Fire risk assessment vs fire safety audit: what's the difference?

"Fire risk assessment" and "fire safety audit" get used almost interchangeably in casual conversation, and on a small building the distinction rarely matters much in practice. On a larger or more complex portfolio, though, conflating the two can leave a genuine gap in what's actually been checked — because they're not quite doing the same job.

What a fire risk assessment is

A fire risk assessment, in the sense the current Regulatory Reform (Fire Safety) Order 2005 requires, is a structured evaluation of fire hazards, the people at risk, and the adequacy of existing precautions in a specific building. It's the core statutory document a responsible person needs to have and keep current — the thing this blog spends most of its time on.

What a fire safety audit tends to mean

"Audit" is a looser, non-statutory term used in different ways by different consultants. Sometimes it means a broader management-systems review — checking not just the building's physical precautions but the paper trail around them: whether reviews are happening on schedule, whether records are complete, whether responsibilities are clearly assigned. Sometimes it's used as a lighter-touch synonym for the FRA itself. The term isn't defined in the Order the way "fire risk assessment" effectively is, so it's worth clarifying with whoever's using it what they actually mean.

Where the confusion causes real problems

The risk is a responsible person believing an audit satisfies their statutory FRA obligation when it was scoped as something narrower — a spot-check of a few precautions rather than the full structured assessment the RRFSO expects. Equally, a genuinely thorough audit of the management system around fire safety is valuable in its own right, but it doesn't replace the judgement of a competent assessor looking specifically at fire risk in that building.

• –Ask any provider explicitly: is this a statutory fire risk assessment under the RRFSO, or a management review of your fire safety arrangements?
• –Check the output — a genuine FRA should include significant findings and a prioritised action plan, not just a checklist score
• –Don't assume an audit satisfies your legal duty to hold a current FRA unless it's explicitly scoped as one
• –Keep both documents, clearly labelled and dated, if you commission both

Why the labelling matters for record-keeping

On a portfolio, this matters beyond terminology — if documents are filed loosely as "fire safety reports" without distinguishing which ones are the statutory FRA and which are supplementary reviews, it becomes genuinely hard, months later, to answer a simple question: does every building have a current, valid fire risk assessment on file? That's exactly the kind of ambiguity a structured record — one clearly tagged document per building, with its own review date — is meant to remove.

Two documents people expect to be interchangeable

The confusion has a practical cost. An organisation holding a recent third-party audit sometimes believes it holds an up-to-date assessment, and vice versa, because both produced a professional-looking document with findings in it. They are different exercises with different purposes, and one does not substitute for the other however recent it is.

The symptom is usually discovered at the worst moment — during an enforcement visit or after an incident — when someone asks for the assessment specifically and is handed something else. Worth confirming in writing exactly what any commissioned piece of work is, before it is filed as though it were something it is not.

Common mistakes

• –Filing an audit report as though it were the risk assessment
• –Commissioning work without confirming in writing which one it is
• –Assuming a recent audit means the assessment does not need reviewing
• –Holding both without knowing which findings sit in which
• –Treating an insurer's survey as equivalent to either
• –Letting the more recent document be assumed to supersede the other