How to Prepare a Hotel Crisis Plan: Emergency, Authority, Communication, and Crisis Team

When a crisis begins in a hotel, time works differently. A decision that on a normal operating day could be weighed over several hours may have to be made within minutes. Information is incomplete, staff see different things, guests are waiting for answers, the technical team is trying to solve the problem, and management has to think about safety, operations, communication, and financial consequences all at once. This is exactly why the moment of crisis is the worst time for this:

“Deciding who will do what”

The answers to questions such as “Who decides?”, “Who has authority if the general manager cannot be reached?”, “Who will inform the guests?”, “At what point will the crisis team be activated?”, “Who will talk to the authorities?”, and “How will we reach the guest list if the PMS is down?” must be given before the crisis begins.

A well-prepared Crisis Management Plan — CMP is not a magic file that holds the answer to every crisis. Its core purpose is to build a management system that makes it easier to decide under uncertainty.

A crisis plan defines not only what will be done, but who will act, when, with what authority, based on what information, and in coordination with whom.

1. What Is a Crisis Management Plan?

A Crisis Management Plan is the management framework that enables the business, when a serious event occurs, to:

• classify the event,
• activate the necessary management level,
• protect human safety,
• determine decision authority,
• organize the crisis team,
• manage critical operations,
• coordinate internal and external communication,
• record the decisions taken,
• start recovery

The purpose of a crisis plan is not to predict every possibility. That is not possible anyway. But the business can define the following in advance:

Who will decide? → Who will implement? → Who will be informed? → When will escalation happen? → Which alternative will be activated? → Where will information be gathered? → Who will communicate?

This is where the real value of a crisis plan emerges.

2. Design a Management Model First, Not a Document

One common mistake in preparing a crisis plan is to start writing procedures straight away. A fire procedure. An earthquake procedure. A power outage procedure. A cyberattack procedure. All of these are necessary; but a common management architecture that works across all scenarios must be built first. Because even when the event changes, some questions do not change:

• What is the level of the event?
• Who will lead?
• Who will be informed?
• At what point will the crisis team activate?
• Who can make which decision?
• Who will manage guest communication?
• Can operations continue?
• When will the next assessment be made?

So the foundation of a strong crisis plan is this combination:

Scenario Procedures + Common Crisis Governance

3. What Is Crisis Governance?

Crisis Governance is the decision-making system during a crisis. In normal operations the organization chart may be enough. But during a crisis time shrinks, information thins out, the impact of decisions grows, and normal departmental boundaries blur. So crisis governance is a special decision mechanism added on top of the normal organizational structure. A good governance model clarifies four things:

Authority → Accountability → Escalation → Coordination

That is: Who has authority? Who is accountable for the outcome? When will the event be raised to a higher level? How will departments coordinate?

4. Not Every Problem Is a Crisis

One of the first sections of the plan should be event classification. A practical model can have four levels.

The aim is not to create terminology but to apply different management levels to different events. A broken TV in a single room and a major earthquake should not activate the same decision system.

5. Why Is Incident Classification Necessary?

If classification is not done, two errors can occur.

Under-Reaction

A serious event is managed like a minor problem. Escalation is delayed.

Over-Reaction

A minor event is unnecessarily raised to the crisis level. The organization starts working in a constant state of alarm.

So the plan should assess not the event itself but its impact.

6. Set Crisis Activation Thresholds

To reduce staff making personal judgments such as “Is this a crisis or not?”, activation criteria should be set. For example, escalation can be considered if one or more of the following apply:

• risk to human safety,
• serious injury,
• more than one guest affected,
• loss of critical operations,
• prolonged power or water outage,
• significant loss of room capacity,
• intervention by an official authority,
• serious suspicion of a data security issue,
• major financial impact,
• intense media interest,
• a viral social media incident,
• the possibility that the hotel cannot continue operating

The core principle here should be:

Activation by Criteria, Not by Personal Feeling

7. What Does Escalation Mean?

Escalation is moving an event from the current management level to a higher decision level. Not every event should go straight to the general manager. But some events should also not be held at a lower level longer than necessary. So an Escalation Matrix can be prepared.

Thanks to this structure, the answer to “Whom should I call?” is known in advance during the event.

8. Escalation Should Not Depend Only on the Type of Event

The same event can rise to a different level under different conditions. For example, an internet outage can be an incident if it affects a single office computer. But if the same outage affects the PMS, the payment system, reservations, and the phone system, it can approach crisis level. So escalation criteria should be built by assessing the following together:

Type + Scale + Safety + Duration + Operational Impact + Reputation

9. What Is a Crisis Management Team?

It is not right to leave events above a certain level on a single person’s shoulders. Instead a Crisis Management Team — CMT is formed. The purpose of the CMT is not for everyone to decide at once. On the contrary:

It is to organize decisions, information, and implementation.

10. The Crisis Management Team in a Large Hotel

In a larger business the CMT can consist of these functions:

But copying this table as is to every hotel is not right.

11. The Crisis Management Team in a Small Hotel

In an independent hotel of six or ten rooms, having separate positions such as IT Director, Security Director, Communication Director, and Crisis Manager is not realistic. But this does not mean the functions disappear. For example:

The core principle is:

There may be no department; there must always be responsibility.

12. The Crisis Leader’s Job Is Not to Do Everything

The crisis leader’s job is not to put out the fire, explain to guests one by one, repair the IT system, or call the supplier. The real task is to see the whole picture and manage the decision system. The Crisis Leader:

• sets priorities,
• assesses the event level,
• activates the necessary teams,
• makes critical decisions,
• evaluates conflicting information,
• manages the balance between operations and safety,
• sets the time of the next assessment

13. The Crisis Leader Must Not Be Buried in Micro-Operations

If the crisis leader gets buried in the question “Which fuse on the generator has tripped?”, they may miss the big picture at the same time: guest relocation, operational capacity, employee safety, media communication, and future reservations. So this distinction should be maintained:

Technical Problem Solving ≠ Crisis Leadership

14. “The GM Decides” Alone Is Not Enough

One classic weakness of crisis plans is dependence on key people. The plan may be written like this: “The General Manager decides.” But what if the GM is not at the hotel, has the phone switched off, is on a plane, is in hospital, or has been affected by the event themselves? The plan must not stop here.

15. The Primary + Backup System

At least one backup should be defined for every critical role.

The aim is to reduce Key Person Dependency risk. None of the crisis system’s critical functions should depend on the presence of a single person.

16. The Backup Must Really Have Authority

Writing on paper “If the GM is absent, the Duty Manager decides” is not enough. The Duty Manager must really know which decisions they can make, which spending they can approve, at what point they can partially close the hotel, and whether they can start relocation. Otherwise a backup exists but real authority does not.

17. Authority Should Not Be Up for Negotiation During a Crisis

During a crisis, the following dialogues should not take place: “Can we close the rooms for sale?” “Does this need the owner’s approval?” “Can we send the guest to another hotel?” “Can we give a refund?” “Can we make a statement on social media?” The critical part of these questions should be answered in advance.

18. An Example Crisis Authority Matrix

The actual authority structure should be designed according to the size of the hotel. But the principle does not change:

Authority Must Exist Before Urgency.

19. An Emergency Contact List Is Not a Phone Book

A good Emergency Contact List does not consist only of employees’ mobile numbers. It can include:

Internal

• Crisis Leader
• GM
• Duty Manager
• Front Office
• Technical
• Security
• IT
• Finance
• HR

External

• electrician
• generator service
• plumber
• IT provider
• PMS provider
• internet provider
• security firm
• health facility
• insurance
• lawyer
• critical suppliers

20. The Emergency Contact List Is a Living Document

Having the phone number of a technical manager who left the business three years ago on the list is of no use. So this cycle should be applied:

List → Verify → Update → Test → Repeat

At set intervals, the critical numbers on the list should actually be verified.

21. The List Must Be Reachable Even Without the Internet

Keeping the crisis plan only on Google Drive, the PMS, cloud storage, or a company server can create a new risk. Because the crisis can block access to one of these. So it can be considered to hold critical information under this model:

Online + Appropriate Offline Access

The aim is not to produce dozens of uncontrolled paper copies but to be able to reach critical information when system access is lost.

22. Communication in a Crisis Has Three Goals

Good crisis communication should provide three things.

The Right Information

Wrong information must not spread.

The Right Person

Not everyone should make their own statement.

The Right Time

Information should not be delayed unnecessarily.

So these three should be managed together:

Accuracy + Authority + Timing

23. Saying What You Don’t Know Is Better Than Giving Wrong Information

It is not possible to know all the answers during a crisis. For example, the statement “We do not yet know the exact duration of the outage. The technical team is responding. We will share the next update within 30 minutes” can be more credible than saying “It will be fixed in 10 minutes” and then not being able to fix the system for two hours.

24. The Single Spokesperson Principle

Especially in serious events, media and public communication should be run through an Authorized Spokesperson. Because if reception says one thing, the GM another, and the social media team another about the same event, the crisis can grow.

25. Guest Communication Is a Separate Function

Crisis communication is not only media communication. A guest in the hotel wants to know what happened, whether they are affected, what they need to do, and when they will get new information. So guest communication should be an explicit responsibility within the CMT.

26. Do Not Forget Employee Communication

Before guests, employees may need the right information. Because employees are in direct contact with guests. So this chain should be built:

Crisis Team → Internal Briefing → Guest-Facing Teams → Consistent Guest Communication

27. Create a Single Reality in a Crisis

One of the significant problems of major events is information fragmentation. The technical team may say “The system will be back within an hour.” Reception may say “We were told three hours.” The social media team may post “The problem is solved.” So in serious crises a Command Center logic should be set up.

28. A Command Center Does Not Have to Be a Physical Room

A large hotel may have a dedicated crisis room. In a small hotel, a designated office, a phone group, a secure digital channel, or a single management desk can serve the same function. The aim is not a physical space but to create a Single Coordination Point.

29. What Is Tracked at the Command Center?

At the least, the following can be tracked:

• current situation,
• affected guests,
• affected employees,
• closed areas,
• operational status,
• critical systems,
• decisions,
• assigned actions,
• external contacts,
• next update time

30. What Is a Situation Report?

It is a short status report that makes sure everyone uses the same information as the crisis progresses. Example:

Incident

Main electrical supply cut off.

Current Status

Generator is running; some areas have no power.

Guest Impact

12 rooms affected.

Safety

There is no direct safety threat.

Operations

Reception and basic lighting are working.

Action

Electrician and generator service are on site.

Decision

New check-ins are temporarily on hold.

Next Update

In 30 minutes.

This report can significantly reduce information pollution during a crisis.

31. Set an Update Rhythm

One important element of crisis communication is rhythm. For example, a status assessment every 30 minutes can be set. Depending on the seriousness of the event, this interval can be 5 minutes, 15 minutes, 30 minutes, or 1 hour. What matters is that the time of the next assessment is known.

32. Record Important Decisions During a Crisis

In intense crises, a few hours later the answers to “Who made this decision?”, “What time did we find out?”, and “Why did we close the inventory?” can be forgotten. So a Decision Log can be used.

This record serves not only a legal or administrative purpose. It is also the raw material for post-crisis learning.

33. A 200-Page Plan Is Not Used During a Crisis

The main CMP can be comprehensive. But what the operations team needs at the critical moment is very often a one-page Action Card.

34. A Fire Action Card Example

FIRE

1. Verify the alarm.
2. Activate the emergency procedure.
3. Start the necessary evacuation.
4. Inform emergency services.
5. Start guest accountability.
6. Inform the Crisis Leader.
7. Isolate the affected area.
8. Centralize the flow of information.
9. Assess the operational impact.
10. Await the recovery decision.

But this card does not replace the relevant technical and statutory emergency procedures. Its job is to remind the management chain under high stress.

35. A PMS Outage Action Card Example

PMS DOWN

1. Verify the outage.
2. Determine local/general scope.
3. Assess the possibility of a cyber incident.
4. Inform IT/the PMS provider.
5. Switch to the offline guest list.
6. Activate the manual check-in/out procedure.
7. Consider an alternative payment method.
8. Make the housekeeping/FO data flow manual.
9. Start guest communication.
10. Track recovery status.
11. Verify data when the system returns.
12. Transfer manual transactions into the system.

36. A Power Outage Action Card

POWER FAILURE

1. Determine the scope of the outage.
2. Assess the risk to human safety.
3. Check emergency lighting.
4. Verify generator status.
5. Check elevator status.
6. Assess critical systems.
7. Activate technical service.
8. Inform Guest Care.
9. If the outage drags on, activate Business Continuity.
10. Verify systems after recovery.

37. The Crisis Plan Manages the Problem, the BCP Keeps the Business Alive

The Crisis Management Plan and the Business Continuity Plan complement each other. The CMP answers “How will we manage the crisis?” Business Continuity answers “How will we sustain critical operations while the crisis continues?” For example, in a PMS outage, the crisis plan determines who will be activated. Business continuity defines how check-in will be done without the PMS.

38. Every Critical Crisis Scenario Should Have a Continuity Question

For example:

If there is no electricity

How will minimum operations be sustained?

If there is no water

How many hours can we operate?

If there is no PMS

How will guest information be reached?

If there is no internet

How will payment and reservations be managed?

If there is no main supplier

Who is the alternative?

If part of the hotel closes

Where will guests be moved?

If this link is not made, the crisis plan remains merely a response plan.

39. The Crisis Plan Architecture

A practical structure can be built like this:

Section 1 — Governance

Roles, authorities, escalation.

Section 2 — Contact Directory

Internal/external critical contacts.

Section 3 — Emergency Procedures

Fire, health, evacuation, etc.

Section 4 — Crisis Playbooks

Critical scenario cards.

Section 5 — Business Continuity

Offline and alternative operations.

Section 6 — Communication

Guests, employees, media, stakeholders.

Section 7 — Recovery

Criteria for returning to normal.

Section 8 — Forms

Situation Report, Decision Log, Incident Report.

Section 9 — Training & Drills

Training and testing system.

Section 10 — Review & Learning

AAR and corrective actions.

40. Manage the Plan as a “Living Document”

A crisis plan should not be prepared once and stay the same for five years. Because employees change, suppliers change, phone numbers change, the PMS may change, the building may change, new risks may emerge. So the plan should live in this cycle:

Create → Train → Test → Learn → Update → Retest

41. Not Every Employee Needs to Know the 200-Page Plan

What the employee needs to know is their own role. For example, a receptionist should know whom to call, how to direct guests, what information they can share, the guest accountability process, and what to do if there is no PMS. The technical team needs to know different things. So Role-Based Crisis Training is more effective.

42. Add the Crisis Role to New-Employee Onboarding

A new employee learns the Wi-Fi password, the breakfast hours, the check-in procedure. But if they do not know what to do in a fire alarm, the onboarding is incomplete. The basic crisis role should be passed on when the employee starts work.

43. Drills Show Whether the Plan Works

The most dangerous state of a crisis plan is looking flawless on paper but not working in real life. So the plan must be tested.

44. The Tabletop Exercise

Not every test has to be a physical evacuation. The management team can work through a scenario at the table:

“It is 21:15. The hotel is 95% full. The PMS and the internet have gone down at the same time. The system provider cannot be reached. Six check-ins are waiting at reception. What do we do?”

Then the system is tested through questions such as:

• who is deciding?
• who is being called?
• which plan is activated?
• what is told to the guest?
• how will payment be taken?
• where is the guest list?

45. Test the System in a Drill, Not the Employee

An employee acting wrongly may be a training problem. But it may also be that the procedure is unclear, authority is ambiguous, the phone list is outdated, or equipment is inaccessible. So a drill should be seen not as a People Test but as a System Test.

46. The Output of a Drill Should Be a Gap List

For example:

The purpose of a drill is not to tick the “we did a drill” box. The aim is to start this cycle:

Gap → Corrective Action → Verification → Retest

47. The 15 Most Common Mistakes in a Crisis Plan

1. Seeing the plan as consisting only of fire and earthquake.
2. Preparing hundreds of pages of unusable documentation.
3. Not defining event levels.
4. Not setting crisis activation criteria.
5. Tying every decision to the GM.
6. Not defining backup authority.
7. Not assigning roles in the crisis team.
8. Not updating the phone list.
9. Keeping the plan only on an online system.
10. Forgetting guest communication.
11. Letting every employee make statements.
12. Not linking Business Continuity to the plan.
13. Not preparing offline operations.
14. Not holding drills.
15. Not closing the gaps found in drills.

48. 20 Crisis Plan Decision Gates

Test your plan with these questions.

Decision Gate 1

Is it clear which event is a problem, incident, emergency, or crisis?

Decision Gate 2

Are crisis activation thresholds defined?

Decision Gate 3

Is there an Escalation Matrix?

Decision Gate 4

Who is the Crisis Leader?

Decision Gate 5

Who takes over if the Crisis Leader cannot be reached?

Decision Gate 6

Are the CMT functions clear?

Decision Gate 7

Is each role’s responsibility clear?

Decision Gate 8

Are urgent decision authorities defined in advance?

Decision Gate 9

Is the Emergency Contact List up to date?

Decision Gate 10

Can critical information be accessed offline?

Decision Gate 11

Who is responsible for guest communication?

Decision Gate 12

Who is responsible for media communication?

Decision Gate 13

How will the Command Center be set up?

Decision Gate 14

Is the Situation Report format ready?

Decision Gate 15

Is the Decision Log ready?

Decision Gate 16

Do critical crisis scenarios have Action Cards?

Decision Gate 17

Are the CMP and Business Continuity linked?

Decision Gate 18

Do employees know their crisis roles?

Decision Gate 19

Has the plan been tested with drills?

Decision Gate 20

Have drill findings been verified and closed?

49. Governance

• Incident levels have been defined.
• Crisis activation criteria have been set.
• An Escalation Matrix has been prepared.
• A Crisis Leader has been designated.
• A Backup Crisis Leader has been designated.
• A Crisis Management Team has been formed.
• Roles have been put in writing.
• An Authority Matrix has been prepared.
• Critical spending/compensation authorities have been set.

50. Communication

• An Emergency Contact List has been created.
• The list has been verified.
• Offline access exists.
• The guest communication owner is clear.
• The employee communication owner is clear.
• The Authorized Spokesperson is clear.
• The communication approval mechanism is clear.
• The update rhythm has been defined.

51. Crisis Coordination

• A Command Center model has been defined.
• A Situation Report format is ready.
• A Decision Log format is ready.
• An Action Tracking system exists.
• The Crisis Team communication channel is clear.
• An external stakeholder escalation system exists.

52. Playbooks

• A Fire Action Card exists.
• A Medical Emergency Action Card exists.
• A Power Outage Action Card exists.
• A Water Outage Action Card exists.
• A PMS outage Action Card exists.
• An Internet outage Action Card exists.
• A Cyber Incident Action Card exists.
• An Earthquake/Natural Disaster Action Card exists.
• Critical supply interruption has been planned.
• A reputation crisis escalation model exists.

53. Business Continuity

• Critical Business Functions have been identified.
• Minimum Viable Operation has been defined.
• An offline guest list system exists.
• Manual check-in/out is possible.
• An alternative payment method has been considered.
• Backup suppliers exist.
• Critical system backups have been tested.
• A recovery procedure has been defined.

54. People

• Employees know the basic crisis procedures.
• Role-based training has been done.
• New-employee onboarding includes crisis training.
• The night shift’s authorities are clear.
• Backup roles have been trained.

55. Testing

• A tabletop exercise has been done.
• Physical drills have been done.
• The communication system has been tested.
• The offline procedure has been tested.
• Backup access has been tested.
• A Gap List has been produced.
• Corrective actions have been assigned.
• A retest has been done.

56. A “Minimum Viable Crisis Plan” for Small Hotels

A small independent hotel may not need a crisis management book of hundreds of pages. But it can have at least these nine components:

1. Risk List

The most critical risks.

2. Escalation Matrix

Who calls whom.

3. Crisis Roles

Who does what?

4. Primary + Backup

If the first person is unavailable, who?

5. Emergency Contacts

Critical people, internal and external.

6. Action Cards

The most important scenarios.

7. Offline Procedures

How will operations work if systems are down?

8. Communication

Who will say what to guests and employees?

9. Drill

Does the system really work?

If this lean structure is genuinely implemented, it is worth more than a plan of hundreds of pages that goes unused.

57. Level 1 — Person-Dependent

“If something happens, our manager will handle it.”

This is the most fragile level.

58. Level 2 — Documented

There is a plan. But roles and testing are weak.

59. Level 3 — Organized

The Crisis Team, escalation, authority, and communication are defined.

60. Level 4 — Operational

Action Cards, offline procedures, and business continuity are tied into real operations.

61. Level 5 — Tested

The plan is regularly verified through:

• tabletop,
• drill,
• backup test,
• communication test

62. Level 6 — Adaptive

Every incident, near miss, drill, and real crisis improves the plan. The crisis plan is no longer a static document.

It is a living management system.

Conclusion: A Good Crisis Plan Does Not Give You Every Answer; It Lets You Make the Right Decision Faster

No Crisis Management Plan can foresee every event that may occur in the future. A new technology problem may arise. An unexpected natural disaster may happen. An operational crisis never thought of before may occur. So the success of a good crisis plan is not “having written the answer to every scenario.” The success is:

The organization knowing how it will decide even in an unexpected scenario.

For this the system should build this chain:

Notice the Event → Classify → Escalate → Activate Leadership → Protect Human Safety → Gather Information → Decide → Assign Responsibility → Communicate → Protect Critical Operations → Reassess the Situation → Start Recovery → Record → Learn → Update the Plan

The most critical part of this chain is not built when the crisis begins. It must have been built before the crisis. In a well-prepared hotel, staff do not try to build an organization during a crisis by asking “What do we do now?” The system is already there. Who will lead is known. Who will be called is known. Authorities are known. Backup roles are known. Communication channels are known. How critical operations will continue is known. And this system has been tested before, not only on paper. So the core principle of a hotel crisis plan is this:

A crisis plan is not a document sitting on a shelf; it is a decision-making system that works under uncertainty.

The real test of the plan is not how detailed the file is. The real test is this:

That when a serious event occurs at 03:00, when the general manager cannot be reached, and when one of the main systems is not working, the organization can still make the right decisions.

At that point the crisis plan stops being a document and turns into institutional resilience.

Related reading: How to Set Up Emergency and Crisis Management in Hotels: A Guide to Fire, Earthquake, Evacuation, and Crisis Management · How to Set Up a Hotel Security System: A Guide to Daily Security, Incident Management, and Incident Reports · How to Build Crisis Management in Hotels: A Guide to Risk, Preparedness, and Business Continuity

Note: This content is for general information only and is not legal, financial or technical advice. Regulations and practices change over time. Before making decisions, consult a qualified professional (lawyer, accountant, engineer, etc.).

Hotel Investment Guide — Volume VIII

This article is developed from the Crisis Management Plan, crisis governance, authorization, Crisis Management Team, crisis communication, Business Continuity, and organizational resilience approach covered in the Hotel Investment Guide — Volume VIII: Growth and Sustainability.

Volume VIII takes a systems approach to the long-term resilience and growth capacity of the business, from guest loyalty to crisis management, from renovation and CAPEX planning to a second hotel, multi-property management, and building a sustainable hotel brand.