Lightning risk assessment
A lightning risk assessment, often called a lightning protection risk assessment, decides whether a structure needs protection, and how much. It is a calculation, not an opinion, and three standards set out how to do it: IEC 62305-2:2024, NFPA 780-2026 Annex L and AS 1768:2021. This page covers what each one computes, what triggers it, what the result decides and what makes a result you can defend.
A lightning risk assessment answers one question with a number: is the risk to this structure higher than the level that can be tolerated?
Three standards set out how to answer it, and all three compare a calculated risk with a tolerable one. IEC 62305-2:2024 (Ed.3) clause 7.3 asks for protection when the risk R is above the tolerable level RT, and for measures until it is not. NFPA 780-2026 Annex L offers a simplified risk assessment of the expected strikes ND against a tolerable frequency NC (Section L.5). Its detailed method tests up to four risks, R1 to R4, each against its own value (L.6.5). AS 1768:2021 Section 2 tests R1 to R4 against the tolerable values of Table 2.1 and follows the selection process of Figure 2.1. None of them has a height above which protection becomes automatic, or a separate judgement about whether a building "looks exposed".
That makes the assessment engineering work with a defined input set and a reproducible output, so two competent engineers assessing the same building to the same standard should reach the same verdict. This page covers the work itself: how the three methods differ, what falls inside an assessment, who it applies to, what triggers it, what the result decides, where the numbers come from, what the report has to show, and where practitioners most often go wrong. The arithmetic of the IEC risk components is set out separately in the IEC 62305-2 risk assessment method, and the NFPA method in NFPA 780 Annex L explained.
Lightning risk assessment under IEC 62305-2, NFPA 780 and AS 1768
The same question, three different risk models. Each standard's tolerable values are named below with the word it uses for them, and the values themselves are in its tables. Buy each standard from its publisher for design work.
| IEC 62305-2:2024 (Ed.3) | NFPA 780-2026 Annex L | AS 1768:2021 Section 2 | |
|---|---|---|---|
| Status of the method | Normative part of the standard | Informative annex, not a requirement of NFPA 780 (Annex L preamble) | Section 2 is part of the standard; the model behind it, Appendix B, is informative |
| What it computes | One risk R for injury (L1) and physical damage (L2), per risk zone, plus a frequency of damage F for internal systems (L3) (clauses 5.3, 7.3, 9.1) | A simplified risk assessment of ND against NC (L.5), or a detailed method with up to four risks, R1 to R4, from components RA to RZ (L.6.3, L.6.5) | R1 to R4 (Appendix B, B.2.2) from components RA to RZ (Table 2.2) |
| Tolerable values | RT = 10⁻⁵ per year, "representative" (7.3 NOTE 1). FT = 0,1 per year for critical internal systems and 1 per year for others, "typical" (9.3 NOTE 1) | Defaults in Table L.6.2 for loss of life or injury, loss of service and loss of historical significance, none printed for economic loss. The simplified risk assessment uses NC = 1.5 × 10⁻³ / C (L.5.1.1) | Typical values in Table 2.1 for each type of loss, with a starting point for economic value that the owner may change (Table 2.1 NOTE) |
| Who may change them | National or local regulation (the Introduction), or a different value after detailed investigation (7.3 NOTE 1) | The AHJ, the owner or someone acting for the owner (L.6.2) | The owner or user for economic loss (Table 2.1 NOTE) |
| Strike density | Ground strike-point density NSG (Annex A) | Ground strike-point density NSG, or 1.7 times a flash density (L.2.2) | Ground flash density Ng from the Figure C.1 map (C.3.1) |
| Output | A pass or fail for each risk zone, and the measures that bring R within RT and F within FT | An LPS optional or recommended from the simplified risk assessment (L.5.2.1); from the detailed method, a comparison for each relevant type of loss (L.6.5) | Protection needed or not for each type of loss, then whether an LPS, surge protection or both are required (Figure 2.1) |
Two cautions follow from the table. First, a value never moves from one standard to another: NFPA 780's 1.7 and IEC's factor k are not interchangeable, and IEC has no R1 to R4 at all in Edition 3. Second, AS 1768:2021 is internally inconsistent on cultural heritage. Table 2.1 prints 10⁻⁴, while the calculation tool sold with the standard and its worked Figure C.2 apply 10⁻³, so a report should say which value it used. The detail is in NFPA 780 vs IEC 62305 and AS 1768 explained.
What the assessment actually covers
The scope is defined, not assumed. Under IEC 62305-2:2024 (Ed.3), clause 7.2 lists what counts as the structure under assessment: the building itself, the installations it carries, its contents, anyone inside it or on its roof or standing within 3 m of its walls, and whatever the surroundings suffer when the building is damaged.
Two parts of that IEC list are regularly missed. The first is the 3 m band outside the building, which brings a person standing near a down conductor into the calculation. The second is the contents and the people, which is why an assessment depends on what a building is used for and not only on its shape. A warehouse and a school of identical dimensions in identical locations do not produce the same result, under any of the three standards.
Connected lines sit at the boundary. The same IEC clause counts a line outside the building only so far as it can bring a damaging current indoors. A power or telecom service is in scope as a route into the building, and the cable run itself is not the thing being protected.
Under IEC 62305-2 a large or mixed-use structure is usually divided into risk zones, and the comparison of R with RT is made zone by zone, or for the whole building only where it holds a single zone. A building can pass on an averaged view and still contain a zone that fails.
The other two standards draw the line differently. NFPA 780-2026 L.6.5 starts by defining the facility, which is usually a standalone structure but can take in a building with its outbuildings and equipment supports. AS 1768:2021 Clause 2.1 applies its method to standalone structures only. It leaves out risk to people outdoors (Section 6 covers public safety), small shelters and rotundas, and structures whose owner has already decided to protect them. For distributed facilities such as treatment plants and mine sites, Clause 2.5.4 swaps the spreadsheet for a simpler count of flashes to the whole facility.
Who needs a lightning protection risk assessment
Under IEC 62305-2:2024, three types of loss decide what has to be calculated. NFPA 780 and AS 1768 use four risks instead, set out below the cards.
Injury to human beings
Loss from injury to people, death included. Clause 5.3 notes it can also follow from failure of internal systems where that endangers life, and it names buildings at risk of explosion, and hospitals, as the examples.
Physical damage
Loss from physical damage to the structure and its contents. Clause 5.3 NOTE 2 records that loss of national heritage is covered here rather than by a loss type of its own.
Failure of internal systems
Loss from failure of internal systems. NOTE 1 is specific that this is about surges affecting the function those systems provide, not physical damage to them.
The IEC rule is in the same clause: run the risk calculation for any structure that carries loss type L1 or L2. Since almost every occupied or valuable building carries one of those, the practical answer to "does this need an assessment" is usually yes. Where L3 is the concern, the standard adds a frequency of damage calculation alongside the risk calculation, and where such a failure would harm the environment or reaches equipment that safety depends on, it belongs in the risk calculation instead.
NFPA 780-2026 and AS 1768:2021 keep the older four-risk shape: R1 for loss of life or injury, R2 for loss of service, R3 for loss of historical significance or cultural heritage, and R4 for loss of economic value (NFPA L.6.3, AS Appendix B, B.2.2). A structure carries whichever of the four apply. AS 1768:2021 limits R2 to structures that provide a public utility service, such as water, power, gas, telecommunications or rail (B.2.2 NOTE). NFPA 780-2026 L.5.3.1 lists critical facilities, among them emergency operations centres, fire and police stations, hospitals, schools, telecom and energy sites, and L.5.3.2 says each should be protected or assessed with the detailed method of Section L.6.
What triggers an assessment, and what the result decides
Each standard says when the calculation applies and what follows from it. The wording differs more than most people expect.
A shall, once R exceeds RT
The risk calculation applies whenever L1 or L2 is involved (clause 5.3). If R is above RT in any zone, protection is necessary and measures are added until R is no higher than RT (clause 7.3). If F is above FT, measures should bring it down (clause 9.3). Where nothing else requires an assessment, the owner decides whether to reduce R (7.3 NOTE 2).
Guidance, with legal duties first
Annex L is informative. From the simplified risk assessment, an LPS is optional when ND is at most NC and recommended when it is higher (L.5.2.1). From the detailed method, protection might not be needed when every relevant risk is below its RT (L.6.5). L.1.1 lists cases where protection deserves serious thought whatever the result, such as large crowds, tall isolated structures and explosive contents, and L.1.1.1 puts statutory, regulatory and insurance rules ahead of any result.
A shall, once Section 2 says so
If any risk exceeds its tolerable value, protection is needed (Figure 2.1). Where RA plus RB is below RT, surge protection alone is enough and a complete LPS is not (Figure 2.1 footnote a). Clause 3.1 then requires direct strike protection wherever the assessment calls for it. Clause 2.2 adds that a high risk to people, or a valuable site, can justify protection whatever the result.
One line in AS 1768:2021 is easy to miss. Clause 2.5.3 notes that the spreadsheet assumes a metal
or reinforced concrete structure is electrically continuous, earthed and fitted with adequate air
terminations. So a "no protection needed" result still leaves continuity and earthing to be
confirmed to Sections 3 and 5. Clause C.3.4.2 then shows how the least protection is found, adding
fire protection, a protection level and surge protection in turn until each risk is within its
limit. See the AS 1768 risk assessment and
the NFPA 780 risk assessment
Required, or advisable?
These are different questions, and it is worth separating them early on a project. Each standard defines a method and says where it applies. What makes an assessment mandatory for a specific building is normally something outside the standard: the national building regulation, the project specification, the insurer, or the authority having jurisdiction.
Each standard acknowledges the gap in its own way. IEC 62305-2:2024 clause 7.3 NOTE 2 leaves the choice of whether to reduce R with the building owner or manager wherever no rule obliges a risk evaluation. NFPA 780-2026 says outright that Annex L is not one of its requirements, and L.1.1.1 ranks legal and insurance requirements above whatever the assessment shows. AS 1768:2021 Clause 2.2 calls the decision to protect a matter of judgement, with the spreadsheet as guidance. Establish which situation you are in before you start, and record the answer, because it decides who may set the tolerable value you will be measured against. For the US position on codes, read is lightning protection required by code.
A computed pass does not end the discussion either. IEC 62305-2:2024 clause 7.3 NOTE 3 points out that where R is already within RT, protection is not needed to reduce risk, but can still lower the frequency of damage to internal systems, or reduce loss or service unavailability in other ways. NFPA 780-2026 L.1.1 makes a similar point about large crowds, critical services and irreplaceable cultural heritage, and AS 1768:2021 Clause 2.2 about the risk to people and the value of a site.
The standard that governs your project
Most of the world assesses lightning risk to IEC 62305, reached through a national or regional adoption rather than the international document itself. The technical content of an adoption is the IEC content; what an adoption can carry is a recorded national departure, and those change the arithmetic rather than the method. Germany, Greece and Italy each have one, and each is documented in the standard's own list of differing practices.
The United States is the significant exception, working to NFPA 780 instead, and Australia works to AS 1768:2021. Each carries its own risk method. NFPA 780-2026 has an informative risk assessment in Annex L: a simplified risk assessment, and a detailed method with up to four risks, R1 to R4. AS 1768:2021 sets out its risk assessment in Section 2, with the model behind it in Appendix B. If your project sits under a US or Australian specification, or under one that names more than one standard, settle which one governs before you calculate. These are separate documents with separate methods, and a result computed under one is not a result under another. See the NFPA 780 risk assessment and NFPA 780 Annex L explained, the AS 1768 risk assessment and AS 1768 explained, and the comparison in NFPA 780 vs IEC 62305.
The edition matters as much as the standard. IEC 62305 was revised in 2024, and the third edition changed things that move numbers, including the move to a ground strike-point density. NFPA 780-2026 made the same move in Annex L, where the 2020 edition used a flash density. AS 1768:2021 replaced AS/NZS 1768:2007. A result computed on a superseded edition is not wrong arithmetic, it is a result under a replaced model, and a reviewer citing the current edition will treat it as such. See what changed in IEC 62305-2:2024, what changed in NFPA 780-2026, AS/NZS 1768:2007 vs AS 1768:2021 and IEC 62305 around the world.
Where the lightning data comes from
IEC 62305-2:2024 Annex A gives three sources for the ground strike-point density NSG, in a clear order of preference. A report should say which one it used.
Measured LLS data
Clause A.1 records that across much of the world NSG comes from lightning location system data meeting IEC 62858, and clause 8.1 names that data as the main source for the dangerous-event rate. This is the strongest input available.
Scaled from flash density
Where NSG is not directly available, NSG = k NG scales a ground flash density by a factor k that should come from the national LLS data provider. NOTE 1 allows a factor of 2 to be assumed where the provider cannot supply it, for example where only an NG map exists.
Satellite estimate
Where no ground-based location network covers the site, the standard recommends NSG = 0,5 NT, where NT is the total density of optically recorded flashes, cloud-to-ground and intracloud together, from satellite climatology data.
Record which rung you used, because they carry different confidence. A k factor assumed as 2 because no provider value exists is a defensible choice made under a NOTE in the standard, and it is a weaker input than a measured density for the site. Annex A is informative, which makes stating your source a matter of professional honesty rather than a box to tick.
The other two standards name their own sources, and the factors do not cross over. NFPA 780-2026 Section L.2 reads NSG from the map in Figure L.2.1 and, where only a flash density is known, multiplies it by 1.7 (L.2.2), not by IEC's k. AS 1768:2021 uses the ground flash density Ng from the Bureau of Meteorology map reproduced as Figure C.1 (C.3.1). In every case a density figure printed with no provenance is the most common untraceable number in this field.
The tolerable risk is not a fixed constant
Under IEC 62305-2:2024, RT is widely quoted as though the standard fixes it at 10⁻⁵ per year. It does not. Clause 7.3 NOTE 1 gives RT = 10⁻⁵ per year as a representative value of tolerable risk, and allows another value once the case has been investigated in detail, weighing how exposed people are inside and around the building and how much the public depends on it.
The IEC standard goes further and allows national or local regulations to fix RT, the tolerable frequency of damage FT, and the calculation rules and parameter values of its annexes. So the tolerable value is resolved from the jurisdiction and the project, with the representative figure as the default where nothing else is specified. Carrying it as a hardcoded constant is a modelling error, not a simplification.
The IEC tolerable frequency of damage is treated the same way. Clause 9.3 NOTE 1 offers FT = 0,1 per year for internal systems critical to the service being maintained and FT = 1 per year for non-critical systems, and calls these typical values. NOTE 2 then puts the choice with the owner or manager of the structure, who knows what service unavailability can be tolerated. That is a conversation to have and record, not a number to pick quietly.
NFPA 780-2026 and AS 1768:2021 say the same thing in their own words. NFPA's Table L.6.2 values are defaults for use where no other source gives one, and L.6.2 lets the owner, a representative or the AHJ choose others. Table L.6.2 prints no value at all for R4, economic loss, so someone has to supply one before R4 can be judged. AS 1768:2021 calls its Table 2.1 values typical, and the NOTE to Table 2.1 lets the owner or user pick the economic loss value from a cost and benefit view, with 10⁻³ as a starting point and a stricter value where damage would be costly.
The practical consequence is that "the risk passed" is an incomplete statement under any of the three. What passed is a comparison against a threshold that somebody chose, and a report that does not say who chose it, or on what basis, has left out the part a reviewer will ask about first.
What a defensible assessment contains
The test is simple. Can a competent stranger take your report and reproduce your verdict without asking you a question?
Standard, edition and jurisdiction
Which standard and edition the result is computed under, and the jurisdiction. Under IEC 62305-2, also the national adoption and any recorded departure applied. This frames every number that follows.
Inputs with sources
Every input, and where it came from. The density figure with its source, each table selection with its table, each dimension with its drawing. An input with no source cannot be checked.
Components, not just a total
The risk broken into its components, per IEC zone or per NFPA or AS type of loss. A single total hides which mechanism drives the result, and therefore what a mitigation would need to act on.
Threshold and verdict
The tolerable values used, who set them, each comparison, and the measures specified where a risk exceeded its limit. Where it could not be brought within the level, the residual risk stated plainly.
Under IEC 62305-2:2024, where the best measures on offer still leave R above the tolerable level, clause 7.3 NOTE 5 says the site owner is informed, and that where temporary preventive measures can cut the risk a long way, a thunderstorm warning system to IEC 62793 can be installed. The deliverable in that case is a communicated residual risk plus an operational response. Read more on what makes a report audit-ready and on why the result has to be traceable.
Where assessments go wrong
Treating the tolerable risk as a law of nature. Covered above, and the most frequent. In all three standards the printed value is a default, and where a jurisdiction, owner or AHJ has set its own it is the wrong number.
Mixing standards. Taking a factor, a table value or a tolerable risk from one standard into another. NFPA 780 and AS 1768 look like IEC's older model, but their values are their own. A US or Australian result built with an IEC input is not a result under either standard.
Adding the risks into one number. NFPA 780-2026 L.6.5 prints a total R = R1 + R2 + R3 + R4, but makes the comparison for each relevant type of loss, and AS 1768:2021 does the same through Figure 2.1. A summed figure judged against one tolerable value can pass while R1 fails its own.
A density figure with no provenance. If the report does not say where the density came from, the reader cannot weigh the result. Under IEC 62305-2 a measured strike-point density, a scaled flash density and a satellite estimate are not interchangeable.
Averaging a zoned IEC structure. Where an IEC 62305-2 structure is partitioned into risk zones, the comparison against the tolerable value belongs to each zone. A structure-level average can report a pass over a zone that fails.
Running the previous edition. Spreadsheets and templates outlive standards. A calculation still encoding IEC 62305-2:2010, NFPA 780-2020 or AS/NZS 1768:2007 produces a result under a replaced model, and the move to strike-point density alone can change an IEC or NFPA verdict.
Confusing the risk assessment with the design. The assessment decides whether protection is needed and to what level. Designing the physical system, the air terminals, down conductors and earthing, is separate work: IEC 62305-3, NFPA 780-2026 Chapter 4 onward, or AS 1768:2021 Section 3. Read lightning protection levels for how the IEC assessment and design connect.
Letting a language model write the numbers. A risk assessment is a computation with a defined method. Text that resembles an assessment is not an assessment, and a figure that cannot be recomputed cannot be signed.
When to reassess
An assessment is a function of its inputs. IEC 62305-2:2024 clause 7.2 lists what those inputs describe: the structure, its installations, its contents, the people in and around it, and the environment affected by damage to it. Change any of them and the result can move, under any of the three standards.
In practice that means a change of use, an extension or a new storey, a new incoming power or telecom service, a change in what is stored or made inside, the removal or addition of fire provisions, new construction nearby that changes how sheltered the location is, or a new edition of the standard. Each is a reason to recompute rather than to reissue. AS 1768:2021 Clause 5.4.3 asks for the protection's effectiveness to be reassessed after alterations or extensions, and its NOTE names a change of use and new photovoltaic panels among the examples.
None of the three standards sets a fixed interval for redoing the risk assessment, so any review interval you work to comes from your jurisdiction, your insurer or your project specification. The installed protection system has its own inspection cycle, which is a separate matter: at least every two years under AS 1768:2021 Clause 5.4.4, yearly or as the AHJ sets under NFPA 780-2026 Section 1.7, and the IEC 62305-3 regime covered in IEC 62305-3 and its inspection. See also the NFPA 780 inspection checklist.
Related reading
For the IEC method behind the verdict, read the IEC 62305-2 risk assessment method, and for the arithmetic worked through on a real building, how IEC 62305 risk is calculated. For the standard as a whole, start at what is IEC 62305. In the US, read NFPA 780 explained and NFPA 780 Annex L explained. In Australia, read AS 1768 explained and lightning protection standards in Australia. All three methods are compared side by side on the standards page.
Sector guides cover the cases where one mechanism dominates: data centres, hospitals, renewable energy sites, oil, gas and hazardous facilities, telecom sites and heritage buildings.
The assessment, computed and traced
What it does not do is replace the engineer. The physical design belongs to the design parts of
each standard and to a competent person, and responsibility for every result rests with whoever
signs it.
Questions answered
What is a lightning protection risk assessment?
Who needs a lightning protection risk assessment?
Is the tolerable risk always 10⁻⁵ per year?
Where does the lightning strike rate in an assessment come from?
What does a lightning protection risk assessment report need to contain?
Does the assessment cover the area outside the building?
When does a lightning protection risk assessment need to be redone?
What happens if the risk cannot be brought below the tolerable level?
Is a lightning risk assessment mandatory?
The tolerable risk in IEC 62305-2 is not a fixed constant.
Clause 7.3 NOTE 1 gives RT = 1 × 10⁻⁵ per year as a
representative value of tolerable risk and adds that another value may be set once
the case has been investigated in detail. The standard's introduction then lets national or local regulations fix
RT, the tolerable frequency of damage FT
Get started today