Common Fire Risk Assessment Failures: What Responsible Persons Get Wrong and How to Avoid Enforcement Action

A suitable and sufficient fire risk assessment, as required by Article 9 of the Regulatory Reform (Fire Safety) Order 2005, must systematically identify all fire hazards in the premises, evaluate the risk to all relevant persons, and set out the precautions needed to reduce that risk to an acceptable level. The assessment must be carried out by a competent person — defined under Article 18 as someone with sufficient training, experience and knowledge to carry out the task properly.

The five core steps of a compliant fire risk assessment are:

1. Identify fire hazards. Locate sources of ignition, fuel and oxygen throughout the premises.
2. Identify people at risk. Consider employees, lone workers, visitors, contractors and any occupants who may have difficulty evacuating, including those with disabilities.
3. Evaluate, remove or reduce the risk. Assess the likelihood of fire and the harm it could cause, and implement control measures.
4. Record the findings, prepare an emergency plan and provide training. All findings must now be recorded in full — the previous requirement to record only ‘significant findings’ was removed by Section 156 of the Building Safety Act 2022.
5. Review and update the assessment regularly. The assessment must be reviewed when there is reason to believe it is no longer valid or following any significant change to the premises.

Fire authorities auditing premises under the FSO will ask to see evidence of each of these steps. An assessment that omits any one of them is likely to be assessed as unsuitable or insufficient.

Fire safety audit data points to a clear pattern: many premises that fail an audit have a risk assessment in place, but it no longer reflects actual conditions in the building. MHCLG fire prevention and protection statistics for England (year ending March 2025) show that Article 9 risk assessment breaches accounted for 8,471 recorded non-compliances — and only 58% of the 51,020 fire safety audits carried out that year had a satisfactory outcome, the lowest proportion since 2011 (MHCLG, 2025). Fire authorities conducting inspections regularly encounter Responsible Persons who are genuinely surprised to receive enforcement notices on the basis of an assessment they considered current but which no longer reflected the building. An assessment produced when a building was first occupied, then left unchanged through years of alterations, changes of use, and staff turnover, is a common source of exactly this situation.

Analysis of enforcement notices on the National Fire Chiefs Council (NFCC) public register for the period 1 January to 12 September 2025 — excluding London Fire Brigade, which publishes notices separately and is not included in the NFCC register — shows that 1,620 notices were issued to Responsible Persons for non-compliance with the Fire Safety Order (Bettis, 2025). Of those, 648 were served under Article 9 alone — meaning that in approximately four out of ten enforcement actions recorded on the register, the Responsible Person either had no risk assessment at all or had one that was not suitable and sufficient. The same analysis found 545 prohibition notices were issued in the same period, almost a third of all notices, indicating that in many cases the failures identified were serious enough to require immediate restriction of premises use (Bettis, 2025).

A further common pattern is that Responsible Persons appoint an assessor, receive a document, and then take no further action on the findings. The assessment identifies remedial actions, but those actions are not completed, not monitored, and not evidenced. When a fire authority audits the premises, the gap between what the assessment recommended and what has been done becomes the basis for enforcement.

Enforcement notices and prohibition notice data consistently point to the same categories of non-compliance. It is important to set these in context: a fire risk assessment is the mechanism through which a Responsible Person is supposed to identify and address each of these issues. Where these failures are found during a fire authority inspection, in many cases they represent items that were not picked up — or were identified but not acted upon — during the risk assessment process. The list below is therefore best read as a checklist of what a thorough, current fire risk assessment must cover and verify. If your assessment has not addressed each of these areas, that gap is your exposure (Bettis, 2025; MHCLG, 2025):

• No assessment or no record of the assessment. Some Responsible Persons have carried out an informal walkthrough but have no written record. Under the Building Safety Act 2022, all findings must be fully recorded. An undocumented assessment has no legal standing.
• Assessment not suitable or sufficient for the premises. Generic templates applied without regard to the specific hazards, occupancy type, or layout of the building are frequently judged inadequate. An assessment for a multi-occupancy residential building, for example, must address the structure, external walls, and flat entrance doors following the Fire Safety Act 2021.
• Assessment not reviewed following significant changes. Structural alterations, changes in use, new occupants with specific evacuation needs, or changes in the materials stored or used on the premises all require an immediate reassessment. In many cases, enforcement action is triggered by premises that have changed materially since the original assessment was produced.
• Inadequate means of escape. Article 14 of the FSO requires that escape routes are kept clear, usable and of sufficient number. With 10,323 recorded breaches in 2024/25, this is the single most common FSO non-compliance identified at audit (MHCLG, 2025). Obstructed corridors, self-closing fire doors wedged open, and final exit doors secured with locks that cannot be opened from the inside during an emergency are among the most common specific findings.
• Deficient fire detection and alarm systems. Article 13 requires that, where appropriate, the Responsible Person provides and maintains detection and warning systems. Alarms that are not regularly tested, that have disconnected components, or that do not cover all parts of the premises are a frequent source of enforcement notices.
• Inadequate emergency lighting. Escape routes must be identifiable in the event of power failure. Premises with failed or absent emergency lighting in stairwells, corridors or exit routes frequently receive enforcement notices.
• Failure to provide fire safety information and training to employees. Article 21 requires that employees and, where appropriate, non-employees receive comprehensible and relevant information on fire risks and emergency procedures. In many enforcement cases, staff are found to be unaware of the evacuation procedure, the location of assembly points, or how to raise the alarm.
• Failure to cooperate and coordinate with other Responsible Persons. In premises with multiple Responsible Persons — for example, where a landlord and a tenant share a building — Article 22 requires active cooperation. Enforcement action is taken where each party assumes the other has carried out the assessment or implemented precautions.

The competency of the person carrying out the assessment directly determines whether the resulting document can be considered suitable and sufficient under Article 9. The Fire Safety Order requires the assessment to be carried out by a competent person. Where a Responsible Person commissions an assessor who lacks the knowledge, training or experience to assess the specific type of premises, the resulting assessment may be found to be inadequate regardless of its format or length.

The issue of assessor competency has become increasingly prominent following the Grenfell Tower Inquiry Phase 2 report published in September 2024, which highlighted the absence of mandatory regulation and accreditation for fire risk assessors (MHCLG, 2025).

Following the Inquiry, the government has said it intends to legislate for mandatory competence requirements for fire risk assessors, including certification against approved standards by United Kingdom Accreditation Service (UKAS)-accredited bodies. This change represents a significant shift from the previous voluntary registration system.

Before appointing a fire risk assessor, Responsible Persons should carry out the following checks:

• Confirm that the assessor meets the competency criteria set out by the Fire Risk Assessment Competency Council and can provide evidence of this.
• Verify that they have direct experience of assessing your premises type and sector.
• Define the scope of the assessment clearly before engagement and confirm the assessor will have access to all areas and relevant information.
• Obtain more than one quote on the same scope to allow a meaningful comparison.
• Request references from previous clients in similar premises types and ask specifically whether any issues were subsequently identified by the Fire and Rescue Authority.
• Ask for evidence of sufficient professional indemnity insurance and confirm the assessor operates independently and maintains a complaints procedure.
• Keep a record of the steps taken in selecting the assessor. If the appointment is ever questioned, documented due diligence is the Responsible Person’s first line of defence.

Appointing an unaccredited assessor does not transfer legal liability from the Responsible Person to the assessor — the duty remains with the Responsible Person at all times.

Fire and Rescue Authorities in England and Wales have a range of enforcement powers under the Fire Safety Order when they identify non-compliance. The action taken depends on the severity and nature of the failure identified.

• Informal advice and Fire Safety Matters letters. In cases where non-compliance is found but does not reach the threshold for formal enforcement, the authority may issue informal advice or a Fire Safety Matters letter setting out actions required. Failure to act on these may be escalated to formal enforcement.
• Enforcement notices (Article 30). Served where the Responsible Person has failed to comply with a requirement of the FSO. The notice specifies the breach and the timescale within which it must be remedied, which must be at least 28 days. In the period January to September 2025, 892 enforcement notices were issued (Bettis, 2025).
• Alterations notices (Article 29). Served where the fire authority considers the premises represents a serious risk or may do so if changes are made to it. The notice requires the Responsible Person to notify the authority before making specified changes. There were 183 alterations notices in the same period (Bettis, 2025).
• Prohibition notices (Article 31). Served where the authority considers there is a risk of death or serious injury. A prohibition notice restricts or prohibits use of all or part of the premises immediately and is not suspended even if appealed. In the period January to September 2025, 545 prohibition notices were issued (Bettis, 2025).
• Prosecution. Where a Responsible Person fails to comply with a statutory notice, or where a breach of the FSO has put people at risk of death or serious injury, prosecution may follow. Penalties include unlimited fines and up to two years’ imprisonment. Where an offence is committed by a company, individual directors, managers or officers may also be personally liable (FSO 2005, Article 32).

It is worth noting that Leicestershire Fire Authority issued 198 notices in the same nine-month period — the highest total for any single fire authority recorded in the NFCC register. London Fire Brigade publishes its notices separately and is not included in these figures.

A fire risk assessment does not have a set expiry date, but it must be reviewed if there is reason to believe it is no longer valid, or if there has been a significant change to the premises or to the matters to which the assessment relates. In practice, an annual review is generally regarded as good practice for most non-domestic premises, with more frequent review in higher-risk environments or where conditions change regularly.

Organisations should have a clear change management procedure or policy in place so that relevant changes are identified, assessed, and reflected in the fire risk assessment without delay.

The following changes should trigger an immediate review:

• Structural alterations to the building, including changes to walls, ceilings, roofs, or floor layouts
• Changes to the use of the premises, or any part of them
• Changes to the number or type of occupants, particularly where people with mobility or sensory impairments are present
• The introduction of new hazardous substances, processes, or equipment
• Changes to fire safety systems, including alarm systems, suppression systems, or emergency lighting
• A fire, near miss, or other significant incident on the premises
• Any enforcement action or audit finding

The Building Safety Act 2022 introduced a requirement to record all findings in full, rather than only significant findings. Responsible persons should ensure that the fire risk assessment fully records the outcome of the assessment, including the hazards identified, the people at risk, the control measures in place, any residual risk, and the actions required, with timescales and named persons responsible for completion.

Several emerging risks require Responsible Persons to update or supplement their fire risk assessments where these risks are present on their premises.

The significant increase in the use of electric vehicles, e-bikes, e-scooters and battery-powered equipment has introduced a fire risk that many existing assessments do not address. Lithium-ion battery fires are fast-spreading and difficult to extinguish. Responsible Persons for premises with car parks, bicycle storage, charging points or communal areas where these devices may be charged should review their assessments to cover this risk specifically.

The increasing use of rooftop solar panels has introduced fire risks that many older assessments do not address. PV systems present particular hazards because they continue to generate electricity in daylight and cannot be fully isolated in the same way as other electrical installations. They may also restrict safe access to the roof for firefighters, and faults can cause fires within the panels, cabling, or inverter equipment. Responsible persons for premises with PV installations should ensure that the fire risk assessment covers the location and extent of the system, the arrangements for electrical isolation, and any implications for evacuation routes, firefighting access, and maintenance.

For specified high-rise and higher-risk residential buildings in England, the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 introduced duties to identify residents who may have difficulty evacuating and to complete Person-Centred Fire Risk Assessments (PCFRAs) and Residential Personal Emergency Evacuation Plans (PEEPs) where required. Fire risk assessments for qualifying buildings should now reflect these duties.

The phased withdrawal of BS 476 fire testing standards began in March 2025, with the transition to the European classification system BS EN 13501. Responsible Persons overseeing procurement of fire protection materials or refurbishment works should ensure specifications reference the current standard.

The Fire Safety Act 2021 confirmed that fire risk assessments for multi-occupied residential buildings must cover external wall systems, cladding and flat entrance doors. Many assessments produced before 2021 do not address these elements and require updating.

Fire risk assessment failures remain one of the leading causes of formal enforcement action under the Fire Safety Order 2005. The evidence from enforcement data and prosecution records consistently identifies the same categories of failure: no assessment or an inadequate one, failure to review following changes, poor documentation, and failure to implement the findings.

A compliant assessment is not a form-filling exercise. It is a structured, premises-specific evaluation carried out by a competent person, fully documented, kept current, and acted upon. The legal duty rests with the Responsible Person at all times, regardless of whether an external assessor is appointed.

The legislative framework has strengthened significantly since the Building Safety Act 2022 and the Fire Safety Act 2021. Responsible Persons who have not reviewed their assessments to reflect these changes, or who have assessments that predate them, should treat that gap as a priority compliance risk.

Responsible Persons who need more detailed guidance on carrying out or reviewing a fire risk assessment should consult the government’s fire safety guidance for those with legal duties. It provides practical, premises-specific guidance to support compliance with the legal requirements.

The failures described in this article are preventable, but only if those carrying out or overseeing assessments understand what the law requires and how to apply it in practice. Human Focus’s IIRSM-approved Fire Risk Assessment Training covers the legal background, the five-step assessment process, how to record findings, and how to structure a review and improvement programme.

This IIRSM-approved Fire Risk Assessment Training produces a verified record of completion that supports your compliance audit trail. It is suitable for health and safety officers, facilities managers, risk managers, and supervisors with fire safety responsibilities.