Almost every conversation about lightning protection starts in the wrong place. Someone asks for a price for a system before anyone has established whether a system is needed, what class it should be, or which parts of the building could do the job already. The standard answers all three questions, and it answers them in that order.
BS EN 62305-2 is the risk assessment part of the series. It does not ask whether lightning could strike the building, because it can strike any building. It asks how likely a damaging strike is, and how much that damage would cost in terms the standard defines as loss. There are four: loss of human life, loss of service to the public, loss of cultural heritage and economic loss. For most commercial and residential property only the first and the last are in play, and the first dominates the outcome.
The calculation compares a risk figure for the structure against a tolerable risk. The inputs are unglamorous and entirely factual: the plan dimensions and height of the building, its location and the local lightning flash density, the surroundings, what the building is made of, what it is used for, how many people are inside, how long they are inside, how easily they can leave, and what services enter it. Change the height or add a taller neighbour and the number moves. Change the occupancy from a storage unit to a school and it moves a great deal more.
Where the calculated risk exceeds the tolerable risk, the standard sets a protection level, I to IV, with I the most onerous. That level then drives everything in BS EN 62305-3: the mesh size on the roof, the spacing of down conductors, the rolling sphere radius used to check what is protected and what is exposed. In practice most ordinary UK buildings that need protection at all land at Level III or IV. Level I and II are the province of buildings with explosive risk, critical infrastructure or exceptional occupancy.
The second question the assessment answers is what the building already gives you. Structural steel frames, reinforced concrete with continuous rebar, piled foundations and metal roof coverings can all serve as natural components, provided continuity and cross section can be demonstrated. A building with a continuous steel frame and piled foundations may need no dedicated down conductors and no earth rods at all, only bonds at the right points and a roof network. Establishing that at risk assessment stage rather than after the facade is finished is the difference between an elegant system and a lot of tape.
The third answer is the one clients care about most: the honest possibility that no system is required. A single storey unit in a sheltered location with low occupancy can come out below the tolerable risk. Reporting that is not lost work. It is the reason the assessment is worth doing, and it is the document that supports the decision if anyone asks later.
What a good risk assessment looks like on paper is short. It states the inputs used, the flash density applied, the resulting risk figures against the tolerable values, the recommended protection level, the natural components accepted and the reason for each, and any assumption that would change the answer if it turned out to be wrong. That last section matters. If an assessment assumes the roof cladding is electrically continuous and it is not, the design that follows is built on sand.
If you are responsible for a building and hold no risk assessment, that is the first thing to commission, not a quotation for copper. It costs little, it sets the scope for everything that follows, and it either justifies the spend or removes it.