The Fire Safety (England) Regulations 2022 (FS(E)R) was written in response to the Grenfell Inquiry Phase 1 recommendations that were published in October 2019. The new regulations became enforceable on 23rd January 2023.
FS(E)R forms part of the Government’s self-styled “Biggest Reform of Building Safety in 40 Years.” It places significant formal requirements on the Responsible Person (RP) and Fire and Rescue Services (FRS) in relation to electronic information sharing, fire safety management and enforcement.
The focus of this audit is on the readiness of the 43 English FRS to receive electronic information from Responsible Persons (building managers) relating to floor plans, building plans, external wall information, fault reports, and repair reports.
Audit methodology
In the week preceding the 23rd January 2023 (FS(E)R, the Building Safety Register team visited all 43 English FRS websites to audit their readiness. We identified the web page that informs RPs about the FS(E)R and then tested the process for submitting electronic information (we submitted dummy information).
FRS that were capable of receiving the required electronic information were then assessed on a further three basic measures of: privacy, security and data quality (see Note 1).
FRS that were graded ‘not ready’ or ‘partially ready’ in the week preceding 23rd January 2023 were further visited on 23rd January 2023 between 9am and 11am to check whether their readiness status had changed.
The results below reflect the FRS readiness picture at 11am on the 23rd January 2023 (11 hours after the Fire Safety (England) Regulations 2022 became enforceable.
Audit results
On the key measure of Readiness only 63% of English FRS were ‘ready’. 21% of FRS were ‘not ready’ (including: London, Hampshire, Hertfordshire, South Yorkshire, and West Yorkshire).
Privacy
All aspects of electronic information sharing with FRS includes the submitter’s name, email address and telephone number and the same information for the RP. We checked whether the forms were accompanied by a privacy policy (we did not conduct a detailed GDPR assessment at this stage).
76% of English FRS are processing personal information without a privacy policy
Security
FRS are ingesting important fire safety information from RPs via their websites. This information will be used to inform risk assessment, operational response to 999 calls and in some cases could be used as evidence in criminal proceedings. We applied a simple test of whether this information could be submitted without any form of security check (authentication via a login process).
94% of English FRS are ingesting evidential information without security checks
Data Quality
FRS are now ingesting data for at least 12,000 high rise blocks in England. As mentioned in the security section of this report, the data exchange is essential to the life safety of residents. Accordingly we checked whether any of the FRS provided forms that validated the data prior to submission.
100% of English FRS are ingesting evidential information without validation
Other findings
As we conducted the audit we observed other interesting findings that we may come back to in a later report, these included:
- Forms triggering French translation popups
- Date pickers in American date format
- Forms that allow submission of repairs that pre-date the corresponding fault
- Forms that contain ‘INSERT LOGO HERE’
- Web pages entitled ‘TEST PAGE’
- Forms asking for the First Name and Last Name of buildings
- Web pages that contained factual and material inaccuracies in relation to the wording of the FS(E)R
Audit summary
Our expectation upon commencing this audit was for a small number of FRS to be behind with their readiness.
We did not expect to find 21% ‘not ready’ and we certainly didn’t expect this number to include the London Fire Brigade*. It is important to note that the LFB are the operational responder and regulator for over 50% of the high rise blocks in England. Furthermore, the Grenfell Tower tragedy occurred within their jurisdiction, they were witnesses at the inquiry and the new regulations were written in response to the learnings from Grenfell.
Due to the frighteningly low level of readiness observed at the early stages of this audit and in the public interest we warned the UK Home Office, Government Ministers and a number of FRS in public and private. Our early intervention prompted a number of improvements that have flattered the readiness numbers published today.
*After the conclusion of this readiness audit, LFB have now launched their High Rise Building Portal, which appears to be rushed out and dysfunctional. This development does not materially change our finding of ‘not ready’.
