White paper

Measuring up against ISO 31030 – The travel risk management standard Study shows organizations may be putting travelers at risk

White paperMeasuring up against ISO 31030 – The travel risk management standard

2© 2023 Everbridge | everbridge.com

How are organizations measuring up? The introduction of ISO 31030 has removed much of the guesswork and provided clarity in an area that’s never been more critical. But how well are organizations measuring up?

To gain a better understanding, Everbridge conducted a survey of over 200 global C-suite executives involved with the management of travel risk. The survey posed detailed questions to find out whether respondents felt that their organizations were meeting the standard’s key requirements.

The survey, which is still open and can be accessed at the end of this report, comprises 50 multiple choice questions across seven key areas of the standard:

1. Understanding the organizational risk profile

2. Travel risk policies

3. Travel risk assessment and treatment

4. Incident response

5. Specialist support

6. Communication and consultation

7. Program monitoring and review

This report summarizes the findings from the survey to date. Breaking the findings down across the seven key focus areas, the report presents the top-level results, and explains why each of the areas is important.

Setting the standard for travel risk management

ISO 31030 (Travel Risk Management) provides guidance on how to manage the risks to organizations and their travelers. The globally recognized standard sets out a structured approach to the development, implementation, evaluation and review of travel risk management policies and programs, and the assessment and treatment of travel risks.

White paperMeasuring up against ISO 31030 – The travel risk management standard

3© 2023 Everbridge | everbridge.com

The snapshot view On completion of the survey, respondents received a total top-level score which fell into one of three ranges – low, medium, and high.

A LOW rating means that the organization’s travel risk management program is currently falling short in several key areas defined by ISO 31030, and could be putting both their travelers and organization at risk. A low score also indicates that they may be failing to meet both their legal and moral duty of care obligations relating to their traveling population.

A MEDIUM rating indicates that the organization’s travel risk management program is meeting some of the guidance criteria defined by ISO 31030 but is still lacking in several key areas, and could therefore be putting both their travelers and organization at risk. A medium score also indicates that they may be failing to meet some of their duty of care obligations relating to their traveling population.

A HIGH rating indicates that the organization currently has a solid travel risk management program in place and is meeting many of the guidance criteria defined by ISO 31030.

Those receiving a low or medium rating need to act immediately. It’s vital that they review specific areas highlighted by their survey results to identify where improvements need to be made.

Even those receiving a high rating shouldn’t be complacent. To maintain their duty of care requirements and continue to protect their travelers and organization, it’s important that they continually review the policies and programs they have in place to ensure that they remain fit for purpose. Risk landscapes and operating environments can change frequently. Regularly evaluating the effectiveness of their programs to identify strengths and weaknesses will also help to guide further development and improvement.

With less than a quarter of those surveyed receiving a high rating, there’s still clearly much to be done in order to protect traveling employees and their broader organizations. The results reinforce the importance of organizations having the right policies and programs in place to meet the requirements laid out by the standard.

Read on to find out how respondents, and their organizations, scored in each of the key focus areas laid out by ISO 31030.

Overall score

Low Medium High

24%

51%

25%

Only 24% of respondents had a solid travel risk management program in place as defined by ISO 31030

White paperMeasuring up against ISO 31030 – The travel risk management standard

4© 2023 Everbridge | everbridge.com

01 Understanding the Organization’s Risk Profile

When it comes to understanding the risk landscape within which they operate, only 27% of respondents stated that they had a clear understanding of their organization’s risk profile, based on both internal and external factors.

Risk Profile

27%

27%

Only 27% of respondents had a clear understanding of their organization’s risk profile

Why this matters

It’s important that organizations have a clear understanding of the factors that can affect or influence their travel risk management program objectives, including the external and internal context within which they operate.

Externally, the industry within which organizations conduct business is a key factor that can impact the risks faced by travelers. Organizations should be aware of the relevant legislation, regulatory requirements and codes of practice that are relevant in their home country, and other countries in which they operate.

Other external factors can include:

• Political, socio-economic, religious, and cultural issues

• The state of industrial relations

• The effectiveness of public and private security, and emergency services

• Natural or geological factors

Internally, attention needs to be given to travelers’ profiles in relation to destinations. Factors such as race, nationality, gender, sexual orientation, occupation, disability, or medical history can all affect the risks associated with travel. The risks can extend beyond safety and security and can also include medical and other needs.

Other internal factors can include:

• The organization’s vision, mission, and values.

• The range and type of travel activities undertaken.

• Capabilities, including traveler competencies and profiles.

• The resources, techniques and tools needed to manage organizational travel risk.

The nature and scale of an organization’s travel risk will also inform how risk is managed and delivered, as the risk profile of an organization with occasional travel to low-risk locations is very different to one operating frequently in high-risk locations.

The risk profile will also inform the extent to which an organization can manage the risks using their own resources or whether they will need to rely on support from third-party providers to deliver necessary functions.

White paperMeasuring up against ISO 31030 – The travel risk management standard

5© 2023 Everbridge | everbridge.com

02 Travel risk policies

Of the executives surveyed, only 36% felt that their organization’s travel risk management policy aligned with their other business policies, including business continuity, travel procurement, sustainability, and organizational resilience.

Travel risk policies

Only 36% of respondents felt that their TRM policies aligned with other organizational policies

Why this matters

Although ultimate accountability for risk resides with top management, everyone in the organization has a role to play in ensuring that appropriate duty of care has been met. Travelers themselves have a responsibility to cooperate and act in compliance with the organization’s travel risk management policy and procedures.

For travel risk management programs to be effective, they need to involve stakeholders across the organization. Although their individual priorities will be different, they all play a part in the travel risk management remit. Ensuring that an official travel risk management policy is in place, and that relevant stakeholders are identified and brought into the loop as early as possible is therefore crucial.

27%

36%

A travel risk management policy should be a high- level document that indicates an organization’s travel risk management strategy. As a fundamental component of the broader resilience framework, travel risk is extremely important as it’s one of the areas where an organization may be most exposed. With travelers finding themselves out of their comfort zones and away from their more familiar surroundings, the risk potential for both the traveler and the organization is greatly exacerbated.

Travel risk management policies should set out the responsibilities of the various internal and external stakeholders that have a role in delivery of both routine operations and non-routine situations, such as during an incident.

The responsibilities of travelers to cooperate and act in compliance with the organization’s travel risk management policy and procedures should also be set out. This is sometimes referred to as “duty of loyalty”. The responsibilities outlined in the policy can be developed in more detail in the travel risk management program.

The principal objective of a travel risk management policy should be to ensure that travelers can perform their duties optimally, in an environment that’s as safe and secure as is reasonably possible, and to have procedures in place to respond to an emergency. The travel risk management policy should establish the program and set the boundaries in which this objective is to be delivered.

White paperMeasuring up against ISO 31030 – The travel risk management standard

6© 2023 Everbridge | everbridge.com

03 Travel Risk Assessment and Treatment

When asked about pre-trip risk assessments, and the controls required to address risks prior to travel, during travel and after incidents, plus whether such measures were tailored to specific destinations and individuals, only 21% of respondents felt that their organization had adequate measures in place.

Risk assessment and treatment

Only 21% of respondents felt that adequate measures were in place

Why this matters

All travel should be considered as part of a risk assessment process. Based on the risk assessment, organizations should ensure that controls address risks posed prior to travel, during travel, during and after incidents, and once travel is completed. Such measures should be tailored to the destinations and the individuals traveling.

Risk assessment is the overall process that includes risk identification, risk analysis and risk evaluation. This is based on an understanding of an organization’s risk context and the travel arrangements under consideration. The complexity

21%

of the risk assessment needs to be determined by several factors including the overall context, the established principles set out in an organization’s travel risk management policy, and the characteristics of the planned travel.

Based on the results of the risk assessment, one or more treatment options may be required to modify risk to an acceptable level. The same treatment option can also affect multiple travel-related risks. Treatment options should therefore be selected in consideration of the range of risks affecting the specific proposed travel, rather than considering each risk in isolation.

Although top management is accountable for ensuring that arrangements are in place for managing risk associated with travel, multiple individuals, including management, contracted providers, and travelers themselves, are responsible for managing these risks.

The selection of treatment options involves judgements balancing the overall advantages (tangible and intangible) and disadvantages (disproportionate costs and other adverse effects) that can occur, and how these can affect the objectives for the proposed travel and overall organizational objectives. Treatments need to be monitored and reviewed continually to ensure that changes in context or the nature of risk is reflected in considering further risk treatments, and that risk treatment strategies continue to meet the agreed objectives for those treatments.

White paperMeasuring up against ISO 31030 – The travel risk management standard

7© 2023 Everbridge | everbridge.com

04 Incident response

In terms of responding efficiently and effectively to the potential threats caused by conflict or protests, terror attacks, severe weather events or natural disasters, 45% of respondents felt that their organization was well-placed.

Incident Response

45% felt that their organization could respond well to incidents

Why this matters

Business travelers face a growing array of risks – from minor disruptions like travel delays, to major threats such as those mentioned above. Organizations need to be prepared to respond efficiently and effectively to all potential eventualities, however unlikely they may seem.

Incident management measures should be based on risk assessments and should be appropriate, proportionate, and dependent on location. Organizations need to be able to address global as well as local incident response planning and implement appropriate measures.

45%

These measures should address:

• Preparedness

• Treatment

• Response

• Recovery

• Adaptability

• Incident reviews

It’s imperative that organizations assess their capacity to respond to a critical incident, and their ability to activate appropriate incident response and evacuation/repatriation plans.

For clarity, organizations should have a written incident response plan that describes the authorities and responsibilities of key personnel including the incident management team.

Communication protocols are also critical in responding to any incident, so it’s vital that all key stakeholders, internal and external, are well- trained and experienced in their responsibilities. They should have the knowledge and ability to use the designated platforms to trigger an incident management response. This should include appropriate procedures to be used when under duress (e.g. the use of a recognizable code or expression to indicate an individual is in trouble).

In planning, organizations should also consider the methods that are available for mass communication, such as specialist tools or service providers, intranet and social media platforms to quickly disseminate information. It’s also important to note that organizations will need to take into consideration that the use of some specific technological equipment in certain countries is subject to legal restrictions, and that plans may therefore need adjusting accordingly.

White paperMeasuring up against ISO 31030 – The travel risk management standard

8© 2023 Everbridge | everbridge.com

05 Specialist support

Of those surveyed, 68% stated that their organization uses a third-party provider to support with specialist services such as risk assessments, crisis response, high-risk destination support, and potential relocation or evacuation of personnel.

However, of the 68%, only 44% felt that there was a clear escalation protocol for engaging these services as required.

Specialist Support

44% of those relying on specialist support felt that clear

escalation protocols were in place

Why this matters

Following the framework laid out by ISO 31030 will help to an extent, but the nuances of travel risk management can often prove complex. All organizations, with or without a dedicated travel risk management team in-house, can benefit from the additional support and expert guidance provided by specialist third-party providers.

Planning for, and responding to, incidents almost always demands a coordinated effort on the part of several departments, dealing with a combination of medical, security and travel-related issues. Regardless of the size of an organization, bringing

44%

in additional support from expert providers can prove highly beneficial.

Third-party service providers can be used to assist, where required, with medical and security advice and support prior to, during and post- travel. Such support can include the assessment, provision and dissemination of information, advice and updates and, where appropriate, this should include practical and logistical support.

Such providers should be carefully selected to ensure both their competence and experience. When partnering with any provider, it’s important that organizations carry out due diligence. Most providers will welcome and positively encourage it. Finding out mid-crisis that the expected necessary support may not be available, could be disastrous.

In practical terms, this means organizations taking a close look at those they partner with and rely on, whether this be their risk management, security or medical assistance provider, their insurance provider or their travel management company. Is there clarity on roles and responsibilities? Is this based on assumptions, or has comprehensive scenario testing been carried out? It’s common to hear stories from organizations who have been let down by providers when they’ve most needed them – purely because there’s been no clarity on what the providers will and won’t do, or what is and isn’t covered.

Keep in mind that organizations are ultimately accountable for decisions made and actions taken by third-party providers acting on their behalf, so it’s imperative that organizations select a partner with the appropriate capabilities.

White paperMeasuring up against ISO 31030 – The travel risk management standard

9© 2023 Everbridge | everbridge.com

06 Communication and consultation

Only 19% of those surveyed felt that travel risk management policies and procedures were effectively communicated throughout their organization, that travelers and managers understood them, and all parties involved were aware of the potential travel risks and the mitigation measures in place.

Communication and consultation

Only 19% felt that policies and procedures were effectively communicated and understood

Why this matters

The agreed travel risk management policies and procedures should be effectively communicated throughout the organization so that potential travelers and their managers understand them, and travelers are aware of travel risks and how the organization controls and manages them.

For travel risk management programs to work, organizations need to have a solid program in place, and ensure that all stakeholders are aware, involved and truly engaged with the program.

Communication is key. At a strategic level, organizations need to ensure that the development of travel risk management policies and procedures engages all relevant internal and external personnel.

Some important issues to consider include the following:

1) The travel risk management policy and program should be communicated to, and acknowledged by, all travelers.

2) Travelers and other stakeholders should be engaged in the risk assessment process and in the identification and selection of risk treatments.

3) All stakeholders need to be aware of:

• The actual or potential impact of travel risks on work productivity, safety, security and health.

• The risks the traveler can be exposed to during travel, and how to identify those risks.

• How they can contribute to the effective management of travel safety, health and security.

4) Travelers also need to understand:

• The benefits of following the travel risk management policy and procedures.

• The implications of not doing so, with respect to managing risks and failing to meet legal and other requirements.

• Their requirement to be engaged in their organization’s duty of care by following policies and procedures in place to protect them and the organization from foreseeable harm (their “duty of loyalty”).

19%

White paperMeasuring up against ISO 31030 – The travel risk management standard

10© 2023 Everbridge | everbridge.com

07 Program monitoring and review

A large majority - 81% - of respondents believed that their organization could do better when it came to evaluating and reviewing their travel risk management program and providing the necessary audit trails to ensure compliance with ISO 31030.

Monitoring and review

81% believed their organization needed to improve the way their TRM program was evaluated and reviewed

Why this matters

However robust a travel risk management program, situations can change. Organizations should regularly evaluate the effectiveness of programs to identify strengths and weaknesses to guide further development and improvement. In addition to a scheduled annual review, additional circumstances may trigger more frequent reviews to allow for the new situations.

The evaluation, monitoring, and review processes determine how effectively teams are implementing and complying with travel safety, health and security policies and arrangements. This should take place at all stages of the travel risk

management process by people with the necessary expertise. If service providers are engaged, organizations should consider how they can help with the program monitoring and review process.

The extent, frequency, and trigger (periodic, event-based or other change in circumstances) for monitoring and review will depend on differing requirements and context. At a minimum, a full review should be conducted annually, with a focus on improvement and incorporating lessons learned.

As reviews are completed and an organization’s travel risk management program is updated, it’s crucial to ensure that all stakeholders are informed. This will include service providers, sub-providers, internal staff and, of course, travelers.

In addition to these reviews, surveys should also be designed and used to identify gaps, improve program effectiveness, and highlight changes in conduct, compliance and security culture within the organization. The surveys should cover important aspects of the travel risk management program such as the initial briefing, training, support while traveling, and the post-travel debriefing.

The travel risk management function should identify, collate, and track program key performance indicators to provide stakeholders with actionable metrics to evaluate and increase program effectiveness.

All relevant data should be appropriately recorded and reported as part of an organization’s duty of care and compliance. From a good practice and business continuity perspective, travel risk management typically results in many processes and data or metrics, which should all be stored appropriately.

81%

White paperMeasuring up against ISO 31030 – The travel risk management standard

11© 2023 Everbridge | everbridge.com

Conclusion Business travelers, whether international or domestic, can be faced with unfamiliar situations and environments that can threaten their safety, security, and well-being, and negatively affect the outcome of their travel objectives.

Organizations have a legal and a moral duty to protect their people, wherever they may be. The ISO 31030 guidelines provide a means for organizations to demonstrate that decisions are based on the organization’s capacity to appropriately mitigate risks. Addressing any potential travel risk

management shortfalls will enable organizations to build and maintain a truly effective program, enabling them to meet their duty of care requirements and fully support their travelers and their broader organizational resilience remit.

As the survey results show, with only 24% of respondents receiving a HIGH overall score for their travel risk management program as defined by ISO 31030, there is still immense room for improvement among over three quarters of survey respondents. Even then, those in the top category should ensure continuous reviews of their programs and policies as risks consistently evolve.

How does your travel risk management program measure up against ISO 31030?

Everbridge’s ISO 31030 survey allows you to benchmark your own travel risk management program against the internationally recognized standard.

On completion of the survey, you’ll receive a set of personalized results. Your results will provide an overall program score plus a breakdown of your score against each of the seven key areas detailed in this report.

These scores can be used as a high-level indicator as to how well your organization is performing against ISO 31030, and to highlight where there may be vital shortfalls in your policies and programs.

Take the survey now.

https://iso31030everbridge.scoreapp.com/?utm_medium=report&utm_source=everbridge&utm_campaign=report-iso-31030-2023-q1-travel-risk-management&utm_content=iso-31030-survey

Get in touch to learn about Everbridge, empowering resilience.

PR-WP-EN-Measuring-Up-Against-ISO31030-Travel-Risk-Management_11.16.23

About Everbridge Everbridge, Inc. (NASDAQ: EVBG) empowers enterprises and government organizations to anticipate, mitigate, respond to, and recover stronger from critical events. In today’s unpredictable world, resilient organizations minimize impact to people and operations, absorb stress, and return to productivity faster when deploying critical event management (CEM) technology. Everbridge digitizes organizational resilience by combining intelligent automation with the industry’s most comprehensive risk data to Keep People Safe and Organizations Running™.

For more information, visit Everbridge.com, read the company blog, and follow us on LinkedIn and Twitter.

About Everbridge

https://www.everbridge.com/ https://www.everbridge.com/ https://www.everbridge.com/blog/ https://www.linkedin.com/company/everbridge/ https://twitter.com/Everbridge