Why Building Risk Assessment Matters
Every building carries risk. The question is not whether risks exist but whether they are identified, scored, documented, and managed. A systematic risk assessment transforms vague concerns into a quantified risk register that enables informed decision-making — whether you are evaluating a building for lease, managing an existing portfolio, or conducting acquisition due diligence.
The 5×5 Risk Matrix
| Likelihood → Impact ↓ | 1 — Rare | 2 — Unlikely | 3 — Possible | 4 — Likely | 5 — Almost Certain |
|---|---|---|---|---|---|
| 5 — Catastrophic | 5 | 10 | 15 | 20 | 25 |
| 4 — Major | 4 | 8 | 12 | 16 | 20 |
| 3 — Moderate | 3 | 6 | 9 | 12 | 15 |
| 2 — Minor | 2 | 4 | 6 | 8 | 10 |
| 1 — Insignificant | 1 | 2 | 3 | 4 | 5 |
■ ≥15: Intolerable — immediate action required. ■ 5-14: ALARP — manage with controls and monitoring. ■ ≤4: Acceptable — monitor and review.
Building Risk Categories
| Category | Key Risks | Typical Score Range |
|---|---|---|
| Structural | Extra floors, design code vintage, modifications, settlement, corrosion | 4-25 (wide range) |
| Fire & Life Safety | No detection, no sprinklers, blocked exits, no fire licence | 6-25 (high consequence) |
| Electrical | Poor earthing, no RCD, overloaded circuits, no thermographic survey | 4-20 |
| HVAC/MEP | Age, capacity shortfall, no ventilation, Legionella, refrigerant | 3-15 |
| Vertical Transport | Age, no safety inspection, no AMC, trapped passengers | 3-16 |
| Environmental | Flood zone, seismic zone, contamination, air quality | 3-20 |
| Regulatory | Missing permits, expired licences, non-compliance with codes | 4-16 |
| Operational | No BCP, single point of failure (power, water), no FM systems | 4-15 |
Scoring Guide
Likelihood Scale
| Score | Label | Probability | Example |
|---|---|---|---|
| 1 | Rare | <5% in 5 years | Major earthquake in low-seismic zone |
| 2 | Unlikely | 5-20% in 5 years | Significant structural issue in well-built building |
| 3 | Possible | 20-50% in 5 years | Fire alarm failure in ageing system |
| 4 | Likely | 50-80% in 5 years | Generator failure without annual load bank test |
| 5 | Almost Certain | >80% in 5 years | Electrical fault in untested distribution board |
Impact Scale
| Score | Label | People | Financial | Operations |
|---|---|---|---|---|
| 1 | Insignificant | No injury | <$5K | <1 hour disruption |
| 2 | Minor | First aid injury | $5K-$50K | 1-8 hours disruption |
| 3 | Moderate | Medical treatment | $50K-$500K | 1-7 days disruption |
| 4 | Major | Serious injury, hospitalisation | $500K-$5M | 1-4 weeks disruption |
| 5 | Catastrophic | Fatality or permanent disability | >$5M | >1 month or permanent |
Risk Treatment Strategies
| Strategy | When to Apply | Examples |
|---|---|---|
| Avoid | Risk is intolerable and cannot be reduced | Don't lease the building. Vacate the floor. Don't approve the project. |
| Reduce | Risk can be lowered to acceptable level | Install fire detection. Conduct structural assessment. Add generator. Test earthing. |
| Transfer | Risk impact can be shared or insured | Insurance, landlord responsibility clause, performance bond from contractor. |
| Accept | Risk is within tolerance, or cost of treatment exceeds benefit | Minor cosmetic issues. Acceptable remaining useful life. Known and documented gap. |
Building Risk Register Template
| ID | Risk | Category | L | I | Score | Treatment | Owner | Target Date |
|---|---|---|---|---|---|---|---|---|
| R-01 | No fire detection system on floors 3-8 | Fire Safety | 4 | 5 | 20 | Install addressable fire alarm | FM Manager | Q2 2026 |
| R-02 | Electrical earthing not tested in 3+ years | Electrical | 3 | 4 | 12 | Commission earth resistance test | Chief Engineer | Within 30 days |
| R-03 | Generator not load-bank tested annually | Operational | 4 | 3 | 12 | Schedule load bank test | Chief Engineer | Within 60 days |
| R-04 | Building in BNBC Seismic Zone 2, designed to 1993 code | Structural | 2 | 5 | 10 | Commission seismic vulnerability assessment | CRE Director | Q3 2026 |
| R-05 | Single exit staircase on floors 9-12 | Fire Safety | 3 | 5 | 15 | Negotiate external fire escape or relocate from affected floors | CRE Director | Q1 2026 |
Risk Assessment Process
- Scope: Define what is being assessed (whole building, specific floors, specific systems)
- Walk-through: Physical inspection covering all risk categories (2-4 hours for a typical office building)
- Document review: Permits, certificates, maintenance records, previous assessments
- Scoring: Score each identified risk using the 5×5 matrix
- Treatment plan: Assign treatment strategy, owner, and target date for each risk ≥6
- Report: Risk register + summary with total risk profile score
- Review: Quarterly review of risk register — update scores as treatments are completed
References
- ISO 31000:2018 — Risk Management Principles and Guidelines
- IEC 31010 — Risk Assessment Techniques
- ASTM E2018 — Property Condition Assessment
- RICS — Building Survey and Due Diligence Standards
- HSE UK — ALARP Risk Management Principles
- NFPA — Fire Risk Assessment Methodology
- BNBC 2020 — Bangladesh National Building Code (Seismic and Wind Provisions)
Insights & Guidance
- Every building carries risk — the question is whether risks are identified, scored, and managed systematically.
- Use a 5×5 risk matrix (likelihood × impact): ≥15 = intolerable, 5-14 = ALARP (manage), ≤4 = acceptable.
- 8 risk categories: structural, fire, electrical, HVAC/MEP, vertical transport, environmental, regulatory, operational.
- Four treatment strategies: Avoid (don't lease), Reduce (fix it), Transfer (insure it), Accept (document and monitor).
- A building risk register is a living document — review quarterly, update as treatments complete.
- In Bangladesh: the most common high-scoring risks are fire safety gaps, structural unknowns (extra floors, old design codes), and electrical safety.
Without a systematic risk assessment, buildings are managed on assumption rather than evidence. A risk register transforms subjective concerns into quantified, prioritised, and assigned actions. It is the basis for informed decision-making — whether to lease, how much to invest, what to fix first, and what to accept. Every building in a professional portfolio should have one.
- Unidentified risks — risks that exist but have never been assessed (the most dangerous kind).
- Static register — a risk register created once and never reviewed or updated.
- Scoring bias — underscoring risks to avoid difficult conversations or investment.
- Building Risk Register (current, reviewed within 3 months)
- Risk assessment reports for each category
- Treatment action plan with owners and dates
- Quarterly review records
- Does the building have a risk register? When was it last reviewed?
- Are the highest-scoring risks being actively managed?
- Walk the building with the risk register — does reality match the assessment?
- Has a formal risk assessment been conducted? By whom?
- What are the top 5 risks and their current scores?
- What is the risk treatment plan and timeline?
- Risk assessment — ISO 31000 trained risk professional.
- Structural risk — licensed structural engineer.
- Fire risk — fire protection engineer or NFPA-qualified assessor.
- Environmental risk — environmental consultant for contamination, flood, seismic.