Most of the money leaks in a multi-unit restaurant do not come from a single catastrophic event. They come from a pattern that gets discovered two weeks late in the weekly P&L review. Labor was three points hot on Thursday. Then again on Friday. Then again the next Thursday. By the time the area director reads the report, the group is out four shifts of variance and the general manager cannot even remember what happened.
Automated escalation is the correction. Not exotic. Not AI. A trigger fires when a threshold is crossed. The right person gets a message on the day it happened. They act inside 24 hours instead of 14 days. The dollar impact is meaningful and the tooling to build it is cheap.
The five triggers to start with
I have tried longer lists. Ten triggers. Fifteen. Every time the extra alerts trained the field to ignore the ones that mattered. The list that has held up across two multi-unit groups is five.
Labor variance over three points, single day
The general manager submits a forecast. 7shifts and Toast produce actuals. When the day closes and actual labor as a percent of sales lands more than three points hot against the forecasted target, an alert fires to the general manager and the area director the same night. Not the next Monday. The night it happened.
Three points is the threshold I use. Some groups run tighter at 2.5, some at 3.5 depending on average check volatility. What matters is the number is consistent and it is on a single day, not week-to-date. Week-to-date alerts fire too late to change behavior.
Comp or void over two hundred dollars, single check
Toast fires a webhook every time a check clears with a comp or void amount. The rule filters for anything over two hundred dollars on a single check and pings the area director with the check number, the manager on duty, the reason code, and a Toast deep link. Ninety percent of these turn out to be legitimate service recovery. The other 10 percent are the ones you want to find on the day, not on the month-end audit.
Health inspection score under ninety
Any score under 90 from a routine inspection triggers a pager alert to the regional director and the operating partner. The alert includes the location, the score, and any critical violations. This is the trigger you hope never fires. When it does, you want the response to start inside the hour, not the next business morning.
Temperature log missed for two consecutive days
Digital temp logs in tools like ChefMod or the Toast Kitchen Display module produce a daily record. When two days pass without a completed log for a given unit, the alert fires to the general manager and the area director. This is the leading indicator of a food safety event and it is the cheapest one to catch.
Safe cash count variance over one percent
End-of-day cash variance over 1 percent of the day's cash sales pings the area director with the count difference, the closing manager, and the previous 14-day trend. Pattern matters more than the single instance. The pattern is only visible if the alert fires each time it happens.
Those five are the starting set I would build tomorrow at any group between five and thirty units. At Hana Group, running 21 franchise units across six states inside Walmart, Sam's Club, Whole Foods, and Target, the same five triggers were the ones that produced actual action. The exotic alerts we tried on version one, waste by menu item, average handle time by station, third-party delivery cancel rate, all sounded useful in a planning meeting and produced no operator behavior change in the field. The core five did.
Fig. 1 · The trigger-to-alert flow.
Who gets paged when
Every alert has a named person. Not a group channel. Not a distribution list. A person. Group alerts get ignored because every recipient assumes someone else has it. Named alerts get acknowledged because the recipient knows there is no one behind them.
The decision tree is simple. Anything about one unit goes to the general manager first, with the area director copied. Anything that spans two shifts or crosses a dollar threshold goes to the area director as primary. Anything involving a guest injury, a health inspector, an alleged harassment incident, or a labor law claim goes to the regional director or operating partner as an incident, with legal on copy.
Fig. 2 · Named routing by severity and scope.
The service level on acknowledgment matters. Slack alerts get four hours during operating hours. Text alerts get one hour. PagerDuty incidents get fifteen minutes, day or night. If the SLA is missed, the alert re-fires up the tree. That is the whole escalation logic. It fits on one page.
The alert fatigue trap
This is the mistake every operator makes on version one. You add a trigger because it "would be nice to know." Then another. Then another. Six months later there are 47 alerts a week in the general manager Slack channel and nobody reads any of them.
The rule I use now. No more than five triggers total in the first six months. If a sixth is proposed, one of the existing five has to be retired to make room. That constraint forces the group to actually decide which events are worth an interruption.
The tuning cadence is monthly. On the first Monday of the month, the area director reviews every alert that fired in the previous 30 days in an Airtable log. For each one they answer a single question. Did this alert lead to an action. If the answer was no more than one time in five, the threshold gets raised. If the answer was yes every time, the threshold might actually be too loose and you are missing similar events.
An alert that fires without action trains the field to ignore alerts that do need action. Silence is expensive. Noise is more expensive.
The numbers that changed at Zareen's
Before we wired escalation automation into the three Zareen's locations, the average discovery lag on a labor variance event was 11 days. That number came out of a simple audit. Pull the last 20 labor variance events over three points. Ask when the general manager and area director first talked about it. The average was 11 days after the first bad shift.
After the alerts went live and the tuning cycle settled, the same audit produced an average of 0.8 days. Roughly same-day discovery, with a few edge cases that took a weekend. The variance did not disappear. But it stopped compounding across a full week of the same mistake.
The labor line moved 120 basis points across the group over the following quarter. Not all of that was the alerts. Some was the schedule redesign that happened at the same time. But the leadership team was unanimous that the alerts were what made the schedule redesign hold. Without the alerts, the schedule discipline slid back inside six weeks. With them, it held.
Tools, concretely
The stack I would build tomorrow for a group under 30 units.
- Toast for POS webhooks. Comp, void, and cash variance events all fire natively.
- 7shifts for labor. The daily labor report can be pushed by webhook or pulled through their API.
- Zapier or Make as the routing layer. Make is stronger on branching logic. Zapier is easier for a non-technical operator to maintain.
- Slack for informational alerts. One channel per alert type, one thread per event.
- Twilio for text alerts. Cheap. Reliable. Every general manager already has a phone.
- PagerDuty for on-call rotation on the incident-tier events. Not overkill for a group with health inspector or guest injury exposure.
- Airtable as the alert log. Every fire logged. Monthly tuning review.
- Power BI for the "did the escalations move the P&L" review that closes the loop.
Total build time is about two weeks for a competent operator or freelancer. Total monthly cost sits between 150 and 400 dollars depending on volume. The payback in labor and comp basis points is order-of-magnitude larger.
Mistakes I made building this
I built the first version with eleven triggers. Inside two months the general managers were muting the Slack channel. We stripped it back to five and adoption came back the next week. Fewer alerts, more attention.
I sent the first version of the labor variance alert to a group channel. Nobody acknowledged. I switched to a named recipient with the area director on copy, and acknowledgment on the first-touch alert went from 30 percent to 94 percent inside two weeks. Group channels are for visibility. Individual assignment is for accountability. Do not confuse them.
I skipped the monthly tuning review for a full quarter at one group because we were mid-integration on a new POS. Thresholds drifted. By month three, one alert type was firing on almost every close and getting ignored by everyone. It took six weeks of tuning to rebuild the credibility of the system. Skip the monthly review and you pay for it later.
What this does not replace
The weekly P&L review still happens. The weekly one-on-one between the area director and the general manager still happens. Escalation automation catches events. Weekly rhythm catches trend. Both are needed. Alerts without a rhythm turn into an inbox nobody trusts. Rhythm without alerts is where discovery lag lives.
The other thing worth saying. Automated alerts do not manage people. A general manager who keeps triggering the same alert is not an alert problem. They are a coaching conversation. If you find the same name at the top of the alert log every month, the fix is not to raise the threshold. The fix is a real conversation about scheduling discipline or judgment.
The point
Discovery lag is the silent cost in every multi-unit operation. Two weeks late is the default. Same day is the target. The gap between them shows up on the labor line, the comp line, and the food line every month.
Five triggers. Named recipients. A routing pipe that costs a few hundred dollars a month. A monthly tuning cadence that keeps the signal honest. That is the whole build.
The operators who wire this get out of the business of finding out on Monday what happened last Wednesday. They also get out of the business of running the same postmortem three months in a row on the same repeated mistake. Same-day discovery is not glamorous. It is boring. Boring in operations is exactly the point. The wins compound quietly and show up as basis points nobody had to fight for on the next quarterly review.