Community Risk Management Planning: From Risk Evidence To Strategic Decisions

Introduction

Over the last few months, I have spent quite a bit of time thinking about Community Risk Management Plans, partly through work around risk and strategic planning, and partly through a review of current CRMPs (and supporting material) published by fire and rescue services across the UK.

The aim of that review was not to rank FRS or decide who was doing it best. I was interested in understanding how different services approach what is, broadly speaking, the same task. There is a lot of good work out there, but there is also considerable variation in how FRSs structure their CRMPs, where the supporting evidence sits, how much detail is included in the main document and how clearly the links between risk and priorities are explained.

Some CRMPs are relatively short public-facing documents, while others contain much more supporting evidence. Some FRS have moved towards web-based or more interactive approaches, while others retain a more traditional single document, sometimes supported by separate risk profiles, strategic assessments or delivery plans.

I do not think that variation is necessarily a problem. FRSs operate in different places, with different geography, demographics, risks, governance arrangements and financial pressures. What it has made me think about, though, is the process that sits behind the document and whether CRMP development sometimes becomes more complicated than it needs to be.

Purpose And Scope

There is always a deadline associated with producing a CRMP, so it is understandable that attention can quickly turn to what needs to be published and when. Questions such as these inevitably start appearing:

• What will the document look like?

• How long should it be?

• When does consultation need to begin?

• Who is going to write each section?

• What supporting evidence needs to be published alongside it?

All of those things need dealing with, but I do not think they are the best place to start.

A CRMP should form part of a much wider and continuing process of understanding community risk and deciding how the service manages it. The published plan is obviously an important output from that work, but if too much attention is focused on producing the next document it is easy to lose sight of the wider purpose.

In particular, a service should not reach the start of a new CRMP cycle and suddenly begin trying to establish what its community risk looks like. I doubt many FRSs are doing that in a literal sense, but the underlying point is important… The risk picture should already exist and should be kept under review as new information becomes available, demographics change, new technologies and behaviours emerge, and the service's own operating environment develops.

The CRMP process might prompt a more substantial review of some of that evidence, or a rethink of how it is being presented and used, but it should not require the organisation to rebuild its understanding of risk every few years simply because a new plan is due.

The NFCC work on community risk provides a useful common foundation here, particularly its definition of risk around likelihood and consequence and the wider progression from identifying hazards through analysis and into decision-making. I think the distinction between understanding risk and deciding what to do about it is important, because the two can sometimes become blurred together.

Understanding And Assessing Risk

FRSs have become increasingly sophisticated in the way they use data and analyse risk. There will always be debate about individual methodologies and areas where the evidence is incomplete, and some professional judgement is inevitably involved, but there is now a substantial amount of analytical work taking place across the sector.

Even a very good assessment of risk, however, does not tell a service exactly what it should do.

The analysis might identify particular groups, locations or incident types where risk is higher. It might show how that risk is changing or where existing arrangements appear less effective. It might highlight an emerging issue that needs greater attention. The more difficult step is then deciding what that means in practice.

That can involve questions around prevention, protection, response, resilience, workforce and investment. It can mean deciding what should change and what should stay broadly the same.

This is also where the real-world constraints become more significant. Finance, workforce capacity and statutory responsibilities all matter, and public or political views can also influence what is deliverable. I still think it is useful to separate those considerations from the underlying assessment of risk as far as possible.

A service should understand the risk as objectively as it reasonably can, rather than changing the assessment because one approach to addressing the risk might be unaffordable. Equally, there is little value in producing a theoretical plan based on the assumption that resources are unlimited. The challenge is to understand the evidence properly and then make clear, defensible choices within the circumstances the FRS is actually operating in.

For me, that link from evidence through to decisions is one of the most important parts of CRMP development.

Ownership and Governance

There is also a fairly basic organisational question around who actually owns the CRMP.

FRSs typically appoint someone specific to manage the process. There is a lot to coordinate, from evidence and workshops through to consultation, governance and publication, so having someone responsible for keeping it moving is sensible.

The danger is when CRMP development becomes seen as the CRMP manager's project, rather than something that belongs to the wider organisation. If the plan is genuinely setting out how the FRS intends to manage community risk over the next few years, then senior leaders need to be involved in the thinking and the choices throughout, rather than offering their input once most of the work has already been completed.

That does not mean every senior officer needs to be involved in every piece of analysis, and nor should a CRMP become an endless series of workshops involving everyone in the organisation. It does mean being clear about who owns the important decisions and how the expertise that already exists across the service is being brought into the process.

Prevention, protection, response, resilience, analysis, finance and other functions will all hold different parts of the picture. Drawing those together into a coherent view is probably one of the reasons CRMP development can be difficult in the first place, because it cuts across the normal organisational boundaries rather than sitting neatly within one team.

Consistency and Learning

One of the things that struck me from looking across current CRMP approaches was how differently services can present essentially similar tasks. I would not advocate a single national template and I do not think a rural service should have an identical CRMP to a large metropolitan service; the local context matters too much for that.

I do, though, think there is scope for a more recognisable common process underneath the plans. Somebody familiar with CRMP work in one part of the country should understand the logic of a plan produced elsewhere, even where the risks, evidence and resulting priorities are very different.

The simplest way I can think of describing that is probably common questions, locally evidenced answers.

There is also value in looking more widely at how other services have approached particular parts of the process. FRSs understandably look at their neighbours or organisations they regard as comparators, but a good idea about how to structure evidence, present risk or run a particular stage of the planning process does not necessarily come from somewhere that looks very similar.

A metropolitan service may have something useful to learn from a much smaller rural one, or vice versa. Looking across the national picture has reinforced that for me. There are a lot of different approaches out there, and some of that variation is useful because it gives services a wider pool of ideas to draw from rather than having to work everything out again for themselves.

Audience and Evidence

There is also a balance to strike between the internal purpose of the CRMP process and its external purpose.

The final CRMP is a public document and needs to explain what the FRS is doing in a way that people can understand. Consultation and public engagement also form an important part of the process.

At the same time, the organisation itself will need a level of evidence and analysis that often goes well beyond what it would make sense to include in the main public-facing document.

I do not think there is a right answer in terms of length or format. A relatively short CRMP can be supported by a substantial evidence base elsewhere, while another service may choose to include much more of that information in the plan itself. Web-based approaches provide another option again.

The important thing is being clear about the purpose of each element and who it is intended for. Trying to make one document act as the detailed evidence base, the strategic decision-making record, the consultation document and an accessible explanation for the public can make the task unnecessarily difficult.

The underlying evidence needs to be robust enough to support the choices being made, while the published plan needs to explain those choices clearly and proportionately. Those requirements are closely connected, but they are not quite the same thing.

Evaluation

Another area where I think there is more scope for development is evaluation.

FRSs collect a lot of performance information, but measuring activity is not necessarily the same as understanding whether an approach is working. If a service reports that it completed 5,000 home fire safety visits, that is useful operational information, but it does not by itself tell us whether those were the right 5,000 visits, whether they reached the people at greatest risk, or whether they had the effect that was intended.

The same principle applies more widely across a CRMP. If decisions have been made because of an assessment of risk, there should ideally be some way of coming back later and asking whether those decisions appear to have improved the position.

That does not mean every commitment needs a complicated evaluation methodology. Some outcomes will be difficult to measure and some will take years to become clear. There is still an important difference between asking whether an activity happened and asking whether it worked.

This also links back to the point about keeping the underlying risk picture up to date. If the evidence base is being maintained and previous decisions are being evaluated properly, the next CRMP should start from a much stronger position. The process becomes more about understanding what has changed, what appears to be working and what now needs to be different, rather than trying to assemble the whole picture again.

External Support

CRMP development brings together a broad evidence base, people from different parts of the organisation and some genuinely difficult choices. FRSs also need to work within national guidance, inspection expectations, consultation requirements and local governance arrangements, so it is understandable that the process can be difficult to coordinate.

I do not think the answer is to hand the whole exercise to an external consultant and ask them to produce a CRMP. The service needs to own the evidence, the decisions and the resulting plan.

There is, though, plenty of scope for external support without losing that ownership. Sometimes that may simply mean an independent review of the approach, a challenge to some of the assumptions being made or a wider view of how other services have dealt with similar issues. In other cases there may be a need for more substantial help with areas such as risk methodology, evidence, workshops, analysis or options development.

That is an area I am increasingly supporting through GTH Consulting. The aim is not to take the process away from a service, but to add experience, capacity or an independent perspective where that is useful. For some services that might mean support across a substantial part of the process, while for others a small amount of input at a few key stages may be enough.

The important thing is that the process leaves the service with more than another published document. It should provide a clear line from its understanding of community risk through to the choices it makes, while giving it a sensible basis for reviewing whether those choices are working over time.

If you are reviewing your CRMP approach or starting to plan the next cycle and think an external perspective could be useful, please get in touch.

GTH Consulting

graham@gthconsulting.co.uk

© 2026. All rights reserved. Read our privacy policy.