Travel risk management for mid-size companies

Not legal or security advice. This guide is general information for the person setting up a travel program. What your organization must do depends on where you and your employees are based and where they go; for that, ask your employment, safety or insurance advisors.

What travel risk management covers

Travel risk management is how a company plans for the things that can go wrong on a work trip, and what it does when one happens. At a company of 100 to 1,000 people it rarely means a security department. It means four things done consistently: a policy that says which trips need a closer look, checks before those trips, knowing where travelers are, and a plan for the first hours of an incident.

Duty of care is the obligation behind all of this: what our duty of care guide describes as an employer's responsibility to take reasonable steps for employees' health and safety, including when they travel. Our duty of care guide covers where that obligation comes from, the five-step risk assessment, how to design check-ins and escalation, and the records that show you did it. This guide is the operating side: who does what, the rules to write, and the order of events when something happens.

Most trips are routine and need nothing beyond booking through the program. The point of the program is to spot the few that aren't, early, and to make the response fast when an event hits a place where your people are.

Who owns what

The gap to look for first at a mid-size company isn't a missing tool. It's that nobody is named for a step, so the step happens only when someone remembers. Write down an owner and a deputy for each part, including who decides after hours.

Two of these matter most. The approver for higher-risk trips should be senior enough to say no, and named in the policy, so travelers and their managers know who to ask before booking. The incident lead needs a deputy who can act at night and on weekends, with access to the itineraries and the contact sheet from a phone.

Write the policy

The travel risk section of a policy can be a page long. It should answer six questions:

1. How are trips booked? Through the company's program, so the itinerary is on file. Say what travelers must do if they book elsewhere, such as forwarding the itinerary.
2. Which places need a closer look? A tier list, usually keyed to a public reference such as government travel advisories, plus places your own business has reasons to treat with care.
3. Who approves what? The named approver for each tier, and what they need to see: the purpose of the trip, the itinerary, the assessment and the controls.
4. What must the traveler do? Read the briefing, keep their profile current, check in on the agreed schedule, and call the incident line if something happens.
5. What happens in an incident? Who leads, how travelers are contacted, when an unanswered check is escalated, and who hands over to medical or security providers.
6. What data is used, and who sees it? Itineraries, profiles and any location data, who can see them, and how personal travel is kept out of the company's view.

An example tier rule

A simple way to build the tier list is to key it to the four levels the US State Department uses for its Travel Advisories.^[2] Here is one way to write that, as a starting point for your own policy:

Adjust it to your business. A company that sends engineers to remote sites may want approval at a lower level for those trips; a company whose travel is mostly to client offices in large cities may keep the rule as it is. Whatever you choose, apply the rule to the place the traveler is actually going (see below), and record each exception with the reason.

The restricted destinations section of the policy builder writes this kind of rule into a sample travel policy, with the other rules a policy usually covers.

Use government travel advisories

For a US company, the State Department's Travel Advisories are the obvious public reference. Its own feed puts it plainly: as a first step in planning any trip abroad, check the Travel Advisories for your intended destination.^[2] The feed links each advisory to its page on travel.state.gov.^[1]

The four levels

1. Level 1: Exercise Normal Precautions
2. Level 2: Exercise Increased Caution
3. Level 3: Reconsider Travel
4. Level 4: Do Not Travel

These are the level names the department uses in its advisories, as checked on Oct 22, 2026.^[2]

Read past the headline level

• Areas within a country. Many advisories say that some areas have increased risk, and a country's headline level can sit below the advice for parts of it. Brazil's advisory, for example, is at Level 2 but says not to travel to its international land borders, due to crime and kidnapping.^[2] Check the cities and regions on the itinerary, not just the country.
• The reasons. Each advisory says why it is at its level, such as crime, terrorism, unrest, health or kidnapping.^[2] The reasons tell you which controls matter: a briefing on demonstrations is different from a plan for health care.
• The date. Each advisory carries the date it was issued or updated.^[2] Check it again shortly before departure for higher-risk trips, and record the level and date you relied on with the approval.

Not everyone is a U.S. citizen

The State Department writes its advisories for U.S. citizens.^[2] Employees with other nationalities can face different entry rules and risks, and should also read their own government's advice. For UK nationals, the Foreign, Commonwealth & Development Office publishes travel advice by country, covering entry requirements, safety and security, health risks and legal differences.^[4] Health risks by destination, including the CDC's travel health notices, are covered in the duty of care guide.

STEP, for U.S. citizens

Some advisories recommend enrolling in the Smart Traveler Enrollment Program (STEP) to get important updates and alerts from the U.S. embassy or consulate. Enrolling helps the U.S. embassy or consulate contact you or your emergency contact in an emergency.^[2] They ask travelers to enroll themselves, and link to the STEP site.^[2][3] Put a reminder, with the link, in the briefing for U.S. citizens traveling abroad, and ask them to name the same emergency contact your HR team holds.

Before each trip

Most of the checks below take a minute when they're part of booking, and a lot longer when they're remembered at the airport. Build them into the booking and approval process, and keep the heavier ones for the trips your tiers say need them.

The travel risk assessment form records the assessment and the approver's decision, and the trip incident contact sheet puts the contacts a traveler needs on one page.

What a briefing covers

• The advisory level and the reasons behind it, for the places on the itinerary.
• The controls for this trip: booked airport transfers, the hotel, areas to avoid, who meets them.
• Who to call, in what order, for a travel problem, a medical problem and a security problem.
• When to check in, and what happens if they don't.
• Entry requirements and any local laws or customs that affect them.

Knowing where travelers are

You can't respond to an incident until you know who is there. For most mid-size companies the most reliable source is the itinerary: the flights, hotels and dates booked through the program. It tells you who should be where, and when, without tracking anyone's phone. The duty of care guide covers the choices in detail, including phone location and personal travel.

From a risk point of view, three gaps matter:

• Trips booked elsewhere. They don't appear in the picture at all. Make the program the expected route for work travel, and make forwarding an itinerary easy for the exceptions.
• Changes on the road. A traveler who extends a stay or moves hotel without telling anyone is somewhere you don't expect. Ask travelers to make changes through the program, and include changes in the briefing for higher-risk trips.
• Stale contact details. A mobile number that doesn't work abroad makes the first hour much longer. Check it at booking, not during the incident.

The first hours of an incident

An incident can be anything from a storm that strands travelers to an attack near their hotel. The order of events is broadly the same, and writing it down before you need it is most of the work.

Two decisions shape the response, so make them in the policy: how you contact travelers (and what counts as a reply), and when an unanswered check is escalated, and to whom. The contact and check-in and escalation sections of the duty of care guide walk through both.

Practice it once

Run a short exercise once a year: pick a fictional event in a city where your people often go, and walk through the first hour with the incident lead, the deputy and your travel management company. Check that the itinerary list comes out right, that the contact details work, that the after-hours numbers answer, and that everyone knows who hands over to the medical or security provider. Write down what was slow, and fix it.

Review the program

Review the program once a year, and after any real incident. Useful questions, with answers you can check in your own data:

• What share of trips was booked through the program, and where did the rest come from?
• Were higher-risk trips approved before booking, with an assessment on file?
• In the last incident or exercise, how long did it take to list the travelers affected, and to reach each one?
• Do the tier list and the named approvers still fit where your people go?
• Are the incident contacts, provider numbers and insurance details current?

Record the changes, who owns each one and when it was done. The records section of the duty of care guide lists the evidence each step should leave.

Where silentVIP fits

silentVIP arranges travel and supports the response; it doesn't replace your policy or your specialist providers. We monitor incidents 24 hours a day, 7 days a week. When an incident is confirmed, we match it to the trips on file, list the travelers whose trips overlap the places and dates, contact them and record each answer, with the first contact attempt within 30 minutes of the incident being confirmed. Unanswered checks are flagged as overdue and can be escalated to your travel manager.

Locations come only from trips booked through the program: we don't track phones, trips booked elsewhere aren't included, and private travel isn't visible to the employer. Medical, security and insurance services come from your own providers. Restricted destinations can require approval for every trip, or be blocked from booking, in the travel policy.

Questions

Sources

Government statements on this page come from these public sources, each checked on Oct 22, 2026. The tier rule is an example for your own policy, not government advice. silentVIP's own commitments come from our published terms and our traveler safety page.

1. U.S. Department of State, Travel Advisories (travel.state.gov). The department's page of advisories by country. travel.state.gov blocks automated reads, so the statements on this page were checked in the department's own Travel Advisories feed, below. https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html (checked Oct 22, 2026)
2. U.S. Department of State, Travel Advisories feed (travel.state.gov). The department's feed of every current advisory. It describes itself: "As a first step in planning any trip abroad, check the Travel Advisories for your intended destination." Each advisory has its own date and one of four levels: Level 1, Exercise Normal Precautions; Level 2, Exercise Increased Caution; Level 3, Reconsider Travel; Level 4, Do Not Travel. Many advisories add that some areas of the country have increased risk; some at Level 2 name areas not to travel to at all (Brazil's, for example: Level 2, but "Do Not Travel to" its international land borders due to crime and kidnapping). Each advisory gives its reasons, such as crime, terrorism, unrest, health or kidnapping. The advisories are written for U.S. citizens, and some recommend enrolling in the Smart Traveler Enrollment Program (STEP) "to get important updates and alerts from the U.S. embassy or consulate. Enrolling helps the U.S. embassy or consulate contact you or your emergency contact in an emergency." https://travel.state.gov/_res/rss/TAsTWs.xml (checked Oct 22, 2026)
3. U.S. Department of State, Smart Traveler Enrollment Program (STEP). Where travelers enroll. The site blocks automated reads, so what STEP does is quoted from the advisories in the feed above, which link here. https://mytravel.state.gov/s/step (checked Oct 22, 2026)
4. UK Foreign, Commonwealth & Development Office, Foreign travel advice (GOV.UK). The UK government's travel advice by country: "advice and warnings about travel abroad, including entry requirements, safety and security, health risks and legal differences." https://www.gov.uk/foreign-travel-advice (checked Oct 22, 2026)

Last reviewed: Oct 22, 2026. Spotted something out of date? Email support@silentvip.com.

Read next