The Mandate Matrix for Hotel Compliance

Most hotel compliance tracking is a spreadsheet with one row per employee and one column per certification. It works until it doesn't, and it stops working at a predictable moment: the second state.

The moment a portfolio crosses a state line, the columns stop meaning the same thing for every row. A bartender in Sacramento and a bartender in Austin both need alcohol-service certification, but not the same certification, not on the same renewal clock, and not with the same consequences for lapsing.

A spreadsheet can't express that. A matrix can.

The three axes

The model is simple to state and surprisingly hard to maintain by hand. Every training requirement is the intersection of three things:

State — the jurisdiction the property sits in. California requires RBS for alcohol service, harassment-prevention training under AB 1825 / SB 1343, and workplace-violence prevention under SB 553. Texas requires TABC Seller-Server. New York requires annual harassment training. Federal baselines apply everywhere underneath: OSHA bloodborne pathogens, PCI-DSS handling, and NFPA fire and life safety.

Role — what the person actually does. A housekeeper needs bloodborne pathogens; a bartender needs alcohol service; a night auditor needs PCI. Titles vary between properties, so the useful unit is the role as scheduled, not as printed on the offer letter.

Certification — the specific credential, its issuing body, its validity period, and what evidence counts as proof.

Fix any two axes and the third is determined. That's the whole idea: you stop tracking people and start tracking rules, and the people inherit requirements from where they work and what they do.

What this fixes immediately

New hires configure themselves. Add a person, assign a role and a property, and the required certifications are implied. No one consults a document to decide what a Texas banquet server needs.

New properties inherit rules, not chaos. Acquire a hotel in a new state and you add one row to the state axis. Every employee at that property picks up the correct requirements on day one.

Role changes recalculate. Promote a housekeeper to houseperson and the requirement set changes automatically, with credit preserved for what's already complete.

Multi-state stops being manual. The California/Texas problem disappears because the matrix never assumed a single answer.

Expiry is the other half

Knowing what is required is only useful alongside when it stops being valid. Certification is a state with a decay function, and the failure mode is silence: nothing happens when a credential expires. No alert fires. The employee keeps working. You find out during an audit, or after an incident.

Expiry cadence is what closes that gap: refreshers auto-assigning at 90, 60, 30 and 14 days before expiry, with escalating notification. Four touches, because one email 30 days out will be missed by someone working split shifts.

The cadence matters more than any single reminder. By the 14-day notice you're no longer nudging the employee; you're alerting their manager that a scheduled worker is about to become unscheduleable.

Reading it at different altitudes

The same matrix serves different audiences by aggregation:

None of these are separate reports. They're the same data summed along different axes, which is only possible because the underlying model is structured rather than a grid of dates someone typed.

Where hand-built matrices fail

If you build this yourself in a spreadsheet, three things will eventually break it:

1. Mandates change. States amend requirements and add new ones. Someone has to notice and update every affected row.
2. Role drift. The person hired as a server now runs banquets on weekends. The spreadsheet says server.
3. Nobody owns it. The person who built it leaves. The formulas survive; the understanding doesn't.

All three are maintenance problems, and maintenance is what fails first under 73% turnover.

The bottom line

Compliance isn't hard because the rules are complex. It's hard because the rules are conditional, and conditional logic maintained by hand degrades quietly.

Model it as state × role × certification and the tracking stops being a document somebody updates and becomes a property of the system, one that's correct on the day you acquire a hotel in a state you've never operated in before.

See how the Compliance Tracker maps the matrix and runs the expiry cadence automatically.