Latest / "Mise En Place" Culture First™ / The Disaster Preparedness Playbook for Food & Lodging
Transcript
- Brad Peters: Welcome to the recipe for results. This is your podcast extra for certification in the hotel, restaurant, and bar industry brought to you by HRB Universal. So I want you to picture this. You are the general manager of a massive 400 room coastal resort. Right, a really high-end blaze. Exactly. It's a Friday night, mid-August, prime season. The dining room is just packed. I can hear the ambient music already. yeah, perfectly calibrated. The stakes are hitting the tables at a perfect medium rare, and the guests just feel like they are the absolute center of the universe. Like a master class in curated luxury, you know? Yes, exactly that. But then, out of nowhere, the power just dies. wow. Total blackout. Pitch black. Pitch black. And a second later, the water pressure in the kitchen drops to a trickle, and then, you know, just to zero. That is a terrifying sound for a chef. I mean it gets worse because then the weather radio in the back office starts screaming that a category four hurricane is basically three hours away. Yeah, that's not just a bad night, that is a full blown crisis. Right. In that single terrifying second, your job as a hospitality leader completely changes. You are no longer in the business of luxury. No, absolutely not. You are you are now in the business of keeping hundreds of people alive. Yeah. And that illusion of the curated experience, I mean, it just evaporates the exact moment the grid fails. It really does. And for anyone operating in this space, whether you are an independent restaurant owner, an executive chef, or a hotel GM, that moment is the ultimate test. Because it's an actual legally defined emergency, right? Exactly. It's what the FDA Food Code and emergency management agencies officially define as an imminent health hazard. Imminent health hazard. That sounds incredibly serious. it is. Basic sanitation. Temperature control, life safety. I mean, it all literally goes out the window. So that brings us to the mission of our deep dive today. We are looking at this massive stack of incredibly dense emergency response guides. So many manuals. Right. FDA compliance manuals, extreme disaster recovery protocols. And we are doing this to extract a relentless, hour by hour operational playbook. Because you need one for when everything falls apart. Yeah, hoping for the best is just it's not a strategy. Definitely not. You have to look at the harsh operational realities. Severe flooding, power grid blackouts, citywide water boil advisories. The total collapse of the supply chain, too. Exactly. We need a framework to even begin processing this kind of chaos. And these emergency manuals, they rely heavily on the Federal Emergency Management Agency's framework. Right, FEMA. Yeah, FEMA. They have four official phases of disaster response. We are talking about mitigation, preparedness, Response and recovery. Okay. So four phases mitigation, preparedness, response, recovery. Right. And you really have to look at those phases through a dual sector perspective. Yeah. What do you mean by dual sector? Well, the way a food service operation handles this is entirely different from the lodging side. I see. Food versus beds. Yeah. Food service is dealing with cold chain disruptions, preventing spoilage, maintaining sanitation. And the lodging side? Lodging has to manage guest relocation, generator capacity, extended shelter operations. It's a totally different beast. That makes total sense. So break down these four FEMA phases for me real quick. Sure. So mitigation is about the steps you take to prevent or reduce the severity of the disaster way before it actually hits. Like hardening the target. Exactly. Then preparedness is the pre disaster logistics, getting your ducks in a row. Right. Response is that immediate visceral action. When the event is actually happening around you. The panic moment. Yep. The panic moment. And finally, recovery is the incredibly complex road to reopening your doors. And most people just naturally focus on that panic moment, right? The response. They do, yeah. But the hard data shows that the battle to save your inventory, your revenue, and your staff, it is won or lost during mitigation and preparedness. So before the storm even arrives. Exactly. So let's start right there in that mitigation phase, well before the lights actually go out. Okay. I'm ready. What is step one? The absolute first step in this playbook requires completely rewiring the management structure of the property. Wait, really? Yes. Changing the management structure. Yes. You have to shift from the standard everyday hospitality hierarchy into what these manuals call a strict incident command structure or ICS. ICS, okay. Why is that so important? Because it's a brutal psychological pivot. Okay. I mean think about how a normal hotel or restaurant operates. It's very collaborative. Highly collaborative. It's a decentralized fluid structure. The front desk manager chats with housekeeping, the chef coordinates with the dining room manager. Right. It's designed to feel seamless and invisible to the guest. Exactly. But when a hurricane is bearing down on you or a massive infrastructure failure hits, that collaborative structure becomes a massive liability. Too many cooks in the kitchen. Literally and figuratively, yeah. It is way too slow. It relies entirely too heavily on consensus. I guess you don't have time to have a quick huddle about what to do if the roof is leaking. You absolutely do not. So under an ICS, that standard hierarchy dissolves instantly. The general manager or whoever the designated senior executive is on the property becomes the incident commander. The incident commander. That sounds very military. It is based on military and first responder structures. They hold ultimate unquestioned decision making authority over every single action taken on that property. So it's like switching from a peacetime government to a wartime cabinet. That is the perfect analogy. You no longer have time for committees. Under this incident commander, the entire operation is strictly split into four primary leads. Okay, what are the four leads? You have guest relations, safety and security, facilities and engineering, and food and beverage. Just those four. Just those four. If you have, you know, three different middle managers trying to figure out who is checking the generator fuel burn rate. And who is checking on a guest in a wheelchair, things fall through the cracks. Right, and in a crisis, a dropped ball can mean someone gets hurt. Exactly. The ICS forces absolute tunnel vision. The safety and security lead, for example, is not worrying about whether the guests are comfortable. What are they focused on? They are entirely focused on building access control, establishing a fire watch, doing floor sweeps, and locking down the physical perimeter. Wow, okay. So very rigid boundaries. Very rigid. And while they are doing that, the guest relations lead is managing the human element. Like figuring out who is actually in the building. Yeah, compiling the rooming manifests, tracking who has infants, who has pets, and crucially identifying any guests with mobility issues or medical dependencies. That is so critical. And then there's facilities and engineering. Right. The people managing the physical plant. They are tracking the primary and backup generator load testing. They monitor the fuel levels down to the gallon. Because if the generator dies, it's game over. It really is. They also assess the structural integrity of the building and physically isolate the utilities. And the fourth one was food and beverage, right? Yes, the food and beverage lead. And let me tell you, they aren't planning a tasting menu. I would assume not. They are looking at the cold chain compliance temperatures, directing the rationing of food, managing meal prep without utility power, and securing the sanitary storage of drinking water. Wait, hold on a second though. I want to push back on this a little bit. Go for it. We train hospitality workers, I mean, from day one, to smile, right? To be endlessly accommodating, to literally bend over backwards to say yes to a guest's every whim. absolutely. The customer's always right. Right. But suddenly you're telling me a twenty-two-year-old front desk agent now has to act like a drill sergeant to a VIP guest who's paying a thousand dollars a night. Yes. That feels like it goes against every single instinct they have ever been taught. It completely goes against every instinct, which is exactly why it requires aggressive, proactive training. So how do they handle it? Well, the manuals are explicit here. The incident command structure must proactively de-escalate that usual customer service deferential behavior. Meaning they have to turn off the hospitality charm? Yes. If the guest is standing next to a massive pane of plate glass in the lobby, as a category four storm approaches, the staff member cannot politely suggest they move. They can't just say, Excuse me, sir, would you mind stepping away from the window? No. Because the guest might say, I'm fine, I'm watching the storm. The staff member must project calm, empathetic, but absolute authority. They have to command them to move. Exactly. True duty of care in a disaster is not about putting a mint on the pillow. It is about keeping the guest out of the morgue. Wow. Keeping the guest out of the morgue, that really sets the tone. It is life and death. So Who is actually executing all these orders when the storm hits? Because the standard staff shift is going to end eventually. Right. The sources detail the formation of what they call hotel rideout teams. Rideout teams? Okay. Who is on a ride out team? A write out team is a dedicated, voluntary group of staff who remain locked down on site during a major event. Wait, voluntary? They aren't forced to stay? Legally and ethically, you really shouldn't force them. You are asking people to leave their own homes, their own families, and their own properties totally vulnerable just to protect your business. That is a massive ask. It is huge. Therefore it has to be voluntary and it has to be compensated aggressively with a shift differential. Like hazard pay. Exactly. Extra emergency hazard pay on top of standard rates, with all overtime applied strictly per local labor laws. Okay, so you have this fall into your team. They are getting paid well to be there. How do you schedule them? Because this could last for days. The scheduling is intense. They operate on alternating 12 hour shifts. Twelve hours on, 12 hours off? Yep. Team A is on from seven to nineteen, and team B is on from nineteen to seven. But what happens when they go off shift? I mean, you can't just have them sleeping on the floor in a hallway behind the front desk. No, you definitely can't. The recovery protocol is heavily regimented for downtime. The property must dedicate a block of interior windowless guest rooms. Windowless rooms. Why windowless? For safety. If windows blow out, you don't want your sleeping staff to get injured. Or if you don't have windowless rooms, a structurally reinforced area like a ballroom, exclusively for off-duty team sleep and personal care. That makes sense. Because if your staff burns out, your entire response collapses. What else do they need besides the place to sleep? Every single member needs a designated seventy two hour supply kit. What goes into that kit? Well, a minimum of one gallon of drinking water per person per day, just for hydration and basic sanitation. So three gallons of water just for themselves. At least. Plus non perishable food. And they need serious gear. Personal protective equipment. Like what? Hard hats? Yes. Steel toed boots, heavy duty work gloves, hard hats, rain gear. They aren't wearing their standard hospitality uniforms in a a disaster zone. I would hope not. They also need multi channel two E radios with spare batteries and manual crank chargers. Hand crank chargers. Because the power is out. Because relying on cell towers or wall outlets is completely useless. That actually touches on a massive vulnerability you brought up earlier. Technological resilience. this is a huge one. Because if the physical server room in the basement of your resort floods. Which happens all the time in coastal areas. Right. And your property management system, your PMS, is hosted locally on those servers, you are totally blind. Completely blind. You lose your guest manifests, you lose your billing data, you lose the digital keys, everything. I want to really dig into that for a second because a lot of people might wonder how does a cloud-based system actually save you if the local internet goes down anyway? That is a very common question. It comes down to off-site continuity and something called tokenization. Tokenization. Okay, explain that. If your PMS is cloud based, all your guest records, special needs notes, and payment data are stored securely on remote servers, right? Somewhere far away from the storm. Right. So when the Wi-Fi dies at the hotel and the local network goes down, the front desk can't see it, sure. But your offsite corporate teams or remote risk officers can still access that data. I see. Because the data isn't trapped in a flooded basement. Exactly. So those remote teams can coordinate with emergency management agencies on your behalf because they know exactly who is in the building. Based on the last cloud sync. That is brilliant. And what about the money? You mentioned tokenization. Right. The payment data is tokenized, meaning the credit card numbers are converted into secure alphanumeric strings. Okay. So even if the physical property is utterly destroyed, the billing and revenue capture can be processed later by the corporate office without needing the local servers to survive. Wow. So the cloud basically insulates your entire business model. It does. It separates the business data from the physical vulnerability of the building. Okay, so to recap where we are, the command structure is locked in. The incident commander is in charge. Right. The writeout team is equipped with their gear and their crank radios. The data is secured in the cloud. Everything is staged. Which means we now enter the preparedness phase. We are looking at the seventy-two to twelve hour countdown before the event makes landfall. Or before the infrastructure totally collapses. This is the crunch time. And every single decision made in this seventy two to twelve hour window dictates whether the operation actually survives the week after the disaster. It is make or break. We begin with vendor prep. Vendor prep. What does the playbook demand here? It demands prearranged guaranteed contracts for emergency fuel delivery, dry ice procurement, and priority post storm water extraction. Guaranteed contracts. Yeah. Meaning you don't just call them when the storm is on the news. absolutely not. If you are frantically Googling for a diesel fuel supplier twelve hours before a hurricane hits, you have already failed. Because everyone else in the city is making that exact same call. Exactly. You have to be at the very top of their delivery list, weeks, if not months in advance. And your facilities lead, the person we talked about earlier, they need to know exactly how much fuel to order. Down to the gallon. They need to know the exact generator fuel burn rate under heavy load versus light load, so they know exactly when that emergency delivery has to arrive. Okay, so fuel is secured. Next is the food and beverage mitigation. This is where it gets really painful for chefs. At forty eight to seventy two hours out, the executive chef has to make some hard calls. Because you don't want a ton of food sitting around if the power goes out. Right. First, you completely cancel all incoming shipments. Just call the purveyors and say, Don't come. Yes. You absolutely do not want a delivery truck dropping off fifteen thousand dollars of fresh premium seafood right before the refrigerators lose power. That would just be throwing money directly into the garbage. Really would. And then you must radically engineer your existing menu. Menu engineering. Aggressive specials. Like running specials. You look at your inventory and design a menu strictly to exhaust your perishable raw proteins, fresh produce, and dairy. So if you have a massive walk-in full of salmon, suddenly everyone is getting a special on salmon. Exactly. You alter the banquet menus, you push the high risk items out to the dining room as fast as possible to monetize them before the grid fails. You want to turn that vulnerable inventory into cash while you still have stoves that work. Exactly. But obviously you can't cook and sell everything in forty eight hours. Right. There's always gonna be stuff left over. And this brings us to one of the most brilliant mechanical tactics in the entire playbook. Okay, I am fascinated. It's called walk in optimization. Walk in optimization. This is where we leverage the physics of thermal mass, right? We do. And it is so incredibly smart. It makes me think about how a squirrel frantically hoards nuts for the winter. You know, they don't scatter them around the yard, they pack them densely into one Tiny little space in a tree. That is a great visual. And you do the exact same thing with your perishables in a commercial kitchen. So what is the actual directive? The directive is to take all your high value inventory from the very standard coolers, the low boys, the prep stations scattered all around the kitchen. Right. Consolidate it. Yes, consolidate all of it into the main walk-in freezers. Why does cramming it all together help? Because of the physics of thermal mass. By packing a walk-in freezer as tightly as possible with frozen and soon to be frozen goods, You create a massive block of thermal mass. Dense matter holds cold better than air. Far better. A fifty pound case of frozen prime rib holds cold significantly longer than empty air in a freezer. So when you pack the freezer wall to wall, floor to ceiling, that frozen mass basically acts as its own giant ice block. It insulates itself. Exactly. And well ahead of the storm you take it a step further. You drop the thermostat set points on that walk in as low as safely possible. How low are we talking? The manuals suggest pushing it down to negative ten or even negative fifteen degrees Fahrenheit. wow. You super chill the entire room. You super chill it. And once it is packed full and super chilled, you padlock it or you heavily tape the door shut. You basically turn it into a sealed insulated vault. Yes. Because every single time an employee opens that door, they let out the heavy cold air which spills across the floor, and they let in ambient warm air. And that ruins the thermal mass. It drastically reduces the time the food will stay in the safe temperature zone after the power cuts. So you tape it shut and you forbid anyone from opening it. Now I feel like some operators might think about throwing a bunch of dry ice into those walk-ins to extend the cooling even longer. That sounds like a good idea on paper. It sounds great on paper, but the emergency guides attach a massive bold print life safety warning to that practice. Why? What's wrong with dry ice? Dry ice is solid carbon dioxide. It doesn't melt like regular ice, it sublimates. Sublimates. Meaning it turns directly from a solid into a gas? Exactly. And as it sublimates, it expands massively and displaces oxygen in the room. I see where this is going. Yeah, and because carbon dioxide gas is heavier than air, it pools on the floor. So if you put hundreds of pounds of dry ice in a sealed, taped shut walk in freezer. Right. And an employee walks in a day later when the power is out without Proper ventilation and they bend down to pick up a box off the floor. They walk right into an invisible suffocation hazard. That is terrifying. The CO two buildup can absolutely be lethal. If you use dry ice at all, the space must be aggressively ventilated before anyone enters, and you really must use oxygen monitoring equipment. Okay, so walk in optimization sounds incredibly stressful for an executive chef, even without the dry ice. It is high sticks. If we are turning the freezer into this sealed ice fortress, how does a chef triage what gets saved in the vault versus what just gets cooked immediately or thrown out? It really comes down to a harsh calculation of economic value versus physical density. Can you give me an example? Sure. You prioritize dense, high value items for the thermal mass, premium cuts of meat, dense blocks of cheese, frozen seafood. Things that hold their temperature well and cost a lot to replace. Exactly. But high water content produce. Like lettuce, tomatoes, or cucumbers. They won't survive anyway. No, they will not survive the freezing process. The extreme cold ice crystals will physically rupture their cellular walls. So they just turn to mush. Complete mush. So you cook them, you serve them, or you just toss them out. The goal is to save the tens of thousands of dollars wrapped up in those high value proteins. Speaking of high value items, let's talk about the bar inventory. this is a really important one. The directive here is very specific. And it's not just about saving money. It's actually about saving the physical building. Right. You must move all high proof alcohol, we are talking anything over 40% proof, off the open display shelves. Because picture the typical resort bar, right? Beautiful back lit glass shelves lined with rows of premium liquors. Very aesthetic. But in a severe high wind event or an earthquake, those bottles become deadly glass projectiles. Which is bad enough. But more importantly, high proof alcohol is highly flammable. Extremely flammable. So if the building sustains structural damage or if the grid surges and causes electrical shorts, a shattered bottle of overproof rum is a literal fire accelerant. Yes. A spark hits a puddle of high proof alcohol, and your flooded hotel is suddenly on fire. So what does the playbook say to do? It requires securing all high proof alcohol in locked ground level cabinets. This mitigates the fire hazard, and it also prevents unauthorized access. Like from panicked guests. Panicked guests or potential looters if The building perimeter is breached during the disaster. Makes sense to lock it down. Let's shift gear slightly to the lodging and guest prep side of the house during this same seventy two to twelve hour countdown window. Okay. Moving away from foot and bev. Yeah. We talked about cloud systems earlier being so great, but the physical reality on the ground requires a massive step backward in technology. It absolutely does. Because when the lights go out, the Wi Fi dies. And eventually the battery backups on those fancy digital room key systems start to fail. You cannot rely on an iPad to know who is in your building. You really can't. So you have to go analog. You have to print three physical paper copies of the guest manifest. Paper. Good old paper. Good old paper. And this isn't just a basic list of names. It has to be highly detailed. It notes room numbers, emergency contacts, who has infants, who has pets. And crucially Any medical needs, right? Exactly. Like a guest who is dependent on a CPAP machine for sleep apnea, or someone who needs refrigerated insulin. And what do you do with these three copies? One of those copies must be kept in a waterproof container at the incident command desk at all times. Imagine trying to evacuate a fifteen story hotel in the pitch dark with just flashlights. It'll be pure chaos. Right. And if you don't know exactly which room has a guest who uses a wheelchair, that chaos turns into a tragedy very quickly. That piece of paper is your only map. It is your most important tool. And you are actively moving guests around the property before the storm hits based on that manifest. Moving them where? You move everyone out of the ground floor rooms due to the risk of storm surge and severe flooding. Okay, get them up high. But not too high. You also move everyone out of the top floor rooms due to the risk of roof damage and wind shear. So you are basically sandwiching them in the middle. Consolidating the human footprint. You move them all into mid-level interior rooms. Why is that better? It makes monitoring them much easier for the writeout team, and it places the guests in the most structurally sound envelope of the entire building. That makes a lot of sense. Now there's this other operational detail in the manual that sounds so incredibly basic, but it is absolutely vital. The bathtubs. Yes. Filling spare holding tanks, cleaning buckets, and literally all available bathtubs in the empty rooms with non potable water. It seems silly, but it will save you. If the municipal water pumps fail. Or the city shuts down the mains to prevent contamination, the toilets in the hotel won't flush. Because they need pressure. Right. Having bathtubs full of water means the staff can manually bucket flush the toilets. Just pour a bucket of water straight into the bowl? Exactly. Gravity does the rest. If you have four hundred people trapped in a building for three days without working plumbing, you will very quickly have a secondary health crisis from human waste. Ugh, that is grim. But Totally necessary to plan for. It is the ugly reality of disaster prep. Okay. The twelve hour window closes. The preparations are done. The walk-ins are taped, the bathtubs are full, the guests are moved. We are now at ground zero. The zero to seventy-two hour immediate response window. This is the phase where the focus shifts entirely away from protecting assets, inventory, or revenue, right? Yes. The only objective now is human life, period. And the first major operational trigger here is based on wind speed. It is. Once sustained tropical storm winds hit, and that is officially defined as anything greater than thirty nine miles per hour, the property goes into total exterior lockout. Lockout. Meaning nobody goes out. Nobody. At thirty nine miles per hour, the wind can pick up a piece of metal roofing or a large tree branch and turn it into a lethal flying projectile. So walking outside to just quickly check on your car is no longer an option. Absolutely not. The exterior doors are locked and they are barricaded if necessary. No guest and no staff member may step outdoors under any circumstances whatsoever. And inside the building, while it's locked down, you issue the in room directives. Right. Guests are instructed to close all their drapes and blinds. I assume this isn't for ambiance. No, it's a physical barrier. If a window blows out, heavy drapes act like a net to catch flying glass charts. And if extreme wind threatens total glass failure. Like a tornado or a category five. Then the directive escalates dramatically. Guests must take shelter in their interior bathrooms, and they are explicitly instructed to pull the heavy mattresses off the beds and use them as physical shields over their bodies. I liken the staff's role here to being a flight attendant during just extreme violent turbulence. That's exactly what it is like. You have to project this absolute unwavering calm, but you are strictly enforcing life safety rules. Yes. But let's deal with the reality of human behavior for a second. People panic. They do. People do highly irrational things when they are scared. It's one thing to have a plan on paper, but when a terrified guest is screaming at the front desk that they demand to go out to their car in the middle of a tornado warning, how do you handle that? It is incredibly tough. I mean you can't tackle a guest to save their life, can you? This is the nightmare scenario for the ride out team. And the legal guidance in the manuals is very specific on this exact situation. What does it say? You use the PA systems, you use phone calls, you use firm authoritative language to guide them to shelter. But staff cannot physically force a noncompliant guest to leave their room or to stay in the building. Because of the liability. The legal liability, yes, but also the physical risk to the staff member is just too high. You don't get into a physical altercation in a crisis. So what do you do? Just let them walk out into a hurricane. You document. If a guest absolutely refuses to comply with a life safety directive, The strict protocol is to document their name, document their room number, note the exact time of their refusal, and hand that specific information directly to first responders or the emergency operations center when they eventually arrive. Wow. You basically wash your hands of them. You have to. You do not risk the write out team. You must prioritize the guests who are actually following instructions. That is sobering. Meanwhile, while all this human drama is happening, the facilities lead is managing the utilities in real time. Yes, and that is a massive job. Let's talk about elevators. Right. Elevators are a complete death trap in a flood or a power failure. A flooded elevator pit can short the electronics or trap people inside a metal box with rising water. So what is the protocol? The protocol is to park the elevators on a mid to high non-flooding floor, open the doors, and physically take them out of service by cutting the power. So nobody can call them. Exactly. You keep only one emergency cab active and you only do that if it is backed by a highly reliable generator or For emergency responder use. And the water management requires immediate action too. If the municipal water pressure drops or fails entirely, the hotel must immediately shut off the main intake valves. Yes. Now, this is a point that always confuses people, myself included. Okay, let's break it down. If there's no water coming from the city anyway, the pipes are just empty, right? Why does it matter if the main intake valve to the hotel is open or closed? It comes down to the physics of backflow and pressure differentials. Okay, physics lesson. Let's do it. Let's do it. Normally the municipal city water system is highly pressurized, say sixty pounds per square inch. And that pressure pushes clean water into your building. Right. It forces it up the pipes. Exactly. But if a massive water main breaks down the street during the storm, that city pressure drops to zero. Sometimes it even creates a negative vacuum. Okay, so the city side of the pipe has zero pressure. Right. But if your hotel is ten stories tall, the sheer physical weight of the water currently sitting inside your building's vertical plumbing system creates immense downward pressure. I see. Yeah. If you leave the main intake valve open, gravity will literally pull all the water from inside your hotel backward, out of your building, and into the city's main line. Which means any chemicals from your boilers, your Cooling towers or graywater cross connections could contaminate the entire public water supply. Exactly. It's called back siphonage. Or conversely, when the city pressure fluctuates back on temporarily, contaminated groundwater or raw sewage leaking into the broken city main can be sucked directly into your building's clean water pipes. That is disgusting and incredibly dangerous. It is. So closing that main valve immediately isolates your building's plumbing from the failing municipal system. Creates a physical barrier. Okay. That makes perfect sense now. So during all of this physical chaos, the crisis communications are still flowing to the guests. Yes, constant communication is key. And the rule here in the manual is a really fascinating study in human psychology. It says you must use short, active voice sentences that do not rely on visual context. This is so important. In a severe panic state, the human brain loses the ability to process complex multi step instructions. It just shuts down. It really does. And if the power's out, or the emergency fire strobes are flashing and casting weird disorienting shadows, visual cues are entirely useless. So you don't say over the PA, please proceed toward the large blue painting at the end of the hall and exit through the glass doors. No, because in the dark, they can't see the blue painting at all, and the glass doors might be shattered or barricaded. You use rigid active commands instead. Yes. You say turn left at the desk, walk down the hall. Take the stairs down two flights. Short, unambiguous, direct. And you must use a multi channel approach. Absolutely. The PA system, SMS text alerts to their phones, and staff runners physically knocking on doors. Why so many methods? Because systems fail. If the PA system shorts out and you have no backup method, you have hundreds of people stranded in the dark with zero instructions. Right. Redundancy is survival. Exactly. Okay, let's fast forward bit. Let's say the storm passes, the immediate physical danger of the wind or the tornado is over, you survived the response phase. Everyone is safe. Right. But a silent, invisible enemy emerges. The infrastructure has failed. You have simultaneous loss of power and potable water. This changes the operational reality entirely. You are no longer fighting the weather outside. You are now stepping into the rigid, uncompromising world of the FDA food code. The food code. As we mentioned at the very beginning of the deep dive, losing power and water simultaneously is an FDA defined imminent health hazard. It is the big red button of the food industry. And the hazard is imminent because your basic defenses are gone. Hand washing is impossible without running water, wear washing and sanitizing equipment is impossible, toilet operation ceases, and temperature control for your food is totally compromised. So the rule is absolute. Standard operations must cease immediately. You lock the customer entrances. And you document the exact time of the outage, right? Because that starts what they call the regulatory time clock. That clock is everything. It determines what food you can legally save and what food must be thrown directly into the dumpster. Let's talk about the danger zone. The FDA code states that time temperature control for safety foods. They call TCS foods. Right. TCS foods, which means raw meat, dairy, cut melons, cooked starches. If they are held above 41 degrees Fahrenheit for more than two to four hours, they must be discarded. This is where operators tear their hair out, and it's where executive chefs fight bitterly with health inspectors. Let's explore that friction because it's a really interesting debate. it's a huge point of contention. If I'm an executive chef and I'm looking at $10,000 worth of premium whole muscle intact beefsteaks in my cooler, and my thermometer reads forty five degrees for three and a half hours. Right. Is it really garbage? I mean, human beings cooked meat over open fires for thousands of years. Can I just fire up the gas grill out back, cook that steak well done to one hundred sixty-five degrees, kill the bacteria and save the inventory? It is a really painful financial realization, but the answer is definitively no. You cannot just cook it out. Why not? Heat kills bacteria. It does. But if we dive down into the microbiology of why the FDA food coat is so rigid here. It makes perfect sense. Okay, let's get into the microbiology. It's not just about spoilage bacteria. Spoilage bacteria are the pseudomonas organisms that make food smell bad or get slimy. The stuff that tells your nose not to eat it. Right. Spoilage bacteria are gross, but they rarely actually kill you. The FDA is heavily concerned about pathogens, and more importantly, the exotoxins those pathogens produce. Let's unpack the difference between the pathogen and the toxin, because that seems to be the core issue. It is. Pathogens are the living vegetative bacteria, things like Staphylococcus auteus or Bacillus cereus. When those TCS foods sit above forty one degrees, these bacteria wake up from being dormant and they multiply rapidly. Okay, so the bacteria are breeding on the warm steak. Yes. Now your chef logic is partially correct. Cooking the steak to 165 degrees is We'll absolutely kill the living bacteria cells. So the bacteria are dead, but the danger isn't gone. No. Because while those bacteria were multiplying in the warm cooler for three hours, they were feeding and producing waste products. Exotoxins. So they are basically poisoning the meat as they breed. Precisely. And many of these exotoxins are highly heat stable. Meaning, no matter how well done you cook that steak, even if you char it to a literal crisp, The chemical structure of the toxin remains perfectly intact. Wow. Yeah. So if a guest eats it, they will get violently ill with food poisoning within hours, even though the bacteria that actually made the toxin are long dead. That is why the four hour clock is absolute. You cannot cook away a heat stable toxin. You cannot. And that completely flips the script on how you view food safety. It explains the intense rigidity of the code. Now there is a caveat for frozen food, right? Yes. And this is exactly why the walk-in optimization thermal mass strategy we talked about earlier is so critical. Because it buys you time. It buys you days. If the food in your super chilled walk-in freezer has thawed, but it still contains visible ice crystals. Okay, so it's still slushy. Right. Or if it is still temping below forty degrees Fahrenheit when the power finally returns, it can generally be safely refrozen or cooked immediately. So the goal of packing the freezer was to stretch that thaw time from a few hours to a few days, keeping it out of the danger zone entirely. Exactly. You are fighting the clock with thermal mass. But what happens if the power grid is fine, but the municipal water is contaminated? Like the city issues a boil water advisory due to a main break or a treatment plant failure. This is a huge headache. The playbook dictates that any water used for food prep, beverage service, or ice making must remain at a rolling boil. For at least one solid minute to kill waterborne pathogens. Now, people often ask me about this. Can I just put a few drops of bleach in the water to purify it like they do in those wilderness survival guides? For a private home in a desperate emergency, perhaps. But for a commercial food service establishment? Absolutely not. Why is it different for a restaurant? Chemical disinfection of drinking water using bleach is generally not a legal option because of regulatory compliance. Commercial kitchens lack the Specialized highly calibrated on site testing equipment required to prove to a health inspector that the chemical residuals in the water are actually at safe levels for human consumption. because it's a very fine line. Extremely fine. If you use too much bleach, you are literally poisoning your guests with chemicals. If you use too little, the pathogens survive and you poison them with bacteria. And you have no way to prove which side of the line you're on. Right. If you can't test it and scientifically prove it to an inspector, you cannot serve it. The FDA food code, specifically chapter three, gets incredibly granular about water, especially when it's frozen into ice. Ice is notoriously one of the most dangerous overlooked vectors for cross-contamination in a disaster. The code states that packaged food cannot be stored in direct contact with undrained ice. Which means you can't just throw a bunch of vacuum sealed deli meats into a cooler full of ice and let them sit in the meltwater. Because the meltwater's dirty. Yes. Because if that plastic packaging has a microscopic pinhole Or a weak seam, that contaminated melt water is going right into the food. And here is a massive operational rule that I found fascinating. If you use ice as an exterior coolant, say you fill a hotel pan with ice and lay raw fish or whole melons on top of it to keep them cold. A very common practice. Right. That ice can never be repurposed as an ingredient in food or drinks. Ever. Never ever. Why is that so strict? The exterior of a melon is highly porous and covered in agricultural bacteria from the dirt in the field. The surface of raw fish is covered in marine bacteria. The moment they touch the ice, the ice is contaminated. So if a bartender tries to be frugal and takes a scoop of that cooling ice to quickly chill down a cocktail? You have just created a direct transmission line for a massive foodborne illness outbreak. It is incredibly dangerous. And what about the staff handling the food? If there is no running water, they can't wash their hands at the hand washing sinks. The FDA code is aggressively strict here. With no running water, barehand contact with ready-to-eat food is strictly prohibited. There are zero exceptions. Ready-to-eat food being anything that won't be cooked further before being served, right? Bread, salads, cooked meats, garnishes. Exactly. The staff must use alternative procedures. Single use gloves, deli tissue, spatulas or tongs. But they can't wash their hands before putting the gloves on. They must use hand sanitizers or other approved alternative hand washing methods before putting the gloves on. The moment you lose water, the risk of a highly contagious norovirus or hepatitis A outbreak skyrockets. I imagine inspectors are very unforgiving about this. A health inspector will shut you down instantly, on the spot, if they see bare hands touching a sandwich during a water outage. Okay, this brings us to the aftermath. The storm is gone, the utilities might be slowly flickering back to life, but the facility is badly damaged. It's mess. The walk ins are full of rotting food, the floors are wet, and the financial pressure from the executive suite is mounting rapidly. Everyone wants to know how much money they are losing. Before a single mop is lifted, before a single dumpster is filled with ruined inventory, the management and team must secure their financial recovery. Yes. And that means navigating the incredibly complex, often deeply adversarial world of insurance claims. I compare a damaged restaurant or hotel to an active crime scene. You do not touch the evidence until the detective logs it. That is the perfect analogy. An insurance adjuster is essentially a financial detective. They will not pay for a single loss they cannot physically see. The directive is to systematically photograph and video record absolutely everything before cleanup begins. Structural damage. The high water marks on the drywall showing exactly how deep the floodwaters got, the damaged equipment. And crucially, you must photograph the spoiled inventory. This goes against every instinct a chef or a facility manager has. I'm sure. When a walk-in freezer has been off for four days in the August heat, the smell is indescribable. It is horrific. The immediate human instinct is to get a crew with heavy duty garbage bags, hold your breath, and throw everything into the dumpster immediately, just to stop the stench. But how does an operator balance the health department's strict demand for a sanitized kitchen with the insurance adjuster's demand to see the rotting damaged goods? You execute the photo protocol first. You open the doors, and you take clear, high resolution video of the entire contents of the walk in. You want to capture the sheer scale of the loss. Yes. You take wide shots showing the volume, and close up shots of the really expensive items the cases of wagyu beef, the buckets of caviar. You document the temperatures on the internal thermometers to prove the failure. And then you throw it out. Only after you have irrefutable visual evidence do you bag it and toss it. Tossing ruined food to stop a bad smell before photographing it is literally throwing thousands of dollars into the trash. The insurance company will just say, prove it was there. And if you can't, you don't get paid. And the insurance nuances are tricky too. An operator might think, I have spoilage coverage. I'm totally fine. Spoilage coverage is notoriously limited. It usually has sublimits that are far below the actual value of a fully stocked walk in freezer. What do you mean by sublim? You might have eighty thousand dollars worth of inventory in the freezer, but your specific spoilage sublimit on the policy might cap out at a maximum payout of fifteen thousand dollars. Ouch. So you just eat the remaining sixty five thousand dollar loss? Unfortunately, yes. And even worse, power loss alone rarely triggers a payout for lost revenue or business interruption. Really? Even if you're closed for a week. Right. Unless the outage was caused by a covered physical peril on your actual physical property. Explain the difference. If a municipal transformer blows up five miles down the road and your grid goes dark and you lose power for three days, your standard policy might not cover the lost income because your physical building wasn't actually damaged. But if the hurricane winds rip the electrical mast off the roof of your specific building, causing the outage. Then that physical peril to your property triggers the coverage. Understanding these legal nuances is exactly why documenting the specific cause of the damage with photos is so absolutely critical. There are also hidden hazards you have to document and discard. The manuals highlight a really insidious one that people might not think about glass. Yes. In a high wind event, windows shatter, and the wind drives microscopic glass dust and tiny shards. It's a massive food safety concern. The wind can embed glass dust into Porous packaging, like cardboard boxes of dry goods, fabric bags of flour or open bins of sugar. And you cannot wash glass dust off a tomato. You cannot sift it out of a fifty pound bag of flour. It's just invisible and deadly. The rule is taconian, but totally necessary. All suspect items, anything that was even potentially exposed to blown glass, must be photographed for the insurance claim and then immediately discarded. Then comes the actual cleanup, the sanitization protocol. Let's say the ground floor flooded with just a few inches of water from the street outside. The health department considers all flood water to be black water. Even if it looks relatively clean. It doesn't matter if it looks crystal clear. It is automatically assumed to be heavily contaminated with raw sewage, industrial chemicals, and heavy pathogens. So you can't just mop it up and spray some standard all purpose cleaner from the janitor's closet. No. Any equipment and any salvageable structural surfaces like Stainless steel prep tables or tiled walls must undergo a rigorous three-step process. Wash, rinse, and sanitize. And the sanitization chemicals have very strict parameters. The manual dictates using a chlorine bleach solution at 100 to 200 parts per million. Which translates to about one tablespoon of bleach per gallon of potable water. Or using a quaternary ammonium solution, often called quat at 200 parts per million. Let's look at why an operator chooses one over the other. Bleach, or a sodium hypochlorite, is cheap and it's fast acting. But but it is highly reactive. It breaks down rapidly in sunlight, heat, or when it hits heavy organic loads like heavy dirt or grease. It loses its sanitizing power very quickly. So what about quat? Quaternary ammonium is often preferred in commercial settings because it leaves a residual antimicrobial film on the surface, continuing to kill bacteria even after it dries. But there's a catch, right? Always a catch. Quat requires specific temperature parameters and exact mixing ratios. Proper chemical concentrations, verified with chemical test strips, are the only way to prove to an inspector that the blackwater contamination has been fully neutralized. We also have to unpack the RACE protocol. This applies heavily in the aftermath. Because post storm, when the power grid fluctuates and violently surges back on, or when water has seeped into the electrical panels, the risk of structural fires just skyrockets. Imagine standing in a dark, damp commercial kitchen. The CD grid finally turns back on. A massive power surge hits a wet electrical panel, a huge spark jumps, and suddenly you have a fire. But you still don't have municipal water pressure to feed the building's sprinkler system. That is terrifying. But it is the reality of disaster recovery. So what is the protocol if an electrical fault triggers a fire? Staff execute race. R A C E Right. Rescue anyone in immediate danger. Alarm, pull the fire alarm and call nine hundred one. Contain the fire if possible by closing doors to starve it of oxygen. And evacuate the building. So let's look at the timeline. The property is documented, the rotting food is in the dumpster, the glass embedded cardboard is gone, the kitchen is fully sanitized with two hundred PPM quat. The lights are finally back on. Everything looks ready. Right, but unlocking the front doors requires clearing significant regulatory hurdles. You cannot simply flip the open sign just because the lights are on. There is a mandatory system recovery phase you have to pass first. Let's look at the plumbing. Once municipal water is restored, you can't just pour a glass of water from the tap and serve it to a guest. All potable water lines, all drink dispensers, soda guns, and ice machine water lines must be aggressively flushed for at least five minutes. This purges any stagnant, potentially contaminated water or heavy metals that settled in the building's pipes during the multi day outage. And the ice machines. The physics of this are fascinating. Well, this is a great mechanical detail. You have to discard all the ice that was sitting in the bin during the storm, obviously. Then you sanitize the empty bin. Then you turn the machine on, and then you have to completely discard the first new batch of ice it makes. Think about the mechanics of a commercial ice maker. When it sits without power for days, the internal freezing plates warm up. Biofilms and hard water scale buildup loosen inside the machine. So that first batch of new ice basically acts as a physical scour. Exactly. The freezing and dropping action pulls out any residual scale, mold, or contamination from the internal mechanisms. It is essentially a solid state flush of the machine. You also have to do equipment checks. You must manually verify that your hot water heaters can reach at least one hundred ten degrees Fahrenheit. Because if you don't have one hundred and ten degree water, your hand washing sinks and your commercial dishwashing machines are not code compliant. The detergents and chemical sanitizers won't activate properly at lower temperatures. And if you can't wash hands or dishes to code, you cannot operate. Which brings us to the ultimate regulatory clearance. If your facility was closed, Due to an imminent health hazard. Like structural damage, sewage backup, or that simultaneous lack of power and water we discussed. Right. It must remain closed until granted formal approval, meaning a physical reopening inspection by the local health department or regulatory authority. The person in charge must act as an ongoing assessor of food code compliance. But let's look at the real world pressure on a manager for a second. The pressure's immense. You've got a corporate office bleeding tens of thousands of dollars a day in lost revenue. You've got staff who are desperate for their paychecks because their own homes are damaged and they need cash. Right. The dining room looks perfectly fine. The coolers are finally cold. The chef is prepped. What is the actual consequence if a manager just decides to bypass the backlogged health department and quietly open the doors to get some cash flowing? The financial temptation is massive, but the consequence is catastrophic. Reopening without official clearance after an imminent health hazard closure is a direct, flagrant violation of the food code. Will they actually find out? they will find out. Because inspectors aggressively canvass disaster areas. And when they do, they can immediately suspend your operating permit. They will issue a formal season desist order. So you go from being closed for a few days due to a storm to having your license revoked indefinitely for a regulatory violation. Precisely. And from a liability standpoint, if you reopen illegally, And a single guest gets sick because you didn't properly flush the water lines. The legal liability falls entirely on the operator. Your insurance might even deny coverage because you were operating illegally. Exactly. You are risking the entire existence of the business to save one or two days of revenue. It is never worth the risk. But there is a smart way to manage this pressure, which the manuals call phased reopening. Yes. A large facility like a 400 room resort doesn't need to be One hundred percent restored to operate in some capacity. So how does a phased reopening work? If the ground floor restaurant is totally destroyed by storm surge, but the upper floors of the hotel are structurally sound and the power and water are verified safe by the authorities, you could reopen just those upper floors. You aren't hosting tourists or running full room service though. No, you are housing relief teams, utility lined workers, FEMA personnel, and insurance adjusters. It brings in revenue, it provides a vital service to the community's recovery effort, and it allows you to keep your core staff employed while the damaged sections of the property are rebuilt. It is the smartest way to bounce back. Let's step back and look at the entire journey we just took. We started with the lights going out in a crowded dining room, and we've navigated all the way through the microbiology of toxins, the physics of thermal mass, the legal realities of noncompliant guests. And the rigorous chemical sanitization required to reopen. It really covers every single aspect of survival. Mitigation is about physical survival. Documentation ensures your financial recovery. And rigid, unwavering adherence to the FDA food code is what protects public safety and your operating license. It completely redefines what this industry is truly about. It really does. If you're running a restaurant or if you manage a massive resort. True hospitality isn't just about a seamless check-in experience or a great stake. No, it's so much more than that. When the skies turn dark and the infrastructure collapses, true hospitality is about operational resilience. It's about the competence, the intense training, and the courage required to keep your guests and your staff alive when everything goes wrong. As we wrap up this deep dive, I want to leave everyone listening with a final thought to mull over. Okay, let's hear it. Well, we've spent this entire time breaking down exactly how to prepare the physical building, how to manage the inventory, how to handle the guests, and how to navigate the regulatory red tape. The mechanical side of things. Right. But think about the human element at the very center of this playbook. How does a hospitality leader prepare themselves mentally for the sheer trauma of leading a team through a disaster? That is a huge question. How do you project calm authority? Manage a crisis. And make life or death decisions knowing that your own home and your own family might be in the path of the very same storm. It's a profound burden. When you look at an x-ray of a broken arm, it's a clean line. It's broken or it's not. But when you are the incident commander standing in the dark, looking at a flooded lobby, failing generators, and a terrified crowd, there are no clean lines. It is the absolute definition of murky waters. And your only map is the playbook.