vaayaa Inclusive Education
Hospitality risk assessment

Cafe, Coffee Shop and Beverage Bar Management Risk Assessment: Food, Fire, Cash and Staffing Controls

A worked example of how a small cafe and beverage bar finds, scores and controls the risks to guests, staff, food, cash, customer data and supply, from allergen cross contact and espresso equipment to fatigue and card payment failures.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Cafe, Coffee Shop and Beverage Bar Management course

Executive summary

This assessment shows how a small cafe and beverage bar can find, rate and control the risks that matter most to its guests, staff and takings. Eight risks were chosen because they are plausible in everyday cafe work, from food handling and espresso equipment to cash, staffing, alcohol service, customer data and supply. Allergen cross contact and fire or burn hazards carry the highest natural scores, while cash, staffing and emergency readiness follow closely. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but food safety stays at Medium because the impact on a guest with an allergy remains severe. The first actions are allergen labelled prep areas, scheduled extraction cleaning, a drill with one incident register and a split cash count. The cafe is a teaching example, so every score illustrates method rather than describing a real business.

Focus area
Cafe, coffee shop and beverage bar operations
Setting
Independent cafe and beverage bar serving hot drinks, light food and limited alcohol, with table bookings and card and cash payments
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a single cafe with a counter, a small kitchen, a beverage bar, table service, table bookings and card and cash payments. It looks at risks to guests, staff, food, cash, customer data and continuity of supply. Jurisdiction, licensing rules, building layout, staff numbers and equipment models are not specified, so they are treated as assumptions for teaching.

Context

The cafe opens from morning to early evening and employs baristas, a kitchen cook, a shift manager and the owner, who also handles purchasing and cash. Guests order at the counter or book tables through an online system that stores names, phone numbers and dietary notes. The kitchen has a commercial dishwasher, a cold room, hot holding cabinets and grinders and espresso machines with steam wands. A limited alcohol service runs in the afternoons. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to serve safe food and drink, protect guests and staff from harm, keep takings accurate, handle customer data responsibly and keep the cafe open and trusted. The assets in scope are the kitchen and bar equipment, stock and recipes, the premises, cash and card takings, the booking and loyalty records and the cafe reputation. Stakeholders include guests with allergies or disabilities, baristas, kitchen and floor staff, the owner, the licensing authority, suppliers, neighbouring tenants and local emergency services. Clear roles matter: every risk has one owner role, and the owner reviews the register with the shift managers each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H04 H05 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H07 H08 Likelihood 3, impact 4, score 12, high: H03 Likelihood 3, impact 5, score 15, high: H02
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H07 H08 Likelihood 2, impact 3, score 6, medium: H03 H05 H06 Likelihood 2, impact 4, score 8, medium: H01 H02
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Food contamination and allergen cross contact 20 Critical 8 Medium Head chef or kitchen supervisor
H02 Fire, burns and espresso equipment hazards 15 High 8 Medium Facilities manager
H03 Emergency readiness and incident learning gaps 12 High 6 Medium Shift manager
H04 Cash, till and card payment failures 12 High 4 Low Cafe owner or finance lead
H05 Staff fatigue, understaffing and service failures 12 High 6 Medium Operations manager
H06 Alcohol licensing and responsible service breaches 10 High 6 Medium Licensed premises manager
H07 Customer data privacy and booking accessibility 9 Medium 4 Low Cafe owner acting as data lead
H08 Supplier disruption for coffee, dairy and bakery 9 Medium 4 Low Purchasing lead
H01

Food contamination and allergen cross contact

Safety Before 20 After 8

Raw and cooked foods are handled without temperature control or separation, and allergens such as nuts, milk or gluten move between prepared items, leading to illness or a severe reaction.

Who or what is affected: Guests with allergies, kitchen staff and the public

Causes

Busy service, shared utensils and allergen recipes changed without updating the records.

Consequences

Illness, allergic reaction, temporary closure, complaints and reputational harm.

Existing controls

  • Staff complete a basic food hygiene course before handling food.
  • Allergen information is listed on the menu board and in the kitchen.

Control gaps

Allergen sheets are not updated when suppliers change products, and temperature logs are often filled in afterwards.

Additional controls

  • Prevent: Use colour coded boards and separate prep areas for the top allergen items on the menu.
  • Detect: Check fridge and hot holding temperatures at opening and closing each day and record them.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Head chef or kitchen supervisor Target: Within 30 days Early warning: Any guest allergy complaint or a temperature reading outside the recorded safe range.
H02

Fire, burns and espresso equipment hazards

Safety Before 15 After 8

Steam wands, hot water, grinders, gas or electric heat sources and grease build up can cause burns, electrical faults or a kitchen fire that spreads through the premises.

Who or what is affected: Baristas, kitchen staff, guests and building neighbours

Causes

Grease build up, worn cables, overloaded sockets and hot surfaces left unguarded during service.

Consequences

Burns, fire spread, evacuation, injury claims and temporary closure.

Existing controls

  • Equipment is serviced by an outside contractor each year.
  • Fire extinguishers and a fire blanket are sited in the kitchen.

Control gaps

Equipment checks are annual and the extraction system is not included in the maintenance schedule.

Additional controls

  • Prevent: Clean extraction filters and grease traps on a fixed schedule with a signed record.
  • Respond: Train staff to shut off gas and power and to use the correct extinguisher type for each fire.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Facilities manager Target: Within 30 days Early warning: Tripped circuit breakers, scorch marks or a grease layer found during a routine walk round.
H03

Emergency readiness and incident learning gaps

Operational Before 12 After 6

No current evacuation plan, first aid cover or drill record exists, and near misses and guest incidents are not logged, so the same failure repeats without anyone learning from it.

Who or what is affected: All staff, guests and emergency responders

Causes

Small staff team, changing rosters and no one clearly owning the emergency plan.

Consequences

Slow response to injury or fire, repeated incidents and weak learning from near misses.

Existing controls

  • A first aid kit is kept behind the counter.
  • Staff are shown the main exit route during induction.

Control gaps

Drills are not recorded and near misses are reported only when someone is hurt.

Additional controls

  • Prevent: Keep a trained first aider on each shift and a written site emergency plan on the wall.
  • Detect: Log every incident and near miss in one register that the owner reviews each week.
  • Recover: Run an evacuation drill twice a year and record what was learned and what was changed.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Shift manager Target: Within 30 days Early warning: An incident or near miss that is not written in the register within 24 hours.
H04

Cash, till and card payment failures

Financial Before 12 After 4

Till floats are miscounted, cash is taken without being recorded, or the card terminal fails at peak times, so sales are lost, money goes missing and guests cannot pay.

Who or what is affected: Owner, cashiers and customers

Causes

Manual counting errors, shared till logins and reliance on a single payment device.

Consequences

Lost takings, theft, unpaid bookings and frustrated guests at the counter.

Existing controls

  • Cash is counted at the start and end of each shift.
  • The card terminal is supplied by a payment provider that offers telephone support.

Control gaps

Daily reconciliation is done by one person and the backup terminal has never been tested.

Additional controls

  • Prevent: Use a two person cash count and a locked float box with a limited number of keys.
  • Detect: Reconcile till totals to card settlements and to the cash banked each day.
  • Respond: Keep a manual card imprint process and a backup terminal ready for outages.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Cafe owner or finance lead Target: Within 45 days Early warning: A till variance above the agreed tolerance on two shifts in a row.
H05

Staff fatigue, understaffing and service failures

People Before 12 After 6

Short staffing, long shifts and unclear roles lead to tired staff, slow or wrong orders, injuries from rushing, and unsafe lifting of heavy stock, which damages the guest experience.

Who or what is affected: Employees, guests and online reviewers

Causes

Peak hours, sickness cover, pay pressure and an unclear division of tasks between staff.

Consequences

Injury, guest complaints, poor reviews and staff turnover.

Existing controls

  • Rotas are set a week ahead by the shift manager.
  • Staff breaks are noted on the timesheet.

Control gaps

Breaks are not enforced and fatigue is not discussed during shift handovers.

Additional controls

  • Prevent: Set a minimum crew for each service period and cap the number of consecutive long shifts.
  • Detect: Track late orders, complaints and overtime each week against the agreed target.
  • Respond: Keep a list of trained relief staff who can cover a sudden absence at short notice.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations manager Target: Within 60 days Early warning: Two or more missed breaks or repeated late drink orders within a single shift.
H06

Alcohol licensing and responsible service breaches

Legal and compliance Before 10 After 6

Alcohol is sold to someone underage or already intoxicated, or licence conditions such as service hours and display of notices are not followed, exposing the business to penalties.

Who or what is affected: Staff, guests, the licensing authority and the public

Causes

A busy bar, pressure from large groups and staff who are unsure of the policy.

Consequences

Fines, licence review, prosecution and harm to a guest or member of the public.

Existing controls

  • Bar staff are asked to show identification when they are unsure of a guest's age.
  • Licence conditions are displayed in the staff room.

Control gaps

Refusals are not recorded and staff training on the policy is not refreshed.

Additional controls

  • Prevent: Adopt a written age check policy and refuse service to anyone showing signs of intoxication.
  • Detect: Audit a sample of sales and refusals each month against the written policy.
  • Respond: Record each refusal and any incident, and report it to the manager at once.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Licensed premises manager Target: Within 30 days Early warning: A refusal that is not logged or a sale made without an identification check.
H07

Customer data privacy and booking accessibility

Technology and data Before 9 After 4

Names, phone numbers and dietary notes stored in booking and loyalty tools are shared, kept too long or left exposed at the counter, and the booking page is hard to use for guests with disabilities.

Who or what is affected: Guests, staff and the booking provider

Causes

Shared logins, loyalty sign up forms left on the counter and online forms without clear accessible labels.

Consequences

Privacy complaints, contact from a regulator, lost bookings and exclusion of some guests.

Existing controls

  • The booking system requires a password for staff access.
  • Guests can book by telephone as well as online.

Control gaps

Access is not removed when staff leave, and the booking page is not tested with assistive tools.

Additional controls

  • Prevent: Collect only the guest data that is needed and delete dietary notes after the visit.
  • Detect: Review staff access to the booking system each quarter and remove leavers at once.
  • Respond: Tell affected guests promptly if a data leak occurs and record the steps taken.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Cafe owner acting as data lead Target: Within 60 days Early warning: A staff login used after the person has left, or a guest complaint about a booking form.
H08

Supplier disruption for coffee, dairy and bakery

Supplier Before 9 After 4

A roaster, dairy or bakery supplier fails to deliver or changes a product, so the menu cannot be served, or a substitute alters taste or allergen content without warning.

Who or what is affected: Staff, guests and the supplier

Causes

A single supplier for key items, short notice product changes and transport delays.

Consequences

Menu gaps, lost sales, unplanned allergen risk and damaged supplier trust.

Existing controls

  • Two suppliers are listed for the main coffee blend.
  • Deliveries are checked against the order when they arrive.

Control gaps

Allergen details are not checked again when a substitute product arrives.

Additional controls

  • Prevent: Ask suppliers to notify allergen or recipe changes in writing before each delivery.
  • Respond: Keep a short menu plan that can run without the main dairy or bakery items.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Purchasing lead Target: Within 60 days Early warning: A supplier delivery that is late or short on two occasions within one month.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls, judged as if the cafe had only basic habits in place. Residual risk is the score after the existing and added controls are working. Impact is judged on harm to people first, then on money lost, closure time, licence effects and damage to trust, and a risk is never rated down simply because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Staff who run the shifts should challenge the ratings, and each rating is reviewed whenever a warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Fridge and hot holding temperatures recorded outside the safe range.Escalate to the head chef at once, and to the owner if food is not discarded or the same fault recurs on the same day.
Till variance above the agreed tolerance on two shifts in a row.Escalate to the owner within 24 hours, and pause the cash float until the cause is found and recorded.
Incidents or near misses not entered in the register within 24 hours.Escalate to the operations manager at once, and to the owner if the gap continues for a full week.
Overtime hours or missed breaks above the weekly target.Escalate to the operations manager when the target is exceeded for two weeks, and review the rota with the team.
Age check refusals not recorded on sampled alcohol sales.Escalate to the licensed premises manager at once, and suspend alcohol service for the shift if the policy is ignored.

Contingency arrangements

If a serious event occurs, such as a guest allergic reaction, a fire, a data leak or a licence breach, the shift manager calls the emergency services where needed, makes the area safe and keeps a written record. The owner closes the affected service area until it is safe, preserves records and decides on any temporary closure. The licensed premises manager and the data lead contact the relevant authorities and affected guests as the local rules require. A standby plan covers cash, a backup card terminal and a short menu, so trading can resume quickly and openly.

Prioritized action plan

  1. Introduce allergen labelled prep areas and daily temperature checks, owner head chef, within 30 days.
  2. Schedule extraction cleaning and a full equipment safety check, owner facilities manager, within 30 days.
  3. Hold a site emergency drill and start a single incident register, owner shift manager, within 30 days.
  4. Split the cash count and test the backup card terminal, owner cafe owner, within 45 days.
  5. Set minimum crew levels and a written age check policy, owner operations manager, within 60 days.

Conclusion

Good cafe management depends on a few steady habits: allergen controls, temperature checks, safe equipment, a tested emergency plan, split cash duties and a rota that protects people from fatigue. The highest scores sit with food safety and fire or burn hazards, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real food, fire, alcohol, privacy or tax question.

Assumptions and limitations

Assumptions

  • Jurisdiction is not specified, so food, alcohol, fire and privacy duties are described only in general terms.
  • The cafe holds a limited alcohol licence and sells beer and wine by the glass during afternoon hours.
  • Equipment is serviced by outside contractors, and the building is shared with other tenants.

Limitations

  • Scores are illustrative and do not describe any real cafe or inspection result.
  • Food, alcohol, fire and privacy rules vary by place and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Hazard analysis and critical control points principles
  • Hierarchy of controls
  • Allergen management principles for food service
  • Incident reporting and learning cycle
  • Data protection principles for customer records

Hospitality Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Cafe, Coffee Shop and Beverage Bar Management course Read the best practices for this course

More Hospitality risk assessments

Hourly Active: 35,661 Learners