Swiss Cheese Theory and Fire Safety: How Multiple Failures Combine to Create Risk
Most serious fire safety failures are not caused by a single catastrophic mistake. They are caused by several small weaknesses — in maintenance, training, management, and physical protection — that happen to line up at the same moment. Swiss Cheese Theory explains why, and what responsible persons can do about it.
Fire safety incidents have a stubborn tendency to look obvious in retrospect. Once investigators have pieced together what happened, the sequence of failures often seems almost inevitable — a propped-open fire door here, an overdue inspection there, a member of staff who was never properly trained, an alarm fault that had been logged but not fixed. The question that follows — how did so many things go wrong at once? — is one that Swiss Cheese Theory was developed specifically to answer.
Understanding this model does more than satisfy intellectual curiosity. It changes how responsible persons, building managers, and fire safety professionals think about risk, and it points directly to the practical steps that reduce the likelihood of failures combining into a serious incident. For anyone responsible for a fire risk assessment, managing a building, or overseeing fire safety across a portfolio of properties, it is one of the most useful frameworks available.
The origin of the Swiss Cheese Model
The Swiss Cheese Model was developed by Professor James Reason, a British psychologist whose career was devoted to understanding human error and how accidents occur in complex systems. Reason argued, influentially, that serious accidents are almost never the result of a single failure by a single individual. Instead, they emerge from the interaction of what he called latent conditions — weaknesses embedded in the system itself, often long before anyone recognises them as dangerous — and active failures, the immediate actions or omissions that trigger the final sequence of events.
His model, set out in his 1990 book Human Error and developed in subsequent research, visualises a system's defences as a series of slices — like slices of Swiss cheese laid side by side. Each slice represents a layer of protection: a physical barrier, a procedural control, a piece of equipment, a training programme, a management system. Every slice has holes, representing weaknesses or gaps in that particular layer. In normal operation, the holes in different slices do not align, and a hazard that gets through one layer is stopped by the next. An accident happens when, at a particular moment, the holes in multiple layers happen to line up, creating an unobstructed path from the initiating hazard all the way to harm.
Reason's contribution was to shift the analytical focus away from blaming the individual — the worker who made the final mistake — and towards understanding why the system had allowed such a hazardous alignment to develop in the first place. His thinking proved enormously influential across safety-critical industries, including aviation, healthcare, nuclear power, and fire safety, and it remains the dominant conceptual framework for understanding complex system failures.
How the model applies to fire safety
Fire safety is, by design, a layered system. No single measure is expected to prevent every fire or protect every occupant on its own. Instead, a series of overlapping controls are put in place — prevention, detection, compartmentation, suppression, escape, training, management oversight — so that if one layer is penetrated or fails, others remain to limit the consequences. This is precisely the kind of system Swiss Cheese Theory was built to describe.
Each layer in a fire safety system can be thought of as a slice of cheese, with its own potential holes. The following are the main layers that apply to most commercial and residential premises, along with the kinds of weaknesses that open holes in each.
Prevention
Prevention is the first and most fundamental layer — keeping ignition sources away from fuel and oxygen, managing the storage and use of flammable materials, and controlling activities such as hot works that introduce additional fire risk. The holes in this layer include poor housekeeping, inadequate control of contractors, unsupervised electrical equipment, and the accumulation of combustible materials in areas where ignition sources are present. For warehouses and industrial premises in particular, the fire load can be very high, and the prevention layer bears significant weight.
Detection and alarm
An early-warning system that detects fire and alerts occupants quickly is one of the most important life-safety measures in any building. Holes in this layer include detector heads that are not maintained or tested regularly, alarm faults that have been logged but not repaired, systems that do not cover all occupied areas, alarm grades that are insufficient for the building type, and — in buildings with sleeping accommodation such as hotels or HMOs — systems that cannot reliably wake sleeping occupants. A fire that has been burning for several minutes before the alarm activates has already eaten significantly into the available evacuation time.
Compartmentation
Fire-resisting construction — walls, floors, and fire doors — is intended to contain a fire within the area of origin, limiting its spread and buying time for evacuation and fire service intervention. This layer is undermined by fire doors that have been propped open, damaged, or incorrectly installed; by penetrations in fire walls from services or building works that have not been properly fire-stopped; by damaged or incorrectly specified fire-resisting glazing; and by alterations to the building that have compromised compartment walls without proper assessment. Compartmentation failures are among the most consequential holes in the fire safety system, because once fire and smoke spread beyond the compartment of origin, available escape time shrinks rapidly.
Suppression
Suppression systems — sprinklers, gaseous suppression, and portable fire extinguishers — can control or extinguish a fire before it reaches a size that threatens life or causes widespread damage. The holes here include extinguishers that are out of date, incorrectly specified for the fire risks present, or located where staff cannot reach them quickly; suppression systems that have not been serviced or tested in accordance with the relevant British Standards; and buildings where suppression has never been considered despite a high fire load or critical risk profile.
Escape and evacuation
Even where prevention, detection, and suppression all partially succeed, the means of escape and the evacuation plan must be capable of getting everyone out safely. Holes in this layer include escape routes that are obstructed by stored goods, locked or difficult-to-open fire exits, inadequate emergency lighting, poor or missing fire exit signage, an evacuation plan that has not been updated to reflect changes in the building or its occupancy, and assembly points that are too close to the building or too small for its maximum occupancy. Our guidance on fire escape and evacuation planning covers this layer in detail.
Training and human response
The physical layers of fire safety — compartmentation, suppression, escape routes — all depend to some degree on human action to be effective. Staff need to know how to respond when the alarm sounds, what their specific responsibilities are, and how to assist others who may need help evacuating. The holes in this layer are opened by inadequate or infrequent fire safety training, high staff turnover in sectors such as hospitality and care where trained staff leave and are replaced by those who have not yet received training, fire wardens who have not been briefed on their specific duties, and organisations that conduct fire drills infrequently or not at all. In schools, care homes, and hotels, the human response layer is particularly critical, because the people in the building may include those who cannot self-evacuate and who depend entirely on staff to get them out safely.
Management and oversight
Underpinning all of the physical and procedural layers is the management system — the responsible person's oversight of fire safety across the premises, the frequency and quality of inspections, the rigour with which action lists from fire risk assessments are followed up, and the priority given to fire safety maintenance alongside competing operational demands. This is the layer that most directly determines the condition of all the others. A responsible person who takes fire safety seriously, who ensures that assessments are current, that maintenance is carried out on time, and that staff training is kept up to date, is continuously shrinking the holes in every layer below. A responsible person who treats fire safety as a compliance exercise, commissioning an assessment and then filing it without acting on its findings, allows holes in every layer to grow.
The key insightIn Swiss Cheese terms, every fire safety failure — every propped door, every outdated extinguisher, every untrained staff member, every overdue inspection — is a hole in one layer of the system. No single hole causes an accident. The accident happens when enough holes, across enough layers, happen to align at the same moment as an initiating event.
Le Constellation: a tragic alignment
The fire at the Le Constellation bar in North Macedonia on New Year's Eve 2024 illustrates the model with devastating clarity. The initiating event — fountain sparklers igniting flammable acoustic foam on the ceiling — was the kind of incident that the fire safety system should have been capable of containing. In a building with functioning compartmentation, a working alarm system, clear escape routes, and trained staff, the consequences need not have been so catastrophic.
Instead, investigators found that multiple layers had failed simultaneously. Allegations made in the aftermath included: that the venue had not been subject to a fire safety inspection since 2019, despite annual inspections being required; that staff had not received adequate fire safety training; that emergency exits were obstructed; and that the acoustic foam used on the ceiling — the material that allowed the fire to spread so rapidly — was combustible and should never have been installed. Each of these was a hole in a different layer of the fire safety system, and on that night, they aligned.
The tragedy is that none of these individual failures was unusual or difficult to address. Inspection programmes lapse. Training is deferred. Escape routes become obstructed. Materials are specified without adequate consideration of their fire performance. These are common findings in fire risk assessments across all building types. What was unusual — and catastrophic — was that so many of them coexisted in the same building at the same time.
What changes when you think in layers
One of the most practically useful aspects of the Swiss Cheese Model is the way it reframes the significance of individual small failures. A propped-open fire door is annoying; in isolation, it probably will not cause a serious incident. But a propped-open fire door in a building where the alarm system has an unresolved fault, where the escape route on the floor above is partially obstructed, and where the night staff have never been trained — that is a very different situation. The same hole, in a different configuration of layers, carries very different risk.
This means that responsible persons who think in layers are better placed to prioritise their attention and resources. Rather than treating each fire safety deficiency as an independent item to be closed out on a list, they ask: which holes, in combination with other weaknesses I know about, represent the greatest risk of alignment? A building with strong compartmentation and a well-maintained alarm system can afford to treat a minor housekeeping deficiency differently from a building where both of those layers are already compromised.
It also means that change — in the building's use, layout, or occupancy — deserves particular attention, because change often opens new holes in layers that were previously sound. A warehouse that introduces overnight operations has created a new hole in the human response layer — fewer staff, less supervision, potentially different people in the building from those named in the fire warden rota. A school that converts a storage area into a classroom has potentially affected the compartmentation of that part of the building. An office that takes on a new tenant in a previously vacant suite has introduced new occupants whose evacuation needs and familiarity with the building's alarm system are unknown. Each of these changes warrants a review of the fire risk assessment and, where relevant, a check that the other layers of the system remain sound.
The most common holes we find
In carrying out fire risk assessments across offices, care homes, schools, hotels, warehouses, HMOs, and churches throughout Chester, Cheshire, the Wirral, and the wider North West and North Wales, we find the same holes appearing across the layers of the fire safety system with some regularity. The following are among the most frequent.
Fire doors propped open, damaged at the base or edges, fitted with incorrect or missing hardware, or closing improperly because of dropped hinges or swollen frames. Each represents a hole in the compartmentation layer. In buildings with multiple fire doors on escape routes, the cumulative effect of several marginally defective doors can be significant.
Alarm systems with faults that have been acknowledged in the log but not acted upon. In some cases faults persist for weeks or months, during which time a section of the building may not be covered by detection. This is a significant hole in the detection layer, particularly where the affected zone includes sleeping accommodation or an area of high fire load.
Corridors used for storage, fire exits blocked by delivery goods, or emergency lighting units not functioning. These are holes in the escape layer that may go unnoticed precisely because they do not cause any day-to-day problem — until the moment they are needed.
Staff who have never received fire safety training, fire wardens whose training has lapsed, or organisations where a training session was delivered two years ago but significant numbers of the current workforce were not employed at that time. High-turnover sectors such as hospitality and care are particularly vulnerable to this pattern.
Fire risk assessments that identified significant findings — inadequate compartmentation, insufficient detection coverage, defective fire doors — whose action lists have never been acted upon. The assessment has diagnosed the holes, but they have not been filled. This is arguably the most troubling pattern, because it means the responsible person was aware of the risk and did not address it.
Flammable decorative materials, combustible ceiling or wall finishes, or accumulated waste in plant rooms, electrical cupboards, or beneath stairs. These are holes in the prevention and compartmentation layers simultaneously, because they both increase the likelihood of ignition and accelerate fire spread if ignition occurs.
A fire risk assessment that is several years old and has not been reviewed following material changes to the building — or that does not exist at all. Without a current assessment, the responsible person cannot know which holes exist in which layers, and cannot manage the risk of their aligning.
Three principles for keeping the holes from aligning
Swiss Cheese Theory does not suggest that it is possible to eliminate all holes from all layers — in practice, no building and no fire safety system is perfect at every moment. What it does suggest is that the goal of fire safety management is to keep the holes small, to keep them in different positions across different layers, and to ensure that no single initiating event is likely to find an unobstructed path through all of them. Three principles follow from this.
Maintain the depth of your defences
Do not allow the overall number of layers to reduce. A building with strong compartmentation, a well-maintained alarm system, clear escape routes, trained staff, and a current fire risk assessment is resilient to the inevitable small failures in individual layers, because other layers will compensate. A building that has allowed one or two of these layers to deteriorate significantly is much more vulnerable, because the remaining layers have to carry the weight of the missing ones. Managing agents with responsibility for multiple properties should think about this at portfolio level as well as building level — a property whose fire risk assessment is overdue, whose alarm system is due for service, and whose fire door inspection is outstanding is a building where multiple layers may have deteriorated simultaneously.
Treat change as a trigger for review
Change in a building — in its use, its occupancy, its layout, or its management — is consistently associated with the opening of new holes. The responsible person who reviews their fire risk assessment promptly when a material change occurs, and who checks that the other layers of the system remain sound in the light of that change, is much less likely to find themselves in a situation where multiple holes have aligned without anyone noticing. The responsible person who allows changes to accumulate without review is, in Swiss Cheese terms, allowing new holes to open in multiple layers at once.
Close the holes you know about
The most straightforward application of the model is also the most important. A fire risk assessment that identifies significant findings — defective fire doors, inadequate detection, obstructed escape routes, training gaps — is producing a map of the holes in the building's layers. Acting on those findings closes the holes. Failing to act on them leaves them open, and allows the risk of alignment with other weaknesses to persist. Fire safety training, fire door inspections, regular fire alarm servicing, and periodic reassessment are all, in these terms, acts of hole-closing — each one reducing the probability that a hazard will find an unobstructed path through the system.
A note on complacencyOne of Professor Reason's important observations was that the absence of incidents can itself contribute to risk. A building that has not had a fire in many years may generate a sense that the current arrangements are adequate, discouraging the investment of time and money in maintenance and review. Swiss Cheese Theory suggests a different reading: the absence of an incident simply means that the holes have not aligned — yet. The holes themselves may still be growing.
How a fire risk assessment maps the holes
A fire risk assessment is, in Swiss Cheese terms, a systematic examination of the holes in each layer of a building's fire safety system. A competent assessor looks at each layer in turn — prevention, detection, compartmentation, suppression, escape, training, management — identifies the weaknesses present in each, and produces a prioritised action list for addressing those weaknesses. The overall picture that emerges tells the responsible person not just which individual deficiencies exist, but how the combination of deficiencies across layers affects the building's overall resilience.
This is why the quality and currency of the fire risk assessment matters so much. An assessment produced several years ago, before significant changes were made to the building, may have accurately mapped the holes as they existed at that time. But if the holes have since moved — if a door that was in good condition has deteriorated, if a training programme that was current has lapsed, if a new partition has compromised compartmentation — the map no longer reflects reality, and the responsible person is navigating blind.
At Fletcher Risk Management, we carry out assessments across all building types throughout Chester, Cheshire, the Wirral, North Wales, and the wider North West — treating each building as a working system rather than a static checklist. We look at how the premises is actually used, which layers are most critical given the specific risks and occupancy involved, and which combinations of weaknesses represent the greatest risk of alignment. For managing agents with multi-property portfolios, we can provide coordinated assessments that give a consistent picture across a range of buildings, supporting the kind of portfolio-level oversight that Swiss Cheese Theory suggests is important.
Details of all the sectors we work in — including offices and commercial premises, HMOs, care homes and healthcare, schools, hotels and hospitality venues, warehouses and industrial premises, and churches and places of worship — are on our sector pages. Our regional coverage page sets out the areas we serve across the North West and North Wales. If you have concerns about the state of the layers in your building, or if your fire risk assessment is overdue, please get in touch.
Are the holes in your building lining up?
A current, competent fire risk assessment is the starting point for understanding where your building's defences are weakest. Fletcher Risk Management works with businesses, landlords, care homes, schools, and managing agents across Chester, Cheshire, the Wirral, and the North West. Please get in touch.