Understanding Travel Risk Management (TRM)
About Safeture The Safeture platform is a complete and cloud-based service managing risk, safety and crisis processes involving employees. The solution takes care of all risk and crisis management needs, finding new ways to safeguard employees wherever they are and secure your company. More information on Safeture and the BCD marketplace Travel Risk Management.
Defining travel risk management (TRM)
ISO standard 31030 defines travel risk management as “the effects of uncertainty on objectives due to travel.”
Quite simply, what this really adds up to is making work-related travel safe(r) for employees and other people traveling on a company’s behalf. The standard further describes TRM as “coordinated activities to direct and control an organization with regard to travel risk.”*
So, TRM is not just the “why,” it’s also the “how.” You can find out more about ISO 31030 in this short video from BCD Travel’s Global Crisis Management team.
*ISO 31030:2021 Travel risk management – Guidance for organizations
Getting started
For travel managers new to TRM, using an external TRM supplier may be a good starting point. TRM programs can range from simple to highly complex, and ISO 31030 may be an unsuitable guide for those completely new to TRM.
Even before bringing in a third-party, seeking advice from a travel management company (TMC) can also be a useful starting point. Available through Advito, BCD Travel’s Traveler Security Program Assessment (TSPA) can help ensure TRM alignment to ISO 31030
Why travel risk management?
There are three main factors necessitating a TRM program:
- Duty of care – in most countries, employers have a legal responsibility to care for staff when working, and this includes work-related travel. The responsibility is less clear for non-employees traveling on the company’s behalf, but it seems sensible to include them within the wider scope of duty of care. As this is a legal responsibility, employers may be liable for damages (and in some jurisdictions, senior executives may be liable to criminal charges) if an employee is injured or killed on a trip. A properly delivered TRM program may provide some legal defense. And it’s worth remembering that workplace laws apply wherever an employee is active on behalf of an employer, and that includes when traveling for business.
- Moral and ethical duty – employers have a duty to keep employees safe whentraveling on business and support them should something happen on a trip.
- Reputation – being seen as a caring employer will help companies retain staff and attract new employees
Why BCD should be a vital part of your travel risk management strategy
Around the clock monitoring
Our Global Crisis Management team monitors events 24/7/365 to identify incidents that may impact business travelers.
Once identified, our team conducts an assessment and action plan for each incident.
Prepare and prevent
Our proprietary and interactive security map allows you to visualize a traveler’s current and upcoming locations against known risk events.
The in-depth destination reports and automated risk alerts will keep travel managers and their travelers informed before they ever step on a plane.
Communicate and act
When an incident occurs, we provide multiple ways to communicate with travelers.
Real-time mobile alerts to both travelers and travel managers to keep them informed and aligned.
Automated “I’m Safe” check-in functionality for highrisk incidents. Responses sync back to interactive security maps in DecisionSource.
Reach out directly to travelers via email or SMS with contact data pulled straight from their itineraries.
Where responsibility for risk is less clear
There are some aspects of travel where an employer’s responsibility towards employee risk is less clear.
Bleisure travel
Whilst on a business trip, an employer’s responsibility for employee safety and welfare begins the second
they leave home (for the airport) until they are back home. Engaging in leisure activities during a trip adds
complexity, particularly when leisure and business travel are blended together in a bleisure trip. Clear policies should define the boundaries between work and leisure, while the validity of the company’s travel insurance during leisure time should also be ascertained.
Bleisure travel as an employee benefit
Post-pandemic, blended travel has become more popular than ever and has supported the growth of the “digital nomad.” Many business travel insurance policies will cover employees when they extend their trip to include some leisure time. Companies can promote this as an employee benefit, helping with talent acquisition and staff retention
Managing the entire risk
It’s a mistake simply to ensure a TRM program covers only the most common travel risks, as it leaves
companies exposed to the legal consequences of unmanaged risks.
Remote workers
The boundaries between work-related travel and remote working are becoming increasingly blurred. When a natural disaster occurs, should a company look after both business travelers and remote workers in the area? An employer’s legal responsibility for out-of-office work has become less clear. Ideally, TRM should extend to all impacted employees, and not just to those traveling for business. Travel risk management is becoming people risk management.
Don’t just focus on high-profile risks
When it comes to travel, it’s easy to focus on the high-profile risks, such as terrorist attacks or large-scale natural disasters. While it’s important to prepare for such events, particularly since their travel impact could be significant, in reality, they occur only rarely. It’s just as important to prepare for smaller impact risks, which are easily overlooked, but which occur much more frequently. These can be more isolated incidents, impacting a smaller number of or even single travelers. They can include medical emergencies or car accidents – the number one cause of non-natural business traveler deaths*.
*Centers for Disease Control and Prevention, Traffic and Road Safety
Find out how BCD has supported companies with their travel risk managements needs
Discount retailer
Business drivers
Duty of care
Complying with duty of are is the main driver for establishing a TRM program, as it will help mitigate the risk of lawsuits and other damages.
Past incidents
A post-incident review is often the catalyst for implementing or improving TRM at a company. Where a program is already in place, a review can help identify what’s working and what isn’t and herald the necessary adjustments. Companies experiencing frequent incidents – by the very nature of their travel patterns – can have some of the most developed TRM solutions.
Employer ethics
Organizational culture and ethics can sometimes override compliance as the main motivator for TRM. Protecting staff may be a core value which drives companies to invest the necessary resources. As this may require the TRM program to be aligned with multiple organizational policies, sufficient resourcing will help ensure this
implemented effectively.
Travel risk management solutions and comprehensive TRM programs
It’s possible to classify common TRM solutions into two groups: inadequate and adequate.
Duty of care is not a transferrable
responsibility
While insurance companies and third-party assistance providers can be critical in providing duty of care solutions, an organization’s duty of care is not a transferrable responsibility.
Employers should always maintain an active role in overseeing supplier relationships and service fulfillment to ensure their employees’ health, safety and security needs are being met.
Inadequate solutions
These provide some level of travel risk management but are unlikely to be sufficient for full duty of care, thereby exposing companies legal and financial penalties. The most common approach is to have insurance only, but it’s not enough on its own. Travel insurance is often insufficient for non-medical incidents, such as natural disasters, kidnapping and civil unrest. And some medical incidents may also be excluded. Relying on travel insurance alone, organizations increase the risk of reputational and financial damage, as many frequentlyoccurring types of incident will not be covered.
As a first step, it would be an improvement to implement a basic managed solution, which does not include assistance. In this instance, companies would appoint a travel manager(s) to look after travel tracking and travel insurance. The manager could also arrange all travel or assign a dedicated travel management company (TMC).
While the travel manager becomes the contact point in event of an incident, they won’t be available 24/7. And they lack the resources to support employees on the ground. Incident responses tend to be poor and slow and may full short of a company’s duty of care requirements.
Adequate solutions
These offer good protection for traveling employees, aligning well with a company’s brand and values. While large organizations have the resources to build their own TRM solution, many companies choose to simply buy a complete one from an external assistance provider. And even those companies creating their own solutions, may decide to outsource certain components.
When selecting an external provider, it’s important for them to be able to offer 24/7 medical and security emergency assistance and be able to cover all costs, following up with insurance claims at a later date.
Such a solution that reacts with assistance is considered to be adequate from a duty of care perspective. But more comprehensive solutions with prevent or reduce employee exposure to risks and act proactively when risks change.
Comprehensive travel risk management programs
Comprehensive managed solutions consider all risks and create risk mitigations for all stages in a business trip, from planning to a traveler’s return home.
Pre-trip processes
The best solution is to not expose travelers to risk in the first place and prevent incidents happening through good planning and preparation. The following methods can be effective:
- Automated integration of travel bookings with country risk levels to trigger the need for travel approval.
- Pre-trip approval to ensure travel plans adhere to TRM policy. For certain high-risk destinations, travel could be blocked with authorization.
- As a policy requirement for work travel, employees must register with the TRM program before departure.
- Pre-trip medical approval to ensure a traveler is fit to travel, thereby reducing the risks of health-related incidents.
- Safety and security training.
- Alerts both pre- and on-trip.
- Prebooked travel services to reduce the risk of incidents. Booking secure ground transportation from known safe suppliers is one of the most commonly used services.
Proactive assistance
Comprehensive solutions may often include a proactive process in responding to an incident. This would include reaching out to all employees in the vicinity of a major incident, to confirm they’re ok or need assistance.
Location information can help identify which employees to contact. Communication should extend to employees planning travel to the affected area too. Travel booking data will be a useful source of whom to contact.
Pre-trip processes should cover all employees
Ensure that pre-trip preparations are inclusive of the needs of all travelers in your workforce.
Companies must look after the safety and well-being of all travelers, but certain diversity dimensions such as travelers’ race and ethnicity, gender, gender identity and expression, age, sexual orientation, neurodiversity and accessibility for travelers with disabilities, to highlight some, may require additional focus to ensure inclusive travel experiences.
Travel risk management program roles
Multiple stakeholders need to be involved in implementing travel risk management programs. Once these are in place, annual table-top exercises should be held to fully test incident management processes from end to end. Such exercises should also include insurance companies and any third party assistance providers to simulate emergency processes and responses as realistically as possible.
Travel
In companies where such a role exists, the travel manager should be involved in the TRM program, as it forms a critical part of managing employee trips.
Security
A company’s security manager may often be assigned responsibility for its TRM program.
But travel risk can often be a small part of the role. And security’s status as a cost rather than a source of revenue may make it difficult to secure investment.
Companies need to see TRM as securing revenue and profit and not merely as a cost.
Human Resources
As TRM programs support a company’s duty of care, it’s crucial to involve HR in their creation and when a major incident occurs.
Travel Management
By mandating their use in the travel policy, a travel management company (TMC) or corporate travel department (CTD) can assist with pre-trip authorization and tracking of travelers via bookings data.
And by requiring employees to book through the TMC or CTD, companies are reducing the risks associated with unmanaged bookings.
Medical Assistance Provider
As health-related issues are the second most common faced by business travelers, including a medical assistance provider in a TRM program is crucial. Medical insurance coverage for traveling employees will most likely include a company to contact for medical assistance. But this may restrict assistance only to those incidents specifically covered by the policy.
Working independently with the medical assistance provider can ensure the TRM Program supports both medical and non-medical incidents. One number (only) to get assistance in an emergency will reduce traveler stress in the event of an incident. And if other specialist providers are required, then the medial assistance provider can get them involved, as and when necessary.
Security Assistance Provider
Some incidents will be specifically security-related, so including a security assistance provider in the TRM program is another necessity. Such providers can book secure ground transportation to reduce risk when travelling between the airport and hotel, for example. And in the event of an incident, they can provide security personnel or assist in evacuations.
Insurance companies
Knowing that an insurance company is on hand to handle claims and cover costs provides extra reassurance when delivering support to traveling employees. Action should not be delayed by concerns about payment. To get the right insurance, it’s important to describe the level of protection required, the number of employees requiring coverage, and what their travel and work patterns are. The insurance company will also need to know how it’s expected to work with the travel risk management program.
For companies with travel to countries with a high risk of kidnapping, it’s important to remember that this requires a special type of insurance, which might not be included in a standard travel insurance package. Separate kidnap and ransom insurance should be investigated.
Threat Intelligence Provider
Threat intelligence is a crucial part of the risk assessment, which can determine to which countries employees may travel and what security preparations they should make. Real-time 24/7 alert services can enable assistance to be provided proactively if a threat develops.
Internal Management
The most important role in a TRM Program is ultimately held by a company’s own management. ISO 31030 has leadership and commitment at its core, connected to all other parts of the TRM framework. Commitment needs to be secured and this can be done simply by pointing out the financial, reputational and possibly criminal damages that might arise if management fails in its duty of care towards employees.
Travel risk management tasks and processes
Leadership commitment and communication
Senior management support is crucial, more so if they mandate the use of the TRM program by all travelers. Failure to participate should result in denial of travel. But the TRM program needs to be effective, and this requires senior management support in the shape of sufficient resourcing. Absent this, and the program risks functioning poorly and failing to fulfil the company’s duty of care.
Rollout process
Getting the rollout right is key to traveler adoption of a TRM program. Employees need to know the program has been introduced, what it means for them and how they can use it. What number to use in an emergency? How to use the insurance policy? The TMC through which bookings should be made? Any mobile apps that need to be used? These are some of the questions travelers will need answers to.
Pre-trip processes
In a comprehensive TRM solution, pre-trip processes are the best way to ensure a high-quality program. Getting it right on pre-trip authorization, mandating booking through designated TMCs, education and high-risk booking processes is the place to start.
Assistance
Where an external emergency assistance provider is used, it’s important to establish efficient interaction with their systems, and with those of any subcontractors that might be used.
Common mistakes
Does your company have specialized insurance coverage?
Additional policies may be required for kidnap and ransom and the risks to the company, should the safety of key personnel be compromised.
Travel insurance is enough
By relying solely on travel insurance that includes work-related travel, a company will fail in its duty of care to employees, exposing it to legal and financial risks. This is because insurances normally include restrictions, and that means employees will not be covered in certain circumstances. Pre-existing medical conditions, evacuations due to security and health threats, cyber security attacks, natural disasters may often be excluded from travel insurance, but they’re the sort of risks that many business travelers face.
Should an event or situation be excluded from the policy, the employee may not be assisted or could face paying for assistance themselves.
Misunderstanding mobile phone tracking
It’s a common misunderstanding that mobile phone location tracking conflicts with an individual’s privacy. When used for TRM purposes, it’s possible to limit an employer’s access to location data to prevent its misuse.
To allay fears about real-time tracking by employers, availability of mobile location data could be restricted to a third party emergency assistance provider. And if this isn’t the case, employees could turn off tracking for a specific location or restrict its use to certain areas.
Common problems
Traveler resistance
Company culture and individual behaviors and preferences are the most common obstacles to a TRM program. Experienced travelers who may in the past have faced high-risk situations without the support of TRM may doubt its value and may be reluctant to comply with any policy requirements.
Even when TRM is mandated in travel programs, they won’t cover bookings made outside of travel policy. Some travelers may simply be unaware of the mandate. Others might believe they can find better deals or may be dissatisfied with the service they’re receiving from their travel manager or TMC. Perhaps the policy prevents them using their preferred airline or hotel chain? Whatever the reason, such bookings could be supported by the TRM program, if employees share a copy of the booking confirmation email with the TRM system.
Technical issues
Even with all employees onboard, technical problems can derail TRM:
- Bad travel booking data – use of free text fields means it’s easy to enter incorrect traveler details
- Location tracking not working – as such systems often operate in the background, they can sometimes be disabled by operating systems looking to preserve mobile phone battery life
- Incorrect employee data
Legal issues
While data protection and privacy laws shouldn’t preventthe operation of successful TRM programs, they still need to be legally compliant. There are often restrictions over the cross-border transfer of personal data. Ownership and control of personal data must also be established, to ensure legal compliance and legal responsibility in the event of a data breach. And there need to be the proper protections in place to secure against cyberattacks and threats.
Employee engagement can reduce traveler resistance
Actively engage with employees to emphasize the importance of the TRM program.
Craft any messaging to highlight how allowing access to location data, personal mobile phone numbers and emergency contacts can help companies protect their employees in the event of an incident.
How BCD Travel can help you
Travel risk management tools and solutions
Communication is key to successful TRM.Communication needs to be enabled both to and from the traveler and there are a number of solutions worth considering.
Destination intelligence
As part of the pre-trip authorization process, companies can provide destination intelligence to employees. This can help them make informed decisions before a trip and can help identify and mitigate risks.
Travel tracker
A system integrated with the travel management company (TMC) automatically receives copies of all flight, hotel, rail and ground transportation bookings. In the event of an incident, travel managers can more easily search active and future bookings within specific geographic areas. Travel trackers can also be used to manage risk for future trips as the situation evolves. But travel trackers can only show the booked and not actual location of traveling employees. For this reason, they should be augmented with other solutions, such as mobile phone locators.
Mobile phone locator
Such devices provide a real-time location of an individual mobile phone, meaning travelers can be located, even if they deviate from their original itinerary. To protect their privacy, location tracking could be restricted to predetermined geographic areas or provide less exact locations. And possibly misuse by an employer could be avoided by only allowing dedicated assistance providers to access location data.
Mass communication
Many travelers could be impacted by the same incident. Mass communication offers an effective way to inform all employees in an affected area, and not just travelers. Such tools are already used for business continuity and crisis management purposes, but they should be enhanced with TRM functionality.
Integrated TRM platforms
The solutions detailed so far may be used in isolation, but they are increasingly being integrated within the same TRM platform. Some include APIs (application program interfaces) to allow them to link with other systems, including HR platforms containing employee personal data.
The future of travel risk management
The post-pandemic acceleration in the shift towards an increasingly mobile workforce has blurred the definition between work-related travel and remote working. When it comes to the duty of care towards employees, TRM must apply beyond those traveling purely in the traditional sense. Travel risk management will need to transition into people risk management, addressing the risks faced by employees wherever they are.
As it broadens its focus to people across companies, TRM must also leverage technology to automate and integrate better with other company systems and processes.
In whatever shape or form it takes, one thing is clear: TRM will need to grow to satisfy the needs to travelers in an increasingly global, but far from safe world.
Fulfilling the duty of care
While the ISO 30130 standard can provide a comprehensive take on what travel managers should do to ensure duty of care compliance, it may be hard to decide what actions to prioritize. Safeture has created its own simple checklist as a useful starting point:
- Create a travel policy
- Mandate a travel management company for all employee travel
- Secure management commitment, budget and resources to implement a TRM program
- Ensure comprehensive travel insurance is in place
- Contract with an emergency assistance supplier able to manage both medical and security incidents
- Implement a system for locating travelers
TRM’s expanding scope
Travel risk management is evolving. Agile organizations, which want to attract and keep the best employee talent, are expanding TRM’s scope beyond travel to include employees working from home, hybrid workers and even digital nomads.
In the end, it’s not just about duty of care for travelers, but duty of care for all employees. And this is why travel risk management is evolving into people risk management.