NFPA Risk Assessment Tool

Photo of author
Written By Chris Ekai

NFPA Risk Assessment Tool

An NFPA risk assessment tool is a worksheet, method or software application that performs the risk assessment a particular NFPA code requires: the dust hazard analysis in NFPA 660, the arc flash assessment in NFPA 70E 130.5, or the equipment categories in NFPA 99 4.1. NFPA 551 is the guide for judging whether it was done properly.

At 11:56 on the morning of July 29, 2025, a cloud of dust billowed from the top of the production tower at Horizon Biofuels in Fremont, Nebraska. Within seconds flames jetted from the windows, followed by an explosion that collapsed the tower and the break room beside it.

Dylan Danielson, 32, the day-shift operator, and his daughters Hayven, 12, and Fayeah, 8, died in the collapse. The Chemical Safety Board’s investigation update of September 17, 2025 attributes the blast to a large release of combustible wood dust from the process.

CSB Chairperson Steve Owens called combustible dust a well-known and completely avoidable hazard, according to Nebraska Public Media. OSHA issued its citation on January 24, 2026, and later disclosed that a wood grinder, hammermill, surge mixer and bucket elevator had all run without controls against hot surfaces, as WOWT reported on April 3, 2026.

The Practitioner’s Cheat Sheet
An NFPA risk assessment tool is any worksheet, method, or software that carries out a risk assessment a specific NFPA code or standard calls for. There is no single tool; there are at least eight, each tied to a standard: NFPA 551, 660, 70E, 99, 780, 1300, 1851 and the Research Foundation’s EFFECT screening tool.
The previous version of this article described a ‘Risk Analysis Tool’, a ‘Fire Protection Information Report Tool’ and a ‘Decision Analysis Tool’ built on AHP and MCDM. NFPA publishes none of those. This rewrite replaces them with the tools that exist and the clauses that require them.
Horizon Biofuels, Fremont, Nebraska, July 29, 2025: a wood dust explosion killed an operator and his two daughters. OSHA cited the company in January 2026; four machines ran without controls against hot surfaces. NFPA 660 has required a documented dust hazard analysis, revalidated every five years, since December 6, 2024.
NFPA’s 2024 fire experience survey counts 1.39 million fires, 3,920 civilian deaths and $19 billion in property damage, with structure fires producing 81 percent of the deaths. The largest single losses were a manufacturing facility, industrial plants and apartment complexes.
NFPA 551 sorts every fire risk assessment into five method categories, from qualitative to cost-benefit. Pick the lowest category that answers the decision in front of you; the worked wood pellet mill register below is semi-qualitative and fits on one page.
Arc flash (NFPA 70E 130.5), medical equipment (NFPA 99 4.1), community risk (NFPA 1300 with CRAIG 1300) and lightning (NFPA 780 Annex L) each have their own assessment logic. The comparison table in section six shows which to run, how often, and what evidence each leaves behind.

 

Every one of those findings is a line item in a dust hazard analysis, the NFPA risk assessment tool that NFPA 660 has required of wood-processing plants since December 2024. This article maps the tools NFPA publishes, explains the five method categories NFPA 551 uses to judge them, and walks through a wood pellet mill register row by row.

What an NFPA Risk Assessment Tool Is, and the Eight That Exist

NFPA is a standards body, and its codes rarely tell a facility what its risk is. They tell the facility to assess it, document the result, and act on it. So the phrase NFPA risk assessment tool covers whatever instrument closes that gap, and the definition of a risk assessment in each standard sets what the tool must produce.

No NFPA risk assessment tool is interchangeable with another. A dust hazard analysis asks where dust accumulates and what could ignite it; an NFPA 99 assessment asks what happens to a patient if equipment fails. The hazard versus risk distinction runs through all of them, but the scoring, the reviewer and the retention period differ.

Standard Tool or clause What it assesses Who runs it
NFPA 551 Guide for the Evaluation of Fire Risk Assessments; five method categories Whether any fire risk assessment is fit for the decision it supports AHJs, building officials, fire protection engineers
NFPA 660 Dust hazard analysis (DHA), revalidated every five years Combustible dust accumulation, ignition sources, deflagration and explosion isolation Qualified person with dust and process knowledge
NFPA 70E Section 130.5 arc flash risk assessment; Table 130.5(C) likelihood Likelihood and severity of an arc flash for each task and equipment condition Electrical safety program owner; reviewed at least every 5 years
NFPA 99 Section 4.1 risk categories 1 to 4; ASHE three-worksheet tool Consequence of failure of building systems and medical equipment to patients Facilities and clinical engineering, for CMS and Joint Commission surveys
NFPA 780 Annex L lightning risk assessment; tolerable versus expected strike frequency Whether a structure needs a lightning protection system Designer or owner, checked by the AHJ
NFPA 1300 Community risk assessment across nine profiles; CRAIG 1300 dashboard Where, to whom and how often emergencies occur across a jurisdiction Fire department CRR committee with community partners
NFPA 1851 PPE risk assessment before ensemble selection Duties, frequency, climate, incident operations and CBRN exposure Fire department PPE program manager
Research Foundation EFFECT facade fire risk tool, Tier 1 and Tier 2 Multi-story facade fire and egress risk in buildings over 18 m Portfolio owners and AHJs screening high-rise stock

Two more items appear in searches for the phrase NFPA risk assessment tool. NFPA’s Fire and Life Safety Ecosystem assessment is a yes-or-no questionnaire across eight components with a color-coded score, described by Meghan Housewright of the Fire and Life Safety Policy Institute in NFPA Journal. It scores a jurisdiction’s safety system as a whole.

The other is the ASHE NFPA 99 2021 risk assessment tool, a free template with Systems, Equipment and Emergency Management worksheets that hospitals adapt for their inventories. We cover it, and a working spreadsheet version, in the NFPA 99 risk assessment tool guide, and the healthcare code itself in the NFPA 99 risk assessment for healthcare facilities article.

Why the Codes Now Demand a Written Assessment

The case for running a documented NFPA risk assessment tool starts with the national loss record. NFPA’s fire experience survey for 2024, published by Shelby Hall in November 2025, counts 1,388,000 fires, 3,920 civilian deaths and $19 billion in property damage, with a fire every 23 seconds. The full report attributes 81 percent of the deaths to structure fires.

Figure 1. The 2024 US fire record

NFPA Risk Assessment Tool

Figure 1. Four figures from NFPA’s Fire Loss in the United States During 2024, published November 2025.

Deaths rose 6.8 percent on 2023 while injuries fell 11.8 percent, and the report names a manufacturing facility, industrial plants and apartment complexes as the largest single losses of the year. The catastrophic multiple-death fires report by Stephen Badger adds 12 incidents and 50 residential deaths, 13 of them children under six.

Combustible dust has its own record, and its own NFPA risk assessment tool. The CSB’s dust hazard study counted 281 incidents between 1980 and 2005 that killed 119 workers and injured 718, and its standing recommendation asks OSHA for a general industry dust standard built on NFPA’s. OSHA’s revised National Emphasis Program of January 2023 added lumber, baking and truss manufacturing, as AIHA summarized.

Standard Requirement Interval Evidence a surveyor or inspector asks for
NFPA 660 (effective Dec 6, 2024) Documented DHA for every process handling combustible particulate solids Revalidate at least every 5 years, sooner on change DHA report, action log, housekeeping and ignition-control records
NFPA 70E 130.5 Arc flash risk assessment before energized work Review at intervals not exceeding 5 years and after major modification Incident energy study or table method, labels, job safety plans
NFPA 99 4.1 Risk category for each building system and piece of equipment On installation and on change of use; CMS enforces the 2012 edition Category inventory, maintenance strategy, sign-off
NFPA 1300 Community risk assessment feeding a CRR plan Continuous cycle: assess, plan, implement, evaluate CRA document, CRR plan with goals and measures
NFPA 780 Annex L Strike-frequency assessment when the owner or AHJ wants proof At design and on structural change Annex L calculation sheet, protection decision
NFPA 1851 Risk assessment before selecting protective ensembles On program review and on new hazard exposure Assessment addressing the seven listed factors

The regulation behind each NFPA risk assessment tool has tightened since 2023. NFPA 660 took effect on December 6, 2024 and folded NFPA 61, 484, 652, 654, 655 and 664 into one combustible dust standard. Because the first DHAs under NFPA 652 fell due in late 2020, the five-year revalidations for thousands of facilities land in 2025 and 2026.

Healthcare follows the same pattern with its own NFPA risk assessment tool. CMS enforces the 2012 edition of NFPA 99, and Jensen Hughes notes that the code accepts ISO/IEC 31010 and NFPA 551 procedures as valid assessment methods. A facility that cannot show which category each system holds fails the survey question before any equipment is inspected, as the healthcare risk management framework explains.

How to Run an NFPA Risk Assessment Tool in Six Steps

Whichever NFPA risk assessment tool applies, the sequence is the same, and NFPA 551 describes it as a technical review and documentation process. The six steps below fit every fire, dust and electrical assessment, and they align with the generic risk assessment process that ISO 31000 sets out. The difference is in the inputs each NFPA clause demands.

Step Action NFPA input Output
1 State the purpose and the decision NFPA 551 4.4.1.1: identify whether the aim is to measure existing risk, reduce it, or set an acceptable level for a new design One-paragraph scope with the target at risk named: occupants, responders, property, operations or environment
2 Assemble the inventory NFPA 660: every process handling dust; NFPA 99: every system and device; NFPA 70E: every task and equipment condition Numbered asset or task list with location and owner
3 Identify hazards and ignition or failure modes Dust explosion pentagon; Table 130.5(C) normal versus abnormal condition; NFPA 99 failure consequence Hazard column populated for every row, none left blank
4 Score likelihood and severity NFPA 551 method category chosen to match the decision; 5 x 5 matrix for semi-qualitative work Score per row against a tolerable line agreed in step 1
5 Select controls in hierarchy order NFPA 70E hierarchy of risk controls: eliminate, substitute, engineer, warn, administer, then PPE Action log with owner, date and the residual score
6 Document, sign, schedule revalidation NFPA 660 five-year rule; NFPA 70E five-year review; NFPA 99 change-of-use trigger Signed report, dated, with the next review in the calendar

Most runs of an NFPA risk assessment tool go wrong at step one, so the NFPA 551 first revision spells out the purpose statement: the level of risk in an existing building, methods of lowering it, or an acceptable level for a new or renovated one. Write that sentence before opening a worksheet. The risk assessment methodology guide covers how the purpose drives the method.

Step three depends on the hazard inventory being complete, and the hazard identification guide gives the walk-down routine. For a dust process the evidence you need in hand before scoring is short, and every item below is something an inspector will ask to see:

  • Combustibility test data for each dust stream, or a documented reason for assuming the material is explosible
  • A layout drawing showing where dust is generated, conveyed, collected and can settle out of sight, including beams, ledges and false ceilings
  • Maintenance records for bearings, belts and drives that can run hot, plus the interlocks fitted to stop them
  • The location of every occupied room relative to the process, including offices and break rooms

Steps four to six of any NFPA risk assessment tool turn the inventory into a decision, and the residual risk explainer describes what the after-control score must show. Revalidation intervals are fixed by each standard, and the guide to assessment frequency lists the change triggers that pull a review forward.

The Five Method Categories in NFPA 551

NFPA 551 does not prescribe a method or an acceptance criterion for an NFPA risk assessment tool. It classifies methods so an authority can judge whether the one chosen was adequate; the guide’s product page names building officials and fire authorities as its readers. The five categories run from qualitative through semi-qualitative, quantitative and cost-benefit, as Fire-TechInfo summarizes.

Figure 2. NFPA 551 method categories

NFPA Risk Assessment Tool

Figure 2. The five NFPA 551 method categories, ordered by the data and modeling effort each requires.

Category Typical inputs Typical output Fits when
Qualitative Expert judgment, checklists, occupancy and hazard descriptions Ranked list, high-medium-low matrix Screening many assets or a small building with standard hazards
Semi-qualitative, criteria-based Indexed scores for building features against pass or fail criteria Score per feature with a compliance verdict Existing buildings measured against a code baseline
Semi-qualitative, consequence-based Fire scenarios with scored consequences and ranked likelihoods Risk matrix with scenario rows Facilities with distinct scenarios such as dust, storage or process fires
Quantitative Ignition frequencies, event trees, fire and egress modeling Expected loss or individual risk per year Performance-based design and high-consequence occupancies
Cost-benefit Quantified risk plus the capital and operating cost of each control Net present value or cost per life saved for each option Choosing between competing protection schemes

The current revision cycle adds detail on which targets an NFPA risk assessment tool must name: occupants, the general public, emergency responders, property, operations and business interruption, the environment and cultural resources. It also references risk matrices adapted from MIL-STD-882E, which is the matrix most qualitative risk assessment work already uses.

Our rule when choosing an NFPA risk assessment tool method is to start one category lower than instinct suggests. A semi-qualitative consequence-based register answers most facility questions, and the types of risk assessment article explains when a quantitative study is worth its cost.

Cost-benefit work belongs to decisions between sprinkler retrofit, compartmentation or detection upgrades, where the fire risk assessment guide gives the comparison structure.

A Worked Dust Hazard Analysis for a Wood Pellet Mill

The register below is a semi-qualitative, consequence-based NFPA risk assessment tool applied to a generic wood pellet plant with a grinding line, a hammermill, a bucket elevator and a dust collector on a tower’s top floor. It is illustrative and not Horizon Biofuels’ own analysis, which the CSB is still examining. The layout is common to small mills built inside adapted grain elevators.

The NFPA risk assessment tool scores on a 5 x 5 matrix, likelihood times severity, with a tolerable line at 9. Any row above the line needs a control with an owner and a date; any row at 20 or above stops the process until the control is in place. The risk assessment example article shows the same matrix in a different industry.

Register row Hazard and ignition path Before Control selected After
Hammermill bearing Bearing runs hot under load; dust film on housing ignites; flame front follows the conveyor 20 Bearing temperature interlock trips the mill; weekly infrared check 6
Bucket elevator Belt slip or misaligned bucket creates friction inside a dust-laden enclosure 20 Belt-alignment and speed-monitoring switches; explosion vent on the leg 4
Dust collector on top floor Ember carried by the air stream into the collector; deflagration in a confined vessel above occupied floors 16 Spark detection and extinguishing in the duct; vent to outside; isolation valve 4
Surge bin headspace Dust cloud in the bin headspace meets a static or hot-particle ignition source 12 Bonding and grounding verified; level control to limit free-fall height 4
Floor and beam dust Layers on beams and ledges lofted by a primary event feed a secondary explosion 15 Housekeeping schedule with a measured depth limit; sealed ledges 3
Break room next to tower Occupied room shares a wall with the process tower; collapse or flame reaches occupants 25 Relocate the break room away from the tower; blast-rated separation if it cannot move 5

Figure 3. Register scores before and after controls

NFPA Risk Assessment Tool

Figure 3. Six register rows from the worked dust hazard analysis, scored on a 5 x 5 matrix against a tolerable line of 9.

Four of the six rows in this NFPA risk assessment tool describe conditions OSHA later cited at Horizon Biofuels: grinder, hammermill, surge mixer and bucket elevator running without controls against hot surfaces. The break room row is the one that matters most in hindsight; the CSB update records that the two children were in a break room immediately north of the tower when it collapsed.

The plant’s history would have shaped the likelihood column. Nebraska Public Media reports four serious OSHA violations in 2012 that included failing to stop wood dust accumulating on and around milling equipment, and the CSB notes a February 2025 state air-quality complaint about dust blowing across the property line. A revalidation triggered by either event would have re-scored every row.

What the NFPA risk assessment tool leaves behind matters as much as the scores, because the revalidation five years later starts from this file and an investigator after an incident reads nothing else. Keep it in one place with the layout drawing. For each row the file should hold:

  • The evidence for the likelihood score: maintenance history, test data, inspection photos
  • The control’s design basis, such as the vent area calculation or the interlock setpoint
  • The owner, the completion date and the person who verified the control works
  • The next revalidation date and the change triggers that pull it forward

The ISO 12100 risk assessment template uses the same columns as an NFPA risk assessment tool for machinery hazards, and the injection molding risk assessment shows the format applied to a different process line with hot surfaces of its own. Both registers can share one action log with the dust rows above.

Picking the Right Assessment for Electrical, Healthcare, Community and Lightning Risk

Four NFPA risk assessment tool types come up more often than the rest, and each has its own logic. NFPA 70E section 130.5 requires an arc flash risk assessment before energized work; Table 130.5(C) decides likelihood from the task and the equipment’s operating condition. Normal means properly installed and maintained, doors and covers secured, and no evidence of impending failure.

Figure 4. NFPA 70E arc flash PPE categories

NFPA Risk Assessment Tool

Figure 4. Minimum arc ratings by PPE category in NFPA 70E 2024, from the University of Connecticut’s accessible reproduction of the tables.

Once likelihood is yes, the NFPA risk assessment tool works down the hierarchy of controls before PPE, and the University of Connecticut’s accessible tables list the four categories at 4, 8, 25 and 40 cal/cm². Leidos points out that the standard says reviewed, not recalculated, within five years, and that any distribution change that could alter incident energy triggers an immediate review.

Assessment Unit assessed Scoring logic Cycle Sibling guide
NFPA 70E 130.5 Task plus equipment condition Likelihood from Table 130.5(C); severity from incident energy or PPE category Review within 5 years; on system change Electrical safety program
NFPA 99 4.1 Building system or device Consequence of failure: major injury or death, minor injury, discomfort, no impact On installation and change of use NFPA 99 tool and healthcare guide
NFPA 1300 Jurisdiction across nine profiles Frequency, location and population affected, ranked for CRR planning Continuous assess-plan-implement-evaluate loop Community risk reduction
NFPA 780 Annex L Structure Expected strike frequency against a tolerable frequency set by consequence factors At design and structural change Lightning risk assessment
NFPA 1851 Protective ensemble program Seven required factors from duties to CBRN response Program review PPE selection

As an NFPA risk assessment tool, NFPA 99 scores consequence only. Category 1 means failure is likely to cause major injury or death, Category 2 minor injury, Category 3 discomfort, and Category 4 no impact on patient care, and the NFPA 99 risk assessment tool turns those definitions into a room-by-system worksheet. The risk assessment tool guide places it among the IEC 31010 techniques.

At the scale of a town, the West Virginia fire marshal’s summary of NFPA 1300 lists the nine profiles a community risk assessment must cover: building stock, community service organizations, demographics, economics, geography, hazards, past loss and event history, public safety response agencies and critical infrastructure systems. The standard then carries the result into a CRR plan.

CRAIG 1300, the Community Risk Assessment Insight Generator, is the dashboard version of that process and the one NFPA risk assessment tool NFPA itself licenses. NFPA and mySidewalk launched it in July 2021 after more than 300 communities piloted it, and NFPA has since licensed it to ESCI as the Community Risk Hub. Karen Berard-Reed, NFPA’s community risk reduction strategist, said it exists to remove the data hurdles departments face.

The lightning NFPA risk assessment tool uses a frequency calculation: Annex L compares the expected annual strike frequency for a structure with a tolerable frequency derived from construction, contents and occupancy factors. The NFPA 780 lightning risk assessment article works three examples, and the lightning risk assessment guide covers the IEC 62305-2 alternative.

For buildings over 18 meters, the NFPA risk assessment tool of choice is the Research Foundation’s EFFECT tool, built by Arup with Jensen Hughes review under the high-rise combustible facade project, screens portfolios in a Tier 1 desktop pass before Tier 2 inspection. Fire departments choosing protective ensembles run the NFPA 1851 assessment, which must address duties, frequency, climate, incident operations and CBRN response.

Seven Traps That Derail NFPA Assessments

When an NFPA risk assessment tool fails an inspector or an incident investigation, the defects are recognizable. The Horizon Biofuels record supplies three of them, the healthcare survey findings in our NFPA 99 healthcare guide supply two more, and the remaining two come from arc flash and community work. Each row pairs the defect with its fix.

Trap How it shows up Fix
Assessing the wrong standard A ‘fire risk assessment’ is filed for a dust process, with no DHA, no combustibility data and no ignition source review Map every process to its NFPA clause first; NFPA 660 for dust, 70E for electrical work, 99 for healthcare systems
Inventory gaps Ledges, false ceilings, conveyor enclosures and bucket elevators are absent from the register Walk the plant with the layout drawing; photograph hidden surfaces; add a row for every enclosure
Occupied rooms treated as outside scope Offices and break rooms adjoining the process are never scored Add an occupancy row for every room within the blast or collapse zone and score it first
Revalidation missed The 2020 DHA is the current DHA; the arc flash study predates the last switchgear change Diary the five-year date and the change triggers; treat a citation, complaint or near miss as a trigger
Consequence scored as likelihood NFPA 99 categories are assigned by how often equipment fails, not what happens to the patient when it does Score consequence to the patient only; the category follows the worst credible outcome
Table used without the assessment Table 130.5(C) or the PPE category table is copied onto labels with no documented risk assessment behind it Keep the assessment file: task list, condition check, hierarchy of controls, then PPE
Profiles without partners A community risk assessment is written from response data alone, ignoring building stock, demographics and infrastructure Stand up the CRR committee before the data pull; assign each of the nine profiles an owner

The costliest trap for any NFPA risk assessment tool is the fourth. The CSB update records that Horizon Biofuels employed five people with one operator per shift, so the five-year revalidation is the only scheduled look at its own dust. The physical security risk assessment report template keeps the revalidation date visible, and the risk assessment templates library carries the register format.

NFPA Risk Assessment Tool: Your Questions Answered

Is there an official NFPA risk assessment tool I can download?

Not a single one: NFPA sells the standards that require assessments and licenses CRAIG 1300 for community risk, ASHE publishes a free NFPA 99 tool, and the Research Foundation hosts EFFECT for facades. For a dust hazard analysis or an arc flash study you build the register or engage a qualified person; the one above is a starting point.

Which NFPA risk assessment tool applies to a warehouse?

A general fire risk assessment judged against NFPA 551, plus NFPA 70E for any energized electrical work by staff, plus NFPA 660 if the goods or the process produce combustible dust. If the building exceeds 18 meters, the facade and egress screening in EFFECT adds a portfolio view. The fire risk assessment definition article sets the baseline scope.

How often must an NFPA risk assessment tool be re-run?

For dust, the NFPA risk assessment tool runs on a fixed cycle: NFPA 660 requires DHA revalidation at least every five years and sooner when processes, materials or equipment change. NFPA 70E requires the arc flash risk assessment to be reviewed within five years and after any major modification. NFPA 99 categories change with the use of the room, and the fire risk assessment validity guide covers general fire assessments.

Does an NFPA risk assessment tool satisfy OSHA?

OSHA has no general industry combustible dust standard, so it cites under housekeeping, the general duty clause and the National Emphasis Program, using NFPA standards as the recognized practice. A current DHA under NFPA 660 is the strongest evidence a facility can show; for electrical work OSHA enforces 1910.331 to 335 and treats NFPA 70E as the accepted method.

What does an NFPA risk assessment tool cost to run?

Running an NFPA risk assessment tool such as a semi-qualitative DHA for a small plant costs two to four days of a qualified person’s time plus combustibility testing for each dust stream. An arc flash incident energy study is priced per bus and switchgear lineup. The OSHA penalty proposed at Horizon Biofuels, about $150,000 according to WOWT, exceeded what either assessment would have cost.

Can one NFPA risk assessment tool cover dust, electrical and lightning risk together?

One NFPA risk assessment tool register can hold all three, but the scoring stays separate: a 5 x 5 matrix for dust, Table 130.5(C) plus incident energy for arc flash, and the Annex L frequency comparison for lightning. Merge them in the action log and report them through the key risk indicators a site already tracks.

Where the Profession Is Heading

Through 2026, most first dust hazard analyses completed under NFPA 652 will be past their five-year revalidation date, and Prime Process Safety expects inspectors to ask for the revalidation record instead of the original. Plants inside adapted feed buildings, as Horizon Biofuels was in a 1973 mill, will draw the most attention: their layouts were never designed for dust.

The parent NFPA risk assessment tool standard, NFPA 551, is in revision, with the first-revision report of April 2025 tightening the purpose statement and the list of targets at risk, and NFPA 70E is in its 2027 cycle. Expect both to push assessors toward stating the decision before choosing the method, which is the discipline the risk assessment program article builds into an annual cycle.

The community NFPA risk assessment tool is moving from spreadsheet to dashboard. CRAIG 1300’s license to ESCI puts NFPA 1300’s nine profiles in front of consultants as well as departments, and the concrete pouring risk assessment and other site-level guides show how a single facility’s data feeds the jurisdiction’s hazard profile. Start by identifying the risks a town has never written down.

When a plant or hospital needs each NFPA risk assessment tool mapped to the right clauses and rebuilt as one signed register, we run the six steps with the site team and return the register and action log. The services page lists the formats and the contact page starts it. Our first question is which room shares a wall with the process.