Travel risk management software: duty of care, employee travel tracking and ISO 31030

What is travel risk management?

Travel risk management is the practice of identifying what could go wrong on a work trip, reducing that exposure before departure, responding when something does happen, and keeping a record of all of it. It applies to every business trip, not only trips to obviously dangerous places, because the most common incidents are medical events, road accidents and disruption, not the ones that make the news.

The reason it exists as a discipline rather than a paragraph in a travel policy is that the obligation sits with the employer. When you direct an employee to travel for work, you take on responsibility for foreseeable harm on that trip. Where the legal line falls varies by jurisdiction and by how the employment relationship is structured, but the practical standard organizations are measured against is consistent: did you assess the risk, did you tell the traveler, could you find and reach them, and can you show what you did.

That last clause is why documentation keeps appearing in this category. A program that worked but left no record is very hard to defend after the fact, which is why almost every specialist platform sells its audit trail as hard as its intelligence feed.

What is ISO 31030?

ISO 31030:2021, titled Travel risk management, guidance for organizations, is the international standard describing how to build and run a travel risk program. It covers policy, program development, threat and hazard identification, risk assessment, and prevention and mitigation strategies, and it frames all of it as a cycle you develop, implement, evaluate and review rather than a one-time setup.

It is deliberately not prescriptive about tools. The standard does not tell you to buy tracking software or to contract a medical assistance provider. It tells you to establish governance and ownership so it is clear who makes travel risk decisions and under what policy, to assess risk before travel at the destination, itinerary and traveler level, and to prepare employees so they understand the exposure they are walking into and what to do about it.

For most US companies the practical value of ISO 31030 is as a checklist and a common vocabulary. It gives you a defensible structure to point at, and it gives your vendors and your insurer a shared set of terms. That is genuinely useful. It is also the entire benefit, which brings us to the question people get wrong most often.

Can you get ISO 31030 certified?

No. ISO 31030 is a guidance standard rather than a requirements-based standard, and only requirements-based standards carry an accredited certification scheme. There is no ISO 31030 auditor, no certificate, and no registrar that can issue one. Adoption is voluntary, and the honest phrasing for a program built against it is aligned with ISO 31030, not certified to it.

This matters commercially because the distinction gets blurred in sales conversations. A vendor may offer an ISO 31030 assessment, readiness review or alignment badge. Those can be perfectly legitimate consulting products, and some are genuinely good, but they are that vendor assessing you against its own reading of the guidance. They are not an ISO certification and should not go on a board slide as one.

The useful test is one question: who accredits the body issuing this, and against which requirements clauses. For a standard like ISO 27001 that question has a clean answer. For ISO 31030 it does not, because the clauses are recommendations. Ask it early and it will save an awkward correction later.

How much does travel risk management software cost?

Expect roughly $25 per traveler per year at the tracking-only end of the market and $250 or more per traveler per year where medical and security assistance, evacuation cover and a 24/7 crisis desk are included. Almost nothing in this category is publicly priced, so those are market planning figures rather than published rates, and every real number arrives after a scoping call.

The variable that moves your bill most is the definition of traveler. Some vendors count every employee who could travel, some count everyone with a trip in the last twelve months, and some count concurrent travelers. Between the widest and narrowest of those definitions the same company can see a three or four times difference on identical coverage. Settle the definition before you compare two quotes, or you are not comparing the same thing.

The second variable is what happens when someone needs help. Tracking and alerting are cheap because they are software. Medical evacuation, vetted in-country providers and a staffed crisis desk are expensive because they are people and logistics on standby. If a quote looks unusually low for full assistance, that is the line item to interrogate.

How do companies track employees while traveling?

Three sources, usually combined. Itinerary data from the booking tool or travel agency gives the planned route and is the backbone. Mobile app signals give an actual position when the traveler has the app installed and consented. Manual check-ins fill the gaps, either traveler-initiated or prompted by the platform. Each source fails differently, which is why serious programs run more than one.

Itinerary data is the most complete and the most fragile. It covers every trip booked through the channel and nothing booked outside it, so the moment a traveler rebooks directly with an airline during a disruption, your map is confidently wrong. This is not a rare edge case. It is what happens on exactly the night you most need the data to be right.

Mobile signals fix that, at a cost. They require the app, an opt-in, and a privacy posture you can defend to your own employees and, if you have people in California or an EU-based entity, to a regulator. Consent-based location tracking is normal in this category and is generally accepted when it is scoped to work trips and clearly explained. Continuous tracking outside trips is where programs get into trouble.

The structural fix for the itinerary problem is to make day rebuilds happen inside the system rather than around it. If the rest of the day is re-planned where the itinerary lives, the plan stays accurate through the disruption instead of breaking at it. That is the specific gap TripAgent.ai closes: the traveler asks for the affected day and gets it back re-sequenced around the new timing. It does not reissue the ticket - you rebook through your own channel - and closing this gap is not the same as running a full risk program.

How do you build a travel risk management program?

Start by writing down who owns it. Most programs that stall do so because travel risk sits between travel, HR, security and legal, and each assumes another owns the decision. Name one accountable owner, define what they can decide alone and what escalates, and put it in the travel policy rather than a separate document nobody reads.

Then work through the five obligations a program is judged on, in order.

Pre-trip risk assessment: rate the destination and the itinerary before approval, using a consistent source. State Department advisories and CDC destination health pages are free, public and sufficient for most domestic and low-risk international travel. Buy an intelligence feed when you routinely send people somewhere those sources rate as elevated.

Traveler preparation: tell the traveler what the rating means and what to do. A one-page destination brief attached to the itinerary beats a training module nobody finishes.

Real-time location awareness: keep the itinerary current, which means keeping bookings and changes inside one channel. This is the obligation most likely to be quietly broken.

Incident response: have a documented path from an event to a named human, with an out-of-hours route that does not depend on one person answering a phone.

Post-trip review: log incidents and near-misses. This is the cheapest of the five and the one most often skipped, and it is what turns a policy into a program that improves.

Who are the travel risk management companies?

The enterprise tier is led by International SOS, Crisis24, Healix International, Global Guardian and Control Risks. These are assistance companies first and software companies second: what you are buying is a global network of vetted medical and security providers, an intelligence team, and a crisis desk, with a platform on top. They are the right answer for organizations with genuinely exposed travel, and they are priced accordingly.

Below that sit specialist platforms including Riskline, Safeture, Solace Global and A3M, which serve mid-market programs. The trade is generally more software and less standing assistance capability, at a materially lower price per traveler.

Then there is the layer most companies actually start with and rarely name as a purchase: the booking platform that holds the itinerary. Corporate travel tools including SAP Concur, Navan and TravelPerk all feed traveler location data into this picture, and several bundle basic duty of care reporting. TripAgent.ai belongs in this layer. It is worth being precise about what that means. A planning tool can tell you where people are meant to be, and keep that accurate as long as the itinerary is kept current. It cannot evacuate anyone.

If you are choosing where to spend first, the sequence that works for most US companies is: fix the itinerary channel, adopt free public risk sources, write the response path down, and only then price an assistance contract against the trips that genuinely need one.