The Steps of a Fire Risk Assessment Explained: 5 Steps or 9?

Search for the steps of a fire risk assessment and you will find two different answers. Most sites say five. The current codes of practice say nine.

Both are right and understanding why tells you something useful about how a proper assessment is actually put together.

Why there are two models

The five-step model comes from the government guides published between 2006 and 2008 to support the Fire Safety Order. It mirrors the familiar five steps to health and safety risk assessment and it is a good framework for explaining the process to a lay duty holder.

The nine-step model is set out in PAS 79-1:2020 for non-housing premises and BS 9792:2025 for housing. Both standards address the point directly. They note that some guidance documents suggest five steps, state that they are consistent with such guidance but break the process down into more detail and add that the number of steps defined is irrelevant. What matters is that an appropriately structured approach is adopted and that all relevant issues are addressed.

So the nine steps are not a different method. They are the five-step model with the analytical work made explicit.

One practical consequence: both standards require that in the documented assessment, it is clear that each of the nine steps has been taken. BS 9792:2025 states that the documented assessment should demonstrate that the nine steps have been taken. If you are commissioning work to either standard, that is a reasonable thing to check the report against.

The two models mapped

Note where the extra detail sits: the nine-step model separates the likelihood of fire from the consequences of fire and only then combines them into an overall risk. That separation is the analytical heart of the method and it is what the five-step model collapses.

The nine steps in practice

Step 1: Obtain information about the premises and the occupants

The assessor gathers the factors that shape risk but cannot readily be changed. Both standards call these the "given" factors.

Typically recorded:

• Type and use of the premises
• Number of storeys above and below ground
• Height to the top storey, measured to the highest habitable floor above ground level at the lowest entrance
• Brief details of construction, including whether external walls are traditional masonry, overclad or built using modern methods of construction such as timber frame
• Number and type of dwellings or occupied units
• Number of occupants, staff and visitors and occupancy patterns including out of hours
• Occupants with specific evacuation requirements
• Any history of fires
• The fire strategy for the building, where a documented fire strategy exists

Much of this comes from a meeting with management before the physical inspection. Both standards note that the fire strategy is likely to be of value other than in small, simple premises.

What you can do to help: have the plans, the previous assessment, the fire strategy, service records and a knowledgeable person available. It shortens the visit and improves the output.

Step 2: Identify fire hazards and their control

Hazard identification and determination of the existing measures for eliminating or controlling those hazards. This is a combination of interviewing management and inspecting the premises.

The classic framing is ignition sources, fuel and oxygen:

Ignition sources: electrical installations and equipment, portable appliances, heating, cooking, hot work, smoking, lighting, machinery and friction, static, lightning and arson.

Fuel: stock and materials, packaging and waste, furniture and furnishings, flammable liquids and gases, combustible dusts, flammable wall and ceiling linings and combustible construction.

Oxygen and fire spread: ventilation and air conditioning, oxygen cylinders, oxidising agents and openings that allow fire and smoke to travel.

BS 9792:2025 also prompts assessors to record hazards not covered elsewhere, giving evidence of hoarding, fuel storage tanks for generators and storage or use of dangerous substances as examples.

Arson deserves specific attention. It remains a leading cause of fire in non-domestic premises and the controls are usually cheap: secure waste storage away from the building, external lighting, boundary security, prompt removal of accumulated combustibles and control of access.

Step 3: Assess the likelihood of fire

A subjective assessment, based primarily on the findings of step 2, taking into account information from step 1.

Both standards use three categories. BS 9792:2025 defines them for housing:

• Low: where the likelihood of fire is abnormally low, for example because the extent of common parts is minimal
• Medium: where the likelihood is typical or normal for the type of premises
• High: indicating serious shortcomings in the elimination or control of fire hazards

Note that "medium" is the normal answer for most buildings. An assessment that rates everything low is not being rigorous.

Step 4: Determine the fire protection measures in place

Obtained mainly by inspecting the premises. This is the longest part of most site visits.

Covered in BS 9792:2025 Clause 15 and PAS 79-1:2020 Clause 15:

• Fire detection and warning: system type, category and grade, detector and call point locations, alarm devices, monitoring, faults and crucially whether the system is compatible with the evacuation strategy
• Means of escape: travel distances, exit widths, doors opening in the direction of travel, protected routes, fire-resisting construction, fire doors and their hardware, means of securing doors including thumb turns and obstructions
• Signs and notices
• Emergency escape lighting
• Manual firefighting equipment
• Separating elements and other measures limiting fire spread, including fire stopping, inspected at sample locations
• Automatic suppression
• Loadbearing elements of structure
• External wall construction, including cladding, balconies and attachments
• Smoke control systems
• Systems, equipment and facilities for the fire and rescue service

The judgement in this step is not simply whether measures meet current standards. Both standards set out a decision logic for older buildings: establish whether the precautions meet current standards, if not, whether they met the standards at the time of construction, identify shortcomings against both and then ask the crucial question, do departures from current standards create unacceptable risk?

BS 9792:2025 puts it plainly: a departure from prescriptive guidance is not, alone, sufficient justification for upgrading work. Standards improve over time but that does not mean older standards are unsafe and upgrading to current standards may fail the test of reasonable practicability or be architecturally impossible.

This is the single biggest difference between a competent assessment and a checklist. A checklist records the departure. An assessment decides whether it matters.

Step 5: Obtain information about fire safety management

Primarily discussion with management, supported by examination of records.

Typically covered:

• The fire safety policy and management structure
• Emergency plan and evacuation procedures
• Arrangements for summoning the fire and rescue service
• Staff who respond to fire and people who assist with evacuation
• Liaison with the fire and rescue service
• Routine inspections: daily, weekly, monthly and quarterly checks of alarms, emergency lighting, extinguishers, suppression, fire doors, smoke control, lifts and exits
• Testing and maintenance by competent persons, including frequency, date of last service and remarks by the maintainer
• Training, including who provides it and whether it is recorded
• Fire drills, frequency and findings
• Resident engagement, in housing
• Information provided to third parties, including residents, contractors and the fire and rescue service
• Records

This step is where most action plans get their content and it is the part that a twenty-minute inspection cannot cover. Fire safety management is not visible from a corridor.

Step 6: Assess the likely consequences of fire

A subjective assessment of the likely consequences to occupants. It takes account of the assessor's opinion of the likelihood of various fire scenarios, the extent of injury that could occur in those scenarios and the number of people likely to be affected. It draws mainly on steps 4 and 5, informed by step 1.

Three categories, typically:

• Slight: limited potential for injury
• Moderate: delays in evacuation causing significant smoke inhalation, anxiety or minor physical injuries requiring medical care
• Extreme: significant potential for serious injury or death of one or more occupants, where delay or inability to evacuate might cause severe smoke inhalation, panic and physical injuries requiring immediate hospital care or a fatality

Note the logic. Consequences are driven largely by the fire protection measures and the management arrangements, not by how likely a fire is. A building with excellent housekeeping but a single unprotected staircase has low likelihood and extreme consequences.

Step 7: Assess the fire risk

Likelihood combined with consequences, normally using a matrix.

Both standards recommend at least five predetermined categories of fire risk, typically trivial, tolerable, moderate, substantial and intolerable. The reason for five rather than three is that risk needs finer gradation than either input and the matrix approach produces more consistent results between different assessors: the assessor selects one of three likelihood levels and one of three consequence levels and derives one of five risk levels.

Both standards also require that the methodology provides a transparent means of combining the two. A risk rating with no visible methodology behind it is not compliant.

Step 8: Formulate a prioritised action plan

PAS 79-1:2020 describes the action plan as the principal raison d'être of the assessment. That is the right way to think about it.

Recommended actions should be prioritised, other than where the plan comprises only minor matters that can be actioned without delay. Even where fire risk is assessed as tolerable, there is often a need for minor improvements.

A useful action plan:

• Prioritises by risk, not by cost or convenience
• Gives realistic timescales
• Contains enough technical information for someone else to carry out the work
• Distinguishes legal requirements from recommendations going beyond the minimum
• Identifies where interim measures are needed pending permanent works
• Is comprehensible to a non-specialist

Where fire risk is intolerable, the assessment should say so and BS 8674:2025 identifies as a core competence the ability to identify where risk is so intolerable that interim measures must be implemented immediately or the building can no longer be occupied until remedial action is taken.

Step 9: Determine the date for review

The final step and part of the assessment itself. Both standards require the documented assessment to record the date by which it is to be subject to review.

The assessment should also be reviewed earlier if significant changes take place or there is reason to suspect it is no longer valid. See our separate guide on review triggers.

What must be recorded

Both standards set a minimum. As documented in BS 9792:2025 Clause 10, the assessment should record at least:

• The type and scope of assessment carried out
• The name and contact details of the assessor and any relevant qualifications or certification
• The name and contact details of the duty holder or party for whom it was carried out
• The dates of assessment and of publication
• The names of the principal persons consulted
• The name of the person who checked the report and their qualifications
• Details of any external documents or resources referred to, including applicable legislation
• Information and comment on the matters addressed in the nine steps

It should also record:

• Any significant areas that could not be accessed
• Justification where a fire protection measure obviously and significantly departs from current guidance but no upgrading is recommended
• A clear distinction between matters considered for legal compliance and matters outside the scope of legislation
• The level of fire risk
• An action plan, unless it is expressly confirmed that no additional precautions are necessary
• Photographs, plans and drawings where relevant to illustrate particular issues
• The date for review

BS 9792:2025 notes that recording and justifying significant departures from recognised codes of practice is of particular benefit to those who subsequently audit the assessment, such as enforcing authorities because it makes clear that the matter was considered rather than overlooked.

That sentence is worth remembering. It is the difference between a report that protects you and one that does not.

The record requirement since October 2023

Since 1 October 2023, Article 9(6) of the Fire Safety Order requires the responsible person to make a record of the assessment or review in every case. The former exemption for employers with fewer than five employees is gone. Article 9(7)(a) now requires all findings to be recorded, following removal of the word "significant". Article 11(2) requires the fire safety arrangements to be recorded, again with no small-organisation exemption.

Frequently asked questions

Is it five steps or nine? Both. The five-step model comes from the government guides. PAS 79-1:2020 and BS 9792:2025 use nine steps and both state they are consistent with the five-step guidance but break the process down in more detail.

Do all nine steps have to be evidenced in the report? Under both standards, yes. The documented assessment should make clear that each of the nine steps has been taken.

Why separate likelihood from consequences? Because they are largely independent. A building can have a very low likelihood of fire and a very high risk because the consequences if one occurred would be severe. Combining them prematurely hides that.

How many risk categories should there be? At least five for the overall fire risk and at least three each for likelihood and consequences. Where a matrix is used, the number of categories for likelihood and consequences should be the same.

How long does a fire risk assessment take? For a small simple premises, a couple of hours on site and a similar time writing up. For a large or complex building, days. Any quote implying a nine-step assessment can be completed in twenty minutes is quoting for something else.

Does the assessor need to see everything? No but they must record what they could not access and why. Sampling is normal and legitimate, silence about what was not seen is not.