How often should you really re-audit a building

Ask how often a building should be re-audited and the usual answer is "annually", said with the confidence of a settled rule. It is not a settled rule. It is a sensible default that has hardened into a habit, and treating it as a law of nature leads to two errors at once: auditing stable buildings more than they need, and auditing volatile ones less than they deserve. In our view the right question is not "how often" in the abstract but "what is this building's risk, and how fast is it changing", and the interval should fall out of the answer.

The calendar is a poor proxy for risk

A twelve-month cycle assumes every building ages at the same rate, which they plainly do not. A quiet, low-rise block with stable occupancy and no recent works drifts slowly. A high-rise undergoing remediation, with contractors in and out and the fabric in flux, drifts fast. Holding both to the same annual interval means the calm building gets attention it did not need and the busy one goes too long between looks. The calendar is convenient because it is fixed, but the thing it is standing in for, the rate at which a building departs from its last assessment, is not fixed at all.

This is not an argument against annual audits. For many buildings, annual is about right. It is an argument against assuming annual without asking why.

What should actually drive the interval

A handful of factors do most of the work in setting a sensible interval. The higher a building scores across these, the shorter the gap between audits should be.

• Inherent risk profile. Height, occupancy and use matter. A higher-risk building under the Building Safety Act 2022, at least 18m tall or at least 7 storeys with at least two residential units, carries duties and consequences that a two-storey block does not.
• Rate of change. Buildings under active works, with frequent contractor activity or churning occupancy, move faster and need looking at sooner.
• Vulnerability of occupants. Where residents would struggle to evacuate, the cost of an undetected problem rises, and so should the frequency.
• Track record. A building with a history of failed checks or a thin maintenance record has earned a closer eye than one with a clean run.
• The strength of your running record. If day-to-day change is well logged, a formal re-audit confirms a known position and can sometimes sit on a longer cycle. If the running record is weak, the audit is doing more of the work and needs to come round sooner.

A risk-based pattern we find defensible

Rather than a single interval, we prefer a banded approach that ties frequency to risk. Something like the following is a reasonable starting point, to be adjusted for the specific building.

We would stress that even the lower band is not "set and forget". A trigger, which we come to next, can pull any building forward regardless of where it sits on the calendar.

Triggers beat intervals

The most important point we would make is that material change should override the schedule. A re-audit interval sets the floor, the maximum time you let pass. It should never stop you re-assessing sooner when something happens. A cladding alteration, a change of use, a fire affecting a unit, a serious near-miss, a wave of contractor works on the fabric: each is a reason to look again now, not at the next scheduled date. Where a building falls within the higher-risk regime, the golden thread duty under the Building Safety Act 2022 already expects the record to be kept current through occupation, which is the same idea expressed as a continuous obligation rather than a periodic one.

The practical implication is that you need to know when material change happens, which means logging it as it occurs. An interval without trigger awareness is just a hope that nothing important happened between audits. We wrote about the running-record side of this in keeping audits current when the building keeps changing.

Document the reasoning, not just the date

Whatever interval you settle on, write down why. A regulator or an insurer asking why a building is on an eighteen-month cycle is reassured by a recorded rationale tied to risk, and unconvinced by "that is what we do". The interval is a judgement, and judgements should leave a trail. The same goes for shortening an interval after a trigger: note what changed and why you brought the next audit forward. That record turns a defensible decision into a provably defensible one.

Let the system carry the schedule

The reason intervals default to annual is partly that variable schedules are harder to remember. A building on a fixed yearly cycle is easy to chase; a portfolio of buildings each on its own risk-based interval, with triggers that can pull any of them forward, is not, at least not by memory. That is precisely the kind of work a compliance calendar should carry, so the schedule reflects risk rather than convenience and nothing slips because it was on an unusual cycle.

This is how SAMRISK approaches it: risk-based audit scheduling, change events that can trigger an earlier look, and a calendar that chases the next date whether it falls in twelve months or six. You can see the shape on the audits and compliance calendar pages. The honest answer to "how often should you re-audit" is "as often as the building's risk and rate of change require, and sooner if something material happens". Annual is a fine default. It should not be the end of the conversation.