Beyond the Checklist: Why Building Safety Compliance Needs Quantitative Risk Measurement

In this article, we will explore why Building Safety Compliance Needs Quantitative Risk Measurement is essential for defensible building safety compliance.

For decades, building safety risk was largely a qualitative exercise. A fire risk assessment would rate a hazard as “low,” “medium” or “high,” a surveyor would flag a defect as “requiring attention,” and duty holders would rely on professional judgement to decide what mattered most. 

That approach hasn’t disappeared, and for many risks, expert judgement remains essential. But since the Building Safety Act 2022 (BSA) came into force, the bar for what counts as a defensible risk assessment has risen sharply. 

Accountable Persons and Principal Accountable Persons are now expected to demonstrate, with evidence, that they have taken “all reasonable steps” to manage building safety risk, and increasingly, that means being able to measure it, not just describe it.

The regulatory push towards measurable risk

Section 83 of the BSA requires an Accountable Person for an occupied higher-risk building (HRB) to assess building safety risks as soon as reasonably practicable. Any such assessment must be suitable and sufficient to allow the Accountable Person to comply with their duties under section 84. Section 62 defines building safety risk narrowly around fire spread and structural failure, plus any further risks prescribed by future regulation, a deliberately tight scope, but one the Building Safety Regulator (BSR) is applying with growing rigour.

That rigour is now visible in practice. The BSR has begun delaying Building Assessment Certificates for higher-risk buildings where a structural risk assessment is missing. It is also explicit that a fire risk assessment alone will not satisfy the section 83 duty. 

Notably, the Act itself does not prescribe a specific methodology for assessing structural risk. Instead, accountable persons are expected to adopt a proportionate, reasonably practicable approach that reflects the building’s age, construction, materials and history. 

The absence of a mandated method is not an invitation to informality. If anything, it raises the evidential bar: without a prescribed template to point to, duty holders need their own methodology to be robust, consistent and able to withstand scrutiny from a multi-disciplinary BSR assessment team.

This is where quantitative risk measurement earns its place alongside expert qualitative judgement, rather than replacing it.

What “quantitative” actually means in a compliance context

Quantitative risk measurement doesn’t require actuarial modelling or complex probabilistic engineering (although for structural risk on complex HRBs, that level of analysis may well be justified). For most portfolios, it means converting risk into structured, comparable data:

• Likelihood × consequence scoring: Assigning numerical or banded values to the probability of a hazard materialising and the severity of its impact, then combining them into a single risk score that can be ranked, trended and benchmarked.
• RAG (Red-Amber-Green) status tracking: Translating individual assessment findings into a consistent traffic-light rating that can be rolled up across a building, a portfolio, or an entire estate.
• Weighted portfolio scoring: Where an organisation is responsible for multiple HRBs, weighting risk scores by factors such as building height, occupancy, evacuation strategy and construction type, so that finite budget and attention go where exposure is genuinely highest.
• Time-to-remediation and overdue-action metrics: Measuring not just whether a risk was identified, but how quickly it was closed out, a figure the BSR and the courts have both shown real interest in.
• Trend data across review cycles: Because section 83 assessments must be kept current, tracking whether a building’s risk profile is improving, static or deteriorating over successive reviews turns a point-in-time snapshot into evidence of ongoing management.

The value of this approach isn’t that numbers are inherently more truthful than professional narrative. The value is in comparability, prioritisation and auditability. A qualitative statement that a risk is “significant” tells a regulator very little on its own. A risk score that is calculated consistently across every building in a portfolio, that can be compared year-on-year, and that is backed by a clear, repeatable methodology, tells a much stronger compliance story.

Why enforcement is making Quantitative Risk Measurement essential

Recent HSE enforcement activity has underlined how directly the quality of an organisation’s risk management processes affects legal outcomes, not just its safety record.

Where prosecutions have followed building safety failures, the presence, or absence, of a structured, evidenced system for identifying and tracking risk has been central to how culpability is assessed. A defensible position increasingly depends on being able to show a regulator not just what was found, but how it was measured, how it was prioritised against everything else in the portfolio, and how quickly it was resolved.

This same expectation now runs through the Safety Case Report process. A Building Assessment Certificate offers only a snapshot of compliance at the point of assessment, not a guarantee of ongoing safety. This now means that the systems behind that snapshot, including how risks are tracked, escalated and closed between assessments, matter just as much as the certificate itself. The BSR’s review looks specifically at the systems in place to manage, track and progress actions and recommendations identified through inspections, and at how urgent or emergency work is handled. A spreadsheet updated quarterly, or a set of PDF reports sitting in a shared drive, struggles to demonstrate that kind of live, structured oversight.

The data problem hiding inside every risk framework

Here’s the practical difficulty most Accountable Persons and managing agents encounter: quantitative risk measurement is only as good as the underlying data, and building safety data is notoriously fragmented. 

Fire risk assessments, structural surveys, EWS1 forms, statutory inspection certificates, remedial works schedules, and Golden Thread documentation typically live across different consultants, different formats and different systems. 

Under the BSA, strict document control forms the operational backbone of the statutory “golden thread” of information. While the Act does not use the specific phrase “document control centre,” robust centralisation, version control, and tamper-evident audit trails are legally mandated under secondary regulations (such as the Higher-Risk Buildings procedures) to manage safety-critical data across a building’s lifecycle.

However, for many, calculating a meaningful, portfolio-wide RAG score or a genuine likelihood-and-consequence matrix is nearly impossible when the source information isn’t centralised, standardised, or kept current.

This is precisely the gap that purpose-built compliance software is designed to close, and it’s the problem Complitas was built to solve.

Where Complitas fits

Complitas centralises building safety compliance data into a single, structured platform. That includes statutory inspections, assessment findings, remedial actions, certification and Golden Thread records. No more reports scattered across consultants and spreadsheets.

Centralisation is what makes measurement possible. CompliScore is what does the measuring.

CompliScore: risk measured from evidence

CompliScore is the Complitas risk-scoring engine. It rolls fire, gas, structural and access checks into one rating, from Very Low to Very High. Every score traces back to the checks and certificates behind it.

It applies the principles above as standard:

• Likelihood × severity scoring: Hazards are scored on a recognised matrix, the same logic behind HHSRS. Each is scored 1 to 9 and banded Low, Medium or High.
• Evidence gaps count as risk: A building with outstanding evidence rates lower than a clean record, even with no severe hazards. Missing proof is treated as a risk in itself.
• Worst-case logic: CompliScore takes the worst signal across categories, not an average. One serious fire safety gap can’t hide behind ten tidy gas checks.
• One consistent method: “Low risk” means the same on every property in your portfolio, not whatever the last contractor email said.

The result is a rating that holds up under board, insurer or Regulator scrutiny.

The Building Safety Management Pack: the evidence behind the score

CompliScore is delivered as the front page of the Building Safety Management Pack (BSMP). This is a single document per property, generated on demand from the audit trail already logged in Complitas.

It shows the overall rating, checks completed and evidence outstanding. Every category is accounted for, with certificates and inspection records attached. When a risk assessment is challenged, the evidence already exists. It doesn’t need reconstructing under pressure.

Built for ongoing oversight

• RAG dashboards give Accountable Persons an at-a-glance, portfolio-wide view of risk status, rather than reconciling findings building by building.
• Consistent tracking of actions and remediation timelines provides the evidence the BSR looks for when assessing whether risks are being actively managed, not just recorded.
• A structured, auditable record forms the digital foundation of the Golden Thread. It’s ready when a Safety Case Report is scrutinised.
• Cross-portfolio visibility lets operators of dozens or hundreds of buildings compare and prioritise risk, turning individual assessments into genuine management information.

Discover CompliScore or book a demo to see it on your own portfolio.

In Summary

Quantitative risk measurement isn’t a replacement for expert judgement, and it isn’t a box-ticking exercise either. Done well, it’s what turns individual risk assessments into a defensible, ongoing safety management system. 

For Accountable Persons trying to meet the section 83 duty in substance as well as in letter, the question is rarely whether they have collected the right information. It’s whether that information is structured well enough to measure, prioritise and evidence risk consistently, across one building, or across an entire estate. That’s the gap Complitas exists to close.