Fire Risk Assessment for Small Business: Your 2026 Guide
- 2 days ago
- 11 min read
More than 600 enforcement notices were served on UK small businesses for fire safety breaches in 2022/23, and 38% of businesses lack suitable fire risk assessments according to AnyRisks' summary of Home Office statistics and survey data. That should reframe this topic immediately. For a small business, fire risk assessment isn't a form-filling exercise. It's one of the clearest lines between “managed risk” and “avoidable exposure”.
I see a recurring problem in smaller organisations. Owners often know they need “something on file”, but they don't always know what a suitable and sufficient assessment looks like in practice. That gap matters. A tidy template that misses your electrical risks, vulnerable occupants, storage issues, or escape route problems can leave you non-compliant and no safer than if you'd done nothing at all.
A good fire risk assessment for small business should do two jobs at once. It should satisfy your legal duty under the Regulatory Reform (Fire Safety) Order 2005, and it should help real people get out safely if something goes wrong.
Table of Contents
Why Fire Safety Is a Critical Business Priority - Beyond Compliance: Business Impact
The 5-Step Fire Risk Assessment Process Explained - Step 1 Identify hazards properly - Step 2 Identify people at risk, not just headcount - Step 3 Evaluate and reduce risk - Step 4 Record the significant findings - Step 5 Review and revise
Implementing Proportionate Fire Safety Controls - What proportionate control looks like - A practical walk-round checklist
Recording Your Findings and Creating an Emergency Plan - What your written record should include - Turning findings into an emergency plan
Maintaining Compliance Through Training and Regular Reviews - Training that works in the real world - Annual review is a minimum, not a strategy
DIY Assessment vs Calling in a Competent Person - When a DIY approach may be defensible - When you should bring in a competent person
Why Fire Safety Is a Critical Business Priority
Hundreds of UK small businesses face formal fire safety enforcement each year. For an owner-manager, that is not just a compliance issue. It is a live business risk that can stop trading, unsettle staff, and create awkward conversations with insurers, landlords, and clients.
Small firms often push fire safety down the list until someone asks for the paperwork. I see that regularly. By that stage, the business is reacting to pressure instead of controlling risk in a sensible, proportionate way.
Practical rule: If your assessment would not help a new manager understand your main fire risks and current controls in ten minutes, it probably is not good enough.
The legal duty sits under the Regulatory Reform (Fire Safety) Order 2005. In practice, the responsible person must make sure the fire risk assessment is suitable and sufficient, kept under review, and turned into real control measures. The most common mistake I see is assuming the duty ends once a document exists.
That assumption causes problems quickly. A templated assessment may satisfy nobody if the exits are partly blocked, staff do not know what to do when the alarm sounds, or the findings have not been updated after layout changes, new equipment, or longer opening hours.
Beyond Compliance: Business Impact
A weak assessment tends to create the same three business problems:
Legal exposure: Inspectors look at the condition of the premises, not just the file on a shelf.
Operational disruption: Evacuation is slower and more confused when routes, responsibilities, and shut-down actions are unclear.
Insurance scrutiny: After a fire, poor records and obvious gaps can make claims handling harder than it needs to be.
There is also a practical point that gets missed. Lower national fire totals do not protect an individual business with poor housekeeping, overloaded electrics, or no clear plan for vulnerable occupants and lone workers. Analysts at Fire Marshal Training's workplace fire statistics review show that thousands of workplace fires still occur each year.
For a small business, the question is rarely “could a fire happen anywhere?” It is “what would happen to this business next week if our unit, shop, office, or café was unusable?” Rent still needs paying. Orders still need fulfilling. Staff still need direction.
That is why fire safety belongs in day-to-day business management. It is also why some DIY assessments fall short. If the premises are more complicated than they first appear, if the findings are vague, or if you are unsure what controls are proportionate, that is usually the point where outside competence saves time and reduces risk.
The 5-Step Fire Risk Assessment Process Explained
The standard method used in the UK is the 5-step PAS 79 framework. It's useful because it gives you a structure that inspectors, competent assessors, and insurers all recognise, and it forces you to move from spotting hazards to deciding what you will do about them.
Step 1 Identify hazards properly
Start with the fire triangle. You're looking for sources of ignition, fuel, and oxygen coming together in ordinary day-to-day work.
In a small office, that might mean overloaded extension blocks under desks, a kitchenette toaster beneath cupboards, cardboard stock stored beside a consumer unit, or a portable heater brought in during winter. In a café, it could be cooking equipment, extraction grease, waste packaging, and after-hours charging of devices. In a salon, think heated tools, aerosols, laundry, and busy electrical use in compact rooms.
A useful walk-round question is simple: what could start a fire here, what would help it grow, and what would help it spread?
Step 2 Identify people at risk, not just headcount
A pitfall for many assessments is becoming too generic. They list “staff and visitors” and move on. That misses the point.
You need to think about who may struggle to detect a fire, understand the alarm, move quickly, or find the exit without help. That includes lone workers, contractors, cleaners working early or late, customers unfamiliar with the building, and anyone with mobility or sensory impairments.
A common failure in non-compliant assessments is neglecting this step. 38% of non-compliant assessments fail to identify vulnerable individuals, and that issue is linked to 67% of fatal fire outcomes in small premises according to Keyostas' guide to the PAS 79 fire risk assessment framework.
The people most at risk are often the ones who aren't part of your normal routine. Delivery drivers, agency staff, evening cleaners, and first-time visitors get missed all the time.
Step 3 Evaluate and reduce risk
Now decide whether your current controls are good enough. Don't just note that you “have extinguishers” or “have an alarm”. Ask whether those controls are suitable for the hazards you identified and whether people can rely on them under pressure.
Look at:
Detection and warning: Can people hear or see the alarm where they work?
Means of escape: Are routes direct, unobstructed, and easy to follow?
Compartmentation and doors: Will fire and smoke spread quickly through the layout?
Procedural controls: Are closing checks, charging rules, and waste removal followed?
This is also where proportion matters. A single-room office with low occupancy needs a different control package from a split-level retail unit open to the public.
Step 4 Record the significant findings
If you employ five or more people, your findings need to be written down. Even where the legal threshold for written records doesn't bite, documenting the assessment is still sensible because it shows what you found, what you decided, and what still needs action.
Good records are brief, specific, and usable. “Electrical fire risk present” is weak. “Trailing multi-plug adaptor under reception desk supplying heater and printer. Remove heater, install fixed socket provision, and brief staff not to use personal heaters” is much better.
Step 5 Review and revise
A fire risk assessment isn't a static certificate. It's a living management document.
Review it after layout changes, staffing changes, new equipment, stock changes, near misses, contractor works, or a change in who uses the building. Even small changes can alter how a fire starts, how quickly it spreads, and who may need help to get out.
Implementing Proportionate Fire Safety Controls
Controls work best when they match the actual risks on site. Small businesses don't need every possible measure. They do need the right combination of physical controls, maintenance, and staff habits.
A lot of owners spend money in the wrong order. They buy more extinguishers before fixing poor housekeeping. They install equipment but don't train staff. They assume a fire alarm alone solves a problem created by overloaded sockets and blocked exits.
What proportionate control looks like
Some controls are technical. Alarm systems should meet BS 5839-1:2017, emergency lighting should meet BS 5266-1:2016, and extinguisher selection should align with BS 5306-8:2012. Fire doors and compartmentation also need to match the fire strategy for the premises.
But standards only help if the basics are right on the ground. Electrical safety is the clearest example. The National Fire Chiefs Council states that 78% of fire incidents in small UK businesses stem from unaddressed electrical faults, while only 31% of non-compliant premises conduct annual electrical safety checks. The same NFCC material notes that inadequate evacuation route signage appears in 44% of local fire inspections. Those points appear in the NFCC Business Fire Safety Awareness Tool.
That's why Step 3 usually comes down to practical controls such as:
Electrical discipline: Fixed wiring checks, damaged cable replacement, charger management, and no daisy-chained extensions.
Escape route control: Final exits open easily, corridors stay clear, and signs are visible from the decision points where people need them.
Fire door management: Doors close properly, aren't wedged open, and haven't been altered badly.
Storage control: Cardboard, waste, stock, and flammables stay away from heat sources and electrical equipment.
Training and routines: Opening and closing checks, reporting faults, and knowing who calls the Fire and Rescue Service.
If you want a simple way to think about this, focus on practical control measures in the workplace. Fire safety controls are just control measures applied to ignition, fuel, spread, and escape.
A short demonstration can help staff visualise what “good” looks like in practice:
A practical walk-round checklist
Use this table as a live check, not just a one-off exercise.
Control Area | Check | Status (OK/Action Needed) |
|---|---|---|
Fire extinguishers | Correct type for the hazard, accessible, serviced, and not used as doorstops | |
Alarm system | Call points, sounders, and panel tested and faults acted on | |
Emergency exits | Routes clear, doors operable, no storage narrowing escape paths | |
Emergency lighting | Units present where needed and functioning during loss of power | |
Fire doors | Intact, self-closing where required, seals and frames not damaged | |
Signage | Exit signs visible, directional signs correct, assembly point identified | |
Electrical safety | No overloaded sockets, damaged leads, or uncontrolled overnight charging | |
Flammable storage | Liquids, aerosols, waste, and stock stored away from ignition sources | |
Training and drills | Staff know alarm response, evacuation method, and reporting process |
On site check: If a route is partly blocked in normal working conditions, treat it as blocked. Hoping people will “move things out of the way” during an alarm isn't a control.
Recording Your Findings and Creating an Emergency Plan
The written record is where the assessment becomes operational. Done properly, it gives you evidence of due diligence and a clear action list for the business. Done badly, it becomes a vague document that no one uses.
What your written record should include
For businesses with five or more employees, a written record is required. Keep it concise, but make it specific enough that another competent person could understand the premises, the hazards, the people at risk, the current controls, and the actions needed.
A workable format looks like this:
Premises summary: What the business does, layout, occupancy pattern, and key risk areas.
Significant hazards: Electrical risks, cooking, heaters, waste build-up, stock storage, contractor activities.
People at risk: Staff, visitors, lone workers, disabled occupants, out-of-hours cleaners.
Existing controls: Alarm, lighting, extinguishers, doors, signage, housekeeping, checks.
Action plan: What needs doing, who owns it, and target completion date.
Review trigger: Annual date plus earlier review triggers.
Good wording is concrete. Write “rear stockroom contains cardboard overspill reducing width of escape route” rather than “some storage issue”. Write “staff unfamiliar with manual call point location” rather than “training may be required”.
Turning findings into an emergency plan
Your emergency plan is the response document that flows from the assessment. It should tell people exactly what happens if there's a fire or suspected fire.
Include:
How people raise the alarm
Who calls the Fire and Rescue Service
Primary and secondary escape routes
Assembly point location
Who checks key areas if safe to do so
How you account for staff, visitors, and contractors
What support is in place for anyone needing assistance
This is also where escape route checks matter. If you're unsure what should be inspected routinely, use a practical reference on when to check your fire escape routes.
Your emergency plan should work at 8am, 3pm, and after closing time. If the plan depends on one particular manager always being present, it's too fragile.
A useful habit is to test the wording against a new starter. If they can't follow it quickly, simplify it.
Maintaining Compliance Through Training and Regular Reviews
Most businesses accept that they need a fire risk assessment. Far fewer manage it as an ongoing system. That's where standards drift. Equipment remains in place, but people stop noticing the shortcuts, the stock creep, the wedged door, or the charger left running overnight.
Training that works in the real world
Effective training is practical, short, and tied to the actual building. Staff need to know the alarm sound, the escape routes, the assembly point, who leads, and what not to do. They also need permission to report poor practice without feeling awkward about it.
In small businesses, the best training usually covers:
Alarm response: Stop work, evacuate, don't investigate unless trained and authorised.
Escape behaviour: Use the nearest safe route, don't collect belongings, don't re-enter.
Local hazards: Kitchen equipment, charging stations, heaters, stockrooms, waste areas.
Role clarity: Fire warden duties where appointed, visitor control, and end-of-day checks.
Training should match reality. If your busiest trading period changes how people move through the premises, your drill assumptions need to reflect that.
Annual review is a minimum, not a strategy
Too many businesses treat the annual review date as the only date that matters. It isn't. GOV.UK requires reviews at least annually, but Office Test's practical guide for SMEs highlights a more demanding reality. Small UK businesses with dynamic environments that delay updates beyond three months have a 40% higher rate of near-miss incidents, and failing to update after minor changes such as new equipment can breach the Fire Safety Order.
That matters most in businesses that change fast, including retail, hospitality, studios, workshops, and mixed-use premises.
Review your fire risk assessment when any of these happen:
Layout changes: New shelving, partitioning, furniture, or relocated equipment.
Occupancy changes: More staff, different shift patterns, public events, lone working.
Stock changes: Seasonal build-up, more packaging, more flammable products.
Process changes: New appliances, battery charging, contractor work, refurbishment.
The annual review is the backstop. The key discipline is spotting change when it happens and updating the assessment before it becomes the new normal.
DIY Assessment vs Calling in a Competent Person
This is the question most small business owners want answered. Can you do your own fire risk assessment, or should you bring in someone qualified?
The honest answer is: sometimes you can, but not always safely or defensibly.
When a DIY approach may be defensible
A self-assessment may be reasonable where the premises are very simple. Think a small single-floor office, low fire load, no sleeping risk, no public complexity, straightforward escape, and no one likely to need a bespoke evacuation arrangement.
Even then, the person doing it needs enough knowledge to identify ignition sources, fuel loads, means of escape, and suitable controls. A template can help organise thinking. It can't supply competence on its own.
When you should bring in a competent person
The threshold for professional input arrives sooner than many owners think. The legal issue isn't whether you've tried. It's whether the assessment was carried out by someone competent.
Government guidance is clear that a competent person needs specific training in areas such as ignition sources and fuel loads, not just general business knowledge. The same point is stressed in Essex County Fire and Rescue Service's note on fire risk assessment templates, which also states that 60% of fire incidents in small premises stem from electrical faults and poor storage. Those are exactly the sorts of risks that owners often underestimate because they look ordinary.
Bring in competent help if your premises involve any of the following:
Complex layout: Multiple floors, split levels, back-of-house areas, basements, or maze-like access.
Public access: Customers, patients, pupils, audience members, or regular visitors unfamiliar with the building.
Vulnerable occupants: Anyone who may need assistance to evacuate.
Higher-risk processes: Cooking, workshops, flammables, charging regimes, heavy electrical use, or storage density.
Uncertainty: If you're not sure whether your current assessment is suitable, that's already useful information.
For some businesses, external advice is the sensible middle ground between guesswork and over-engineering. That may mean an independent assessor, a retained consultant, or a service such as health and safety consultancy support that helps control business risk and cost. KODOBI, for example, carries out fire risk assessments customized for premises layout, occupancy profile, and vulnerable individuals as part of its broader consultancy work.
The key trade-off is simple. DIY can save upfront cost in very simple settings. Professional input reduces the risk of blind spots in premises that are anything but simple.
If you need a fire risk assessment that reflects how your business operates, KODOBI provides UK fire risk assessment support, compliance advice, and training for small businesses across office, retail, hospitality, education, events, and other operational environments.
Comments