12. Safety, Risk, Crisis and Resilience Management

Introduction and Context

Tourism depends on movement, confidence and the continued functioning of places. Visitors must feel that destinations, transport systems, accommodation establishments, attractions and public spaces are sufficiently safe. Yet tourism is exposed to an unusually wide range of disruptions: infectious disease, extreme weather, earthquakes, fire, terrorism, crime, cyberattacks, political unrest, supply interruptions and reputational crises. Because tourists can often change destinations quickly, even a limited incident may produce consequences far beyond the site at which it occurs.

Safety, risk, crisis and resilience management therefore constitute a strategic responsibility rather than a narrow operational function. A hotel that controls fire hazards but cannot communicate during a cyberattack remains vulnerable. A destination that evacuates visitors efficiently but neglects local communities may recover economically while losing social legitimacy. Effective management integrates prevention, preparedness, response, continuity, recovery and learning.

For tourism managers, the central question is not whether disruption can be eliminated. It is how exposure can be reduced, consequences contained, decisions coordinated and the organization or destination restored and improved. This chapter develops an integrated approach suitable for hotels, resorts, airlines, attractions, destination management organizations, tour operators and public agencies.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish safety, hazard, risk, crisis, emergency, vulnerability, business continuity and resilience.

2. Conduct a structured risk assessment for tourism operations and destinations.

3. Design prevention, preparedness, response, communication and recovery measures.

4. Apply crisis-management and resilience frameworks to health, disaster, security, political and business-disruption scenarios.

5. Evaluate leadership, governance, ethical and stakeholder issues during crises.

6. Use technology, data and scenario analysis responsibly in risk management.

7. Critically assess common weaknesses in tourism crisis plans.

The Strategic Meaning of Safety and Risk

Safety refers to the protection of people, assets, information and the environment from reasonably foreseeable harm. Security is related but places greater emphasis on intentional threats such as crime, terrorism, violence, espionage and malicious cyber activity. A hazard is a source or condition with the potential to cause harm. Risk combines the likelihood of an event with the severity of its consequences. Although risk is often represented as a product of likelihood and impact, professional judgement is required because probabilities and consequences are rarely known with precision.

Vulnerability describes the susceptibility of people, infrastructure or systems to harm. Exposure concerns the presence of people, assets or activities in locations where hazards may occur. Capacity is the ability to anticipate, withstand, respond to and recover from an event. Thus, the same hazard can produce different outcomes in different destinations. A cyclone affecting a well-maintained resort with evacuation routes, trained staff and reliable communications may cause less harm than a weaker storm affecting an unprepared community.

An emergency is an event requiring immediate action to protect life, property or essential operations. A crisis is more complex. It threatens important objectives, creates uncertainty, attracts public and media attention, and may challenge the legitimacy or reputation of an organization. Business disruption is an interruption to critical processes, whether or not it becomes publicly recognized as a crisis. Resilience is the capacity to absorb disturbance, adapt, continue essential functions and recover or transform after disruption.

These concepts are connected but not interchangeable. Risk management is anticipatory; crisis management is concerned principally with acute disruption and high-stakes decisions; business continuity protects critical functions; resilience takes a broader, long-term view of adaptive capacity.

A Tourism Risk Landscape

Tourism risk is systemic because organizations depend on networks. A hotel relies on utilities, transport, food suppliers, digital platforms, health services, regulators and destination reputation. A failure outside the organization may therefore become an internal crisis. Risk categories commonly include:

• Natural and environmental risks: floods, storms, earthquakes, wildfires, landslides, heat, water scarcity and ecological degradation.
• Health risks: infectious disease, food poisoning, contaminated water, occupational injury and inadequate medical response.
• Security risks: theft, assault, terrorism, trafficking, crowd disorder and hostile intrusion.
• Political and social risks: protests, civil unrest, border restrictions, sanctions, conflict and sudden policy change.
• Operational risks: fire, equipment failure, overcrowding, transport accidents, poor maintenance and staffing shortages.
• Technological and information risks: system failure, ransomware, data breaches, misinformation and loss of communications.
• Financial and market risks: demand shocks, currency instability, insurance gaps and insolvency of partners.
• Reputational risks: misleading claims, discriminatory treatment, poor handling of victims, environmental damage or inconsistent public statements.

The categories overlap. A flood may damage infrastructure, create a health threat, interrupt supply chains and generate reputational damage. Risk registers should therefore record interdependencies rather than treating hazards as isolated items.

Frameworks for Risk Assessment

A useful assessment begins by defining the context. Managers identify the site or operation, stakeholders, critical services, legal obligations, planning assumptions and acceptable levels of risk. They then identify hazards through inspections, incident records, staff consultation, expert advice, visitor feedback, supplier analysis, geographic information and scenario workshops.

Each risk should be analysed in terms of causes, vulnerable groups, existing controls, likelihood, impact, early-warning indicators and responsible owners. Impact should be considered across several dimensions: human safety, service delivery, finance, legal compliance, environment, information and reputation. A simple matrix may classify risks as low, medium, high or extreme, but a matrix is a prioritization aid, not a substitute for analysis. A low-probability event with catastrophic consequences may require substantial preparation even when its numerical score is modest.

Risk treatment normally follows a hierarchy:

1. Avoid: discontinue an activity or location whose risk is unacceptable.

2. Reduce: modify design, procedures, staffing, training or equipment to lower likelihood or impact.

3. Transfer or share: use insurance, contracts, specialist providers or partnership arrangements, while recognizing that responsibility cannot be completely outsourced.

4. Accept and monitor: tolerate residual risk within approved limits, supported by contingency measures.

The process should be documented in a risk register. A strong register includes the hazard, event scenario, causes, consequences, existing controls, risk rating, treatment actions, owner, deadline, indicators and review date. It should be updated after incidents, near misses, organizational changes and new intelligence.

Scenario planning supplements the risk register. For example, a resort may examine a twenty-four-hour power outage, a confirmed infectious case, a fire in a guest floor, a violent incident near the entrance and a cyberattack affecting reservations. Scenarios expose dependencies and decision points that a static list often misses. Stress testing can ask whether the organization can operate with reduced staff, unavailable communications, contaminated water or simultaneous demand from guests seeking assistance.

From Prevention to Recovery: The Crisis Management Cycle

Crisis management is best understood as a continuous cycle rather than a single response event.

Prevention and Mitigation

Prevention seeks to stop an incident; mitigation limits its consequences when prevention is impossible. Measures include safe building design, fire detection and suppression, access control, food-safety systems, vaccination or hygiene protocols where appropriate, supplier diversification, cyber-security controls, insurance and visitor-capacity management. Physical controls should be supported by procedures and competent people. A fire door that is routinely propped open illustrates the difference between nominal and effective control.

Preparedness

Preparedness converts policy into capability. A crisis plan should identify triggers, command roles, contact information, resources, evacuation and shelter arrangements, vulnerable persons, alternative suppliers, media procedures, documentation requirements and recovery priorities. Plans must be accessible when digital systems fail and should be written in language staff can understand.

Training is more valuable when it is role-specific. Front-office staff may need procedures for guest accountability and information management; engineering staff require utility-shutdown competence; managers need decision-making and escalation skills. Exercises should progress from discussion-based workshops to simulations. After every exercise, deficiencies should be recorded, assigned and corrected.

Response

During response, the first priorities are life safety, incident stabilization, accurate information and protection of critical assets. An incident-management structure clarifies who leads, who provides technical advice, who communicates externally and who records decisions. A practical structure may include incident command, operations, planning and intelligence, logistics, finance and administration, and communications. Small properties may combine roles, but responsibilities must remain clear.

Managers should establish the facts without waiting for perfect information. They should distinguish confirmed information, credible but unverified information and unknowns. Decisions should be time-bound and revisited as evidence changes. A useful operating rhythm includes situation reports, decision logs, welfare checks and scheduled coordination with authorities and partners.

Continuity and Recovery

Business continuity focuses on the processes that must continue at an acceptable level. Business impact analysis identifies critical activities, maximum tolerable downtime, minimum staffing, dependencies and recovery priorities. A hotel may prioritize life safety, guest welfare, reservations and financial records, utilities, food and water, and controlled reopening. Recovery time objectives and recovery point objectives are especially relevant to information systems: the first concerns how quickly a service must be restored; the second concerns how much data loss is tolerable.

Recovery is not simply returning to the previous state. It includes damage assessment, claims, employee support, guest relocation, supplier restoration, public reassurance, infrastructure repair and review of regulatory obligations. The organization should capture lessons and invest in improvements before attention and funding decline. Resilience emerges when learning changes design, relationships and decision-making.

Communication as a Control Measure

Communication is itself a safety intervention. In a crisis, people need timely, accurate, accessible and actionable information. Silence encourages rumours; speculation damages trust; excessive technical language prevents action. A communication plan should identify audiences, channels, spokespersons, approval arrangements and translation or accessibility needs.

Messages should explain what happened, what is known, what remains uncertain, what people should do, where assistance is available and when the next update will occur. The organization should never conceal material information, blame victims or promise outcomes it cannot guarantee. Privacy rules require particular care when discussing injured persons, health information or security investigations.

Internal communication is as important as media communication. Employees need instructions, welfare support and a safe mechanism for reporting facts. Guests may require multilingual notices, direct messages, telephone assistance and face-to-face reassurance. Authorities, residents, suppliers, insurers and travel intermediaries may require different levels of detail. Social-media monitoring can identify emerging misinformation, but responses should correct verified facts rather than amplify every rumour.

Governance, Leadership and Ethics

Crisis decisions often involve competing values: speed versus consultation, transparency versus privacy, guest comfort versus public health, commercial continuity versus employee safety. Ethical leadership gives priority to life, dignity, non-discrimination and lawful conduct. It recognizes that tourists are not the only stakeholders. Employees, residents, emergency workers, suppliers, people with disabilities, children and economically dependent communities may bear substantial consequences.

Governance requires defined authority before the crisis. Boards and senior executives should approve risk appetite, fund preparedness, review critical risks and ensure that accountability is not delegated without resources. Public authorities, destination organizations and private businesses should establish coordination arrangements in advance. Mutual-aid agreements, shared contact lists and common terminology can reduce delays.

Legal and professional obligations vary by jurisdiction, but commonly include occupational safety, fire protection, public health, data protection, consumer protection, accessibility, environmental requirements, reporting duties and contract obligations. Compliance is a baseline, not a complete risk strategy. Managers should obtain specialist legal, medical or security advice where appropriate and preserve records of significant decisions.

Applied Management Across Major Threats

Health Threats

Health preparedness includes food and water safety, sanitation, ventilation where relevant, staff illness policies, medical referral pathways, outbreak reporting and continuity plans for absenteeism. A response should avoid stigma and protect confidentiality. Establishments need procedures for isolating or assisting an ill person, coordinating with health authorities, cleaning affected areas and communicating evidence-based guidance. Health measures should be proportionate and reviewed as knowledge changes.

Disasters and Climate-Related Events

Destination and property planning should be based on hazard maps, building vulnerability, warning systems, evacuation routes, shelter capacity and transport constraints. Heat plans may include hydration, shaded areas, work-rest arrangements and schedule changes. Flood and storm plans require protection of critical equipment, backup power, drainage maintenance and decisions about suspension or evacuation. Climate adaptation increasingly requires redesigning assets and diversifying seasonal and geographic dependence rather than relying only on emergency response.

Security Incidents and Terrorism

Security planning combines deterrence, detection, delay, response and recovery. Measures may include trained security personnel, lighting, access controls, visitor screening appropriate to the context, emergency communications, liaison with police and procedures for suspicious items or violent attacks. Plans must avoid creating unnecessary fear or discriminatory profiling. After an incident, trauma support and careful information handling are essential.

Political Instability and Civil Unrest

Managers should monitor official advisories, transport conditions, demonstrations, curfews, border rules and supply availability. They need thresholds for restricting excursions, closing facilities, sheltering guests or arranging departure. Neutral, factual communication is generally safer than political commentary. Contingency planning should account for stranded travellers, currency or payment disruption, staff access and changing legal requirements.

Business and Digital Disruption

Continuity planning should identify single points of failure in utilities, reservations, payment systems, cloud services, food supply and staffing. Cyber resilience requires strong authentication, access control, patching, backups, staff awareness, incident detection and tested restoration. Backups that remain connected to the compromised network may not provide recovery. Manual procedures, offline contact lists and alternative payment or booking processes can preserve minimum service.

Technology, Analytics and Artificial Intelligence

Digital tools support risk mapping, incident reporting, access control, emergency notifications, occupancy monitoring, predictive maintenance and supply-chain visibility. Geographic information systems can combine hazard exposure with property locations and evacuation routes. Dashboards may display incidents, response times, staff availability and unresolved corrective actions.

Artificial intelligence can assist with anomaly detection, demand and weather analysis, translation, simulation and prioritization of incident reports. However, automated outputs may be biased, incomplete or wrong during unusual events. Facial recognition and location tracking raise significant privacy and proportionality concerns. Human oversight, data minimization, cybersecurity, audit trails and clear accountability are required. Technology should strengthen professional judgement, not replace it.

Illustrative Case: Coastal Resort During a Compound Crisis

Background

The fictional Seabright Resort is a 240-room coastal property employing 180 people in peak season. It has a risk register covering storms, fire, food safety and cyber disruption, but its plans were held mainly by senior managers and had not been exercised jointly with local authorities.

Situation

A severe storm warning is issued while the resort is operating near capacity. Heavy rain causes local flooding, a power interruption disables parts of the reservation system and several employees cannot reach the property. At the same time, a guest posts online that contaminated water has caused illness, although the health claim has not been verified. Roads are becoming impassable and guests demand immediate departure.

Analysis

The event is compound: physical hazards create operational disruption, the digital failure limits information, staffing is reduced and an unverified health allegation threatens reputation. The most urgent risks are life safety, medical assessment, electrical and structural hazards, guest accountability, potable water, communication and coordination with authorities. Attempting to restore normal hotel service immediately would divert attention from these priorities.

Approach

The general manager activates the incident structure and appoints an operations lead, communications lead and liaison with emergency services. Staff conduct welfare checks and maintain a record of guests and employees. Engineering isolates unsafe electrical areas, verifies water safety with the relevant authority and protects backup power for emergency lighting and communications. The resort pauses new check-ins, provides food and drinking water, identifies guests requiring additional support and coordinates transport only when authorities confirm safe routes.

The communications lead issues a holding statement: the resort is responding to storm impacts, assessing the water report with health officials and will update guests at a specified time. The message gives practical instructions and avoids declaring either contamination or safety before evidence is available. The IT provider begins system recovery from protected backups while staff use an offline registration process. Managers document decisions, costs and requests for assistance.

Outcome

No serious injury occurs. Guests are gradually relocated when transport becomes safe. The health allegation is not confirmed, but the resort conducts testing and shares the result through appropriate channels. A post-incident review finds that offline guest lists, cross-training and authority liaison were valuable, while weaknesses included inadequate exercise participation, insufficient backup communications and overdependence on one supplier.

Learning Points

The case demonstrates that crises rarely remain within one category. It also illustrates the value of prioritization, uncertainty-aware communication, manual workarounds, stakeholder coordination and documented learning. Resilience is demonstrated not by an absence of disruption but by the ability to protect people, maintain essential functions and improve after the event.

Common Failure Modes and Practical Best Practice

Plans frequently fail because they are generic, inaccessible, outdated or based on unrealistic assumptions. Other common errors include confusing a contact list with a crisis plan, assigning responsibility without authority, neglecting contractors and visitors, failing to protect backups, relying on one spokesperson, ignoring staff welfare and measuring preparedness only by the existence of documents.

Best practice is to maintain a living risk register; link risks to funded actions; use clear escalation thresholds; test plans with realistic scenarios; involve public agencies, suppliers and communities; provide accessible and multilingual communication; protect critical data; maintain manual alternatives; record decisions; and conduct honest after-action reviews. Senior leaders should treat near misses as valuable evidence and reward reporting rather than concealment.

Current Developments and Emerging Directions

Several developments are reshaping tourism resilience. Climate volatility is increasing attention to adaptation, heat management, water security and resilient infrastructure. Public health preparedness now emphasizes surveillance, flexible staffing and trusted communication. Geopolitical uncertainty requires more dynamic travel-risk monitoring and scenario planning. Cyber threats increasingly target interconnected suppliers and smaller businesses with limited technical capacity.

The emerging emphasis is on whole-destination resilience. This approach links hotels, transport, attractions, communities, utilities, emergency services and government rather than treating each organization as an isolated unit. It also recognizes social resilience: trust, inclusion, local knowledge and fair recovery influence whether a destination can sustain tourism after disruption. Resilience should therefore be evaluated not only through restoration speed, but also through reduced vulnerability, equity and the quality of learning.

Chapter Summary

Tourism safety and resilience require an integrated system of prevention, preparedness, response, continuity, recovery and learning. Hazard, exposure, vulnerability, capacity, risk, crisis and resilience describe different aspects of this system. Risk assessment should identify interdependent threats, assess consequences across human, operational, financial, legal, environmental and reputational dimensions, and assign treatments and owners.

Effective crisis management protects life first, stabilizes operations, communicates verified and actionable information, coordinates stakeholders and restores critical functions. Business continuity and scenario planning make plans practical, while exercises and after-action reviews convert experience into capability. Ethical governance requires transparency, privacy, non-discrimination, employee protection and consideration of host communities. Digital tools and AI can improve monitoring and recovery but require human oversight and strong data governance. Ultimately, resilient tourism organizations are those that anticipate disruption, adapt intelligently and use recovery as an opportunity for improvement.

Key Terms

Hazard: A source or condition with the potential to cause harm.

Risk: The combination of the likelihood of an event and the consequences it may produce.

Exposure: The presence of people, assets or activities in an area affected by a hazard.

Vulnerability: The susceptibility of people, systems or assets to harm.

Capacity: The ability to anticipate, withstand, respond to and recover from disruption.

Safety: Protection from reasonably foreseeable accidental or environmental harm.

Security: Protection against intentional threats such as crime, terrorism and malicious intrusion.

Emergency: An event requiring immediate action to protect life, property or essential operations.

Crisis: A high-uncertainty event threatening important objectives, legitimacy or reputation.

Business continuity: The capability to maintain or restore critical functions during disruption.

Resilience: The capacity to absorb disturbance, adapt, continue and recover or transform.

Risk register: A documented record of risks, controls, ratings, treatments, owners and review dates.

Risk appetite: The amount and type of risk an organization is willing to accept.

Scenario planning: Examination of plausible situations to test assumptions and decisions.

Business impact analysis: A process for identifying critical activities, dependencies and recovery priorities.

Recovery time objective: The targeted time within which a service or process should be restored.

Recovery point objective: The acceptable amount of data loss measured in time.

Incident command: A structured allocation of authority and responsibilities during an incident.

Stakeholder: A person or group affected by, or able to affect, tourism decisions and outcomes.

After-action review: A structured evaluation of performance intended to capture and apply lessons.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, exposure and vulnerability.

2. Why is a risk register insufficient without scenario planning?

3. State the principal priorities during the response phase of a crisis.

4. What is the difference between a recovery time objective and a recovery point objective?

5. Why should crisis communication identify uncertainty explicitly?

Long Answer Questions

1. Explain the relationship between risk management, crisis management, business continuity and resilience in tourism.

2. Describe a complete risk-assessment process for a large hotel or destination.

3. Discuss how ethical and governance considerations influence crisis decisions.

4. Examine the role of communication before, during and after a tourism crisis.

5. Analyse the organizational measures required to manage compound crises involving physical, health and digital threats.

Analytical / Application Questions

1. A resort faces a wildfire warning, staff shortages and a failure of its guest-management system. Prepare a prioritized response and continuity plan, including communication and recovery actions.

2. A destination experiences civil unrest after several foreign visitors have already arrived. Determine the indicators, escalation thresholds, stakeholder coordination measures and ethical issues that managers should consider.

3. Critically evaluate the use of AI-based surveillance and predictive analytics in tourism safety management. Identify benefits, risks, governance controls and circumstances in which human judgement must prevail.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from business continuity?

A. Resilience focuses only on financial recovery, whereas continuity focuses on safety.

B. Resilience concerns the capacity to absorb, adapt and improve after disturbance, whereas continuity prioritizes critical functions.

C. Resilience is concerned with intentional threats, whereas continuity concerns natural hazards.

D. Resilience eliminates risk, whereas continuity transfers risk to insurers.

Correct Answer: B. Resilience concerns the capacity to absorb, adapt and improve after disturbance, whereas continuity prioritizes critical functions.

Question 2

A hotel risk register identifies a low-probability event that could cause catastrophic loss. What is the most appropriate managerial response?

A. Ignore it because the probability is low.

B. Accept it automatically because it has a low numerical score.

C. Examine the consequences and develop proportionate preparedness despite the low probability.

D. Transfer all responsibility to a contractor.

Correct Answer: C. Examine the consequences and develop proportionate preparedness despite the low probability.

Question 3

During a crisis, which communication practice is most appropriate?

A. Wait until every fact is confirmed before communicating anything.

B. Release unverified information to demonstrate openness.

C. Provide verified facts, identify uncertainties, give actionable guidance and state when the next update will occur.

D. Limit communication to media organizations.

Correct Answer: C. Provide verified facts, identify uncertainties, give actionable guidance and state when the next update will occur.

Question 4

What is the principal purpose of a business impact analysis?

A. To identify the destination's most attractive tourism products.

B. To determine critical activities, dependencies, acceptable downtime and recovery priorities.

C. To calculate the market share of competitors.

D. To replace emergency exercises with financial forecasting.

Correct Answer: B. To determine critical activities, dependencies, acceptable downtime and recovery priorities.

Question 5

In the illustrative coastal resort case, why was an offline registration process important?

A. It improved online marketing during the storm.

B. It provided a manual alternative when the reservation system was unavailable.

C. It allowed the resort to avoid communicating with authorities.

D. It eliminated the need for guest accountability.

Correct Answer: B. It provided a manual alternative when the reservation system was unavailable.

Question 6

Which measure most directly reduces vulnerability rather than merely transferring risk?

A. Purchasing insurance after an incident.

B. Including a liability disclaimer in guest contracts.

C. Improving evacuation routes, staff training and emergency procedures.

D. Outsourcing all security responsibilities.

Correct Answer: C. Improving evacuation routes, staff training and emergency procedures.

Question 7

A manager should treat an unverified online report of contaminated water by:

A. Publicly accusing the guest of spreading misinformation.

B. Declaring the water safe immediately to protect reputation.

C. Investigating with competent health authorities while giving precautionary, evidence-based guidance.

D. Deleting all comments and making no statement.

Correct Answer: C. Investigating with competent health authorities while giving precautionary, evidence-based guidance.

Question 8

Which feature is most important in a useful crisis exercise?

A. It should confirm that the existing plan is perfect.

B. It should test realistic assumptions, responsibilities, dependencies and corrective actions.

C. It should be conducted only by senior executives.

D. It should avoid involving external stakeholders.

Correct Answer: B. It should test realistic assumptions, responsibilities, dependencies and corrective actions.

Question 9

Why does cyber resilience require protected backups?

A. Connected backups may be compromised during the same attack as operational systems.

B. Backups prevent all cyberattacks from occurring.

C. Protected backups eliminate the need for staff awareness.

D. Backups are primarily used to improve customer advertising.

Correct Answer: A. Connected backups may be compromised during the same attack as operational systems.

Question 10

Which situation most clearly represents a compound crisis?

A. A routine maintenance task completed on schedule.

B. A minor isolated complaint resolved at the front desk.

C. A storm causing flooding, staff absence, system failure and a public health allegation.

D. A planned seasonal reduction in room inventory.

Correct Answer: C. A storm causing flooding, staff absence, system failure and a public health allegation.