A Review Response Policy for Location Managers: Who Replies, Who Escalates

A review response policy for a multi-location business is a short written document that says who may reply to reviews at each location, which reviews go to a central team, and which escalate immediately. The simplest template has three tiers: routine reviews local managers answer, sensitive reviews the central team approves, and threats, legal, health, safety or privacy issues that stop everything until a named person decides.

Below are the template, the permission setup that makes it enforceable, and the rules every replier must follow. For the wider operating model, see our multi-location review management playbook.

Why location managers need a written policy

Location managers know their customers and can often fix a problem the same day, which makes them good at answering everyday reviews. They are also busy, sometimes personally named in complaints, and rarely trained on privacy or legal risk. Without written rules, one manager replies to everything within minutes, another ignores the profile for months, and a third argues with a customer in public.

A written policy sets one standard across locations, tells managers exactly when to stop and hand over, and leaves a record of who decided what.

Set permissions before you write the rules

A policy only works if the access matches it. On Google Business Profile, the access roles are the starting point. According to Google's help page on managing Business Profile owners and managers, a profile has one primary owner; owners have full control, including adding or removing users and deleting the profile; and managers have mostly the same access, except they cannot add or remove users or remove the profile. Both owners and managers can respond to reviews.

Be careful with business groups. Google's page on creating and managing business groups explains that a user added as a manager or owner of a group can access all current and future profiles in that group. So do not add a location manager to a group that contains every location. Either add them to the single profile, or create a group per region or per location with the right people in it.

A manager can also edit other profile details, so if you only want them to handle reviews, say so in the policy. On other platforms, check the current role options and apply the same principle: few people with full control, location access limited to the location.

The three tiers at a glance

Tier 1: what location managers may answer

Tier 1 covers reviews where a short, polite reply carries little risk. Managers may thank customers, acknowledge a clear service miss, apologize, and offer a direct contact for follow-up. They should use the approved reply guidelines, write in their own words rather than pasting one stock answer, and never mention an order number, visit date or detail the reviewer did not already make public.

If a Tier 1 review turns out to be more serious, it moves up a tier at once.

Tier 2: what goes to the central team

Tier 2 covers reviews where the reply could create a commitment, reveal information or set a precedent. Typical triggers: a refund or chargeback, a staff member named in the review, the same complaint appearing at several locations, a review that looks fake or comes from someone who was never a customer, and any review the manager is personally involved in. The manager collects the facts internally and drafts a reply; the central team approves or rewrites it.

Tier 2 is also where decisions about reporting a review belong. A review can be flagged when it actually breaks a platform rule, such as the categories in Google's prohibited and restricted content policy. Negative feedback alone is not a reason, and reports should be made once, accurately, by one person, not by several staff members flagging the same review.

Tier 3: what escalates immediately

Tier 3 items stop the normal process. The manager does not reply, does not contact the reviewer and does not delete anything they control. They capture the review (screenshot with date and link) and notify the named contacts. Tier 3 includes:

• Threats of violence or harm to staff or customers. If anyone may be in danger, contact local emergency services first. See what to do when a review threatens you or your staff.
• Legal matters: mentions of a lawyer, lawsuit, injury claim, or a review connected to an existing dispute.
• Health and safety: food illness, allergic reactions, injuries, unsafe premises, product safety.
• Privacy: reviews that include personal data, and any review where a reply could reveal health or other sensitive information. Healthcare businesses should follow the rules in responding to patient reviews without violating HIPAA.
• Discrimination or harassment claims involving staff or customers.
• Media, regulator or law enforcement contact linked to a review.
• Demands for payment to stop or remove reviews.

What nobody may do, at any tier

This section protects the business as much as the reviewer. In the US, the FTC's rule on consumer reviews and testimonials sets several limits that apply directly to managers. Under 16 CFR 465.5, officers or managers may not write consumer reviews about the business without clearly disclosing their relationship, and may not ask employees or relatives for reviews in ways the rule prohibits. Under 16 CFR 465.7, using an unfounded or groundless legal threat, a physical threat, intimidation or a public false accusation to prevent or remove a review is an unfair or deceptive practice. The full rule is in 16 CFR Part 465.

Put these prohibitions in the policy in plain words:

• Do not write, ask for or pay for reviews of your own or another location, and do not ask staff, friends or family to review it. Our guide on employees reviewing their own company covers the rules in more detail.
• Do not offer anything in exchange for a positive review or for changing a review.
• Do not threaten, accuse or try to identify a reviewer in public, and do not contact a reviewer privately about their review without central approval.
• Do not share customer details, order data, health information or staff details in a reply.
• Do not argue facts in public; state your position once, briefly, and move the conversation offline.

This article is general information, not legal advice. For questions about a specific review or your obligations, consult a qualified lawyer in your jurisdiction.

The policy template

Copy this outline into your own document. Keep it to two or three pages.

1. Purpose and scope. Which platforms are covered (for example Google, Yelp, Facebook, Tripadvisor) and which locations and roles.
2. Roles and access. Who holds the primary owner, owner and manager roles on each platform; who approves new access; who removes access when someone leaves or changes location.
3. Monitoring. How new reviews reach the right person, for example through alerts. See how to set up alerts for new reviews.
4. Tier definitions. The three tiers, with examples of each from your own industry.
5. Response targets. The timing you set for each tier, and who covers when a manager is away.
6. Reply standards. Tone, length, sign-off (role, not full name, unless you decide otherwise), contact channel to offer, and words to avoid.
7. Escalation contacts. Named people for Tier 2 and Tier 3, with a phone backup, plus legal, safety and privacy contacts.
8. Prohibited actions. The list from the previous section.
9. Records. Where screenshots, drafts and approvals are stored, and for how long.
10. Review and sign-off. The date of the next policy review and a line each manager signs to confirm they have read it.

For Tier 3 items that need a public holding reply, give managers one pre-approved wording they may post only when the central team tells them to.

Example (illustrative): Thank you for letting us know. We take this seriously and our [team/department] is looking into it now. Please contact [manager's email] or [phone number] so we can speak with you directly.

For a Tier 1 complaint, an approved pattern could look like this:

Example (illustrative): Hi [Name], thank you for the feedback, and I'm sorry the wait was longer than it should have been. We've shared this with the team at [location]. If you'd like to talk it through, you can reach me at [manager's email]. [First name], [role]

How to roll it out

1. Audit access. List everyone with access to each profile on each platform. Remove former employees and anyone who does not need access.
2. Fix the roles. Move location managers to the Manager role on their own location and keep owner access with the central team.
3. Fill in the template with your own escalation contacts and industry examples.
4. Train with real cases. Use anonymized reviews from your own profiles and ask managers to assign each one a tier.
5. Run a trial for a few weeks where Tier 1 replies are also checked centrally, then let managers reply on their own.
6. Add access changes to HR checklists for joiners, movers and leavers, so profile access is updated the same day.

Keep the policy current

Review the policy at least every quarter. Platform help pages, roles and reporting options change, so check the official pages linked above rather than relying on old screenshots. Look at what was escalated and what should have been, then adjust the tier examples.

Also note that Google's help page on managing customer reviews says replies are checked against content policies and usually take up to 10 minutes to appear, but sometimes up to 30 days. Tell managers this, so a delayed reply does not lead to repeated posting. If a serious review reveals a wider problem, connect this policy to your online reputation crisis plan.