The law does not state a specific time period. It states that is must be 'regularly updated by a suitably competent person'. You will however have to conduct a new assessment if there has been a fire or if there have been significant changes to the structure of the building. In our experience, to be on the safe side, a risk assessment should be conducted annually.

Yes, so long as you are 'suitably competent'. We would, however, advise that you should always use a specialist, especially if you have more than 20 people inside the premises, it's a heritage building, you have complex demands such as server rooms, or if you are dealing with vulnerable people.

You must keep a written record of your fire risk assessment if your business has 5 or more people.