Duty of care for business travel, in practice

Not legal advice. This guide is general information for travel managers. It doesn't tell you what the law requires of your organization, which depends on where you and your employees are based and where they go. For that, ask your employment, safety or insurance advisors.

What duty of care means for travel

Duty of care is an employer's responsibility to take reasonable steps to protect employees' health and safety. A business trip doesn't pause it; if anything, travel adds risks the office doesn't have: unfamiliar places, weather and transport disruption, illness far from the usual doctor, and events nobody planned for. The glossary entry has the short definition.

For a travel manager the practical question has two halves. What do we owe traveling employees? Broadly: thinking about the risks before they go, knowing where they are, being able to reach them, and acting when something happens. How do we show we did it? With records made at the time: a policy, an assessment, an approval, an itinerary, an incident log. If something goes wrong, the question afterward is rarely whether you had good intentions. It is whether you can show what you knew, what you decided and what you did.

The six steps below follow that order. None of them needs a large security team. At a company of 100 to 1,000 people, most of the work is deciding who owns each step and writing it down. To set the program up, the travel risk management guide covers owners, a policy keyed to government advisories and the first hours of an incident.

Where the obligation comes from

United States

The federal Occupational Safety and Health Act sets out employers' general duties. Section 5(a)(1), usually called the general duty clause, requires each employer to provide employment and a place of employment free from recognized hazards that are causing or likely to cause death or serious physical harm. Section 5(a)(2) requires employers to comply with OSHA's standards.^[1] How that applies to a particular trip, especially one outside the United States, is a question for your counsel, and state laws, workers' compensation, contracts and insurance terms can add their own requirements.

United Kingdom

If you employ people in the UK, the Health and Safety Executive's guidance on risk assessment is a clear model. It sets out five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. Employers with 5 or more people must record their significant findings.^[4] The same five steps work well for travel, wherever your employees are based. UK health and safety law mostly applies to work in Great Britain; for work abroad, local law also applies, so ask your advisors.

International guidance

ISO 31030:2021 is the international standard on travel risk management.^[2] It is guidance, not law. Its published scope describes how an organization can manage the risks that travel creates for the organization and for the people traveling on its behalf, with a structured approach to policy, program development, identifying threats and hazards, opportunities and strengths, risk assessment, and prevention and mitigation. It applies to organizations of any sector or size, and leaves out tourism and leisure travel unless the person is traveling for the organization.^[3] If you are writing your approach from scratch, the standard's structure is a useful checklist.

1. Assess the risk before travel

A risk assessment for travel doesn't need to be long. It needs to exist before the trip, and to lead to a decision. Using the HSE's five steps:^[4]

1. Identify hazards. For the destination: health, security, natural hazards and the season, local transport, and any legal or cultural issues for the traveler. For the trip: driving long distances, traveling alone, arriving late at night, or a role that draws attention. For the person: medical needs, accessibility, and anything they tell you would make them more exposed.
2. Assess the risks. How likely is harm, and how serious would it be? Most trips are routine and need nothing beyond the policy. Decide which places or trip types need a closer look, and who decides.
3. Control the risks. Choose the controls: a pre-trip briefing, vetted hotels, booked airport transfers instead of street taxis, a check-in schedule, a local contact, or not going at all.
4. Record your findings. Write down the assessment and the controls, with the date and who made the call.
5. Review the controls. Revisit the assessment when the situation at the destination changes, after an incident, and at a regular interval you set.

Our travel risk assessment form follows these five steps, to print or download.

For health risks by country, the CDC's Travelers' Health site has a page for each destination and publishes travel health notices in four levels, from Level 1 (practice usual precautions) to Level 4 (avoid all travel).^[5] Your own government's travel advice, and your medical and security providers if you have them, cover the rest.

Put the decision in the policy

The simplest control is a restricted destinations rule: a list of places where every trip needs approval, or where booking isn't allowed at all. It turns the risk assessment into something the booking process applies automatically, instead of something people need to remember. The restricted destinations section of the policy builder lets you write that rule into a sample policy, with the other rules a travel policy usually covers. Name who can approve a trip to a restricted place, and what the traveler must do before going, such as a briefing or a check-in plan.

2. Know where people are

You can't account for people you can't find. The most reliable source of location for most companies is the itinerary: the flights, hotels and dates booked through the company's program. It tells you who should be where, and when, without tracking anyone's phone.

• Close the gaps. Trips booked outside the program, sometimes called leakage, don't appear in that picture. Make the program the expected route for work travel, and ask travelers who book elsewhere to forward the itinerary.
• Keep profiles current. A mobile number and an email that work abroad, and an emergency contact, held in the traveler's profile.
• Decide on phone location separately. Some services offer it with the traveler's consent. It raises privacy questions of its own, so if you use it, say so in the policy and explain what is seen and by whom.
• Respect personal travel. Keep private trips out of the company's view unless the traveler chooses otherwise.

3. Contact and check-in

When an incident happens near your travelers, the first job is to find out whether they are safe. Decide in advance:

• Who sends the check-in. The travel manager, your travel management company, a security provider, or a combination. One person should own the list for each incident.
• How. Email, text or a phone call, and in what order. Follow a written message with a phone call for anyone traveling right now or in the affected place.
• What counts as a reply. Safe, or needs help, recorded with the time, the channel and a note. A reply from a colleague on the same trip can count, if it is recorded as such.
• When a silence becomes a concern. Set the time after which an unanswered check is treated as overdue. It can depend on the severity of the incident.

For trips with higher risk, agree a routine check-in before the trip, such as on arrival and before the return flight, so a missed one is noticed without waiting for an incident.

4. Escalation

Escalation is what happens when a traveler doesn't answer, or answers that they need help. Write it as a short ladder:

1. Try every contact method on file, then the traveler's line manager and anyone on the same trip.
2. Escalate to a named person who can make decisions after hours, usually the travel manager or an HR or operations lead, with a deputy.
3. Hand over to the right specialist: your medical assistance provider for illness or injury, your security provider for a threat, your insurer for cover. Record the time of handover and the provider's reference number.
4. Decide who speaks to the traveler's emergency contact, and who doesn't. One voice is better than several.

Keep the specialists' contact details and the procedure for reaching them in one place that everyone on the ladder can open at night, and test that the numbers work before you need them.

5. Review after an incident

Close each incident with a short review, even when everyone was safe. Ask:

• Did we know everyone who was affected, and how quickly? Were any trips missing because they were booked elsewhere?
• Did the check-in reach people? Which replies came late, and why?
• Did escalation work at the hour it was needed? Did the handover to providers go smoothly?
• Does the risk assessment for that place need updating, or should it become a restricted destination?

Write down the changes, who owns each one and the date it was done. That record is often the strongest evidence that the program is managed, not just written.

6. Keep records that show it

This is the "how do we show we did it" half. Each step above should leave a record made at the time, not reconstructed afterward.

Ask your legal or HR advisors how long to keep incident records and assessments, and who may see them. They can contain health information, which needs care.

Where silentVIP fits

silentVIP arranges travel and supports the response; it doesn't replace your duty-of-care policy or your specialist providers. We monitor incidents 24 hours a day, 7 days a week. When an incident is confirmed, we match it to the trips on file, list the travelers whose trips overlap the places and dates, contact them and record each answer. Our commitment: first contact attempt within 30 minutes of an incident being confirmed. Unanswered checks are flagged as overdue and can be escalated to your travel manager. When the incident is closed, the record shows who was contacted, when, and how they answered.

Locations come only from trips booked through the program. We don't track phones, trips booked elsewhere aren't included, and private travel isn't visible to the employer. Medical, security and insurance services come from your own providers; we record their contact details and procedures on the program so we can hand over quickly. Restricted destinations can require approval for every trip, or be blocked from booking, in the travel policy.

The traveler safety page walks through a fictional incident from the first alert to closing it.

Questions

Sources

General and third-party statements on this page come from these public sources, each checked on Oct 21, 2026. silentVIP's own commitments come from our published terms and our traveler safety page.

1. OSHA, OSH Act of 1970, Section 5: Duties. Section 5(a)(1), usually called the general duty clause, requires each employer to provide employment and a place of employment free from recognized hazards that are causing or likely to cause death or serious physical harm. Section 5(a)(2) requires compliance with OSHA standards. https://www.osha.gov/laws-regs/oshact/section5-duties (checked Oct 21, 2026)
2. ISO 31030:2021, Travel risk management: Guidance for organizations. The standard's own page on iso.org. iso.org blocks automated reads, so the scope described on this page was checked on the SIS record below. https://www.iso.org/standard/54204.html (checked Oct 21, 2026)
3. SIS (Swedish Institute for Standards), ISO 31030:2021. The published scope: guidance on managing the risks to an organization and its travelers that come from travel; a structured approach to policy, program development, threat and hazard identification, opportunities and strengths, risk assessment, and prevention and mitigation; applicable to any organization of any sector or size; not for tourism and leisure travel, except people traveling on the organization's behalf. Approved September 14, 2021. https://www.sis.se/en/produkter/sociology-services-company-organization/company-organization-and-management/general/iso-310302021/ (checked Oct 21, 2026)
4. UK Health and Safety Executive, Risk assessment: Steps needed to manage risk. Five steps: identify hazards, assess the risks, control the risks, record your findings, review the controls. Employers with 5 or more people must record their significant findings. https://www.hse.gov.uk/simple-health-safety/risk/steps-needed-to-manage-risk.htm (checked Oct 21, 2026)
5. CDC Travelers' Health, Travel Health Notices. Health notices by destination, in four levels, from Level 1 (practice usual precautions) to Level 4 (avoid all travel). Each destination also has its own page on the Travelers' Health site. https://wwwnc.cdc.gov/travel/notices (checked Oct 21, 2026)

Last reviewed: Oct 21, 2026. Spotted something out of date? Email support@silentvip.com.

Read next