Hospitality risk management: the top risks 64 hospitality companies disclose
Good hospitality risk management starts with knowing which risks your peers actually face. Restaurants, bars and hotels sell an experience delivered by hourly staff, often under someone else’s ownership through franchising. We counted how many of 64 US-listed hospitality companies disclose each risk in their latest annual report and compared the result with fourteen other industries.
Restaurants and hotels most often disclose litigation (86%) — the highest share of any industry in our study — and general regulatory change (72%). The distinctive risks are about people and food: frontline staff shortages, unionisation, food safety, franchisees and stakeholder expectations on ESG.
- Adverse litigation and legal proceedings: 86% (62% on average in the other fourteen industries). General regulatory change: 72% (34%).
- Frontline and store staff shortages: 70% (4% elsewhere). Unionisation of non-union workforce: 59% (8%).
- Failure to meet evolving ESG stakeholder expectations: 67% (20% elsewhere).
- Food safety and contamination incidents: 62% (4% elsewhere).
- Franchisee underperformance and disputes: 42% (1% elsewhere).
Turn this list into your own risk registerRisk Samurai starts you with the risks typical for hospitality companies, then helps you score them, assign owners and track actions.
Get early accessHow we built this. We took the Risk Factors section of the latest annual report of 64 US-listed hospitality companies on SEC EDGAR (filed 27 March 2025 to 25 September 2026), recorded every disclosed risk and grouped equivalent risks across companies. “Share” is the percentage of hospitality companies whose filing discloses the risk. Disclosure is not likelihood: filings are written by lawyers, are over-inclusive and come from public companies that are mostly larger than a typical small business, and shares are approximate. Full method and caveats.
Who is in the sample
The benchmark covers 64 hospitality companies: all 64 filed a Form 10-K, with filing dates between 27 March 2025 and 25 September 2026. By SEC industry code (SIC), the group is made up of 38 restaurants (eating places) (5812), 20 hotels and motels (7011) and 6 eating and drinking places (5810).
In plain words, the sample is mostly mid-sized and large restaurant chains and hotel groups: median annual revenue is about $1.5 billion, the smallest company reports around $8.1 million and the largest around $37.2 billion. The median filing yields 50 distinct risks (range 15–164). Restaurants and bars make up about two-thirds of the sample and hotels the rest, so food-related risks apply mainly to the former and travel-demand risks mainly to the latter.
| Measure | Value |
|---|---|
| Companies | 64 |
| Annual reports | 64 × 10-K |
| Filing dates | 27 March 2025 – 25 September 2026 |
| Annual revenue | median $1.5 billion; smallest $8.1 million; largest $37.2 billion |
| Risks identified per filing | median 50 (range 15–164) |
| Company-level risks the filing explicitly calls new this year | 3.5% |
The top 30 risks hospitality companies disclose
The table ranks risks by the share of hospitality companies whose annual report discloses them. The last column is the average share across the other fourteen industries in our study, so you can see at a glance whether a risk is generic to listed companies or particular to this sector. Risks marked distinctive are disclosed by at least 20% of hospitality companies and by at least 15 percentage points more than in any other industry.
| # | Risk | Hospitality companies | Other industries (avg) |
|---|---|---|---|
| 1 | Adverse litigation and legal proceedings Lawsuits, claims and legal proceedings may produce adverse judgments, settlements and defence costs exceeding insurance, diverting management and harming reputation. | 86% | 62% |
| 2 | General regulatory change and non-compliance Changes in, or failure to comply with, laws and regulations across jurisdictions may raise compliance costs, bring penalties or licence loss and force operational changes. | 72% | 34% |
| 3 | Frontline and store staff shortages distinctive Tight labour markets and high turnover may hinder recruiting frontline, store and hourly staff, causing understaffing, weaker service and reduced trading hours. | 70% | 4% |
| 4 | Cyberattack exposing data and disrupting operations Hacking, malware or ransomware against company systems exposes confidential or personal data and disrupts operations, causing liability, regulatory penalties, financial loss and reputational damage. | 69% | 86% |
| 5 | Internal IT system failure or outage Failure, defect or interruption of internal information systems could halt transaction processing and services, causing financial loss, data loss and reputational harm. | 69% | 42% |
| 6 | Failure to meet evolving ESG stakeholder expectations distinctive Heightened stakeholder, investor and customer scrutiny of ESG practices may raise costs and, if unmet, damage reputation, customer relationships, talent attraction and investor support. | 67% | 20% |
| 7 | Inadequate protection of own intellectual property Weak registration, protection or enforcement of proprietary technology and rights allows competitors to copy or misappropriate it, eroding competitive advantage and revenue. | 64% | 42% |
| 8 | Loss of senior executives or key employees Unexpected departure of senior executives or key employees without ready replacements could disrupt operations, impair strategy execution and harm financial results. | 64% | 54% |
| 9 | Intense competition eroding share and pricing Larger, lower-cost, private-label or new competitors undercut prices or outperform on products, causing loss of customers, market share and margins. | 64% | 70% |
| 10 | Food safety and contamination incidents distinctive Contamination, tampering or poor hygiene at own sites, suppliers, franchisees or delivery partners causes illness, leading to recalls, claims, closures, lost sales and brand damage. | 62% | 4% |
| 11 | Substantial indebtedness constraining cash flow High leverage, including further permitted borrowing, diverts cash flow to debt service and limits flexibility, increasing vulnerability to downturns and default. | 61% | 40% |
| 12 | Acquisitions fail to integrate or deliver benefits Poor selection, valuation or integration of acquired businesses diverts management and disrupts operations, so expected synergies and returns are not realised and results suffer. | 61% | 74% |
| 13 | Weaker consumer discretionary spending Falling consumer confidence, inflation or high interest rates reduce discretionary spending, lowering traffic, sales and margins on consumer offerings. | 61% | 24% |
| 14 | Unionisation of non-union workforce distinctive Union organising or labour law changes lead to unionisation of staff, increasing labour costs and restricting workforce flexibility and operating practices. | 59% | 8% |
| 15 | General insurance inadequate, unavailable or costly Insurance limits, exclusions, insurer disputes, rising premiums or unavailability leave property, catastrophe and liability losses uninsured and increase costs. | 56% | 40% |
| 16 | Adverse changes in tax laws and rates Changes in domestic or foreign tax laws, rates or interpretations increase effective tax rates and cash taxes, reducing earnings and cash flow. | 56% | 53% |
| 17 | Negative publicity damaging brand and demand Adverse media, press or public commentary about the company, accurate or not, damages reputation and trust, reducing customers, referrals, talent, partners and share price. | 52% | 28% |
| 18 | Pandemic disruption to operations and demand A pandemic or public health crisis and related restrictions could disrupt workforce, suppliers and customer demand, reducing revenue and straining liquidity. | 48% | 33% |
| 19 | Natural disasters damaging facilities and operations Natural disasters, severe weather or other catastrophes damage offices, stores or other premises, interrupting operations and service delivery and reducing revenue. | 45% | 26% |
| 20 | Geographic concentration of operations Concentration of operations, customers or assets in a few regions exposes results to local economic, regulatory, competitive or natural-disaster shocks. | 45% | 17% |
| 21 | Third-party IP infringement claims Products, services or technology allegedly infringe third-party intellectual property, leading to litigation, damages, royalties, injunctions, redesign or withdrawal of offerings. | 44% | 39% |
| 22 | Ineffective internal control over financial reporting Weak internal controls or unremediated material weaknesses may cause misstated or late financial reports and restatements, leading to sanctions and loss of investor confidence. | 42% | 54% |
| 23 | Political and legal risks of foreign operations Operating across foreign jurisdictions exposes the business to political instability, differing laws, tax, currency and expropriation, increasing costs and reducing profitability. | 42% | 32% |
| 24 | Franchisee underperformance and disputes distinctive Franchisees and licensees outside direct control may underperform, fail financially, dispute or not renew, reducing royalties, growth and brand value. | 42% | 1% |
| 25 | Rising wage and labour costs Wage pressure, minimum wage laws, payroll taxes and labour shortages raise employment costs that cannot be fully recovered, reducing margins. | 41% | 9% |
| 26 | Debt covenant restrictions and breach Restrictive covenants constrain operations, and a breach or cross-default allows lenders to accelerate debt, halt funding and enforce security over assets. | 41% | 42% |
| 27 | Seasonal and weather-driven demand swings Concentrated peak seasons and unseasonal weather cause uneven sales, capacity strain and inventory mismatches, so a weak peak sharply reduces annual results. | 41% | 15% |
| 28 | New stores or units underperform Poor site selection, delays or weak demand cause new stores or restaurants to miss targets, cannibalise existing sites and reduce returns on invested capital. | 39% | 3% |
| 29 | Non-compliance with privacy and data protection laws Failure to comply with privacy and data protection laws or commitments leads to enforcement action, fines, litigation and reputational damage. | 38% | 24% |
| 30 | Evolving privacy laws raising compliance costs New, changing and inconsistent privacy laws across jurisdictions require costly changes to systems and practices, raising compliance costs and exposure to penalties. | 36% | 42% |
Litigation and regulation lead the list because hospitality is a high-volume, consumer-facing, labour-intensive business: wage-and-hour class actions, slip-and-fall and food-related claims, accessibility suits and liquor liability all generate legal exposure, and minimum wage, scheduling, health, licensing and menu-labelling rules change often. Negative publicity (52%) adds a reputational edge — one viral incident can hurt a whole brand.
Labour is the second theme. Beyond staff shortages and unionisation, rising wage and labour costs (41%, against 9% elsewhere) rank in the top 30. For a restaurant, labour is one of the largest costs and the one most exposed to law changes.
The rest of the list is about demand and footprint. Weaker consumer discretionary spending (61%), seasonal and weather-driven swings (41%), geographic concentration (45%), natural disasters damaging facilities (45%) and new units that underperform (39%) describe a business whose revenue depends on where its sites are and whether people go out. Cyber (69%) is lower than the average elsewhere, but card data, loyalty programmes and online ordering keep it in the top five.
What is distinctive about restaurants and hotels
Eleven risks meet our test for being distinctive to hospitality: disclosed by at least 20% of companies and at least 15 percentage points more often than in any other industry. Five areas cover most of them.
Frontline staffing and unionisation
“Frontline and store staff shortages”: 70% (other industries 4%). “Unionisation of non-union workforce”: 59% (other industries 8%).
Restaurants and hotels need large numbers of hourly staff, and turnover is high. Shortages mean weaker service, shorter opening hours and more overtime; union organising and changes in labour law can raise costs and reduce scheduling flexibility. Track turnover and vacancies by site, invest in the general managers who drive retention, keep pay and scheduling practices competitive and compliant, and make sure managers know what they may and may not do during an organising campaign.
Food safety and food supply
“Food safety and contamination incidents”: 62% (other industries 4%). “Food and ingredient supply interruption”: 31% (other industries 0%).
A single outbreak can close sites, trigger claims and damage a brand for years, and contamination can come from suppliers, delivery partners or franchisees as well as your own kitchens. Supply interruptions force menu changes and raise costs. Approved-supplier programmes, temperature and hygiene monitoring, regular audits of every site including franchised ones, traceability by batch and a rehearsed crisis plan are the core controls.
Franchisees: performance, payment and liability
“Franchisee underperformance and disputes”: 42% (other industries 1%). “Franchisee and licensee payment default”: 23% (other industries 0%). “Franchise and joint-employer liability”: 25% (other industries 1%).
Franchising lets a brand grow without owning every site, but the brand’s reputation then depends on operators it does not control. Franchisees can underperform, fail financially, dispute terms or decline to renew, and joint-employer rules can make the franchisor liable for their employment practices. Monitor franchisee financial health and brand-standard audits, set clear escalation for underperformance, and review agreements and operating manuals against current franchise and joint-employer law.
Evolving ESG stakeholder expectations
67% of hospitality companies disclose it, against 20% on average in the other industries.
Guests, investors and staff increasingly ask about sourcing, animal welfare, packaging, energy use and labour practices. Falling short can cost customers and talent; over-promising invites challenge. Publish only commitments you can measure, assign each one an owner and a supplier plan, and keep evidence ready for investor and customer questions.
Reliance on third-party delivery platforms
34% of hospitality companies disclose it, against 0% on average in the other industries.
Delivery apps bring orders, but they charge high commissions, control the customer relationship and can favour competitors in their rankings. Track the share of sales and margin by channel, keep your own ordering channel and loyalty programme as an alternative, and set a ceiling on how much of revenue any single platform may carry.
The remaining distinctive hospitality risks, both about changing consumer tastes:
| Risk | Hospitality companies | Other industries (avg) |
|---|---|---|
| Health and social acceptance concerns reducing demand Health findings, weight-loss drugs, declining social acceptance or public campaigns against products such as alcohol, sugar or tobacco reduce consumer demand. | 33% | 2% |
| Misjudging consumer and product trends Failure to anticipate consumer trends or offer desirable merchandise and menus leads to unsold stock, markdowns, ineffective marketing and lost sales. | 28% | 1% |
The category mix
Every identified company-level risk is classified into one of nine groups. The table shows how hospitality companies’ risk mentions split across them — a rough picture of where their attention goes, not of where losses come from.
| Risk group | Share of risk mentions |
|---|---|
| Strategic | 26.1% |
| Financial | 21.9% |
| Compliance and legal | 18.4% |
| Operational | 16.3% |
| ESG and sustainability | 5% |
| IT and cyber security | 4.3% |
| People | 4.2% |
| Reputational | 3.2% |
| Project | 0.6% |
Strategic risks lead at 26.1% of mentions, followed by financial (21.9%), compliance and legal (18.4%) and operational (16.3%). Reputational risk accounts for 3.2% of mentions, the highest share of the fifteen industries, which fits businesses whose brand is rebuilt with every meal or stay.
How to use this in your own risk register
A benchmark is a checklist of what peers disclose, not a risk assessment of your business. Use it to spot gaps, then do the real work yourself.
- Pick. Read the distinctive risks and the top ten first. Tick the ones that genuinely apply to your business model, size and markets, and drop the rest. Hotel groups can drop most food items but should keep travel demand, franchise and labour risks; independent restaurants can drop franchise items.
- Rewrite for your business. Filing wording is deliberately generic. Turn each risk into a specific statement of cause, event and consequence — see what a risk register is for the format.
- Score likelihood and impact. Score each risk on your own risk matrix. Do not use the share column as a likelihood: it measures how many companies mention a risk, not how often it happens.
- Name an owner and controls. Each risk needs one accountable person and a short list of the controls that actually reduce it today.
- Add indicators. Pick one or two key risk indicators for the risks that score highest, with thresholds that trigger action.
For example, “Food safety and contamination incidents” becomes: “A contaminated batch of salad leaves from one regional supplier causes illness at several of our restaurants, leading to temporary closures, customer claims and a fall in same-store sales across the region.” That version names the source, the spread and the consequences, and points to supplier audits and traceability as the controls.
Indicators that suit restaurants and hotels include:
- Hourly staff turnover and open vacancies by site.
- Food safety audit scores, with a threshold that triggers a follow-up visit.
- Franchisees on a watch list for financial or brand-standard issues.
- Share of sales through third-party delivery platforms.
- Open employment claims and regulatory inspections with findings.
Restaurants and hotels take card payments at every till and front desk; the PCI DSS compliance checklist covers those obligations. For suppliers, delivery platforms and franchise partners, our third-party risk assessment guide shows how to tier and review them.
Frequently asked questions
What are the biggest risks for restaurants and hotels?
In 64 US hospitality annual reports, the most widely disclosed risks are litigation (86% of companies), general regulatory change (72%), frontline staff shortages (70%), cyberattack (69%) and internal IT system failure (69%).
Which risks are specific to the hospitality industry?
Compared with fourteen other industries, hospitality companies disclose much more often: frontline staff shortages (70% vs 4%), ESG stakeholder expectations (67% vs 20%), food safety incidents (62% vs 4%), unionisation (59% vs 8%), franchisee underperformance (42% vs 1%) and reliance on third-party delivery platforms (34% vs 0%).
How should an independent restaurant or hotel use this list?
Keep the risks that apply at any size — staffing and wages, food safety, licensing and health rules, card data, delivery platforms, weather and local demand — and drop franchise and listed-company items unless they apply. Rewrite each for your sites, score it on your risk matrix and give it an owner.
How was this list built?
From the Risk Factors section of the latest annual report of 64 US-listed hospitality companies on SEC EDGAR. We recorded every distinct risk each section discloses, grouped equivalent risks across companies and counted the share of companies disclosing each one.
Does a higher share mean a risk is more likely?
No. The share measures how many companies chose to disclose a risk, not how often it happens or how much it costs. Annual reports are written by lawyers to protect the company, so they are over-inclusive: a risk can appear in nearly every filing and still be unlikely in any given year. Score likelihood and impact for your own business separately.
Start your register from this benchmark
Risk Samurai uses this benchmark to suggest the risks companies in your industry typically face — staffing, food safety, franchise, regulatory and litigation risks for a restaurant or hotel business — when you build your register. You then rewrite, score and assign owners to them.
Get early access