Martyn's Law risk assessment template and guide
The Act doesn't ask for a document called a "risk assessment" - it asks for procedures appropriate to your premises, so far as reasonably practicable. In practice, getting there means doing assessment work first. Here's a structure that holds up.
What the Act actually expects
The legal standard is procedures "so far as reasonably practicable" for your specific premises - not a generic plan, and not an unlimited obligation to prepare for every conceivable scenario regardless of cost or likelihood. That phrase does real work: it means your procedures should be proportionate to what your premises realistically faces, not a copy-paste of a template built for a different kind of venue.
To get from that principle to something usable, you need to think through what could actually happen at your premises, and what you'd do about it. That thinking is the assessment, even though the Act doesn't name it that way.
Realistic attack scenarios to consider
Government guidance and sector practice point to five broad categories worth thinking through for most premises:
- Vehicle as a weapon - a vehicle driven into a crowd or through a barrier.
- Bladed weapon attack - a knife or similar weapon used against people on site.
- Marauding attacker - an armed individual or group moving through a premises targeting people.
- Fired projectile - a firearm used against people on or near the premises.
- Improvised explosive device (IED) - a device left, carried, or detonated on or near the premises.
Not every scenario is equally relevant to every premises - a small retail unit with no vehicle access nearby has a different profile to an outdoor event with a vehicle drop-off route. The point is to have actually considered each one for your site, not to write identical procedures regardless of the venue.
Mapping scenarios to your four procedure categories
Each scenario should point you towards which of the four response categories matters most:
| Scenario | Most relevant response |
|---|---|
| Vehicle as a weapon | Lockdown, invacuation (move people away from the access route) |
| Bladed weapon attack | Evacuation or invacuation, depending on the attacker's location |
| Marauding attacker | Lockdown, communication (get people out of sightlines, tell them what's happening) |
| Fired projectile | Lockdown, invacuation |
| IED | Evacuation to a safe distance, communication |
Most premises will find lockdown and communication doing a lot of work across scenarios, which is often the first sign that those two procedures deserve more detail than a single paragraph.
A copyable template
A simple five-column table keeps the assessment auditable and easy to review later:
| Scenario | Vulnerability | Procedure | Owner | Review date |
|---|---|---|---|---|
| Vehicle as a weapon | Unrestricted vehicle access to main entrance | Lockdown front doors; invacuate to rear hall | Duty manager | Jan 2027 |
| Bladed weapon attack | Single staffed entrance, no second exit staffed | Evacuate via fire exit B; call 999 | Site security lead | Jan 2027 |
| Marauding attacker | Open-plan ground floor, limited lockable rooms | Lockdown to two designated rooms; PA announcement | Duty manager | Jan 2027 |
| … | … | … | … | … |
Add a row per scenario you've considered, keep the owner as a named role rather than "management", and set a review date you'll actually keep - annually, and after any change to the building or its use.
How this differs from a fire risk assessment
It's tempting to treat this as "another fire risk assessment" and reuse the same paperwork. It shouldn't be. A fire risk assessment, required under separate fire safety law, addresses accidental fire hazards - electrical faults, flammable storage, escape routes for a fire that starts somewhere specific and grows predictably. Martyn's Law addresses deliberate hostile acts, where the "hazard" is a person choosing to cause harm, and the response often needs to be faster and more instinctive than a fire evacuation. Some infrastructure overlaps - the same fire exits often double as evacuation routes - but the thinking behind each assessment is different, and a venue that has only ever done a fire risk assessment has not yet done this one.
Turn the assessment into a document. VenueDuty Pro (£29 one-time) generates a Public Protection Procedures document built from this same evacuation/invacuation/lockdown/communication structure - 40 clauses, printable, with a review log matching the table above. Start with the free tier check.
Check my duty tier — freeFrequently asked questions
What is the Martyn's Law assessment?
The Act doesn't call for a formal risk assessment document by that name. It expects procedures, so far as reasonably practicable, appropriate to your premises - which in practice means thinking through realistic attack scenarios and mapping each to a procedure, owner and review date, as above.
Is there a standard risk assessment template?
No single template is mandated, but a scenario / vulnerability / procedure / owner / review-date table, like the one above, is a practical, widely usable structure.
What is required under Martyn's Law?
Procedures for evacuation, invacuation, lockdown and communication for standard duty, plus documented public protection measures for enhanced duty. See our requirements guide for the full breakdown - the assessment work above feeds directly into writing those procedures.
Is Martyn's Law the same as a fire risk assessment?
No. A fire risk assessment addresses accidental fire hazards under separate fire safety law. Martyn's Law addresses deliberate hostile acts - a different threat model that needs its own thinking, even though some infrastructure, like evacuation routes, overlaps.