IMPORTANT DISCLAIMER: This guide references ISO 31000:2018 (Risk Management – Guidelines); ISO 31010:2019 (Risk Assessment Techniques); ISO 19011:2018 (Guidelines for Auditing Management Systems); ISO 9001:2015 (Quality Management Systems); ISO 45001:2018 (Occupational Health and Safety Management Systems); ISO 14001:2015 (Environmental Management Systems); ISO 55001:2024 (Asset Management); ISO 22301:2019 (Business Continuity Management Systems); NFPA 101, Life Safety Code; NFPA 1, Fire Code; NFPA 4 (Integrated Fire Protection and Life Safety System Testing); NFPA 10 (Portable Fire Extinguishers); NFPA 25 (Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems); NFPA 51B (Fire Prevention During Welding, Cutting, and Other Hot Work); NFPA 72 (National Fire Alarm and Signaling Code); NFPA 80 (Fire Doors and Other Opening Protectives); NFPA 1600 (Continuity, Emergency, and Crisis Management); the International Fire Code (IFC), including Chapter 4 (Emergency Planning and Preparedness), Chapter 9 (Fire Protection Systems), and Chapter 35 (Welding and Other Hot Work); and the International Building Code (IBC). ISO 31000 is described here in general terms consistent with the standard; specific clause references should be confirmed against the adopted edition. Codes and standards vary by edition and are frequently amended by state and local jurisdictions. Section numbers cited here follow the model codes and may differ in your adopted edition. Local amendments and the edition adopted by your Authority Having Jurisdiction (AHJ) always control. This guide is a starting point only. Always verify the requirements applicable to your project with your local AHJ.
Fire safety in a commercial building is not a set of equipment. It is a management system. The sprinklers, alarms, extinguishers, and egress paths are only effective if someone is responsible for them, their condition is monitored, deficiencies are corrected, and the building’s occupants and operations are managed consistently with the fire strategy that was designed. When a fire occurs, the investigation will not simply ask “was there a sprinkler system?” It will ask “was the fire safety management system functioning?”
A fire safety management system (FSMS) is the structured set of policies, procedures, responsibilities, monitoring activities, and review processes by which an organization manages fire risk in its buildings. It is the fire-specific application of risk management, and the most widely recognized risk management framework is ISO 31000.
This article explains what an FSMS is, how ISO 31000 provides its structure, how to build one that is auditable and defensible, how to run the day-to-day controls that keep it effective, and how to align it with the other management systems an organization already operates.
◆ Section 1: Why Fire Safety Needs a Management System
Fire safety is often treated as a technical discipline: design the systems, install them, inspect them. But most fire failures are not purely technical. They are management failures: a system that was impaired and not restored, a procedure that was not followed, a responsibility that was not assigned, a deficiency that was not corrected, a change that was not assessed.
| Failure Mode | Typical Root Cause |
|---|---|
| Sprinkler system impaired during renovation | No impairment procedure; no fire watch |
| Fire alarm not monitored during off-hours | No monitoring contract; no response procedure |
| Exit door blocked by stored materials | No housekeeping program; no inspection |
| Extinguishers not inspected | No assigned responsibility; no schedule |
| Hot work without permit | No permit program; no contractor oversight |
| Evacuation drill not conducted | No drill schedule; no documentation |
| Fire safety documentation missing at turnover | No document management system |
| Change of use without fire assessment | No management-of-change procedure |
| Fire doors propped open or modified | No training; no culture of ownership |
Each of these is a management system gap, not a technical one. An FSMS closes these gaps by establishing who is responsible, what they must do, how it is monitored, and how it is reviewed.
Key point: The technical systems are necessary but not sufficient. They require a management system to remain effective over the life of the building.
Key Article: Article 28 – Commercial Building Fire Safety Plan: Development and Implementation
Pro Tip: A management failure can be as damaging as a technical failure in an investigation, and in litigation or insurance claims it is often harder to defend. An FSMS is the best protection against both.
◆ Section 2: What ISO 31000 Provides
ISO 31000 is the international standard for risk management. It is not fire-specific, and it is not certifiable (unlike ISO 9001 or ISO 45001). What it provides is a set of principles, a framework, and a process that any organization can apply to any risk, including fire risk. Because it cannot be certified, “alignment” with ISO 31000 is a self-declared, self-demonstrated position, which makes the quality of the evidence behind it important.
A. The ISO 31000 Principles
ISO 31000 is built on principles that explain what effective risk management looks like. In summary, risk management should be:
- Integrated into all organizational activities
- Structured and comprehensive
- Customized to the organization’s context
- Inclusive of appropriate and timely stakeholder involvement
- Dynamic, responding to change
- Based on the best available information
- Aware of human and cultural factors
- Subject to continual improvement
B. The ISO 31000 Framework
| Element | What It Provides |
|---|---|
| Leadership and commitment | Top management sets the tone, allocates resources, and is accountable |
| Integration | Risk management is built into organizational processes, not a standalone activity |
| Design | The framework is designed to fit the organization’s context |
| Implementation | The framework is put into practice |
| Evaluation | The framework’s effectiveness is evaluated |
| Improvement | The framework is continually adapted and improved |
C. The ISO 31000 Risk Management Process
| Step | What It Involves |
|---|---|
| Scope, context, criteria | Defining what is being assessed and what “acceptable” means |
| Risk identification | Finding, recognizing, and describing risks |
| Risk analysis | Understanding the nature, causes, likelihood, and consequences of risk |
| Risk evaluation | Comparing risk against criteria to decide what needs treatment |
| Risk treatment | Selecting and implementing options to address risk |
| Communication and consultation | Engaging stakeholders throughout the process |
| Monitoring and review | Tracking risk and the effectiveness of treatment, throughout the process |
| Recording and reporting | Documenting the process and its outcomes |
Communication and consultation, monitoring and review, and recording and reporting run alongside the other steps rather than occurring only at the end.
D. Why ISO 31000 Fits Fire Safety
- It is generic, so it applies to any risk, including fire
- It is scalable, from a single building to a portfolio
- It is internationally recognized, which makes it defensible in audits and investigations
- It integrates with quality, safety, environmental, and asset management systems
- It emphasizes leadership, placing accountability with top management
ISO 31000 describes the process; ISO 31010 supports it with risk assessment techniques. Techniques useful for fire include structured “what-if” analysis, checklists, fault tree analysis, FMEA, and bow-tie analysis, which maps a fire scenario between its causes and consequences and shows the preventive and mitigating controls on each side.
Key point: ISO 31000 does not tell you what your fire risks are or which controls to apply. It tells you how to think about risk and how to build a system that manages it consistently.
Key Article: Article 66 – How to Conduct a Fire Risk Assessment: A Step-by-Step Guide
Pro Tip: ISO 31000 alignment is a strong signal in an audit or investigation. It shows the approach to fire safety is not ad hoc and follows a recognized international framework.
◆ Section 3: The Structure of a Fire Safety Management System
An FSMS aligned with ISO 31000 has a recognizable structure. The content depends on the organization, but the elements are consistent, and they follow a Plan-Do-Check-Act cycle.
A. Policy and Governance (Plan)
| Element | Content |
|---|---|
| Fire safety policy | A written statement of the organization’s commitment to fire safety |
| Roles and responsibilities | Clear assignment of accountability at every level |
| Fire safety director / responsible person | A named individual with authority and resources |
| Fire safety committee | A cross-functional group that oversees the FSMS |
| Reporting lines | How fire safety issues escalate to top management |
| Compliance register | A list of applicable laws, codes, permits, and insurer requirements, with the owner of each |
B. Risk Assessment (Plan)
| Element | Content |
|---|---|
| Risk assessment methodology | The method used to identify, analyze, and evaluate fire risk |
| Risk register | A documented list of fire risks, their ratings, and their treatments |
| Risk criteria | What the organization considers acceptable, tolerable, or unacceptable |
| Periodic reassessment | A schedule for reviewing and updating the assessment |
C. Controls and Procedures (Do)
| Element | Content |
|---|---|
| Fire safety plan | Building-specific plan covering prevention, protection, and evacuation |
| Impairment procedures | What to do when a system is out of service |
| Hot work permit program | Controls for welding, cutting, and other hot work |
| Housekeeping program | Controls for combustible accumulation |
| Contractor and tenant management | Fire safety requirements for contractors and tenants |
| Management of change | Process for assessing the fire safety impact of changes |
| Emergency procedures | Evacuation, shelter-in-place, and response procedures |
D. Monitoring and Measurement (Check)
| Element | Content |
|---|---|
| Inspection, testing, and maintenance (ITM) schedule | NFPA 25, NFPA 72, NFPA 10, NFPA 80, and other schedules |
| Performance indicators | Metrics that show whether the FSMS is working |
| Audit program | Internal and external audits of the FSMS |
| Incident reporting | Reporting and investigation of fires and near-misses |
| Records management | Retention of ITM and other records |
E. Management Review and Improvement (Act)
| Element | Content |
|---|---|
| Management review | Periodic review by top management of the FSMS’s effectiveness |
| Corrective action | Process for correcting deficiencies and preventing recurrence |
| Continual improvement | Process for improving the FSMS over time |
Key point: The FSMS structure is a system, not a checklist. A policy without monitoring is a statement; monitoring without management review is data without action.
Pro Tip: An auditor will look for evidence that each element is functioning, not just that it exists. Documentation that has not been updated in two years is a warning sign.
◆ Section 4: The Risk Assessment Process in an FSMS
The risk assessment is the heart of the FSMS. It is where the organization decides what fire risks it faces and what it will do about them.
A. Scope, Context, and Criteria
Before assessing risk, define:
- Scope: which buildings, occupancies, and operations
- Context: the organization’s objectives, stakeholders, regulatory environment, and constraints
- Criteria: what the organization considers acceptable, tolerable, or unacceptable risk
B. Risk Identification
| Source | Examples |
|---|---|
| Regulatory requirements | NFPA 101, IFC, local codes |
| Historical incidents | Fires, near-misses, and deficiencies in similar buildings |
| Building systems | Sprinkler, alarm, egress, compartmentation |
| Occupancy | Number and type of occupants, including vulnerable populations |
| Operations | Hot work, storage, housekeeping, contractor work |
| External hazards | Wildfire, neighboring buildings, utility failures |
| Human factors | Training, staffing, behavior |
C. Risk Analysis
Each identified risk is analyzed for:
- Likelihood: how likely is it to occur?
- Consequence: what would happen if it did (life safety, property, business interruption, reputation)?
- Existing controls: what is already in place, and how reliable are they?
- Residual risk: what remains after existing controls?
D. Risk Evaluation
Residual risk is compared against the criteria. A simple, widely used approach scores likelihood and consequence on a 1–5 scale and multiplies them:
| Score | Rating | Response |
|---|---|---|
| 1–4 | Low (acceptable) | No further action; monitor |
| 5–12 | Medium (tolerable) | Action within a defined timeframe |
| 15–25 | High (unacceptable) | Immediate action; escalate to top management |
An illustrative risk register entry:
| Risk | Existing Controls | Residual Rating | Treatment | Owner | Due |
|---|---|---|---|---|---|
| Sprinkler system impaired during renovation, with no fire watch | Impairment procedure; permit required | Medium | Add contractor impairment briefing; audit permits monthly | Facility Manager | Q1 |
E. Risk Treatment
| Option | Description |
|---|---|
| Avoid | Eliminate the activity that creates the risk |
| Reduce | Reduce likelihood or consequence through controls |
| Transfer or share | Share the risk through insurance or contract (this does not remove the physical hazard) |
| Accept | Accept the risk knowingly, with documented approval and monitoring |
ISO 31000 describes a broader set of treatment options; the four above are the ones most often used for fire risk.
F. Monitoring and Review
The risk assessment is reviewed:
- Periodically (at least annually)
- When there is a change in occupancy, operations, systems, or regulations
- After an incident or near-miss
- When a risk treatment is implemented
Key point: The risk assessment is the decision-making engine of the FSMS. It is a living process that informs every other element, not a document to be filed.
Key Article: Article 46 – Hazard Classification (Low, Ordinary, High) and Hazardous Areas (NFPA 101)
Pro Tip: Use one risk matrix across the organization. Consistency lets risks be compared and prioritized and makes the FSMS auditable.
◆ Section 5: Roles, Responsibilities, and Accountability
An FSMS without clear accountability is a document, not a system.
| Role | Key Responsibilities |
|---|---|
| Top management | Sets the policy, allocates resources, reviews the FSMS, and is accountable for its effectiveness |
| Fire safety director / responsible person | Owns the FSMS day to day; coordinates risk assessment; oversees monitoring; reports to top management; liaises with the AHJ and fire service |
| Building / facility managers | Implement procedures at building level; ensure ITM is performed; manage contractors and tenant work; report deficiencies |
| Fire safety committee | Cross-functional oversight; reviews risk, performance data, incidents, and corrective actions |
| Occupants | Follow procedures; report hazards; take part in drills; know evacuation routes and assembly points |
| Contractors and tenants | Comply with fire safety requirements; obtain permits for hot work and other regulated activities; report incidents and near-misses |
Key point: Accountability is not the same as responsibility. Many people are responsible for fire safety activities; accountability for the FSMS’s effectiveness sits with top management.
Key Article: Article 52 – The Role of the Fire Safety Director: Duties and Responsibilities
Pro Tip: Name the individuals who hold each role, not just the titles, and update the names when people change. A role without a named person is not auditable.
◆ Section 6: Core Operational Controls
The risk assessment decides what needs controlling. These operational controls are where the FSMS prevents the failures listed in Section 1.
A. Impairment Management
Any time a fire protection system is out of service, the building is more vulnerable. An impairment program (see NFPA 25 Chapter 15 and IFC §901.7) typically includes:
- A designated impairment coordinator
- Notification of the fire department, alarm monitoring company, insurer, and affected occupants, as required
- Tagging of the impaired system
- Fire watch or other approved interim measures where required
- Restoration and verification, including testing, before the impairment is closed out
- Records of every impairment, its duration, and its closure
B. Hot Work Control
Hot work is a leading cause of construction and renovation fires. A permit program (see NFPA 51B and IFC Chapter 35) typically requires:
- A written permit, issued before work begins, for each hot work activity outside designated areas
- Inspection of the work area and removal or protection of combustibles
- A trained fire watch during the work and for a defined period afterward
- Contractor acknowledgment of the requirements, with periodic permit audits
C. Management of Change
Most changes alter fire risk, whether or not anyone intends them to. A management-of-change (MOC) procedure should trigger a fire safety review for:
- Change of use or occupancy
- Renovations, tenant fit-outs, and new construction
- Changes to storage arrangements, commodities, or heights
- Modifications to fire protection systems, compartmentation, or egress
- New processes, equipment, or hazardous materials
- Changes in staffing or operating hours that affect response
The review should confirm that the change is compatible with the original fire strategy, and that fire protection systems and documentation are updated before the change goes live.
D. Housekeeping and Fire Door Control
- Routine inspection of egress paths, stairwells, and storage areas
- Control of combustible accumulation and ignition sources
- Fire doors kept closed, unobstructed, and unmodified, with annual inspection per NFPA 80
E. Contractor and Tenant Management
- Fire safety requirements written into contracts and leases
- Pre-work briefings and induction for contractors
- Permit control for hot work, impairments, and other regulated activities
- Oversight and sign-off at completion, with systems verified as restored
F. Emergency Preparedness and Continuity
- Emergency action plans and drills (see IFC Chapter 4, NFPA 101, and, in the U.S., OSHA 29 CFR 1910.38 for workplaces)
- Coordination with the fire service and pre-incident plans
- Alignment with business continuity planning (ISO 22301 or NFPA 1600), so that recovery from a fire is planned and not improvised
Key point: These controls are where documented policy becomes daily practice. If any one of them is missing, the matching failure mode in Section 1 is likely to occur.
Pro Tip: Tie each control to a named owner and a record. A control with no owner and no record cannot be shown to be working.
◆ Section 7: Competence, Training, and Culture
ISO 31000 recognizes that human and cultural factors influence every risk. A procedure is only as good as the people who follow it.
A. Competence
- Define the competence each role needs, from the fire safety director to the front-desk staff member who first hears an alarm
- Train on appointment, then refresh periodically and after significant changes
- Keep records of who was trained, on what, and when
- Use qualified, competent persons for ITM work, fire watch, and impairment handling
B. Culture
Culture is how people behave when no one is checking. Signs of a healthy fire safety culture include:
- Staff and occupants report hazards and near-misses without fear of blame
- Managers respond visibly to reports
- Housekeeping and door discipline are routine, not campaign-driven
- Leaders take part in drills and review the results
C. Communication
- Make the fire safety policy visible and understood
- Brief tenants, visitors, and contractors on arrival
- Share lessons learned from incidents and near-misses
Key point: Training records show effort; behavior shows effectiveness. Measure both.
Pro Tip: A near-miss report is a free lesson. Make reporting easy, and respond quickly to the first reports so people see that it matters.
◆ Section 8: Monitoring, Measurement, and Performance Indicators
An FSMS must be monitored to confirm it is working, through compliance activities (inspection, testing, maintenance) and performance indicators.
A. Compliance Activities
| Activity | Standard | Frequency |
|---|---|---|
| Sprinkler system ITM | NFPA 25 | Per NFPA 25 tables |
| Fire alarm ITM | NFPA 72 | Per NFPA 72 tables |
| Portable extinguishers | NFPA 10 | Monthly visual inspection; annual maintenance |
| Emergency lighting and exit signs | NFPA 101 | Monthly and annual tests |
| Fire doors | NFPA 80 | Annual inspection |
| Integrated system testing | NFPA 4 | Per NFPA 4 |
| Evacuation drills | NFPA 101 / IFC | Per occupancy requirements |
| Hot work permit audit | NFPA 51B / organization procedure | Periodic |
B. Performance Indicators
Use a balance of leading indicators (activity that prevents fires) and lagging indicators (outcomes).
| Type | Indicator | What It Measures |
|---|---|---|
| Leading | Percentage of ITM completed on schedule | Compliance with the ITM program |
| Leading | Open deficiencies and average time to close | Effectiveness of corrective action |
| Leading | Number and duration of impairments | Reliability of protection systems |
| Leading | Drill participation and training completion rates | Preparedness and competence |
| Leading | Hot work permits audited; MOC reviews completed | Operational control |
| Lagging | Fires, near-misses, and false alarms | Fire experience |
| Lagging | Audit findings and closure rate | Effectiveness of the audit program |
C. Data Quality
Indicators are only useful if the data is accurate. Watch for incomplete records, inconsistent definitions, manual entry errors, delayed reporting, and missing data for periods of impairment. A computerized maintenance management system (CMMS) or similar tool can improve both the reliability and the retrievability of ITM data.
Key point: Monitoring generates data; the FSMS turns data into decisions.
Key Article: Article 49 – How to Conduct a Fire Safety Audit: A Step-by-Step Guide
Pro Tip: Report performance indicators to top management quarterly. An FSMS that is reviewed only annually cannot respond quickly to emerging issues.
◆ Section 9: Audit and Assurance
Audits provide independent assurance that the FSMS is functioning. ISO 19011 gives general guidance on auditing management systems.
A. Internal Audits
| Element | Content |
|---|---|
| Scope | Which parts of the FSMS are audited |
| Frequency | Typically annual for each element, more often for high-risk areas |
| Auditor | Competent and independent of the activity being audited |
| Criteria | FSMS requirements and applicable codes |
| Findings | Nonconformities, observations, and opportunities for improvement |
| Corrective action | Follow-up to closure |
B. External Audits
| Type | Purpose |
|---|---|
| Third-party fire safety audit | Independent assessment of FSMS effectiveness |
| Insurance audit | Insurer’s assessment of fire risk and controls |
| Regulatory inspection | AHJ inspection of code compliance |
| Certification audit | Audit by an accredited certification body against a certifiable standard (e.g., ISO 45001) |
C. Classifying Findings
- Major nonconformity: a systemic failure requiring immediate action
- Minor nonconformity: an isolated failure requiring corrective action
- Observation or opportunity for improvement: a suggestion that may improve effectiveness
Key point: The value of an audit is in the corrective action, not the report. Findings that are never closed are a cost, not a benefit.
Key Article: Article 148 – Third-Party Fire Safety Audits and Peer Reviews (planned)
Pro Tip: Rotate auditors between buildings. An auditor who reviews the same building every year may stop seeing issues that have become normal.
◆ Section 10: Management Review and Continual Improvement
The management review is where top management evaluates the FSMS and decides on improvements.
| Inputs | Outputs |
|---|---|
| Audit results and corrective action status | Decisions on what will change and why |
| Performance indicator trends | Resource allocations |
| Changes in risk profile and risk register status | Improvement actions, with owners and dates |
| Incidents, near-misses, and lessons learned | Communication to stakeholders |
| Regulatory and code changes | Updates to policy, objectives, or risk criteria |
| Resource adequacy | |
| Stakeholder feedback |
Continual improvement is driven by audit findings, incident investigations, indicator trends, changes in the organization’s context, changes in codes, and new technologies and methods.
Key point: Management review is not a compliance exercise. It is how the FSMS adapts to a changing organization and changing risks.
Pro Tip: Document the review decisions and track their implementation. A system that is reviewed but not acted upon is not functioning.
◆ Section 11: Integration with Other Management Systems
Most organizations already operate management systems for quality (ISO 9001), safety (ISO 45001), environment (ISO 14001), asset management (ISO 55001), and sometimes business continuity (ISO 22301). Most of these share a common high-level structure, which makes alignment easier. The FSMS should integrate with them rather than run in parallel.
| System | Integration Opportunity |
|---|---|
| ISO 9001 (Quality) | Document control, corrective action, management review |
| ISO 45001 (Safety) | Risk assessment methodology, incident investigation, training |
| ISO 14001 (Environment) | Regulatory compliance, emergency preparedness |
| ISO 55001 (Asset Management) | Asset register, maintenance planning, lifecycle management |
| ISO 22301 / NFPA 1600 | Emergency response, continuity, recovery planning |
| ISO 31000 (Risk) | Risk process, risk register, risk treatment |
Benefits: less duplication, consistent terminology, shared incident data, efficient combined audits, and risks compared across domains rather than in isolation.
Challenges: differing requirements across standards, different functional cultures, time and coordination, and regulators who may expect separate documentation.
Key point: Integration means aligning processes so the organization manages risk consistently. It does not mean merging everything into one document.
Key Article: Article 157 – Fire Safety in Smart Buildings and IoT Integration
Pro Tip: Start integration with the risk assessment. If the organization uses one risk methodology, the other systems align more easily.
◆ Section 12: Documentation and Records
Documentation is the evidence that the system exists and is functioning.
A. What to Document
Fire safety policy; roles and responsibilities; compliance register; risk assessment and risk register; fire safety plan; ITM records; impairment and hot work permits; MOC records; training and drill records; incident reports; audit reports; management review records; and corrective action records.
B. Records Retention
- Retention periods are set by the specific code or standard and by the organization’s policy, and they differ. Some ITM records need only be kept until the next test plus a defined period, while others, such as original acceptance test records and as-built drawings, should be kept for the life of the system. Confirm the requirement for each record type in the adopted edition and with the AHJ.
- Many organizations adopt a longer uniform policy (often several years) for simplicity and for legal and insurance reasons.
- Electronic records should be backed up and retrievable within a reasonable time during an audit.
C. Document Control
- Version control for policies and procedures
- Approval and distribution records
- A defined review cycle
- Removal of obsolete documents
Key point: Documentation is the FSMS’s memory. A system that cannot demonstrate what it did is not auditable, however well it functions in practice.
Key Article: Article 198 – Fire Safety Documentation and Record-Keeping Best Practices (planned)
Pro Tip: Audit your own records before the external auditor does. It is the fastest way to find gaps.
◆ Section 13: Implementation Roadmap
An FSMS does not need to be built all at once. A phased approach is more likely to succeed.
| Phase | Activities |
|---|---|
| 1. Commit | Obtain top management commitment; approve the policy; appoint the fire safety director; set up the committee |
| 2. Baseline | Gap analysis against codes and this framework; compile the compliance register; review existing records |
| 3. Assess | Define scope and criteria; conduct the risk assessment; build the risk register |
| 4. Build | Develop or update the fire safety plan and operational controls (impairment, hot work, MOC, contractors); assign owners; set up the ITM schedule |
| 5. Train and launch | Train staff, contractors, and tenants; communicate the policy; begin recording |
| 6. Monitor | Track indicators; hold the first quarterly reviews; begin internal audits |
| 7. Review and improve | Hold the first management review; close findings; update the system |
For a portfolio, pilot the system on one or two buildings, learn from them, and then standardize the framework while allowing for site-specific risks.
Pro Tip: Prioritize the highest-risk gaps first, such as impairment control, hot work, and ITM backlogs. A partial system that controls the biggest risks is better than a complete one that is still on paper.
◆ Section 14: Common Challenges and Mistakes
| Challenge or Mistake | Why It Happens | Solution |
|---|---|---|
| FSMS exists on paper but not in practice | Documentation created without implementation | Regular monitoring and management review |
| No named accountability | Roles defined but not assigned | Name individuals and update them when they change |
| Risk assessment not updated | Treated as a one-time exercise | Scheduled reassessment; change triggers |
| Inspections missed | No schedule or no owner | ITM schedule with assigned owners |
| Deficiencies not corrected | No tracking or prioritization | Deficiency tracking with closure verification |
| Audits not followed up | Findings not tracked | Track corrective actions to closure |
| Management review is a formality | No structured inputs or decisions | Structured inputs; documented decisions and actions |
| Data collected but not used | No link between metrics and decisions | Quarterly reporting; action tracking |
| Integration ignored | Systems operate in silos | Cross-functional governance; shared risk methodology |
| Records incomplete or unretrievable | Poor document management | Document control system; electronic records |
| Contractor work outside the FSMS | Requirements not in contracts | Contractor requirements and oversight |
| Incidents not investigated | No procedure | Investigation procedure with root cause analysis |
| Changes not assessed | No MOC process | MOC procedure with fire safety review |
| Training treated as a tick-box | Records valued over behavior | Competence checks, drills, and culture measures |
Key point: The most common failure is the gap between documentation and practice.
Pro Tip: Walk the building with the FSMS documentation in hand. If what is documented does not match what is happening, the FSMS is not functioning.
◆ Section 15: Design Checklist
| Item | Status | Notes |
|---|---|---|
| Fire safety policy approved | ☐ | Signed by top management |
| Roles and responsibilities assigned | ☐ | Individuals named, not just roles |
| Fire safety director named | ☐ | With authority and resources |
| Fire safety committee established | ☐ | Cross-functional; meets regularly |
| Compliance register compiled | ☐ | Codes, permits, insurer requirements |
| Risk methodology defined | ☐ | Aligned with ISO 31000 process |
| Risk register established | ☐ | With ratings, owners, and treatments |
| Risk assessment reviewed periodically | ☐ | At least annually; on change |
| Fire safety plan documented | ☐ | Building-specific |
| Impairment procedure in place | ☐ | Coordinator, tagging, fire watch |
| Hot work permit program in place | ☐ | Includes contractors |
| Management-of-change procedure in place | ☐ | Fire safety review trigger |
| ITM schedule established | ☐ | NFPA 25, 72, 10, 80, and others |
| Training and competence program | ☐ | Records maintained |
| Performance indicators defined | ☐ | Leading and lagging; reported quarterly |
| Audit program established | ☐ | Internal and external |
| Incident investigation procedure | ☐ | With root cause analysis |
| Corrective action process | ☐ | With closure verification |
| Management review scheduled | ☐ | At least annually |
| Documentation and records system | ☐ | Retention and retrieval defined |
| Integration with other management systems | ☐ | Quality, safety, environment, asset, continuity |
| Contractor and tenant requirements | ☐ | In contracts and leases |
◆ Section 16: Conclusion
A fire safety management system is the structured means by which an organization manages fire risk in its buildings. It is not the equipment. It is the governance, process, monitoring, and review that keeps the equipment effective over the life of the building.
ISO 31000 provides the structure. Its principles, its framework of leadership, integration, design, implementation, evaluation, and improvement, and its process of scoping, identifying, analyzing, evaluating, and treating risk, with communication, monitoring, and recording running throughout, apply directly to fire safety. Aligning the FSMS with ISO 31000 gives the organization a recognized, defensible approach that fits alongside the other management systems it already operates.
The critical elements of an FSMS are:
- Policy and governance: clear accountability from top management
- Risk assessment: a living process that identifies, analyzes, and treats fire risk
- Operational controls: impairment, hot work, change, contractor, and housekeeping controls that apply risk decisions in daily practice
- Competence and culture: people who know what to do and choose to do it
- Monitoring and measurement: data that shows whether the system is working
- Audit and assurance: independent verification of effectiveness
- Management review and improvement: the mechanism by which the system adapts
Key Takeaways:
- A fire safety management system is a management discipline, not a technical one; most fire failures are management failures.
- ISO 31000 provides a recognized, defensible framework for the FSMS; it is not fire-specific and not certifiable, but it applies directly.
- The FSMS includes policy, risk assessment, operational controls, monitoring, audit, and management review, working as a Plan-Do-Check-Act cycle.
- Risk assessment is the decision-making engine and must be a living process.
- Accountability sits with top management; roles must be assigned to named individuals.
- Impairment, hot work, and management-of-change controls prevent the most common management failures.
- Culture and competence determine whether procedures are actually followed.
- Monitoring should combine compliance activities with leading and lagging indicators.
- Audits provide independent assurance; closing the findings is what makes them valuable.
- Management review is how the FSMS adapts to change.
- Integration with other management systems reduces duplication and improves consistency.
- Records are the FSMS’s memory; a system that cannot demonstrate its actions is not auditable.
- The most common failure is the gap between documentation and practice.
Take Action Today:
- Confirm a fire safety policy is in place and approved by top management.
- Name the individuals who hold each fire safety role.
- Confirm that a fire safety committee is established and meets regularly.
- Adopt a risk assessment methodology aligned with ISO 31000, with a single risk matrix.
- Establish a risk register and schedule its reassessment.
- Confirm that impairment, hot work, and management-of-change procedures are in place and used.
- Confirm the ITM schedule is established and assigned.
- Define leading and lagging indicators and report them quarterly.
- Establish an internal audit program and schedule external audits.
- Confirm that incident investigation and corrective action procedures exist.
- Schedule management review at least annually, with structured inputs and documented decisions.
- Audit the records system for completeness and retrievability.
- Identify opportunities to integrate the FSMS with other management systems.
Continue Reading from Our Series:
-
Related guide: Article 139 — Furniture, Contents, and Fire Load Management
-
Related guide: Article 66 — How to Conduct a Fire Risk Assessment: A Step-by-Step Guide
-
Read more: Article 49 — How to Conduct a Fire Safety Audit: A Step-by-Step Guide