Governance, Ethics, Risk and Compliance

Introduction and Context

Food and beverage control is often described as a system for protecting revenue, inventory and profitability. At postgraduate level, however, control must be understood more broadly: it is a governance system that aligns commercial performance with lawful conduct, food safety, ethical behaviour, guest welfare and organisational accountability. A hotel may report excellent food cost percentages and still be poorly controlled if suppliers are bribed, allergen information is inaccurate, customer data is misused, or managers conceal incidents.

Governance determines who has authority, how decisions are supervised and how accountability is demonstrated. Ethics guides conduct where rules are incomplete or competing interests exist. Risk management identifies uncertainty that may prevent the organisation from achieving its objectives. Compliance translates external laws, licence conditions, standards and internal policies into operational requirements.

These dimensions are interdependent. Weak segregation of duties can enable fraud; weak purchasing controls can create food-safety risks; poor incident records can undermine regulatory defence; and excessive surveillance can damage staff trust. The strategic challenge is therefore to design controls that are proportionate, evidence-based and compatible with excellent guest service.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain governance, ethics, risk and compliance in a food and beverage context.
2. Assess fraud, collusion, conflict-of-interest and revenue-leakage risks.
3. Design authorization, segregation-of-duty and audit-trail controls.
4. Evaluate food-safety, licensing, taxation and data-protection obligations.
5. Develop ethical and resilient control policies without undermining trust or service.
6. Apply risk-based reasoning to an integrated hotel case.

1. Governance as the Control Architecture

Governance is the system through which an organisation is directed, monitored and held accountable. In a hotel, governance operates at several levels:

• Board or ownership level: approves risk appetite, ethical standards and major compliance commitments.
• Executive level: allocates resources, establishes policies and reviews performance.
• Departmental level: converts policy into purchasing, production, service, cashiering and reporting procedures.
• Operational level: performs checks, records transactions and reports exceptions.
• Assurance level: internal audit, external audit, regulators and independent reviewers test whether controls work.

A useful distinction is between control design and control operation. A policy may require two approvals for supplier creation, but if both approvals are routinely given without review, the design appears sound while operation is ineffective. Governance therefore requires evidence of performance, not merely written procedures.

The three-lines model

A practical framework is the three-lines model:

1. First line—operations: chefs, servers, stores personnel, purchasing officers and managers own risks and perform daily controls.
2. Second line—risk and compliance: finance, quality, legal, food safety and information-security functions advise, monitor and challenge operations.
3. Third line—internal audit: provides independent assurance to senior governance bodies.

The model does not mean that operations can transfer responsibility to compliance. The first line remains accountable for controlling its own activities; the second line provides expertise and oversight; the third line evaluates independence and effectiveness.

2. Ethical Foundations of Control

Rules cannot anticipate every situation. Ethical control therefore requires judgement based on principles such as:

• Integrity: records and representations are truthful.
• Fairness: suppliers, employees and guests are treated consistently.
• Non-maleficence: decisions do not expose people to avoidable harm.
• Respect and dignity: employees and guests are not humiliated or exploited.
• Confidentiality: information is accessed only for legitimate purposes.
• Accountability: individuals can explain and accept responsibility for decisions.
• Proportionality: the response to a risk is appropriate to its likelihood and impact.

A useful test for a questionable action is whether it would remain defensible if disclosed to a guest, regulator, employee, owner or reputable newspaper. This is not a substitute for law, but it exposes rationalisations that technically comply with a narrow rule while violating its purpose.

Ethical dilemmas in hospitality control

Managers frequently face tensions between:

• preventing theft and respecting employee privacy;
• rejecting an unsafe food item and meeting a banquet deadline;
• giving a loyal supplier preferential treatment and maintaining fair competition;
• correcting a guest bill and protecting reported revenue;
• investigating suspected fraud and preserving the presumption of innocence;
• collecting guest information for service personalisation and limiting surveillance.

Ethical decision-making should identify affected stakeholders, applicable duties, foreseeable harms, alternatives, evidence and the least intrusive effective control. A “zero tolerance” slogan is not a complete ethical policy: it may encourage concealment of mistakes. A stronger policy distinguishes honest error, negligence, reckless conduct and intentional deception, while maintaining consistent investigation and documentation.

3. Risk Management in Food and Beverage Operations

Risk is the effect of uncertainty on objectives. In operational use, risk is commonly assessed through likelihood and consequence. A simple qualitative matrix may classify likelihood as rare, possible or likely and consequence as minor, serious or critical. The matrix is a prioritisation tool, not a precise probability model.

For risks with reasonably estimated probabilities and financial impacts, expected loss can be used:

where EL is expected loss per defined period, p is the probability of the event during that period, and I is the financial impact if it occurs. Both probability and impact must refer to the same period and scope. The calculation assumes that the estimate is meaningful and that the event definition is sufficiently clear. It does not capture reputation, legal exposure, human suffering or correlated events.

For example, if a refrigeration failure has an estimated annual probability of 0.08 and would cause an estimated loss of $25,000, then:

The result does not mean that exactly $2,000 will be lost. It is an average decision-support estimate across comparable periods. A food-safety event may require urgent mitigation even when its expected financial loss is low because its human and regulatory consequences are severe.

Risk treatment

Management can respond by:

• avoiding the activity;
• reducing likelihood or impact through controls;
• transferring or sharing some financial consequences through insurance or contracts;
• accepting residual risk within approved tolerance.

A control should have a named owner, defined frequency, evidence of performance, escalation criteria and a method for testing effectiveness. Risk registers should record inherent risk, existing controls, residual risk, further actions, deadlines and accountable managers.

4. Fraud, Collusion and Conflict of Interest

Fraud is intentional deception for personal or organisational gain. In food and beverage operations, common schemes include:

• purchasing goods from a connected supplier at inflated prices;
• receiving kickbacks or undisclosed gifts;
• creating fictitious suppliers or employees;
• diverting stock before it is recorded;
• voiding or discounting sales after cash is received;
• manipulating portion sizes or recipe yields;
• recording complimentary meals that were not authorised;
• altering invoices, goods-received records or inventory counts;
• concealing spoilage or wastage to cover theft;
• colluding with guests, suppliers or colleagues.

The fraud triangle identifies three typical conditions: pressure, opportunity and rationalisation. Organisational culture and capability are often added as broader fraud-risk factors. Controls should reduce opportunity without assuming that employees are inherently dishonest.

Collusion

Collusion is cooperation between two or more people to defeat a control. It explains why segregation of duties is necessary but not sufficient. For example, a purchaser and receiving clerk may agree that short deliveries were complete; a cashier and supervisor may coordinate false voids. Anti-collusion measures include rotation of duties, independent supplier confirmations, surprise counts, analytics, confidential reporting channels and review of relationships between employees and vendors.

Conflicts of interest

A conflict exists when personal interests could improperly influence professional judgement, whether or not improper action has occurred. Policies should require disclosure of financial interests, family relationships, outside employment, gifts, hospitality and vendor contacts. A conflict may be managed by recusal, independent approval, competitive quotation, reassignment or prohibition. Disclosure alone is not always sufficient; the organisation must decide and document the treatment.

Fraud-risk indicators

Indicators are signals for investigation, not proof of misconduct. Examples include unusual purchasing outside contracted vendors, repeated round-number invoices, identical invoice formatting across supposedly independent suppliers, excessive manual discounts, frequent post-shift voids, inventory variances concentrated on one shift, shared bank details among vendors, and employees resisting leave or rotation. Analytics should generate proportionate review rather than automatic punishment.

5. Authorization, Segregation and Audit Trails

Segregation of duties

No single person should normally control initiation, authorization, custody, recording and reconciliation of a transaction. In a purchasing cycle, the requester identifies need, an authorised manager approves it, procurement selects or contracts the supplier, receiving verifies delivery, accounts payable matches documents, and finance releases payment. Small properties may not have enough staff for complete separation; compensating controls can include owner review, independent bank reconciliation, surprise counts and system-generated exception reports.

Authorization design

A sound authorization matrix specifies:

• transaction type;
• monetary or risk threshold;
• authorised role, not merely a named person;
• required supporting evidence;
• permitted emergency route;
• prohibition on self-approval;
• temporary delegation rules;
• review and expiry date.

Thresholds should reflect risk, not only value. A low-value allergen substitution or licence-sensitive purchase may require stronger review than a routine high-volume item.

Audit trails

An audit trail is a chronological, attributable record showing what happened, when, by whom, under what authority and with what subsequent correction. A reliable trail contains original entries, user identity, timestamps, approval records, linked documents, amendments and exception explanations. Deleting or overwriting original records weakens evidential integrity; corrections should preserve the original and record the reason, author and date.

Audit trails should be reviewed for completeness and unusual patterns. System access must be role-based, individual accounts must not be shared, privileged access should be restricted, and logs should be protected from unauthorised alteration. Retention periods must follow applicable law, contractual duties and legitimate business needs; retaining everything indefinitely is not automatically good governance.

6. Food Safety as a Governance Responsibility

Food safety is both an ethical duty and a compliance obligation. A recognised preventive approach is Hazard Analysis and Critical Control Point (HACCP). Its logic is to identify hazards, determine critical control points, establish critical limits, monitor them, define corrective actions, verify the system and maintain records.

Hazards may be:

• biological: pathogens, viruses and parasites;
• chemical: cleaning residues, allergens, toxins or incorrect additives;
• physical: glass, metal, bone or other foreign matter.

A critical limit must be observable or measurable and linked to a specific hazard. For example, a cooking limit must be established from applicable scientific guidance and local regulation; it should not be invented from a generic hotel rule. Records should identify product, date, equipment, responsible employee, result and corrective action.

Food-safety governance also covers supplier approval, traceability, temperature control, personal hygiene, pest management, cleaning, allergen communication, water quality, staff training and incident escalation. If a suspected contamination occurs, the hotel should protect guests, isolate affected stock, preserve evidence, notify competent authorities where required, investigate root causes and communicate truthfully. Quietly relabelling or continuing service is ethically and legally unacceptable.

7. Licensing, Taxation and Regulatory Compliance

Requirements vary by jurisdiction, so managers must consult current local law rather than rely on general textbook statements. Typical obligations include:

• food-business registration or operating permits;
• liquor, entertainment or late-hours licences;
• fire, occupational-health and building approvals;
• weights-and-measures and menu-pricing rules;
• employment and wage requirements;
• waste, environmental and water regulations;
• sales tax, value-added tax, service-charge and withholding rules;
• consumer-protection and advertising requirements.

A compliance register should name each obligation, licence number, issuing authority, responsible owner, renewal date, evidence location, inspection history and escalation path. Calendar reminders are useful but insufficient; managers must verify that conditions continue to be met.

Tax and revenue integrity

Tax control requires accurate classification and recording of taxable sales, exempt items, discounts, service charges, tips, complimentary transactions and refunds. A simplified reconciliation identity is:

This identity applies only to the defined cash drawer and period, and requires that all included receipts and payouts are documented. It does not reconcile card, digital-wallet or room-charge transactions, which require separate processor or property-management-system reports.

For sales records, management should reconcile point-of-sale totals to payment settlements, room postings, general-ledger postings and tax returns. Unauthorised discounts or voids can reduce both revenue and tax, so exception reporting is a compliance control, not merely a profitability tool.

8. Data Privacy and Responsible Technology

Food and beverage systems process payment information, guest profiles, dietary and allergy information, employee data, CCTV footage and loyalty identifiers. Privacy principles commonly include purpose limitation, data minimisation, accuracy, security, retention limitation, transparency and accountability. The precise legal rights and obligations depend on jurisdiction.

A privacy-by-design approach asks:

1. What information is necessary for the stated service?
2. What lawful basis or permission is required?
3. Who needs access, and for how long?
4. How will the information be secured and corrected?
5. What happens after a breach or unauthorised disclosure?

Allergy information deserves special care: it can protect life but may also be sensitive personal information. Access should be limited to staff who need it to deliver safe service, while operational communication must be clear enough to prevent omission.

Artificial intelligence may assist with anomaly detection, demand forecasting, invoice matching or staff scheduling. It should not be treated as an unquestionable decision-maker. Models can reproduce biased data, generate false alerts, expose confidential information or make opaque recommendations. Human review, documented data sources, access controls, validation, performance monitoring and an appeal or correction route are essential. Staff should not upload guest, employee or supplier data into unapproved public AI tools.

9. Resilience, Incident Response and Accountability

Resilience is the capacity to continue essential service, absorb disruption and recover while learning from events. Relevant scenarios include cyberattack, refrigeration failure, supplier contamination, payment-system outage, fire, severe weather, labour shortage and deliberate fraud.

An incident plan should define:

• activation criteria;
• incident leader and deputies;
• guest-safety priorities;
• communication authority;
• evidence preservation;
• alternative suppliers and manual procedures;
• regulator, insurer and law-enforcement contacts;
• recovery and post-incident review.

Accountability should be just and learning-oriented. It distinguishes system weaknesses from individual violations, but it does not excuse intentional concealment, retaliation or reckless disregard. Root-cause analysis should ask why the event was possible, why earlier signals were missed, whether incentives encouraged it, and whether the corrective action addresses the system rather than merely blaming the last person involved.

10. Integrated Case: The Riverside Grand Hotel

The following is an illustrative case.

Background

The Riverside Grand operates three restaurants, banquets and room service. Food cost rose from 31% to 37% in six months, while reported sales remained stable. The hotel also received a complaint that a guest’s declared nut allergy was not communicated to the banquet kitchen.

Problem

Management initially suspected theft and proposed CCTV monitoring of all staff and disciplinary action against the receiving clerk. A preliminary review found that one purchaser selected suppliers, approved emergency orders and maintained vendor master data. The receiving clerk signed deliveries using supplier-prepared quantities. The point-of-sale system allowed supervisors to void sales after payment without a reason code. Allergen information was written on paper sheets that were sometimes discarded after service.

Analysis

The food-cost variance could result from theft, price inflation, inaccurate recipes, waste, poor receiving, unrecorded transfers or sales leakage. The allergy event indicated a high-consequence communication and documentation failure, regardless of whether harm occurred. The proposed universal surveillance was disproportionate and would not address vendor conflicts, weak receiving or missing allergen records.

A risk review identified:

Approach and solution

The general manager appointed a cross-functional review team including operations, finance, food safety and human resources. It preserved transaction records, interviewed staff confidentially and avoided announcing guilt. The hotel introduced three-way matching of purchase order, goods-received record and invoice; required independent approval for supplier creation; and reviewed related-party declarations.

Receiving staff counted or weighed deliveries against purchase orders, recorded substitutions and photographed discrepancies where appropriate. Supervisors could still correct guest bills, but every post-payment void required a reason code and next-day independent review. The hotel analysed voids, discounts, wastage and inventory variances by outlet and shift.

For allergens, the hotel adopted a controlled guest-allergy record, a kitchen acknowledgement step, recipe and ingredient verification, and a service recovery and escalation procedure. Staff were trained that an allergy request is a safety communication, not a preference note. The hotel also established a confidential reporting channel and prohibited retaliation.

Outcome

After three months, unexplained purchase-price variance declined, supplier discrepancies were documented earlier, and voids became fewer and more explainable. The review did not prove that the receiving clerk had stolen goods; instead, it found a control environment in which collusion would have been possible. The hotel gained stronger evidence without treating all employees as suspects. The allergen process produced an auditable communication trail and required management to verify menu changes with suppliers.

Learning points

1. A financial symptom rarely identifies a single cause.
2. High-consequence safety risks require priority even when financial probability is low.
3. Segregation, analytics and independent review must work together.
4. Ethical investigation protects both guests and employees.
5. Controls are effective only when staff understand their purpose and can perform them under service pressure.

11. Designing Effective Policies

A mature policy should specify purpose, scope, definitions, responsibilities, prohibited conduct, required controls, exceptions, evidence, reporting, investigation, sanctions, training and review. Policies should be written in operational language. “Maintain appropriate records” is weaker than “record quantity, unit, discrepancy, receiver identity and time before the delivery is stored.”

Controls should be:

• preventive where avoidance is possible;
• detective where events may still occur;
• corrective where recovery and learning are needed;
• compensating where ideal segregation is impractical.

The control environment should be tested using both compliance testing (did the required step occur?) and substantive analysis (does the recorded result make sense?). Key performance indicators may include inventory variance, unexplained voids, late licence renewals, overdue corrective actions, supplier exceptions, food-safety deviations, training completion and incident-reporting timeliness. Metrics should not encourage concealment; a rise in reported near misses may initially indicate improved trust rather than worsening performance.

Challenges and Limitations

Control systems have costs and can slow service. Excessive approvals may cause employees to bypass procedures; excessive surveillance may produce fear and under-reporting; rigid rules may prevent legitimate emergency decisions. Quantitative risk estimates may be unreliable when data are sparse, and a low recorded incident rate may reflect poor reporting. Technology can improve traceability while creating cyber and privacy risks. External audits provide assurance but are periodic and may not observe informal workarounds.

Managers should therefore apply proportionality, consult employees who perform the work, test controls in real conditions and revise them after incidents or regulatory change. Trust is not the absence of control. It is the expectation that controls are fair, understandable, consistently applied and focused on protecting people and the organisation.

Contemporary Developments

Current practice is moving toward continuous monitoring, digital supplier portals, electronic temperature records, integrated point-of-sale and inventory platforms, whistleblowing protections, sustainability due diligence and privacy-enhancing technologies. Environmental and social governance also affects food and beverage control through responsible sourcing, modern-slavery risks, waste reporting and supplier labour conditions. These developments increase the information available to managers but also increase dependence on data quality, system resilience and responsible governance.

Chapter Summary

Governance, ethics, risk and compliance form an integrated foundation for strategic food and beverage control. Governance allocates authority and accountability; ethics guides decisions where rules are incomplete; risk management prioritises uncertainty; and compliance converts legal and organisational requirements into evidence-based practice. Fraud controls require attention to pressure, opportunity, rationalisation, collusion and conflicts of interest. Segregation of duties, authorization matrices, independent review and reliable audit trails reduce opportunity but must be adapted to the scale of the property.

Food safety is a non-negotiable ethical and regulatory responsibility supported by preventive systems such as HACCP. Licensing, taxation and privacy require current jurisdiction-specific knowledge, accurate records and accountable ownership. Resilient hotels prepare for incidents, protect evidence, communicate honestly and learn without unjustly blaming employees. Effective control is proportionate, transparent and compatible with service quality. Its ultimate purpose is not simply to reduce variance, but to protect guests, employees, owners and the integrity of hospitality operations.

Key Terms

Governance: The system by which an organisation is directed, monitored and held accountable.

Ethics: Principles used to judge responsible conduct, especially where rules are incomplete.

Risk: The effect of uncertainty on organisational objectives.

Expected loss: Probability multiplied by estimated impact for a defined event and period.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Residual risk: Risk remaining after controls are applied.

Fraud: Intentional deception for gain or advantage.

Collusion: Cooperation between people to defeat a control.

Conflict of interest: A personal interest that could improperly influence professional judgement.

Segregation of duties: Division of transaction responsibilities among different people or roles.

Authorization matrix: A documented allocation of approval powers and thresholds.

Audit trail: Chronological and attributable evidence of transactions and decisions.

HACCP: A preventive food-safety system based on hazard analysis and critical control points.

Critical limit: A measurable boundary that must be met to control a hazard.

Compliance register: A record of obligations, owners, evidence and renewal or review dates.

Three-way matching: Comparison of purchase order, goods receipt and supplier invoice.

Data minimisation: Collecting and retaining only information necessary for a legitimate purpose.

Resilience: Capacity to withstand, recover from and learn after disruption.

Just culture: An approach that supports learning while holding intentional or reckless misconduct accountable.

Residual risk: Risk remaining after mitigation and control activities.

Review Questions

Short Answer Questions

1. Distinguish control design from control operation.
2. What are the three lines in the three-lines model?
3. Define conflict of interest and give one method of managing it.
4. What information should a reliable audit trail preserve?
5. Why is food safety both an ethical and a compliance responsibility?

Long Answer Questions

1. Explain how governance, ethics, risk management and compliance interact in a hotel food and beverage department.
2. Discuss the strengths and limitations of segregation of duties in a small hotel.
3. Explain how HACCP principles support accountability and regulatory compliance.
4. Evaluate the relationship between tax integrity, point-of-sale controls and revenue management.
5. Design a data-privacy policy for guest allergy and dietary information.

Analytical / Application Questions

1. A hotel records frequent post-payment voids, rising food cost and a new supplier controlled by a manager’s relative. Develop an investigation and control-response plan that protects evidence and employee fairness.
2. A refrigeration failure may occur with annual probability 0.05 and cause an estimated direct loss of $40,000. Calculate expected annual loss and explain why the result alone cannot determine the control decision.
3. A small resort cannot fully segregate purchasing, receiving and accounts payable duties. Design compensating controls and explain how their effectiveness should be tested.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the primary responsibility of the first line in the three-lines model?

A. Conduct independent internal audits

B. Own operational risks and perform daily controls

C. Issue all external licences

D. Set tax law for the organisation

Correct Answer: B. Own operational risks and perform daily controls

Question 2

A refrigeration failure has a probability of 0.08 and an estimated impact of $25,000 in one year. What is the expected loss?

A. $200

B. $2,000

C. $20,000

D. $312,500

Correct Answer: B. $2,000

Question 3

Which situation is the clearest example of collusion?

A. A cashier makes an accidental entry error

B. A supplier sends an invoice late

C. A purchaser and receiver agree to record a short delivery as complete

D. A manager reviews a daily exception report

Correct Answer: C. A purchaser and receiver agree to record a short delivery as complete

Question 4

What is the main purpose of segregation of duties?

A. To ensure one person controls the entire transaction

B. To divide incompatible responsibilities among roles

C. To eliminate the need for documentation

D. To permit unlimited emergency purchases

Correct Answer: B. To divide incompatible responsibilities among roles

Question 5

Which combination is required for three-way matching?

A. Menu, recipe and guest comment

B. Purchase order, goods receipt and supplier invoice

C. Tax return, payroll and bank statement

D. Licence, insurance policy and audit opinion

Correct Answer: B. Purchase order, goods receipt and supplier invoice

Question 6

Which is a biological food hazard?

A. Glass fragment

B. Cleaning chemical residue

C. Pathogenic microorganism

D. Metal utensil

Correct Answer: C. Pathogenic microorganism

Question 7

Why should a correction to an electronic record preserve the original entry?

A. To hide the correction from auditors

B. To maintain evidential integrity and accountability

C. To reduce the retention period automatically

D. To prevent authorised users from reviewing it

Correct Answer: B. To maintain evidential integrity and accountability

Question 8

Which privacy principle limits collection to information necessary for a legitimate purpose?

A. Data minimisation

B. Unlimited retention

C. Open access

D. Automatic disclosure

Correct Answer: A. Data minimisation

Question 9

The identity Closing cash = Opening float + Cash receipts − Cash payouts applies directly to which situation?

A. A defined cash drawer and period

B. All credit-card settlements across a year

C. Inventory valuation without quantity data

D. A supplier’s profit calculation

Correct Answer: A. A defined cash drawer and period

Question 10

Which response best reflects a just and learning-oriented control culture?

A. Punish every error identically

B. Ignore intentional concealment to protect morale

C. Distinguish honest error from reckless or intentional misconduct while correcting system weaknesses

D. Discourage incident reporting until an investigation is complete

Correct Answer: C. Distinguish honest error from reckless or intentional misconduct while correcting system weaknesses