The previous articles in this series addressed two foundational questions. The first asked whether your Community Risk Assessment is actually telling you the truth. The second examined who should be involved in producing it.

This article addresses the question that follows both of those — and the one that arguably matters most.

Now that you have a CRA, what do you do with it?

It is not a rhetorical question. Across the fire service, completed Community Risk Assessments sit in binders, in shared drives, and in email attachments that were opened once and never revisited. The departments that produced them did the work honestly and thoroughly. They engaged stakeholders, collected data, and documented findings with genuine care.

And then nothing changed.

This is not a failure of intent. It is a failure of process — specifically, the process that should exist between completing a CRA and building a CRR program around it. Most departments invest significant energy in producing the community risk assessment and almost no structured thinking in what comes next.

That gap is where Community Risk Reduction goes to die.

The CRA Is Not the Destination — It Is the Map

The most useful reframe for a completed CRA is this: it is not a finished product. It is a navigation tool.

A map does not move you anywhere on its own. It tells you where you are, what terrain lies ahead, and which routes are available. The decisions about where to go, how fast to travel, and what resources to bring — those still belong to leadership.

The CRA does the same thing. It tells you what risks exist, where they are concentrated, which populations are most vulnerable, and where the gaps between current prevention efforts and actual community need are largest. The decisions about what to prioritize, what programs to build, and how to allocate resources — those require deliberate leadership action that the document itself cannot provide.

Understanding this distinction matters because it changes how departments approach the CRA from the beginning. If the goal is to produce a document, the work ends at publication. If the goal is to use the document to reduce risk, the work is just beginning.

Step One: Translate Community Risk Assessment Findings Into Priorities

The first action after completing a CRA is the one most departments skip or rush — translating findings into a clear, ranked set of priorities.

A thorough CRA will surface more risks than any department can address simultaneously. That is not a problem. It is useful information. The CRA has done its job by revealing the full landscape. Leadership’s job is to decide where to focus first.

Prioritization should be driven by a combination of factors. Frequency matters — risks that occur often have more impact potential than rare events. Severity matters — risks that result in death, serious injury, or catastrophic loss deserve weight beyond their frequency. Vulnerability matters — populations with limited capacity to protect themselves warrant prioritization even when their raw incident numbers are lower. And gap analysis matters — risks that are already well-addressed by existing programs deserve less new attention than risks that current efforts are not touching at all.

This prioritization conversation should happen with the same breadth of internal representation that informed the CRA process itself. If the findings came from a broad internal team, the prioritization should reflect that same breadth. A chief making unilateral prioritization decisions based on a CRA produced by a diverse team loses much of the value that diverse team created.

Document the priorities explicitly. A ranked list of the top five to seven risk priorities, with the CRA data supporting each ranking, becomes the strategic foundation for everything that follows.

Step Two: Build Programs Around Priorities, Not the Other Way Around

This is where many departments make a second critical mistake. They complete the CRA, identify priorities, and then map existing programs onto those priorities rather than building programs designed to address them.

The result is a CRA that validates existing activity rather than driving new strategy. The smoke alarm campaign continues because it always has. The school visit program continues because the relationships are established. The inspection schedule continues unchanged. The CRA findings get acknowledged in a planning document and then quietly set aside as operations return to normal.

This pattern is understandable. Existing programs have momentum, relationships, and often dedicated staff. Changing them is disruptive.

But if the CRA revealed that the department’s top three risk priorities are not being meaningfully addressed by current programs, those programs — however well-intentioned — are not the answer. New approaches, new partnerships, new resource allocations, or new tools may be required.

The discipline required here is to let the CRA findings drive program decisions rather than letting existing programs absorb CRA findings without changing.

Ask directly: for each of our top priorities, what does the evidence say about what works? Who else is addressing this risk and how? What does our community actually need that we are not currently providing? The answers to those questions should shape programs — not the comfort of continuing what is already familiar.

Step Three: Assign Ownership and Build Accountability

A priority without an owner is a wish.

Every risk priority that emerges from the CRA process needs a clearly designated owner — a person or team responsible for developing and executing a strategy to address it. Ownership does not mean that one person does all the work. It means that one person or team is accountable for ensuring that work happens, that progress is tracked, and that results are reported.

This is where the CRA connects to organizational structure. If the findings reveal that fall prevention among seniors is a top priority, who owns that? If the data shows that a specific geographic area has significantly elevated residential fire risk, who is responsible for developing and executing a targeted intervention strategy for that area?

Without clear ownership, CRA priorities drift. They appear in planning documents, get referenced in budget presentations, and then slowly lose visibility as the daily demands of operations absorb available attention and energy.

Clear ownership also enables accountability. When priorities have owners, progress can be tracked, reported, and evaluated. When priorities belong to everyone, they effectively belong to no one — a pattern that the previous articles in this series have addressed directly.

Step Four: Connect the CRA to Resource Allocation

One of the most powerful — and most underutilized — applications of a completed CRA is using it to inform resource allocation decisions.

Budget requests that are grounded in CRA findings carry significantly more weight than requests based on historical spending patterns or general statements about prevention needs. When a chief can tell a city manager that the CRA identified a specific population with significantly elevated fire risk in a specific geographic area, and that addressing that risk requires a specific investment in personnel, technology, or programming, the conversation is fundamentally different than a generic request for more prevention funding.

The CRA gives CRR departments something they rarely have: a defensible, data-driven rationale for where resources should go. Using it that way requires intentional effort to connect CRA priorities to budget narratives, staffing decisions, technology investments, and partnership development.

This is also where structured community assessment data becomes particularly valuable. Data collected through Virtual CRR home safety assessments, for example, provides ongoing visibility into residential risk conditions across the community. As departments implement programs in response to CRA priorities, this data can track whether conditions are actually changing — giving leadership both the evidence base for continued investment and the documentation of impact that city leadership increasingly expects.

Step Five: Report Progress to Leadership and Stakeholders

A CRA that produces priorities, programs, and accountability structures but never reports progress has one more failure point remaining — the failure to demonstrate value to the people who fund and support CRR efforts.

City managers, elected officials, and community stakeholders need to see that the CRA process produced something beyond a document. They need to see that priorities were identified, programs were built, resources were deployed, and outcomes are being tracked.

This reporting does not need to be elaborate. A quarterly update that connects CRA priorities to program activity and early outcome indicators is often sufficient to maintain executive visibility and political support. Over time, as data accumulates and programs mature, the reporting becomes richer — and the case for sustained CRR investment becomes progressively stronger.

Departments that report CRA-driven progress consistently build something that is difficult to achieve through any other means: institutional credibility for prevention as a core function rather than a peripheral activity.

Step Six: Revisit and Refresh

A Community Risk Assessment is not a one-time event. Communities change. Populations shift. New hazards emerge. Economic conditions evolve. The risk profile that was accurate when the CRA was completed may look significantly different three years later.

Departments should establish a regular cycle for revisiting CRA findings — annually at minimum for a high-level review, and on a defined longer cycle for a comprehensive refresh. This does not necessarily mean repeating the full assessment process every year. It means maintaining active awareness of whether the priorities identified in the CRA still reflect current reality, whether new data sources have emerged that should inform the analysis, and whether programs built around CRA priorities are producing the outcomes they were designed to achieve.

The goal is a living strategy — one that evolves as the community evolves — rather than a static document that becomes outdated within months of its completion.

From Assessment to Action

The departments that get the most from their Community Risk Assessment are not necessarily the ones that produced the most thorough document. They are the ones that treated the document as the beginning of a process rather than the end of one.

They translated findings into priorities. They built programs around those priorities rather than mapping priorities onto existing programs. They assigned ownership and built accountability. They connected CRA findings to resource allocation conversations. They reported progress to the people who need to see it. And they committed to revisiting and refreshing their understanding of community risk over time.

That is what it looks like to actually use a Community Risk Assessment.

The CRA does not reduce community risk. The decisions and actions that flow from it do.

Brent Faulkner, MAM, FO, is the CEO and Founder of Virtual CRR Inc.
A retired Battalion Chief from Anaheim Fire & Rescue, Brent brings 28 years of fire service experience, including leadership in structure fires, wildland operations, hazardous materials response, EMS incidents, and specialized rescue operations. He also served 17 years on a Type 1 Hazardous Materials Response Team.

A defining moment in Brent’s career came while leading Critical Infrastructure Protection (CIP) efforts at a DHS-recognized Terrorism Fusion Center. There, he oversaw initiatives to safeguard critical infrastructure from terrorism, natural disasters, and emerging threats — an experience that shaped his passion for Community Risk Reduction and ultimately led to the creation of Virtual CRR.

Brent holds a Master’s Degree in Management, a Bachelor’s in Occupational Studies, and Associate Degrees in Hazardous Materials Response and Fire Science.