures, with human oversight

Question 10

What is required before a corrective action should be considered effectively closed?

A. A verbal promise from the action owner

B. A lower numerical risk score without evidence

C. Evidence that the control was implemented and its effectiveness verified

D. Removal of the finding from the meeting agenda

Correct Answer: C. Evidence that the control was implemented and its effectiveness verified