Third-Party Fire Safety Audits and Peer Reviews

Third-party fire safety auditor inspecting fire alarm control panel during a building audit

Written by

in

IMPORTANT DISCLAIMER: This guide references NFPA 101, Life Safety Code; NFPA 1, Fire Code; NFPA 25, Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems; NFPA 72, National Fire Alarm and Signaling Code; NFPA 10, Standard for Portable Fire Extinguishers; NFPA 80, Standard for Fire Doors and Other Opening Protectives; NFPA 3, Recommended Practice for Commissioning of Fire Protection and Life Safety Systems; NFPA 4, Standard for Integrated Fire Protection and Life Safety System Testing; ISO 19011:2018 (Guidelines for Auditing Management Systems); ISO 31000:2018 (Risk Management — Guidelines); ISO 9001:2015 (Quality Management Systems); ISO 45001:2018 (Occupational Health and Safety Management Systems); ISO/IEC 17021-1 (Conformity Assessment — Requirements for Bodies Providing Audit and Certification of Management Systems); the International Fire Code (IFC); the International Building Code (IBC); and the requirements of property insurers, accreditation bodies, and the Authority Having Jurisdiction (AHJ). Audit standards, qualification requirements, and legal frameworks vary by jurisdiction and by the type of audit. This guide is a starting point only. Always verify the requirements applicable to your project with your AHJ, your insurer, and legal counsel where appropriate.

Most buildings are inspected by the AHJ. Many are inspected by their insurer. Some are reviewed by internal safety staff. But a third-party fire safety audit — an independent, structured review conducted by someone outside the building’s ownership and management structure — is a different level of assurance. It asks not only “does the building comply?” but “is the fire safety program effective, and how do you know?”

A third-party audit is not a substitute for the AHJ inspection. It is a complement. The AHJ verifies code compliance; the third-party auditor verifies the system that produces compliance, maintains it, and improves it. The audit examines the governance, the risk assessment, the procedures, the records, the training, and the culture — the elements that determine whether the building will perform in a fire, not just whether it passes an inspection.

Peer review is a related concept — a review by qualified professional peers that provides an independent evaluation of a design, a program, or a decision. It is often used for complex or performance-based designs where the AHJ may not have the expertise to fully evaluate the proposal.

This article covers what a third-party audit is, how it differs from an inspection, when it is required or recommended, how to select and contract an auditor, how to define the scope, how the audit is conducted, how findings are classified and reported, how to handle legal and confidentiality issues, how peer review works, and how to use the results to improve building fire safety.

◆ Section 1: What a Third-Party Audit Is — and Is Not

A third-party audit is a structured, independent review of a building’s fire safety program. It is not an inspection, and it is not a consultation.

A. Definitions

Activity Purpose Independence
AHJ inspection Verify code compliance Government; independent of owner
Insurer inspection Verify fire risk and controls Insurer; independent of owner, but with a commercial interest in the risk
Third-party inspection (including special inspection and ITM by an independent contractor) Verify that specific systems were installed, tested, or maintained correctly Independent of the installer or owner as required by the code or AHJ
Internal audit Verify program effectiveness Within the organization
Third-party audit Independent evaluation of program effectiveness Outside the organization; no conflict of interest with the building, its contractors, or its insurer
Peer review Independent evaluation of a design or decision Qualified professional peers; no conflict of interest
Consultation Advice on how to improve or fix Commercial relationship; consultant may later implement its own advice

Note: the auditor is normally engaged and paid by the owner or another client. Independence does not mean “no contract.” It means no other relationship that could bias the findings, such as design, installation, inspection, or sales work for the same building.

B. What a Third-Party Audit Is Not

A third-party audit is not:

  • A code compliance inspection (though it may include code compliance as one element)
  • A consultation (though it may produce recommendations)
  • A certification (though some audits lead to certification)
  • A replacement for the AHJ inspection or required inspection, testing, and maintenance (ITM)
  • A guarantee of safety

C. Why Independence Matters

The value of a third-party audit is its independence. An auditor with no stake in the outcome can identify issues that internal staff, contractors, and even insurers may miss or avoid.

Key point: An audit conducted by someone with a commercial interest in the outcome is not a third-party audit.

Key Article: Article 147 — Annual Fire Safety Inspections: A Complete Guide

Pro Tip: Verify the auditor’s independence before engaging them. Ask about their other relationships with the building owner, the contractors, and the insurer.

Third-party audits are not universally required, but they are increasingly required or recommended by:

Party When Required/Recommended
AHJ For complex buildings, performance-based designs, or where the AHJ lacks expertise (for example, NFPA 101’s performance-based option allows the AHJ to require an independent review)
Insurer For high-value, high-hazard, or high-risk properties; may be a condition of coverage
Accreditation bodies For healthcare, laboratories, and other accredited facilities
Owner As part of due diligence, before acquisition, or as part of governance
Lender or investor As a condition of financing or transaction for large properties
Green building or management system certification Some programs require independent verification
Legal/regulatory Some jurisdictions require periodic audits or third-party reports for certain occupancies

A. Buildings That Benefit Most

Building Type Why Third-Party Audit Is Valuable
High-rise Complex systems, life safety critical
Healthcare Vulnerable occupants, regulatory complexity
Assembly High occupant load, life safety critical
Laboratories and industrial Hazardous materials, complex systems
Data centers High-value contents, special hazard suppression
Historic buildings Alternative compliance, unique challenges
Mixed-use Multiple occupancies, conflicting requirements
Performance-based designs Novel approaches, AHJ may lack expertise

B. Trigger Events

Independent review has the most value at defined moments:

  • Before acquisition or refinancing
  • Before and after major renovation, change of use, or change of occupancy
  • After a significant fire, near-miss, or repeated alarm or impairment problems
  • After a change in ownership, management, or fire safety leadership
  • After repeated AHJ or insurer findings
  • When the program has never been independently reviewed

Key point: Third-party audits and peer reviews are not required for every building, but they are valuable for complex, high-risk, or high-value buildings. The cost is small relative to the consequence of an undetected failure.

Pro Tip: Do not wait for a requirement. Schedule an audit at the trigger events above, then repeat it periodically.

◆ Section 3: Selecting the Auditor

The quality of the audit depends on the quality of the auditor.

A. Auditor Qualifications

Qualification What to Look For
Professional credentials Licensed fire protection engineer (PE), Certified Fire Protection Specialist (CFPS), Certified Safety Professional (CSP), or equivalent, as appropriate to the scope
Experience Experience in the building type, occupancy, and systems being audited
Audit competence Training and experience in audit methodology (ISO 19011 or equivalent); lead-auditor experience for team audits
Technical depth Access to specialists for the systems in scope (fire alarm, suppression, smoke control, egress, hazardous materials)
Independence No commercial relationship with the building, its contractors, or its insurer that could bias findings
Insurance Professional liability insurance appropriate to the scope
References Verifiable references from comparable engagements
Reporting Clear, actionable, and defensible reports

B. Auditor Independence

The auditor should be independent of the design team, the installing and maintaining contractors, and the insurer, and should not be an employee of the owner. An auditor who is a current employee of the AHJ should not audit buildings in that AHJ’s jurisdiction.

C. Conflicts of Interest

Conflict Why It Matters
Auditor also provides design services to the owner May avoid findings that lead to design changes
Auditor also provides inspection, testing, or maintenance to the building Would be auditing its own work
Auditor works for contractors whose work is in scope May avoid findings that affect the contractor
Auditor has a financial interest in the outcome (for example, selling remediation) May bias findings
Auditor is selected or paid by the insurer or contractor May bias findings toward that party’s priorities

D. The Selection Process

  • Request for qualifications (RFQ)
  • Review of credentials and experience
  • Reference checks
  • Written conflict-of-interest disclosure
  • Interview
  • Written proposal with scope, team, schedule, and fee

Key point: A qualified, independent auditor produces a useful audit; an unqualified or conflicted auditor produces a document that may create liability without providing assurance.

Pro Tip: Ask for redacted examples of prior audit reports. The quality of the report is the best evidence of the quality of the audit. Select on qualifications and scope first, not on lowest fee.

Audit findings are a record of known conditions. How the audit is contracted and handled matters as much as what it finds.

A. The Engagement Agreement

The agreement should state:

  • Who engages the auditor and who owns the report
  • Scope, criteria, deliverables, and schedule
  • Auditor’s independence and conflict-of-interest representations
  • Access to the building, records, and personnel
  • Confidentiality and who may receive the report
  • Limits on reliance — who may rely on the report and for what
  • Insurance and limitation of liability
  • Whether the auditor may test equipment or only observe

B. Confidentiality and Discoverability

An audit report may be requested by the AHJ, insurer, lender, or in litigation after a loss. Whether it is protected by attorney-client privilege or similar protections depends on how it is commissioned and the jurisdiction. Some owners engage the auditor through legal counsel for this reason.

Do not assume the report is confidential. Consult counsel before the audit about privilege, and about who will receive the report.

C. The Duty to Act on Known Deficiencies

Once a deficiency is documented, the owner has knowledge of it. Failing to correct a known life-safety deficiency can increase legal, insurance, and regulatory exposure. Findings must be acted on, and interim protective measures taken when the deficiency cannot be corrected immediately.

D. Reporting to the AHJ and Insurer

An audit does not automatically have to be reported to the AHJ, but some codes, accreditation programs, insurance policies, or agreements require disclosure of impairments or certain conditions. Confirm the obligations before the audit begins.

Key point: Decide before the audit who owns the report, who receives it, and what must be disclosed.

Pro Tip: Brief counsel and insurance advisors before the engagement, not after the findings.

◆ Section 5: Defining the Audit Scope

The scope defines what will be audited, how, and against what standard. A poorly defined scope produces a poorly defined audit.

Third-party fire safety audit process flow diagram with five stages and peer review track

A. Scope Elements

Element Questions to Answer
Systems Which fire protection and life safety systems are included?
Occupancies and areas Which parts of the building are included?
Criteria Against which codes, standards, insurer requirements, and internal policies will the audit be conducted?
Depth Is this a compliance audit, a program audit, or both?
Records Which records will be reviewed, and over what period?
Interviews Who will be interviewed?
Site visit How many visits? Which areas, including unoccupied and back-of-house spaces?
Testing What, if any, testing is included, and who performs it?
Deliverables What reports and presentations will be produced?
Timeline and confidentiality How long will the audit take, and how will findings be handled?

B. Types of Audit Scope

Type Focus Typical Use
Compliance audit Verify compliance with codes and standards AHJ or insurer requirement
Program audit Verify the fire safety management system Owner or governance requirement
Design peer review Review a design for adequacy Complex or performance-based design
Post-incident audit Review after a fire or near-miss Lessons learned
Due diligence audit Review before acquisition or financing Transaction support
Certification audit Verify against a certifiable standard Accreditation or certification requirement

A certification audit under a management system standard (for example, ISO 9001 or ISO 45001) must be performed by a certification body that meets ISO/IEC 17021-1. A fire safety audit that merely uses ISO 19011 methods is not a certification.

C. The Audit Plan

The plan should be documented before the audit begins and include scope and objectives, criteria, methodology, schedule, team assignments, deliverables, and reporting format.

Key point: A scope that is too narrow misses important issues; a scope that is too broad is unfocused and expensive.

Key Article: Article 141 — Fire Safety Management Systems and ISO 31000 Alignment

Pro Tip: Agree on the scope and criteria in writing before the audit begins. Disagreements after the audit are difficult to resolve.

◆ Section 6: How the Audit Is Conducted

A third-party audit is a structured process of document review, interviews, site observation, and analysis. ISO 19011 describes the principles that apply: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.

A. The Audit Process

  1. Planning and opening meeting — confirm scope, criteria, schedule, access, safety rules, and contacts.
  2. Document review — review the program before the site visit.
  3. Site observation, interviews, and testing — collect evidence in the building.
  4. Analysis — compare evidence to criteria and classify findings.
  5. Closing meeting — present preliminary findings so errors of fact can be corrected.
  6. Report and follow-up — issue the report and verify corrective action.

B. Document Review

Document What the Auditor Looks For
Fire safety plan and emergency action plan Current, comprehensive, implemented
Risk assessment Current, complete, actionable
ITM records (NFPA 25, NFPA 72, NFPA 10, NFPA 80, and others) Complete, on schedule, performed by qualified personnel, deficiencies corrected
Training records Complete, current, appropriate to roles
Drill records Complete, current, lessons learned documented
Incident and alarm records Investigated, root cause addressed
Corrective action records Tracked to closure
Impairment records Managed per standards, with interim measures and notifications
Hot work permits Complete, current, managed
Management of change and renovation records Fire protection reviewed when the building changes
Design, commissioning, and as-built documents (including NFPA 3/NFPA 4 records) Consistent with installed conditions
AHJ and insurer correspondence Prior findings resolved

C. Interviews

Interviewee What the Auditor Looks For
Building owner or manager Commitment, resources, awareness
Fire safety director Knowledge, authority, resources
Facility and security staff Training, procedures, awareness
Contractors Understanding of building requirements and permits
Occupants and tenants Awareness of procedures and egress routes

D. Site Observation

Observation What the Auditor Looks For
Egress paths Clear, marked, illuminated, doors operable
Fire doors and rated barriers Self-closing, latching, unobstructed; penetrations and openings protected
Fire protection systems In place, in service, maintained, with current tags and no impairments
Housekeeping and storage Combustible control, storage heights, clearances
Fire safety plan and signage Posted, current, correct, visible
Changes since the last review Alterations, new uses, or storage not reflected in the program

E. Testing and Sampling

Audits typically sample rather than examine everything. The auditor should state the sampling approach (for example, a sample of doors, stairwells, devices, or records), and the limitations that result. Some audits include limited functional testing (such as fire door operation or emergency lighting). The scope must specify what testing is included, who performs it, and who may operate building systems. Auditors should not operate life-safety systems unless authorized.

F. Remote and Hybrid Audits

Record review and interviews can often be done remotely, but life-safety conditions must be verified on site.

Key point: The auditor collects evidence, compares it to the criteria, and reaches conclusions. Conclusions are only as good as the evidence and the sample.

Pro Tip: Provide the auditor with accurate and complete records. Withholding information undermines the audit and creates liability.

◆ Section 7: Classifying Findings

Audit findings are classified by significance. The classification determines the urgency of the response.

A. Common Classification

Classification Meaning Response
Critical (immediate life-safety condition) A condition that presents an imminent danger to occupants, such as blocked or locked exits or a fully impaired system Immediate notification, interim protective measures, and correction
Major nonconformity A systemic failure or a significant failure to meet a requirement Corrective action within a defined timeframe
Minor nonconformity An isolated failure that does not indicate a systemic problem Corrective action within a defined timeframe
Observation or opportunity for improvement A suggestion that may improve effectiveness but is not a nonconformity Consider for improvement

B. Alternative Systems

Some audits use risk-based (high, medium, low), compliance-based (compliant, noncompliant, not applicable), maturity-based (Level 1 to Level 5), or color-coded (red, amber, green) systems.

C. Critical Findings Cannot Wait for the Report

A critical finding must be reported to the client immediately, not at the end of the audit. The owner should implement interim measures — for example, a fire watch, removing the obstruction, or the impairment procedures in NFPA 25 and NFPA 72 — until permanent correction is complete.

Key point: Agree on the classification system and its definitions before the audit. The classification determines urgency, management reporting, resources, and verification.

Pro Tip: Require the auditor to use a documented classification system so findings are comparable across audits.

◆ Section 8: The Audit Report

The audit report is the primary deliverable. It must be clear, actionable, and defensible.

A. Report Content

Section Content
Executive summary Overview of conclusions and priority actions
Scope, criteria, and methodology What was audited, how, against what standards, and the sampling and limitations
Findings Nonconformities, observations, and opportunities
Evidence Documentation of each finding (records, photographs, observations)
Risk assessment Significance of each finding
Recommendations Practical actions to address findings
Positive practices What is working well
Attachments Supporting documentation

B. Report Quality

A good report is clear, specific (cites codes, documents, and locations), evidence-based, actionable, prioritized, and defensible.

C. Distribution

Distribute to the owner or client and management. Provide it to the AHJ, insurer, or others only as required or agreed (see Section 4).

Key point: A report that is unclear, unsupported, or poorly organized does not serve its purpose.

Pro Tip: Review the draft for factual accuracy before finalization. Errors can be corrected, but the auditor should not change a finding because the owner dislikes it.

◆ Section 9: Corrective Action and Follow-Up

The value of the audit is in the corrective action, not the report.

A. Corrective Action Process

  1. Review findings
  2. Prioritize by risk and significance
  3. Assign responsibility
  4. Establish deadlines and interim measures
  5. Implement corrective action
  6. Verify effectiveness
  7. Document closure

B. Root Cause Analysis

For major and critical findings, determine what happened, why, the root cause, which corrective action addresses it, and how effectiveness will be verified. Fixing the symptom without the cause means the finding will recur.

C. Verification and Reporting

Corrective actions should be verified by the responsible party, the fire safety director, and the auditor (for major and critical findings), and by the AHJ or insurer if required. Status should be reported to management, the audit committee or board where applicable, and the AHJ or insurer if required.

Key point: An audit that identifies findings but does not close them is a cost, not a benefit.

Pro Tip: Track corrective actions in a log with due dates, responsible parties, and closure verification. Schedule a follow-up review about six months after the audit.

◆ Section 10: Peer Review

Peer review is an independent review of a design, a program, or a decision by qualified professional peers.

A. What Peer Review Covers

Area Example
Design review Performance-based design, alternative methods and materials, equivalencies
Program review Fire safety program, risk assessment
Decision review A decision to accept a risk or deviate from a standard
Incident review Post-incident analysis and lessons learned

B. When Peer Review Is Used

  • Complex or novel designs, including performance-based designs
  • Alternative compliance or equivalency proposals
  • High-risk or high-value buildings
  • When the AHJ lacks expertise or requires an independent review
  • When the owner, designer, or insurer wants independent verification

C. Performance-Based Design Review

Peer review is most common for performance-based designs. The reviewer typically checks the fire safety goals and objectives, design fire scenarios, performance criteria, modeling inputs, assumptions and safety factors, the validity of the tools used, and the operational and maintenance conditions that the design depends on (such as fire protection that must remain in service and limits on fuel load). The design basis should be documented so the building can be operated within it for its life. Guidance such as the SFPE Engineering Guide to Performance-Based Fire Protection is commonly used.

D. The Peer Review Process

  1. Define scope and criteria
  2. Select reviewers (qualifications, independence, no involvement in the design)
  3. Provide complete documents
  4. Conduct review
  5. Produce report
  6. Respond to comments
  7. Resolve differences, with the AHJ where applicable

E. Differences from Audit

Aspect Audit Peer Review
Focus Program effectiveness and conformity Design or decision adequacy
Basis Codes, standards, management system requirements Professional judgment, design standards
Deliverable Findings, recommendations Comments, recommendations
Follow-up Corrective action Response and resolution

Key point: Peer review does not replace the AHJ’s review or the designer’s responsibility. It provides independent professional judgment.

Pro Tip: Include peer review early in the design phase for any performance-based or novel design, and have the owner, not the design team, select the reviewers.

◆ Section 11: Audit Frequency and Building an Audit Program

A single audit provides a snapshot. A program provides assurance over time.

  • Set frequency by risk: higher risk, greater complexity, or recent change warrants more frequent review (many owners use a periodic cycle, such as every one to three years for a full audit, with targeted reviews between).
  • Combine layers: routine ITM and internal checks, annual inspections, periodic third-party audits, and event-driven reviews.
  • Rotate or refresh auditors periodically to avoid familiarity, but keep continuity for follow-up.
  • Track trends across audits: repeat findings are a signal of a systemic cause.
  • Report results to governance (management, board, or audit committee) as part of the ISO 31000 risk management cycle.

Pro Tip: Use the same classification and report format each time so trends can be compared.

◆ Section 12: Common Mistakes and How to Avoid Them

Mistake Why It’s a Problem How to Fix
Auditor not independent (selected by contractor or insurer) Findings may be biased Owner selects the auditor; verify independence in writing
Auditor not qualified Cannot evaluate fire protection Verify credentials and experience
Scope or criteria not defined Audit may miss areas; disputes after Define scope and criteria in writing
Documents withheld Findings incomplete Provide complete information
Report not evidence-based or classified Findings not defensible; priority unclear Require evidence and a documented classification system
Legal and disclosure issues ignored Unintended exposure Involve counsel and insurer before the audit
Critical findings left until the report Life-safety risk persists Require immediate notification and interim measures
Corrective action not tracked Findings not closed Corrective action log with owners and due dates
Root cause not addressed Findings recur Root cause analysis
Follow-up not performed Corrections not verified Follow-up review
Peer review not independent Findings may be biased Owner selects reviewers
Audit treated as one-time No continuous improvement Schedule periodic audits

◆ Section 13: Audit Checklist

Item Status Notes
Audit requirement confirmed ☐ AHJ, insurer, owner, accreditation
Auditor selected ☐ Qualified, independent
Independence verified ☐ Written conflict-of-interest disclosure
Engagement agreement and privilege reviewed ☐ Counsel, report ownership, distribution
Scope defined ☐ Systems, areas, criteria, depth, testing
Criteria agreed ☐ Codes, standards, management system
Audit plan prepared ☐ Methodology, schedule, deliverables
Documents prepared ☐ Complete and accurate
Interviews and site visit scheduled ☐ Appropriate personnel and areas
Classification system agreed ☐ Critical, major, minor, observation
Report format agreed ☐ Findings, evidence, recommendations
Corrective action process in place ☐ Tracking, root cause, verification
Follow-up scheduled ☐ Verify corrections
Reporting to management and governance ☐ Board or audit committee
Next audit scheduled ☐ Risk-based frequency

◆ Section 14: Conclusion

Third-party fire safety audits and peer reviews provide independent assurance that a building’s fire safety program is effective — not just compliant on paper, but functioning in practice. They complement AHJ and insurer inspections; they do not replace them.

The critical elements are:

  • Independence and qualifications — the auditor has no conflict of interest and the competence to evaluate fire protection
  • Scope and criteria — defined and agreed in writing before the audit
  • Legal clarity — report ownership, confidentiality, and disclosure addressed up front
  • Evidence and classification — findings are supported and ranked by significance
  • Corrective action and root cause — findings are closed and causes addressed
  • Follow-up and periodic audit — corrections are verified and audits repeat

The most common failure is the gap between the audit and the corrective action. The audit identifies findings; corrective action closes them. Without follow-through, the audit is a document, not an improvement.

Key Takeaways:

  • Third-party audits are independent, structured reviews of a building’s fire safety program.
  • They complement AHJ and insurer inspections and required ITM; they do not replace them.
  • The value of an audit is its independence; the auditor must be qualified and free of conflicts.
  • Define scope and criteria in writing, and settle confidentiality and disclosure before the audit.
  • Findings must be evidence-based and classified; critical life-safety conditions must be reported and mitigated immediately.
  • Corrective action must be tracked to closure, root causes addressed, and corrections verified.
  • Peer review is an independent professional review of a design or decision, especially for performance-based designs.
  • Audits should be conducted periodically and after trigger events, not once.

Take Action Today:

  • Confirm whether a third-party audit is required or recommended for your building.
  • Select a qualified auditor and verify independence in writing.
  • Involve counsel and your insurer on confidentiality and disclosure.
  • Define scope, criteria, and the classification system in writing.
  • Prepare complete and accurate documents, and schedule interviews and the site visit.
  • Act immediately on critical findings and review the draft report for factual accuracy.
  • Implement corrective actions, track them to closure, and verify effectiveness.
  • Schedule the follow-up review and the next audit.

Continue Reading from Our Series:

  • Related guide: Article 147 — Annual Fire Safety Inspections: A Complete Guide

  • Related guide: Article 141 — Fire Safety Management Systems and ISO 31000 Alignment

  • Read more: Article 49 — How to Conduct a Fire Safety Audit: A Step-by-Step Guide


About This Guide: This article is part of a series on commercial building fire safety, written for facility managers, architects, and code officials. It references model codes and standards for educational purposes. Always consult your local AHJ for project-specific requirements.