How to Do Risk Management in Hotels: Risk Register, Prevention, and Early Warning System

In hospitality, the most successful form of crisis management is not managing a crisis well. Stronger still is preventing a significant share of possible crises before they even emerge, noticing early those that cannot be prevented, and being able to intervene before they turn into a serious event.

A fuse box that keeps tripping, a water leak that recurs at the same spot, an irregularity seen in a generator test, a rise in phishing emails reaching staff, or a critical supplier beginning to be constantly late may not look like a major crisis on its own. But each of these may be an early signal of a bigger problem to come. So the core question of risk management is not only this:

“What could happen to us?”

The real questions are these:

Which risks are genuinely important for our hotel? How likely are they? If they occur, what is their impact? How fast do they escalate? How early can they be noticed? Which systems can they spread to? How prepared are we for these risks today?

When these questions are answered systematically, the hotel’s true Risk Profile emerges. And when this profile is managed well, crisis management stops being a reactive function. It turns into this chain:

Risk Management → Prevention → Early Detection → Early Intervention → Crisis Prevention

1. Risk Management Begins Before Crisis Management

Crisis management often becomes visible after the event has occurred. Risk management works before the event occurs. The difference between the two systems can be put simply:

• Risk Management: “What can go wrong and how can we reduce its probability or impact?”
• Crisis Management: “The risk has materialized and turned into a serious event; what do we do now?”

So the institutional system should work like this:

Risk Identification → Assessment → Prevention → Detection → Preparedness → Response → Recovery → Learning

Risk management is the first line of defense in this chain.

2. Risk and Crisis Are Not the Same Thing

A risk is a possibility that has not yet occurred. For example, the following are risks:

• a fire breaking out,
• the PMS crashing,
• a critical supplier being unable to deliver,
• a data breach,
• a water outage,
• the sudden loss of a key manager

When one of these risks materializes, an incident can occur first. If its impact grows, it can reach the emergency or crisis level. So this chain is possible:

Risk → Trigger → Incident → Escalation → Crisis

The purpose of risk management is to break this chain as early as possible.

3. First See the Hotel’s Risk Universe

The first step of risk management is not scoring. First the question “What are we going to score?” needs to be answered. For this, the hotel’s Risk Universe must be built. A modern hotel manages all of the following at once:

• people,
• the building,
• technical infrastructure,
• food,
• technology,
• data,
• money,
• the supply chain,
• employees,
• reputation,
• law,
• the destination

So the risk map cannot consist only of fire, earthquake, and medical emergencies.

4. Natural Disaster and Environmental Risks

This group can include, for example:

• earthquake,
• flood,
• excessive rainfall,
• storm,
• extreme heat,
• extreme cold,
• wildfire,
• landslide

The important distinction here is this:

Being unable to prevent the hazard does not mean you cannot reduce its impact.

Hotel management cannot prevent an earthquake. But it can reduce its impact through this chain:

Structural Safety → Securing Equipment → Evacuation → Emergency Lighting → Guest Accountability → Alternative Communication → Business Continuity

5. Fire and Physical Facility Risks

The characteristics of a hotel building make fire one of the critical risks. Sources of risk can be:

• the electrical installation,
• the kitchen,
• technical rooms,
• the laundry,
• equipment failures,
• guest behavior

Risk management here is not just checking that fire extinguishers exist. The core approach should be:

Reduce the Source → Detect Early → Limit the Spread → Prepare to Respond

6. Technical Infrastructure Risks

A hotel is extremely dependent on invisible technical systems. For example, the following can be critical infrastructure:

• electricity,
• generator,
• water,
• hot water,
• HVAC,
• elevator,
• fire system,
• pumps,
• sewage,
• key/lock system

At the center of technical risk management is Preventive Maintenance. Because a significant share of technical crises may not be complete surprises. Before a failure, signals such as vibration, temperature, noise, performance decline, alarms, and recurring small faults can appear.

7. Technology and Cyber Risks

In a modern hotel, technology is not just office computers. Operations can run through the PMS, POS, booking engine, channel manager, payment system, email, Wi-Fi, cloud systems, and digital locks. So a single cyber event can turn into this chain:

Cyber Risk → System Outage → Operational Disruption → Data Risk → Financial Loss → Reputation Risk

Risks do not respect departmental boundaries. That is why risk management too should not be thought of only department by department.

8. People and Organizational Risks

Risk is not only machines or technology. For example, the following can also create serious risks:

• dependence on a critical employee,
• insufficient training,
• high turnover,
• lack of segregation of duties,
• processes only one person knows,
• ambiguity of authority

In a small independent hotel especially, Key Person Risk is very important. If only one employee knows a process, that employee can become a Single Point of Failure for the organization.

9. Food Safety Risks

In businesses with F&B, the following are critical risk areas:

• cold chain,
• cross-contamination,
• storage temperatures,
• supplier reliability,
• allergen management,
• hygiene

The aim of risk management here is not only to respond when an event happens but to manage the control points before the event.

10. Supply Chain Risks

Some hotels can be highly dependent on a single supplier. For example, laundry, technical maintenance, internet, PMS, security, critical food products, and cleaning chemicals may come from a single source. The risk question is:

What happens if this supplier cannot deliver tomorrow?

If the answer is “operations stop,” there is high dependency.

11. Financial Risks

A Risk Register should not include only physical safety risks. For example, the following can threaten the business’s continuity:

• insufficient liquidity,
• debt service pressure,
• high fixed costs,
• dependence on a single sales channel,
• loss of a major customer,
• a prolonged operational interruption

12. Reputation Risks

Hospitality is a trust-based service sector. An event can spread very quickly through Google, OTAs, social media, and news sites. So for some reputation risks, in addition to the classic probability-impact assessment, Risk Velocity is especially important.

13. Do Not Copy a Ready-Made Risk List

There can be common risk categories for all hotels. But not all hotels have the same risk profile. For a resort, the pool, the sea, a large kitchen, and heavy F&B may be important. In a city hotel, security, foot traffic, internet, technology, and business continuity may be more critical. In a small boutique hotel, a single technical staff member, a single internet line, a single PMS, and dependence on key employees may create greater fragility.

14. Risk Varies with Context

The same event produces different results in different hotels. The risk profile depends on these factors:

Location + Size + Guest Profile + Seasonality + Physical Structure + Technology Dependency + Operational Model

For example, in a seasonal hotel losing two weeks of high season is not economically the same as losing the same period in low season. So a risk score should measure not only the event itself but the consequence of the event in the business context.

15. A Small Hotel Does Not Mean Small Risk

Let us imagine that in a six-room hotel two rooms are taken out of sale due to water damage. The capacity loss is:

2 / 6 = 33.3%

The loss of the same two rooms in a 200-room hotel is:

2 / 200 = 1%

The absolute event is the same. The impact on the business is completely different. So:

Risk Severity Must Be Relative to Business Exposure.

16. What Is a Risk Register?

A Risk Register is a living management record in which the business defines its important risks, assesses them, assigns responsibility, sets their controls, and monitors them. In its simple form:

But a good Risk Register does not stop here.

17. A Risk Register Is Not a Risk List

A more mature Risk Register should contain the answers to these questions:

This builds the following link:

Risk Register → Prevention → Detection → Preparedness → Response → Recovery

The Risk Register is now not a table but the starting point of the crisis management architecture.

18. The Probability × Impact Model

The most basic risk assessment model is:

Risk Score = Probability × Impact

For example, on a 1–5 scale, if Probability = 4 and Impact = 5:

Risk Score = 4 × 5 = 20

This model is useful for prioritization. But it is not sufficient.

19. Why Is Probability × Impact Alone Not Enough?

Two risks can have the same score. But the first may develop over months, while the second can escalate within 20 minutes. One risk is very easy to notice while another can stay hidden for weeks. One risk may affect only a single system, while another can create this chain:

Technical → Operational → Financial → Reputation

So mature risk management should use more dimensions.

20. Risk Velocity

Velocity shows how fast a risk can turn into a serious outcome once it materializes. For example:

Slow Velocity

Long-term deterioration in cash flow.

Medium Velocity

Decline in the service quality of a critical supplier.

High Velocity

Fire.

Very High Velocity

A viral social media crisis or some cyber events.

A high-velocity risk requires faster detection + faster escalation.

21. Detectability

Detectability is this question:

When a risk begins to materialize or grow, how early can we see it?

For example, a generator failure can be noticed through regular testing. But some data breaches may go unnoticed for a long time. So low detectability requires stronger monitoring.

22. Interdependency

Which other systems does a risk affect? For example, an Internet Failure may not be only a Wi-Fi problem. It can affect:

• the PMS,
• payment,
• reservations,
• telephones,
• cloud systems,
• the guest experience

So the higher the interdependency, the greater the systemic impact of the risk.

23. Preparedness

The same risk is not the same in two hotels. In the first hotel there is a backup, staff are trained, an Action Card exists, and the system has been tested. In the second there is no preparation at all. Even if the probability of the event is the same, the business’s fragility is not. So in risk assessment, the Preparedness Level should be seen as a separate variable.

24. Safety Override

Some risks should be treated as high priority even if their mathematical score comes out low. For example, life safety, fire, structural safety, serious medical events, and critical data security should not be left to the Probability × Impact formula alone. Because there are low-probability risks with catastrophic consequences. So a good risk system should use this combination:

Risk Score + Management Judgment + Safety Override

25. A Risk Without an Owner Is Not Managed

One of the most important columns of the Risk Register is the Risk Owner field. Every critical risk should have an owner. For example:

26. What Does a Risk Owner Do?

The Risk Owner’s job is not to manage the crisis alone. Their job can be to:

• monitor the risk,
• ensure controls are implemented,
• track the preparedness level,
• report changes,
• initiate necessary improvements

An important distinction:

Risk Ownership ≠ Crisis Command

When a risk materializes and turns into a serious crisis, the Crisis Management Team steps in.

27. “Everyone Is Responsible” Actually Means No One Is Responsible

Writing “Management” next to a risk is sometimes not enough. A better question is:

Which role is responsible for verifying that this risk’s control system is working?

Clear ownership creates accountability.

28. The Most Valuable Area of Risk Management Is Prevention

Once a risk has been identified, the first question should be:

How can we reduce the likelihood of this occurring?

These can be called Preventive Controls.

29. Examples of Preventive Controls

Fire

Electrical maintenance, kitchen checks, equipment maintenance, housekeeping checks.

Cyber Risk

MFA, access permissions, updates, staff awareness, backup.

Technical Failure

Preventive maintenance, periodic testing, spare parts.

Food Safety

Supplier checks, temperature tracking, hygiene procedures.

People Risk

Cross-training, SOPs, task backup.

The core question should be:

Before managing the crisis, what are we doing to reduce the risk?

30. Maintenance Is a Risk Management System

Preventive maintenance is not just a cost line of the technical department. Used correctly, it becomes a Risk Reduction Tool. For example, a generator is a backup system that must work during a crisis. But if it is not tested regularly, this can happen:

Backup System → False Sense of Security

So this chain should be built:

Maintenance → Test → Finding → Corrective Action → Verification

31. Recurring Faults Must Not Be Normalized

The same fuse keeps tripping. Each time it is reset. The system keeps working. This does not mean “The problem is solved.” The real question is:

Why does it keep tripping?

Recurring small events are often an early signal of a systemic weakness.

32. Not Every Risk Can Be Prevented

It is not possible to completely prevent some risks from materializing. In this case the second line of defense is Detective Controls. The aim is to notice the event as early as possible.

33. Detection Examples

Technical

Alarm, temperature sensor, pressure gauge, maintenance inspection.

Cyber

Login alert, security monitoring, unusual access.

Finance

Cash variance, overdue payments, liquidity dashboard.

Operations

Complaint trend, incident reports, recurring defects.

Supply

Delivery delays, quality failure, service SLA deterioration.

34. What Is an Early Warning System?

An Early Warning System is not a system that predicts the future with certainty. Its job is to make meaningful deviations from normal behavior visible early. This way management can intervene before the event grows.

35. The Early Warning Chain

A practical system can work like this:

Signal → Detection → Threshold → Alert → Review → Action → Escalation

There is a signal. But if no one is looking, it is worthless. If it is being looked at but there is no threshold, the interpretation is unclear. If the threshold is exceeded but there is no action, it is still useless. So early warning is not measurement but a decision system.

36. What Is a KRI?

A Key Risk Indicator — KRI is a measure that can show a risk is beginning to rise. It is not the same as a KPI.

• KPI: “How is our performance?”
• KRI: “Is our risk level rising?”

37. KRI Examples for a Hotel

38. Set Thresholds for KRIs

Measuring alone is not enough. For example, thresholds like these can be set:

• 0–2 events = Green
• 3–4 events = Amber
• 5+ events = Red

But the thresholds should be built for each risk according to the business’s own data and context. The aim is not a decorative dashboard but this link:

Threshold → Action

39. Green — Amber — Red

A simple risk monitoring system can be very effective, especially in small businesses.

Green

The risk is at the normal level of control.

Amber

There is a meaningful deterioration in the risk. Additional control or management attention is needed.

Red

The risk is above the acceptable level. Immediate action/escalation is needed.

This system makes it easier for a manager to interpret hundreds of data points at once.

40. The Amber Level Is the Most Valuable Zone

At the Red level the problem may already have grown. At the Green level normal operations continue. One of the most valuable areas of risk management can be the Amber Zone. Because here the business still has the chance for review, preventive maintenance, alternative supply, training, and capacity increase.

The aim of Early Warning is not to report Red but to intervene at Amber.

41. Make Small Events Visible

Organizational learning should not start only from major crises. Small events can be harbingers of a future major crisis. For example:

• the electrical panel repeatedly tripping fuses,
• water leaks in the same rooms,
• the key card lock system frequently erroring,
• staff receiving phishing emails

Looked at one by one they seem small. Together they can form a Pattern.

42. The Incident Reporting Loop

A simple system can look like this:

Event → Record → Classify → Trend Analysis → Escalate if Needed

The aim here is not to create more bureaucracy for staff. The aim is to prevent the organization from forgetting.

43. What Is a Near Miss?

A Near Miss is an event that could have had a serious outcome but did not, due to luck, timely noticing, or quick intervention. For example, overheating in an electrical panel was noticed. No fire broke out. The wrong approach is to say “No problem, there was no fire.” The right approach is:

The system gave us a free warning.

44. Near Misses Are Among the Most Valuable Risk Data

A real crisis is expensive learning. A near miss is a much lower-cost learning opportunity. So this loop should be built:

Near Miss → Investigation → Root Cause → Corrective Action → Prevention

45. Do Not Punish Near Miss Reporting

If an employee thinks “If I report this, I’ll get into trouble,” risk becomes invisible. For risk management, this principle is more valuable:

Visibility > Artificial Perfection

A business with no incident reports is not necessarily free of risk. Perhaps no one is just reporting.

46. Lagging Indicator

A measure taken after the event has occurred. For example:

• number of fires,
• number of workplace accidents,
• system downtime duration,
• food safety cases

These are important. But they show the past.

47. Leading Indicator

A measure that shows the state of the system before a risk arises. For example:

• preventive maintenance completion,
• backup test success,
• staff training completion,
• open critical maintenance findings,
• overdue corrective actions,
• supplier SLA deviations

The aim of risk management is to answer not only “What happened?” but also “Is something about to happen?”

48. A Control Existing Does Not Mean It Works

The Risk Register may say “Backup exists.” But if the restore test fails, the control is weak. “Generator exists.” But if it does not start automatically, the control is weak. “SOP exists.” But if staff do not know it, the control is weak. So:

Control Exists ≠ Control Effective

49. Test the Control

For every critical control, these questions can be asked:

1. Does the control really exist?
2. Is it applied regularly?
3. When was it last tested?
4. Was the test result successful?
5. If there was a shortfall, was it corrected?
6. Was the correction verified?

This approach moves risk management from documentation to the real operational level.

50. Risk Before and After Controls

A useful distinction for management:

Inherent Risk

The natural level of the risk as if no controls existed.

Residual Risk

The risk remaining after the existing controls are applied.

For example, the natural impact of a fire can be very high. But detection, suppression, maintenance, training, and evacuation controls can reduce the risk. However, Residual Risk may not be zero. The aim of risk management is not to bring every risk to zero. It is to consciously reduce the remaining risk to an acceptable level.

51. Not Every Risk Is Managed the Same Way

Once a risk is identified, four basic approaches can be considered.

Avoid

Stay away from the activity that creates the risk.

Reduce

Reduce its probability or impact.

Transfer

Transfer the financial or operational part of the risk through mechanisms such as insurance/contracts.

Accept

Consciously accept the remaining risk.

What matters is:

Risk Acceptance ≠ Risk Ignorance

Being unaware of a risk’s existence and assessing it and consciously accepting it are not the same thing.

52. The Risk Register Should Not Be a File Opened Once a Year

Risks change. New technology, suppliers, buildings, equipment, employees, services, and market conditions can create new risks. So the Risk Register should be reviewed regularly.

53. In Which Situations Should a Risk Review Be Done?

The risk map can be reassessed, for example:

• in periodic management meetings,
• before the season,
• after a major renovation,
• at a new PMS migration,
• after a new supplier,
• after a serious incident,
• after a near miss,
• at a major organizational change

54. What Management Needs to See

A Risk Dashboard does not have to be very complex. For example:

But the purpose of the dashboard is not to produce colors but to produce decisions.

55. Top Risk Review

In a management meeting, instead of discussing all hundred risks, the focus can be on the Top 10 Risks. For each risk, the following can be reviewed:

• trend,
• control status,
• open action,
• owner,
• deadline

56. The 20 Most Common Mistakes in Risk Management

1. Seeing risk management as only fire and earthquake.
2. Copying another hotel’s risk list.
3. Not assessing risks according to the business’s context.
4. Using only Probability × Impact.
5. Ignoring Risk Velocity.
6. Not assessing Detectability.
7. Not seeing Interdependency.
8. Not taking the Preparedness level into account.
9. Not assigning a Risk Owner.
10. Leaving responsibility unclear by writing “Management.”
11. Mistaking a control’s existence for its effectiveness.
12. Not testing the backup.
13. Normalizing recurring small faults.
14. Not analyzing incident records.
15. Not taking near miss reports seriously.
16. Blaming the employee for reporting.
17. Not setting Early Warning thresholds.
18. Not updating the Risk Register.
19. Not giving actions deadlines.
20. Closing a corrective action without verifying that it really works.

57. 20 Risk Management Decision Gates

Test your risk system with these questions.

Decision Gate 1

Has the hotel’s Risk Universe been defined?

Decision Gate 2

Have risks been assessed according to the hotel’s own context?

Decision Gate 3

Is there a Risk Register?

Decision Gate 4

Have critical risks been prioritized?

Decision Gate 5

Is Probability being assessed?

Decision Gate 6

Is Impact being assessed?

Decision Gate 7

Is Velocity being assessed?

Decision Gate 8

Is Detectability being assessed?

Decision Gate 9

Is Interdependency being assessed?

Decision Gate 10

Is Preparedness being measured?

Decision Gate 11

Is the Safety Override applied?

Decision Gate 12

Does every critical risk have a Risk Owner?

Decision Gate 13

Have Preventive Controls been defined?

Decision Gate 14

Have Detective Controls been defined?

Decision Gate 15

Are there KRIs?

Decision Gate 16

Are KRI thresholds tied to action?

Decision Gate 17

Is Incident Reporting working?

Decision Gate 18

Is there a Near Miss system?

Decision Gate 19

Are Corrective Actions being tracked?

Decision Gate 20

Is the Risk Register updated based on what is learned?

58. Risk Identification

• A Risk Universe has been built.
• Natural disaster risks have been assessed.
• Fire risks have been assessed.
• Technical risks have been assessed.
• Cyber risks have been assessed.
• People risks have been assessed.
• Food safety has been assessed.
• Supply risks have been assessed.
• Financial risks have been assessed.
• Reputation risks have been assessed.
• Destination risks have been assessed.

59. Risk Assessment

• Probability has been assessed.
• Impact has been assessed.
• Velocity has been assessed.
• Detectability has been assessed.
• Interdependency has been assessed.
• Preparedness has been assessed.
• Safety Override criteria have been defined.
• Critical risks have been prioritized.

60. Ownership

• Every critical risk has an owner.
• The owner’s responsibility is clear.
• Backup responsibility has been considered.
• A management escalation system exists.

61. Prevention

• Preventive Controls have been defined.
• Preventive maintenance is being carried out.
• A critical maintenance schedule exists.
• Critical controls are being tested.
• Control effectiveness is being assessed.

62. Early Warning

• KRIs have been identified.
• Thresholds have been defined.
• A Green/Amber/Red system has been considered.
• The alert owner is clear.
• Amber actions have been defined.
• Red escalation has been defined.

63. Incident & Near Miss

• An incident reporting system exists.
• A near miss recording system exists.
• Recurring events are analyzed.
• Trend analysis is done.
• Root Cause Analysis is applied.
• Corrective Actions are opened.
• Owners are assigned.
• Deadlines are given.
• Closure is verified.

64. Risk Review

• The Risk Register is reviewed regularly.
• Risk assessment is done for new systems.
• Risk review is done after major changes.
• Risk scores are reassessed after an incident.
• Controls are reviewed after a near miss.
• Top Risks are reported to management.

65. A Lean Risk Register for Small Hotels

A small independent hotel may not need a corporate risk file of hundreds of lines. Instead, 15–25 critical risks that really matter can be identified. For each, the following can be defined:

• Risk
• Trigger
• Probability
• Impact
• Owner
• Prevention
• Detection
• Backup
• Escalation
• Recovery

Twenty risks that are genuinely managed are worth more than a 500-line Risk Register no one looks at.

66. Level 1 — Reactive

Risks are noticed after the event has occurred. The approach “If something happens, we’ll deal with it” prevails.

67. Level 2 — Listed

A risk list exists. But active tracking is limited.

68. Level 3 — Owned

Critical risks have been scored, prioritized, and assigned an owner.

69. Level 4 — Controlled

Preventive and Detective Controls work. Risk management is tied into operations.

70. Level 5 — Predictive

There is a KRI, trend, threshold, and early warning system. Management does not look only at events that have already occurred.

71. Level 6 — Adaptive

Incidents, near misses, drills, real crises, and technological change continuously improve the Risk Register. Risk management stops being an annual report.

It turns into the organization’s learning system.

72. How Does the System Connect?

The full chain of mature risk management can be built like this:

Risk Universe → Risk Identification → Risk Assessment → Prioritization → Risk Owner → Preventive Control → Detective Control → KRI → Threshold → Early Warning → Action → Escalation → Incident / Near Miss → Root Cause → Corrective Action → Verification → Risk Register Update → Stronger Prevention

In this loop the Risk Register is the starting point. But it is not the end point. The real aim is to make risk visible and turn it into management action.

Conclusion: Management Cannot Manage a Risk It Has Not Defined

The biggest mistake in a hotel’s risk management is the sentence “Nothing like this has happened so far.” That something has not happened in the past does not show it will not happen in the future. But the other extreme is not right either. Declaring every possibility a crisis and preparing unusable tables of hundreds of risks is not effective risk management either. The right approach is this chain:

Define the Right Risk → Understand the Context → Prioritize → Assign an Owner → Prevent → Monitor → Catch the Early Signal → Intervene → Learn → Update the System

The purpose of the Risk Register is not to list everything the business might fear. Its real purpose is to direct management’s attention to the risks that really matter. So the core principle of hotel risk management is this:

Risk priority cannot be set by probability alone or impact alone; the stronger assessment is the combination of probability, impact, velocity, detectability, dependency, and preparedness level. Every hotel’s crisis list may be similar; but every hotel’s real risk profile is different.

And the most valuable point of the system emerges not after the crisis hits but just before it. The electrical panel overheats once more. A small problem shows up in the generator test. Supplier delivery performance deteriorates. PMS outages become more frequent. Phishing emails to staff increase. The same issue appears again and again in complaints. These are not just small operational problems. From the point of view of the right system, these can be:

Early Warning Signals

A well-managed hotel does not connect them after the crisis. It sees them earlier. Because the success of real risk management shows itself:

Not in how well you respond during a crisis, but in how many crises you stopped from growing before they even started.

Related reading: How to Set Up a Financial Control System in a Hotel: Revenue Control, Cash, Fraud, and Internal Control · How to Set Up Emergency and Crisis Management in Hotels: A Guide to Fire, Earthquake, Evacuation, and Crisis Management

Note: This content is for general information only and is not legal, financial or technical advice. Regulations and practices change over time. Before making decisions, consult a qualified professional (lawyer, accountant, engineer, etc.).

Hotel Investment Guide — Volume VIII

This article is developed from the crisis risk map, Risk Register, Risk Owner, preventive controls, incident reporting, near miss, and organizational learning approach covered in the Hotel Investment Guide — Volume VIII: Growth and Sustainability.

Volume VIII takes a systems approach to the long-term resilience and growth capacity of the hotel, from guest loyalty to crisis management, from renovation and CAPEX planning to a second hotel, multi-property management, and building a sustainable hotel brand.