ISO 31030 in 2026: What Strong Travel Risk Management Really Requires

Ultimately, the CEO or president is accountable for duty of care when employees travel, but accountability only works when it is delegated to a named owner and a dedicated travel risk management function.

Many organizations still treat travel risk as a side task, run on spreadsheets and goodwill. ISO 31030 gives significant weight to ownership, responsibility and leadership buy-in, and organizations are moving from informal processes to formal governance. Accountability sits in three layers:

• Executive accountability: the CEO, president and board answer for the health and safety of the whole mobile workforce, international and domestic.
• Program ownership: a dedicated travel risk management role or function, with an executive sponsor, owns the program day to day.
• Shared delivery: travel, security and HR each run their part, under one set of policies.

How to prove it: Henning Snyman’s test is to walk one traveler through the whole journey, from the decision to travel through pre-travel, the trip itself and the return. At every step, ask whether the standard was followed, and whether there is a documented trail an auditor could check. If no single person is accountable for that trail, accountability exists on paper only.

ISO 31030 still matters because it remains the recognized global framework for travel risk management. The standard hasn’t changed, but the risk environment around it has, and organizations are struggling to apply it, not to understand it.

ISO 31030 is international guidance, built on industry best practice and security professional standards. It was designed as a flexible framework, and that flexibility is now its main value, because the pressures on travel programs have multiplied:

• Rapid geopolitical shifts, with escalations and de-escalations within weeks;
• Volatility in border enforcement;
• Rising risk around public events, where the event matters as much as the destination;
• Legal, regulatory and reputational risk now tightly linked;
• Domestic travel and the wider mobile workforce now in scope, not only international trips.

Alan Friedman compares under-investing in implementation to patching a roof: you save money this year and pay more next year, because the environment keeps moving.

In 2026, using the standard well means fitting the program to your organization’s context and risk appetite, keeping travel risk assessments current, and putting controls in place before travel rather than after an incident.

Travel risk policies fail when compliance culture wins over implementation: the policy is written to satisfy an audit, but travelers and local teams never use it, train on it or rehearse it.

A policy is set centrally, but it is carried out by people spread across offices, countries and teams. That gap is where most programs break down. The common failure points:

1. Written to check a box: long plans that exist for the board, not for the people traveling.
2. Never practiced: nobody is trained on the plan or has walked through it in a scenario.
3. Optional language: policies phrased as recommendations rather than requirements.
4. Not actionable locally: rules that local teams can’t apply to their situation.
5. No senior sponsor: without visible leadership backing, the culture never forms.

What works instead:

• Make the policy a requirement, then measure adoption, not just whether the policy exists. This is also how organizations improve travelers’ compliance with pre-trip steps.
• Let local teams implement within the standard.
• Run scenario-based tabletop exercises regularly. Alan has never seen one where people weren’t engaged.

The age of rupture describes the shift from uncertainty to sudden breaks in long-held assumptions about geopolitics and power, breaks that have a sustained impact on how organizations send people to travel.

The difference matters for planning. Uncertainty means not knowing where events will land, and good preparation handles that. Rupture means the ground has already shifted, as in Ukraine, the Middle East, Venezuela and the Gulf states. Organizations then have to act with intent and manage change mid-crisis, which Henning Snyman calls one of the hardest things any organization does.

When a rupture hits, Alan works through three questions:

1. What has shifted, and what is its impact on us?
2. Do we still need to operate and travel there? Usually the answer is yes.
3. Do we have specific, ground-level information on where we’re going, how, and with what contingencies?

Incidents that look alarming on the news are often localized. Local information on the area around an incident, how isolated it is and how volatile it could become tells you more than the headline.

For an ISO 31030 program, the age of rupture means reassessing risk on an ongoing basis, planning for a wide range of outcomes, and discounting none of them.

You prove ROI on travel risk management by turning an abstract risk into measured performance: benchmark the program against ISO 31030, show whether its controls reduce your priority risks, and report it in terms the C-suite uses.

Investment in travel risk management is uneven. Alan Friedman’s rough estimate is that organizations split into thirds:

• Those building robust programs;
• Those that see the need but lack resources;
• Those that understand the risk but aren’t acting.

The weakest argument is box-checking (“the board needs to see we have this”). A stronger business case rests on four steps:

1. Baseline against the standard: how far does the program meet ISO 31030?
2. Risk reduction: do the controls match the risks you actually face?
3. Adoption: are travelers and managers following the process?
4. Peer position: how does the program compare with your industry, which is how leadership will judge it?

Metrics that follow from this include:

• The share of higher-risk trips with a completed risk assessment;
• The share of travelers you can locate at any time;
• The completion rate of pre-trip steps.

Rising political violence that affects senior leaders has made the case more visible. But Alan’s point stands: the profession still has to quantify and communicate it.

Prioritize travel risk by your organization’s risk appetite and actual exposure, not by every threat in the news: set clear thresholds for which trips get assessed, and let a baseline system handle the rest.

Risks are multiplying faster than budgets. The same threat means different things to:

• An oil and gas company used to volatile environments;
• A university focused on student safety;
• A software company that serves both.

And not every fear is a real exposure. Alan Friedman describes staff who feared a raid on an office that was never a target. Their concern deserved a conversation, but not a share of limited resources. A workable sequence:

1. Define your risk appetite: how much risk the organization will accept, and where.
2. Set assessment thresholds: organizations with thousands of trips a year cannot assess each one, so decide when an assessment is required and at what depth.
3. Build the baseline: country briefings, traveler tracking and tiered escalation, at or above industry standard, so staff time goes to the exceptions.
4. Put controls in place before travel, not after an incident.
5. Be able to answer the first question in any incident.

Border device searches are expanding duty of care from a know-your-rights briefing into a data, HR and security issue: who can access or monitor a traveler’s phone, and what company information that exposes.

Encounters with authorities at borders used to be handled with a short briefing on travelers’ rights. Now the question also covers devices. Travelers routinely unlock phones with face ID, so the real exposure is what sits on the device: email, client data, proprietary information.

Handling it takes three changes:

1. Traveler behavior: what to carry, what to remove, and how to respond at the border.
2. A realistic risk assessment by data and IT teams: which data is at risk, on which routes.
3. Shared ownership: HR and security agree the policy together.

For multinational workforces, the policy also has to work across different cultures, privacy expectations and legal systems, and the rules vary by country. Alan’s advice is not to overwhelm travelers: keep the guidance short, train on it with realistic scenarios, and approach it with humility.

This is one example of a wider ISO 31030 point: legal, regulatory and reputational risk are now tightly linked to travel risk.

Benchmark a travel risk program at two levels: first against ISO 31030, then against your own risks, testing whether what you’ve implemented actually makes travelers safer.

Benchmarking matters because it is how programs are judged, by the board and against the industry. It has also never been easier: alongside third-party tools, organizations can now build internal benchmarks with AI.

1. Against the standard: how close is the program to ISO 31030, say 25% or 50%, and where are the gaps?
2. Against your risks: do the controls match your real exposure? Strong governance without a traveler tracking system, for example, is a gap no compliance score will show.
3. Against peers, with care: industry comparison gives context, but it can’t make your decisions for you.

Henning sees this tested during evacuations, when travelers call in asking why they are staying when everyone else is leaving. Some organizations never leave, and that is normal within their industry. A benchmark is only useful if leadership has agreed in advance where the organization stands.

To make the benchmark auditable, walk one traveler through pre-travel, the trip and the return. Check for a documented trail at every step.