Hospitality portfolios generate thousands of compliance actions a year. Most get logged, actioned, and closed. But the data reveals a harder truth: closing an action is not the same as controlling a risk.
An action can be marked complete without verification, without evidence, and without confirmation that the fix has held. That gap, between activity and proof, is where exposure hides.
Vantify’s Annual Compliance Report 2026 analysed a full year of structured data across 1000s of live assessments covering fire, water, asbestos and operational risk. The findings challenge how many organisations define compliance assurance. Below is an extract from the report.
What the data shows at a glance
Across UK portfolios, the data points to persistent everyday risk alongside growing workflow inefficiency.
- Everyday hazards such as slips and trips remain frequent and preventable, often driving the long tail of claims and reputational impact.
- Fire safety continues to generate high volumes of remedial actions, particularly around fire doors and compartmentation integrity.
- Legionella compliance remains operationally demanding, with risk more often created by inconsistent implementation and incomplete evidence than by control gaps.
- Security and antisocial behaviour increasingly appear as safety risks, not ‘just security issues’, creating secondary risk exposures.
- Operationally, the pattern is intent vs delivery: assessments and actions are created, but closure, evidence and investment decisions can lag, leaving some hidden exposures.
The opportunity is to move from ‘compliance activity’ to ‘compliance assurance’.
The most mature organisations move from periodic, document-led compliance to continuous visibility and evidence-backed closure. A hazard is controlled only when actions are completed, verified and evidenced at scale.
Across all 12 trends, three actions consistently reduce risk and cost:
- Strengthen closure discipline (priority-based, escalation, evidence required to close).
- Target repeat recurring risks (a small subset of sites often generates disproportionate risk).
- Connecting compliance to operations and supplier assurance – when compliance, operations and supplier assurance are connected, risk stops ‘hiding’ between systems and control happens before work starts, not after something goes wrong.
The full report sets out all 12 trends in detail, with underlying data, regional patterns and the specific actions that move each risk from activity to assurance.