How do you document and review a fire risk assessment?

ExxFire · 15 Oct 2026

Documenting and reviewing a fire risk assessment means creating a written record of all identified hazards, the people at risk, the control measures in place, and the actions taken to reduce risk, then revisiting that record regularly to confirm it remains accurate and fit for purpose. For most non-domestic premises, written documentation is a legal requirement, not an optional step. The sections below answer the most common questions about fire risk assessment documentation, record-keeping, and review schedules.

What should a fire risk assessment document include?

A fire risk assessment document should include a clear record of the fire hazards identified on the premises, the people who may be at risk, the control measures already in place, any further actions required to reduce risk, and the name of the person who carried out the assessment. Together, these elements form a complete and auditable record of your fire safety position.

In practice, a well-structured fire risk assessment document typically covers the following areas:

Premises details: Address, type of building, occupancy, and use of the space
Identified fire hazards: Sources of ignition, fuel, and oxygen that could start or spread a fire
People at risk: Employees, visitors, contractors, and anyone who may be especially vulnerable
Existing control measures: Detection systems, suppression equipment, escape routes, signage, and emergency procedures
Action plan: Specific steps to address gaps or weaknesses, with responsible persons and target completion dates
Assessor details: Name, qualifications, and date of the assessment
Review date: When the next scheduled review is due

For environments housing mission-critical equipment such as server racks, electrical cabinets, or battery energy storage systems, the document should also capture the specific fire risks associated with those assets, including the potential for electrical ignition and the consequences of equipment damage or downtime. Object-level fire risks deserve their own section in the assessment, separate from general building hazards.

Who is responsible for documenting a fire risk assessment?

The responsible person is legally accountable for ensuring a fire risk assessment is carried out and documented. In a workplace, this is typically the employer, the building owner, or the person in control of the premises. The responsible person may carry out the assessment themselves or appoint a competent person to do so, but accountability remains with the responsible person.

In larger organisations, responsibility for fire risk assessment documentation is often shared across roles. Facility managers typically own the process day to day, while health and safety officers ensure compliance with regulatory requirements. IT infrastructure directors or operations managers may contribute specialist knowledge where technical environments such as data halls or switchgear rooms are involved.

Regardless of who produces the document, it must be signed off by the responsible person and kept accessible for inspection by the fire authority or enforcing authority at any time. Delegating the task does not transfer legal responsibility.

How long should fire risk assessment records be kept?

Fire risk assessment records should be kept for a minimum of three years in most jurisdictions, though many organisations retain them for longer as a matter of good practice. Keeping a full history of assessments, including previous versions and completed action plans, creates an auditable trail that demonstrates ongoing compliance and due diligence.

There is no universal statutory retention period that applies in every country, so organisations operating across multiple territories should check the specific requirements of each jurisdiction. In the UK, for example, the Regulatory Reform (Fire Safety) Order 2005 requires written records to be kept where an employer has five or more employees, but does not specify a precise retention period beyond the general principle that records must be available for inspection.

From a practical standpoint, retaining records beyond the minimum period is advisable for several reasons. If a fire incident occurs, historical records can demonstrate that appropriate assessments were carried out and acted upon. For organisations with complex or high-value environments, this documentation history can also support insurance claims and regulatory investigations.

How often should a fire risk assessment be reviewed?

A fire risk assessment should be reviewed regularly, and most guidance recommends at least once every twelve months as a baseline. Beyond the annual review, an assessment must also be revisited whenever there is a significant change to the premises, the occupancy, the processes carried out, or the fire safety measures in place.

Specific triggers that should prompt an immediate review include:

Structural changes to the building, such as extensions, partitions, or alterations to escape routes
Changes in the use of the premises or the introduction of new equipment or processes
A fire, near-miss, or false alarm that reveals a gap in the assessment
Changes in occupancy, including new staff, contractors, or vulnerable persons on site
Installation or removal of fire detection or suppression systems
New regulatory guidance or changes in applicable fire safety legislation

For high-risk environments, including those housing battery energy storage systems, high-voltage cabinets, or densely packed ICT infrastructure, a more frequent review cycle is prudent. The fire risk profile of these environments can shift quickly as equipment is added, upgraded, or reconfigured, making annual reviews the minimum rather than the standard.

What happens if a fire risk assessment is not reviewed or updated?

If a fire risk assessment is not reviewed or updated, it becomes unreliable as a guide to the actual fire risks on the premises. An outdated assessment may miss new hazards, overlook changes to the building or its occupants, and fail to reflect improvements or deficiencies in fire safety measures. This creates both a compliance risk and a genuine safety risk.

From a regulatory standpoint, failing to maintain an up-to-date fire risk assessment can result in enforcement action by the relevant fire authority. This may include improvement notices, prohibition notices, or in serious cases, prosecution. The responsible person can be held personally liable where a failure to review contributed to harm or loss.

Beyond legal consequences, the operational impact of an outdated assessment can be severe. In environments where equipment failure or fire damage causes extended downtime, the cost of inadequate fire risk documentation compounds the cost of the incident itself. Organisations that rely on continuous operations, such as data centres, energy facilities, and manufacturing plants, face the greatest exposure when fire risk records fall out of date.

Keeping fire risk assessment records current is not an administrative formality. It is a direct input into the decisions that determine whether the right detection and suppression measures are in place when they are needed most.

How ExxFire supports your fire risk assessment process

A thorough fire risk assessment identifies the gaps in your fire protection, and ExxFire’s integrated fire detection and suppression systems are designed to close those gaps for enclosed, high-value equipment. Key features that support your fire safety documentation and compliance include:

Early smoke detection: Aspirating smoke detection identifies fire at the earliest possible stage, before it escalates to a level that causes equipment damage or triggers a full building evacuation
Clean nitrogen suppression: The patented Cool Gas Generator delivers non-pressurized nitrogen that leaves no chemical residue, protecting sensitive electronics without secondary damage
Status reporting: Built-in relays allow the system to report its status directly to your existing fire panel, supporting the monitoring and audit requirements that fire risk assessments often specify
Low maintenance: Once installed and commissioned, ExxFire systems require no further maintenance or check-ups, reducing the ongoing compliance burden for facility managers
Certified and tested: Systems are tested and certified by CNPP in France and DMT, part of TÜV Nord in Germany, giving you documented, third-party validation to support your fire risk assessment records

Whether you are completing a new fire risk assessment or reviewing an existing one, ExxFire’s object protection systems provide a documented, certified layer of fire safety for your most critical assets. Contact ExxFire to find out how the right suppression solution can strengthen your fire risk assessment and protect your operations.