1. Duty of Care: Roles and Responsibilities

Duty of care is the organisation’s responsibility to take reasonable and proportionate steps to protect the health, safety, security and well-being of people travelling on its behalf. The precise legal position depends on jurisdiction and circumstances; this guidance is not legal advice.

A strong duty-of-care approach is proactive. It identifies foreseeable risks before a trip, provides travellers with suitable information and support, maintains a reliable way to contact them during disruptions, and reviews incidents to improve future decisions.

Organisational responsibilities

• Publish a clear business-travel and travel-risk policy that applies to employees, contractors and other covered travellers.
• Assess destination, itinerary and traveller-specific risks before approving travel, with additional controls for elevated-risk journeys.
• Provide access to appropriate insurance, medical assistance, security assistance and emergency communication channels.
• Maintain accurate, proportionate travel visibility: current itinerary, reliable contact details and the location of travellers when needed for a response.
• Protect personal data through role-based access, a stated purpose, retention limits and secure handling procedures.
• Provide training, destination briefings and a simple process for raising concerns or declining travel where a credible risk remains unresolved.

ISO 31030 provides international guidance for organisations on travel risk management. See ISO 31030:2021 for the standard overview.

2. Travel Risk Management Programme

A Travel Risk Management (TRM) programme is the operating system behind duty of care. It connects policy, traveller data, risk intelligence, approvals, assistance providers, communications and continuous improvement into one repeatable process.

Build the programme in eight steps

1. Define scope and risk appetite. Specify which travellers, trip types, countries, suppliers and personal extensions are covered. Define what risk levels can be accepted, who can approve exceptions and when travel must be deferred or declined.
2. Create destination risk tiers. Use a consistent framework for security, political stability, health, climate, transport, legal and cyber risks. For example, apply low, moderate, high and critical tiers, each with clear requirements.
3. Assess each trip. Review the destination and route, but also the traveller’s experience, medical or accessibility needs, purpose of travel, timing, accommodation, local transport, equipment and public profile.
4. Apply proportionate controls. Typical controls include itinerary changes, daylight arrivals, vetted hotels and drivers, a security briefing, medical preparation, local support, check-in requirements, a satellite device or executive protection when justified.
5. Use a structured approval workflow. Standard-risk trips may be automatically approved within policy. Elevated-risk travel should require documented review, traveller acknowledgement and authorised approval before ticketing or departure.
6. Maintain traveller visibility. Consolidate booking and itinerary data, but do not collect more personal data than necessary. Ensure there is a reliable method to contact travellers if a material event occurs.
7. Monitor and communicate. Monitor credible information sources for events that may affect travellers. Deliver concise, actionable messages that identify the affected area, requested action, response channel and time of next update.
8. Measure and improve. Record incidents, near misses, response times, missed check-ins, policy exceptions, training completion and traveller feedback. Review the programme regularly and after significant events.

Suggested risk-assessment categories

3. Emergency and Crisis Management

A travel emergency plan should be understandable at 03:00 in the morning, work across time zones and be tested before it is needed. The plan must define how an event is verified, who takes command, how travellers are accounted for and how decisions are communicated.

Response lifecycle

1. Detect and verify. Confirm the event through trusted sources and determine which trips, locations and travellers may be affected.
2. Assess impact. Identify immediate threats, medical needs, local restrictions, transport disruption, communications availability and potential for escalation.
3. Account for travellers. Use agreed contact methods to obtain welfare status, current location, safety needs and ability to follow instructions. Record attempts and outcomes.
4. Activate the response team. Escalate according to defined thresholds. Assign an incident lead, operations coordinator, traveller liaison, communications lead and log keeper.
5. Support and stabilise. Arrange medical care, secure transport, alternative accommodation, legal or consular support, interpreter assistance or insurer/provider support as appropriate.
6. Communicate clearly. Give affected travellers concise instructions. Provide leadership and stakeholders with factual, approved updates that protect personal information.
7. Recover and review. Confirm safe onward travel or return, close welfare actions, document decisions and conduct an after-action review with specific improvement owners and deadlines.

Evacuation and relocation

Evacuation is a specialist activity and should not be promised casually. Pre-arrange reputable medical, security and travel-assistance providers; understand their geographic limits, activation requirements and decision authority. Decisions should consider the current threat, transport availability, border controls, the traveller’s medical condition, safe receiving locations and credible routes.

Communication plan

• Maintain a 24/7 emergency number and a backup route if the primary channel fails.
• Use multiple channels where necessary: phone, SMS, secure messaging, email and travel-app notifications.
• Prepare message templates for check-in requests, shelter-in-place instructions, travel suspension, relocation and family liaison.
• Set a contact frequency and publish the next-update time, even where there is no material change.
• Keep an incident log with time-stamped decisions, sources, contact attempts, support actions and approvals.

The travel-risk incident-response sequence of notification, assessment, convening a response team, execution and resolution is also reflected in Airmic’s travel risk management guidance (PDF).

4. Employee Training and Pre-Travel Checklists

Effective preparation is risk-based. A short domestic visit may require only an itinerary and emergency contacts, while a higher-risk international assignment may need a detailed briefing, scenario training, formal approval and specialist support.

Core training modules

• Destination awareness: local laws, culture, security conditions, restricted areas, common scams and appropriate behaviour.
• Personal security: hotel security, ground transport, public-space awareness, valuables, alcohol and nightlife decisions.
• Digital security: device protection, VPN and Wi-Fi rules, phishing, safe charging and handling confidential information.
• Health and welfare: medical preparation, insurance assistance, medication, fatigue, mental well-being and local care options.
• Emergency response: check-in process, emergency contacts, incident reporting, location sharing and communication during disruption.
• Scenario practice: delayed contact, lost passport, illness, civil unrest, arrest or detention, theft, severe weather and transport cancellation.

Pre-travel checklist for employees

High-risk travel add-ons

For high-risk locations or roles, add a documented individual risk assessment, security interview, approved transport and accommodation, dedicated check-in schedule, contingency routes, local security contacts and an explicit decision process for travel suspension or withdrawal. Confirm that the traveller understands both the risk and the available support before final approval.