An operational risk register helps department leaders decide what needs attention, who owns the response and when to escalate. A long list of possible problems is not useful unless it connects to the hotel’s actual processes, assigns an accountable person and stays current as conditions change. For related ownership and operational context, see the hotel-owner perspective, hotel operations, and Feathers Hospitality’s management approach.
Use the property’s governance and safety procedures, and obtain specialist advice for technical or legal risks. For ownership and operational context, see the hotel-owner perspective, hotel operations, and Feathers Hospitality’s management approach.
At a glance
- Describe risks as causes, events and consequences.
- Name an owner, action, indicator and review date.
- Keep the register tied to decisions and operating routines.
Give each risk a clear statement
Write what could happen, why and with what consequence. “Staffing risk” is too broad; a useful entry names the role or process affected and the service impact. This structure lets a department leader decide whether a control addresses the cause or only the symptom.
Separate a risk from an existing incident, issue or action. If a failure is already happening, use the operational incident process as well. Link related entries where they share a cause rather than duplicating the same exposure across every department.
Set ownership and authority
Assign one person or role to monitor the risk and coordinate agreed actions. The owner needs enough authority and access to act; otherwise identify a senior decision-maker. A name in a spreadsheet does not establish accountability if the role is unclear.
Define escalation triggers, who receives them and expected response. Department leaders should know which decisions they may take and which require owner or executive approval. Review coverage for leave and shift changes.
Record controls and evidence
Describe controls already operating and where evidence lives: checks, maintenance records, supplier terms, training or system alerts. Distinguish a control that exists from one that is planned. Identify the last time it was tested and any gap found.
Do not label a risk “low” only because a procedure is written. Check whether staff can follow it and whether records show it works. Note the confidence in evidence and request specialist review where judgement exceeds the team’s expertise.
Prioritise with a usable method
Choose a consistent way to compare likelihood, impact and urgency, with clear definitions. A score supports discussion but should not hide consequences such as guest safety, service continuity or legal obligations. Allow a leader to explain an exception and seek a decision.
Limit the number of priority labels so they lead to action. Identify what must happen now, what needs monitoring and what should be accepted by an authorized role. Record residual exposure after controls.
Make actions specific and time-bound
Write the next step as a deliverable with owner and due date. “Monitor” is not an action unless it says what is checked, how often and what threshold prompts intervention. A small task may still need a budget or cross-department approval.
Track dependencies and overdue actions at the operational review. If an action is deferred, record who accepted the exposure and when it returns for review. Close it only when evidence confirms completion.
Review after change and incidents
Update the register when equipment, suppliers, staffing, service or building use changes. Review lessons from failures and near misses with the departments involved. A regular calendar review is useful, but it cannot replace an update triggered by a material change.
Remove stale entries or rewrite them to reflect current conditions. Keep a history of important decisions without turning the live register into an archive. Share a concise view with teams that need to act, protecting sensitive details.
Frequently asked questions
How many risks should a department register?
Enough to support decisions and controls, not an arbitrary target. Prioritise material exposures and consolidate duplicates.
Can a risk register replace incident reporting?
No. Use incident procedures for events that have occurred and the register for ongoing exposure, controls and planned actions.