← Back to home

Travel risk management and duty of care

We build the travel risk program an organization is legally and practically expected to have. It settles which trips need approval, what a traveler is told before departure, who answers the phone at 03:00 local time, and what actually happens when the answer is an evacuation.

What the work covers

A travel risk program decides things. Ours starts from the trips you actually make, so that is where we start too. We rate the destinations you use against the profile of the person traveling, because a female field engineer flying alone to Port Harcourt and a two-day board visit to Dubai are not the same risk on the same country rating. From there we set the approval thresholds, write the pre-travel briefings, define what tracking and check-in you need (and, more often, what you do not), and build the escalation chain that turns a call into a decision.

Where programs fail

At the end of the chain. A policy that says "contact the emergency line" without a named provider, a funded evacuation route and a hospital that will actually accept the patient is a policy that fails on its first real incident. We plan backwards from that moment.

Who delivers on the ground

We plan and manage. The driver, the clinic, the security escort and the aircraft are local, and they are chosen for being local. A team on the ground reads its own terrain better than anyone flown in for the week. Our job is to hold one standard in every country the program touches. We select and vet the providers, brief them to one written standard, audit what they deliver, and stay your single point of accountability.

That is more than good practice. Once people employed by different companies work in the same place, section 8 of the German Occupational Safety Act requires exactly this coordination, and it requires you to satisfy yourself that the other company's people have received appropriate instruction. We carry out that verification for you and document it.

Standards we work to

ISO 31030:2021Travel risk management, guidance for organizations. It is guidance, not a certifiable standard, so nobody can be "ISO 31030 certified". We use it as the structure a program is measured against.
ISO 31000:2018The underlying risk management framework: context, assessment, treatment, monitoring.
Duty of care as an international measureSince June 2022 a safe and healthy working environment counts among the International Labour Organization's fundamental principles and rights at work, and Conventions 155 and 187 have been designated fundamental Conventions. The principle therefore applies across all member states, whether or not a given country has ratified them. That is the measure a program has to hold up to internationally, rather than the law of any one home country.
ISO 45001:2018The certifiable management system standard for occupational health and safety. Its scope turns on control rather than employment, so it reaches contractors and external personnel wherever you direct their work. It does not, however, name traveling or posted workers as a category. ISO 31030 exists to close exactly that gap, which is why the two belong together.
National implementationsWe name them where they bite. In Germany the duty of care under section 618 BGB and the Occupational Safety Act, in the United States the General Duty Clause of the OSH Act for groups with a US entity. They do not replace the international measure, they give it a local shape.
Statutory risk assessmentWhether national occupational safety law reaches beyond its own border is contested and answered differently from country to country. In practice it makes little difference, because the civil-law duty of care travels with the employee and the accident insurers expect an assessment before and during a posting. An employer who has never produced one for travel has a gap that becomes a matter of record after an incident.
VerificationThis register names the standards the work follows. The personal qualifications behind them go to clients in full over an encrypted channel, verifiable with the issuing bodies.

Questions we get asked

Who answers the phone at night?

That depends on the mandate, and you learn what you are getting before it starts. For a single project it can be a named on-call rota with us. For a running program we work with partner operations centers, meaning global security operations centers staffed around the clock, which we use in every region and which hold our procedure and your escalation chain.

What we do not do is put a number in a policy and leave open who sits behind it. Who picks up, what that person may decide alone, and at what point we come in, is written into the program.

We already buy travel insurance and an assistance service. Is that a travel risk program?

No. Insurance pays after the event and an assistance line reacts to a call. Neither one decides whether the trip should happen, briefs the traveler, or tells your duty manager what to do in the twenty minutes before the assistance provider picks up. Those are the parts that reduce the incident count, and they are the parts we build.

It also falls short legally. The duty of care asks for assessment, instruction and precaution, meaning the work done before departure. An assistance number in a card holder evidences none of the three. Insurance and assistance belong in a program, but as its last line, not as a substitute for it.

How long does it take to stand one up?

A single number would be dishonest here, because the spread is real. One trip or a short project can be covered at short notice, in days if it has to be. A travel policy that holds up across a whole organization takes weeks, because approval thresholds, briefings and the escalation chain have to be agreed with HR, the works council and data protection. Add a crisis team that has to be built, staffed and exercised, and it becomes months.

After the first conversation we tell you which of those three sizes you are looking at, including when the honest answer is larger than the one you wanted.

Does this cover freelancers and subcontractors?

Yes, though it comes from a different provision. The employment-law duty of care under section 618 BGB covers your own staff. But as soon as people employed by different companies work in the same place, section 8 of the ArbSchG applies. The employers must inform each other about the hazards, coordinate their protective measures, and you must satisfy yourself that the other company's people have received appropriate instruction. Section 6 of the DGUV Vorschrift 1 says nearly the same in nearly the same words. On top of that sits liability for negligent selection. An employer who engages a provider it has not vetted answers for that choice.

In practice this means defining the scope of your travel policy beyond your payroll rather than improvising it after an incident. It also means the briefing given to the subcontractor's driver is part of your duty, not only his. We document both the briefing and the verification, so that you can evidence the duty was met rather than assert it.

Do you track our travelers?

Only where it earns its cost and survives the works council and data protection conversation. Continuous tracking of every business traveler is usually neither. We more often specify check-in rules by risk tier, which people comply with and which produce a usable signal when someone misses one.

Other capabilities

Medical support and rescue

Medical concepts, staffing plans and the full MEDEVAC chain.

Learn more

Protective services and close protection

Protective concepts, advance work and command, low profile by design.

Learn more

Risk and threat assessment

Country and site analysis, surveys and audits that end in decisions.

Learn more

Crisis and emergency management

Crisis structures with named roles, exercised before handover.

Learn more

Training and briefings

HEAT, medical and crisis training, built on the real deployment.

Learn more

Talk it through first

Every engagement starts with a confidential conversation, and it is free. Describe the operation and the concern. We will tell you honestly whether this is the right capability, another one, or nothing at all.

enquiries@foxpedition.com