Every building in Malaysia carries fire risk. The question is not whether fire hazards exist in your premises they almost certainly do. The question is whether your organisation has systematically identified those hazards, assessed the risk they create, implemented controls to reduce that risk, and documented the entire process in a way that satisfies Bomba and DOSH.
A fire risk assessment answers all four questions. It is not a one-time document or an audit checklist that gets filed and forgotten. Specifically, it is an active, ongoing process that every designated premises in Malaysia must maintain and that Bomba inspectors review during every Fire Certificate inspection and renewal audit.
This guide covers what a fire risk assessment is, why Malaysian law requires it, who must conduct it, what the assessment process involves step by step, and how your Fire Safety Manager leads the process to produce a compliant, genuinely useful outcome.
What Is a Fire Risk Assessment?
A fire risk assessment is a systematic examination of a building or workplace to identify fire hazards, evaluate the risk those hazards create for the people and property in the building, and implement control measures to reduce the risk to the lowest level reasonably practicable.
Unlike a general building inspection, a fire risk assessment specifically focuses on three interconnected elements:
- Sources of ignition — anything that can start a fire, from electrical equipment and cooking appliances to smoking areas and industrial processes
- Sources of fuel — anything that can sustain or accelerate a fire, from stored materials and furnishings to flammable liquids and accumulated waste
- Sources of oxygen — anything that feeds a fire, including ventilation systems, open windows, and air conditioning infrastructure
Beyond identifying these three elements, the fire risk assessment evaluates how they interact within the specific building context and who is at risk if a fire starts. Consequently, it produces a prioritised list of control measures, responsible persons, and review timelines that the building’s Fire Safety Manager (FSM) must implement and track.
Key Point: A fire risk assessment is not a document it is a process. Completing it once and filing it satisfies nobody. Malaysian law requires the assessment to be active, current, and reviewed regularly. Bomba inspectors look at the date, the findings, and the evidence that controls were actually implemented.
Why Fire Risk Assessment Is a Legal Requirement in Malaysia
Three pieces of legislation collectively create the legal obligation for fire risk assessment in Malaysian buildings. Understanding each one clarifies why the requirement cannot be ignored.
Fire Services Act 1988 and the 2020 Amendment Regulations
Under the Fire Services Act 1988 and the Fire Services (Fire Certificate) Amendment Regulations 2020, every designated premises must establish an OKK and appoint a certified FSM. Conducting fire risk assessments is a defined FSM responsibility — it forms part of the ongoing fire safety management obligations that Bomba audits during Fire Certificate inspections.
Specifically, Bomba inspectors look for evidence that a current fire risk assessment exists, that it has been reviewed within the past 12 months, and that the control measures it identified have actually been implemented. A fire risk assessment document that is three years old and shows no evidence of follow-up action does not satisfy the requirement.
OSHA 1994 — Occupational Safety and Health Act
Under Section 15 of OSHA 1994, every employer must ensure — as far as practicable — the safety, health, and welfare of all employees. This duty inherently requires identifying hazards, assessing the risks they create, and implementing controls. Fire represents one of the most significant categories of workplace hazard, and DOSH enforces this obligation independently of Bomba.
Furthermore, the Occupational Safety and Health (Risk Assessment) Regulations require employers to conduct hazard identification, risk assessment, and risk control (HIRARC) for all workplace hazards — including fire. The fire risk assessment directly fulfils this requirement for fire-related hazards.
CIMAH Regulations 1996
For industrial premises handling dangerous substances above specified threshold quantities, the Control of Industrial Major Accident Hazards (CIMAH) Regulations 1996 require a formal Major Accident Hazard analysis which includes fire and explosion scenarios involving hazardous materials. Consequently, industrial sites under CIMAH carry an even more detailed fire risk assessment obligation than standard commercial premises.
Who Must Conduct a Fire Risk Assessment in Malaysia?
The FSM carries primary responsibility for conducting or commissioning the fire risk assessment for designated premises. Specifically, the FSM either leads the assessment personally or engages a qualified external fire safety consultant to conduct it but in either case, the FSM remains accountable for the outcome and must ensure the findings drive actual changes.
For workplaces with an appointed Safety and Health Officer (SHO), the SHO contributes to the fire risk assessment as part of the broader workplace HIRARC process. However, the fire-specific assessment that Bomba audits against remains the FSM’s responsibility not the SHO’s. For a full comparison of these two roles, read our guide: FSM vs Safety Officer — What Is the Difference?
For buildings without a designated FSM typically smaller premises below the designated premises threshold the employer or building owner retains responsibility for ensuring a fire risk assessment exists and remains current.
Additionally, Fire Safety Officers (FSO) contribute to the assessment process by providing ground-level observations from their daily inspections identifying hazards, reporting equipment faults, and noting areas where occupant behaviour creates fire risk. This makes the FSO an important source of real-world input that strengthens the assessment’s accuracy.
The 5-Step Fire Risk Assessment Process
The fire risk assessment process follows a structured five-step methodology that aligns with both Bomba requirements and the HIRARC framework under OSHA 1994. Here is how each step works in a Malaysian building context:
Step 1 — Identify Fire Hazards
The first step involves systematically identifying every potential source of ignition, fuel, and oxygen within the building. Walk through every area not just production floors or kitchens, but server rooms, storage areas, maintenance workshops, loading bays, and car parks.
A. Sources of ignition to identify:
- Electrical equipment — overloaded sockets, damaged cables, faulty appliances, portable heaters
- Cooking equipment — commercial kitchens, pantry microwaves, canteen fryers
- Heating systems — boilers, HVAC equipment, industrial furnaces
- Industrial processes — welding, cutting, grinding, soldering operations
- Smoking areas — including informal smoking spots not officially designated
- Deliberate ignition — arson risk areas such as remote stairwells, car parks, and waste storage
B. Sources of fuel to identify:
- Stored materials — paper, cardboard, timber, plastic, textiles, packaging
- Flammable liquids — solvents, cleaning chemicals, fuel, lubricants, paints
- Furniture and furnishings — particularly foam-filled seating in offices and reception areas
- Waste accumulation — bins, recycling points, skips, and waste storage areas
- Building fabric — timber floors, ceiling tiles, insulation materials
C. Sources of oxygen to identify:
- Natural ventilation — open windows, air vents, roof openings
- Mechanical ventilation — HVAC systems, air handling units, extraction systems
- Oxygen storage — medical oxygen cylinders, laboratory gas supplies
- Compressed air systems — pneumatic equipment and supply lines
Step 2 — Identify People at Risk
The second step identifies which people in the building face the greatest risk if a fire occurs. This goes beyond simply listing all occupants it requires considering who is most vulnerable and why.
Specifically, identify people at risk including:
- Employees working alone — in remote areas, during night shifts, or in isolated sections of the building
- Mobility-impaired individuals — staff, regular visitors, or building users who cannot self-evacuate without assistance
- Sleeping occupants — hotel guests, hospital patients, dormitory residents who may be unaware of a fire during night hours
- People unfamiliar with the building — visitors, contractors, new staff, delivery personnel who do not know evacuation routes
- People in high-risk areas — staff working near ignition sources, in chemical storage areas, or in areas with limited escape routes
- Members of the public — in shopping complexes, public assembly buildings, or any premises with significant public access
For each group identified, the assessment must consider how quickly they can be alerted, how well they know the evacuation routes, and what assistance they may need to evacuate safely.
Step 3 — Evaluate, Remove, and Reduce Risk
The third step takes the hazards and at-risk people identified in Steps 1 and 2 and evaluates the overall fire risk they create then implements controls to reduce that risk.
Risk evaluation considers two dimensions: the likelihood that a fire will start, and the severity of the consequences if it does. Combining both dimensions produces a risk rating typically classified as low, medium, high, or very high that drives the priority and urgency of control measures.
Control measures follow a hierarchy eliminate the hazard first, then substitute, then engineer controls, then administrative controls, then personal protective equipment:
Elimination and substitution:
- Remove unnecessary combustible materials from work areas
- Replace flammable cleaning solvents with non-flammable alternatives where practicable
- Eliminate ignition sources in areas where flammable materials are stored
Engineering controls:
- Install or upgrade fire detection and alarm systems to ensure early warning
- Ensure suppression systems cover all high-risk areas adequately
- Improve compartmentation — fire doors, fire-rated walls, and floor penetration sealing
- Upgrade emergency lighting in high-risk or complex evacuation route areas
Administrative controls:
- Establish and enforce housekeeping procedures — particularly waste removal and storage discipline
- Implement hot work permit systems for welding, cutting, and grinding operations
- Introduce formal electrical equipment inspection and testing schedules
- Review and update the Fire Emergency Response Plan (FERP) to reflect current risk
Step 4 — Record Findings, Implement Controls and Prepare the Emergency Plan
The fourth step produces the formal fire risk assessment document and critically, implements the control measures the assessment identified. A fire risk assessment that exists only as a document, with no evidence of control implementation, does not satisfy Bomba or DOSH requirements.
The formal fire risk assessment document must record:
- The date the assessment was conducted
- The name and qualification of the person who conducted it
- Every hazard identified — by type, location, and severity rating
- Every group of people at risk — and the nature of their vulnerability
- Every control measure identified — with the responsible person and implementation timeline
- Evidence that controls have been implemented — or a documented explanation if implementation is ongoing
- The date of the next scheduled review
Additionally, the assessment must inform the building’s Fire Emergency Response Plan — specifically updating evacuation routes, assembly point procedures, and ERT response protocols based on the hazards identified.
Step 5 — Review and Update the Assessment Regularly
The fifth step and the one most often neglected is reviewing and updating the fire risk assessment regularly. A fire risk assessment is only valid for the building conditions it assessed. When those conditions change, the assessment must change with them.
The FSM must trigger a formal review of the fire risk assessment:
- Annually — as a minimum, regardless of whether any significant changes have occurred
- After any significant building modification — renovation, layout change, new construction, or change of use
- After any change in occupancy or tenancy — new tenants, change of business activity, significant increase in occupant numbers
- After any fire incident or near-miss — to identify what the previous assessment missed and prevent recurrence
- After introduction of new processes, equipment, or materials — particularly anything that introduces new ignition sources or fuels
- After any Bomba inspection finding — to address any fire safety deficiency Bomba identified
Each review must be documented with a revision date and a summary of what changed. Bomba inspectors specifically check whether the assessment has been reviewed following building changes an outdated assessment for a modified building is a common inspection finding.
Common Fire Risk Assessment Findings in Malaysian Buildings
Based on Bomba inspection experience, the following fire hazards appear most frequently in fire risk assessments across Malaysian commercial and industrial premises:
Overloaded electrical systems — particularly in older buildings where original wiring was not designed for current equipment loads. Extension leads daisy-chained across office floors are a persistent finding.
Blocked or obstructed fire exits — storage placed against fire exit doors, goods stacked in escape corridors, and equipment positioned in front of stairwell doors are common in warehousing and manufacturing environments.
Inadequate housekeeping — accumulated combustible waste near ignition sources, overflowing bins, and unmanaged storage of cardboard and packaging materials in production areas.
Hot work without permit systems — welding, grinding, and cutting conducted without formal hot work permits, fire watch procedures, or post-work inspections.
Flammable liquid storage deficiencies — storage outside designated areas, inadequate ventilation, missing bonding and earthing arrangements, and incorrect container types.
Suppression system obstructions — goods stored within the exclusion zone below sprinkler heads, preventing effective discharge coverage.
Missing or expired fire extinguisher servicing — extinguishers beyond their annual service date, or extinguishers missing from designated locations without replacement.
For buildings handling hazardous materials, HAZMAT-specific fire risks including incompatible chemical storage, missing safety data sheets, and inadequate spill containment frequently feature as high-priority findings.
Fire Risk Assessment vs Fire Safety Audit — What Is the Difference?
Many building managers use these terms interchangeably but they describe different processes.
A fire risk assessment is a proactive, management-led process that identifies hazards and implements controls before an incident occurs. The FSM conducts or commissions it as an ongoing management responsibility.
A fire safety audit is typically an external review either by Bomba during a Fire Certificate inspection, or by an independent fire safety consultant that evaluates whether the building’s fire safety management system meets regulatory requirements. The audit reviews the fire risk assessment as one element of the overall compliance picture.
In short, the fire risk assessment feeds into the fire safety audit. A well-conducted, current, and properly implemented fire risk assessment makes a fire safety audit whether by Bomba or an external consultant straightforward and low-risk.
How FERA Supports Your Fire Risk Assessment Process
FERA Training Center prepares FSMs and FSOs to conduct fire risk assessments with genuine competency understanding not just the methodology, but the specific hazard patterns that appear in Malaysian buildings and the control measures that Bomba inspectors look for during audits.
Our FSM training programme specifically covers fire risk assessment methodology, HIRARC integration, control measure implementation, documentation standards, and the review cycle that keeps assessments current and compliant.
Additionally, we deliver the full suite of OKK training that makes your fire risk assessment function effectively in practice:
- Fire Safety Officer (FSO) training — FSOs contribute ground-level hazard observations that strengthen assessment accuracy
- Fire warden training — wardens implement evacuation controls identified in the assessment
- Emergency Response Team (ERT) training — ERT members execute the emergency response procedures the assessment informs
- HAZMAT training — NFPA 472 — for buildings where the fire risk assessment identifies hazardous material risks
All programmes are HRDCorp claimable and delivered in-house across Peninsular Malaysia.
WhatsApp: 019-303 4001
Email: [email protected]
Website: fera.com.my/fsm-fso-training
Frequently Asked Questions
Q1: Is a fire risk assessment legally required in Malaysia?
Yes. Under the Fire Services Act 1988 and the Fire Services (Fire Certificate) Amendment Regulations 2020, conducting a fire risk assessment is a defined FSM responsibility for designated premises. Additionally, OSHA 1994 requires employers to conduct hazard identification and risk assessment including fire hazards for all workplaces. Bomba and DOSH both review fire risk assessment documentation during inspections.
Q2: How often must a fire risk assessment be reviewed in Malaysia?
The FSM must review the fire risk assessment at minimum once annually. Additionally, the assessment must be reviewed immediately following any significant building modification, change in occupancy, fire incident or near-miss, introduction of new processes or materials, or Bomba inspection finding. Each review must be documented with a revision date.
Q3: Who can conduct a fire risk assessment in Malaysia?
The FSM carries primary responsibility for conducting or commissioning the fire risk assessment for designated premises. The FSM may conduct it personally or engage a qualified external fire safety consultant. In either case, the FSM remains accountable for the outcome and must ensure findings are implemented. For workplaces without a designated FSM, the employer or building owner retains this responsibility.
Q4: What happens if my building has no fire risk assessment?
Bomba can issue a non-compliance finding during Fire Certificate inspection, potentially affecting Fire Certificate renewal. DOSH can issue an enforcement notice under OSHA 1994. In the event of a fire incident in a building without a current fire risk assessment, the building owner faces significantly increased legal and insurance liability. Contact FERA to discuss how to establish a compliant fire risk assessment process quickly.
Q5: What is the difference between a fire risk assessment and a HIRARC?
A HIRARC (Hazard Identification, Risk Assessment, and Risk Control) is the broad OSH risk management framework required under OSHA 1994 covering all workplace hazards. A fire risk assessment is a specific, dedicated application of the same methodology focusing exclusively on fire hazards. The fire-specific assessment feeds into the broader HIRARC as the fire hazard component — but Bomba audits the fire risk assessment independently as part of Fire Certificate compliance.
Q6: Can FERA help our FSM conduct a fire risk assessment?
Yes. FERA’s FSM training programme specifically covers fire risk assessment methodology from hazard identification through to control implementation and documentation. Contact FERA to discuss training options and in-house programme delivery for your FSM and safety team.
