What does a duty of care policy mean for business travellers?

A duty of care policy for business travellers is a formal commitment by an employer to protect the health, safety, and security of employees who travel for work. It sets out the organisation’s responsibilities before, during, and after a trip, and defines the procedures, resources, and support that employees can expect when something goes wrong. For any organisation with an international travel programme, this policy is not optional; it is both a legal obligation and a moral one. The sections below unpack the specific questions that travel risk and duty of care professionals most commonly face when building or reviewing their approach.

What are employers legally required to provide under duty of care?

Employers are legally required to take reasonable steps to protect employees from foreseeable harm, including harm that occurs during business travel. This obligation exists under health and safety legislation in most jurisdictions and is reinforced by employment law, corporate governance standards, and, in many countries, specific travel risk frameworks. Failing to meet this standard can expose organisations to legal liability, regulatory action, and reputational damage.

In practical terms, the legal baseline includes conducting risk assessments before travel, providing employees with relevant safety information, and ensuring that appropriate support is available if an incident occurs. ISO 31030, the international guidance standard for travel risk management, gives organisations a recognised framework for meeting and demonstrating these obligations. Aligning with this standard signals that an organisation has taken a structured, documented approach to protecting its people.

The legal duty does not disappear once an employee boards a plane. It extends throughout the journey, covering incidents that occur at the destination, in transit, and during any return. Organisations that lack clear procedures for responding to incidents abroad, whether medical emergencies, security threats, or natural disasters, are likely falling short of what the law expects.

What does a duty of care policy actually cover for travelling employees?

A duty of care policy for travelling employees covers the full lifecycle of a business trip: pre-travel preparation, in-trip monitoring and support, and post-incident follow-up. It defines what the organisation will do at each stage, who is responsible for doing it, and what resources employees can access if they need help.

The core components of a well-structured policy typically include:

Pre-travel risk assessment: Evaluating the destination’s security, medical, and political environment before approving travel
Traveller briefings: Providing employees with destination-specific guidance, emergency contacts, and behavioural advice
Real-time tracking: Knowing where employees are at all times so that assistance can be directed quickly
24/7 emergency support: Ensuring employees can reach a response team at any hour, regardless of time zone
Medical assistance: Covering access to treatment, hospital coordination, and medical evacuation if required
Security response: Providing support in the event of civil unrest, kidnap, or armed threat
Crisis communication: Maintaining clear lines of contact between the traveller, the organisation, and any external assistance provider

For employees travelling to high-risk environments, the policy must go further. It should address hostile environment training, close protection, armoured transport, and evacuation planning. A policy built only for low-risk travel will fail the moment a situation escalates beyond expectations.

How does duty of care differ from standard travel insurance?

Duty of care is an active, ongoing responsibility to protect employees, whereas travel insurance is a financial product that reimburses costs after an incident has occurred. The two are complementary, but they are not the same thing, and organisations that rely on insurance alone to fulfil their duty of care are leaving a significant gap in their employee protection framework.

Travel insurance typically covers medical bills, trip cancellations, and lost property. It does not provide a response team. It does not track where an employee is. It does not arrange a medical evacuation or coordinate with a hospital overseas in real time. When a serious incident unfolds, an insurance policy cannot make decisions, deploy assets, or get someone home safely.

Duty of care, by contrast, is about capability and response. It requires an organisation to have the people, processes, and partnerships in place to act quickly when an employee needs help. This is why organisations with serious travel programmes work with specialist travel risk management services rather than treating insurance as a substitute for operational preparedness.

A useful way to think about it: insurance pays for what happened. Duty of care determines what happens next.

Who is responsible for managing duty of care within an organisation?

Responsibility for managing duty of care is shared across several functions, but ultimate accountability typically sits with senior leadership. In practice, day-to-day management falls to Travel Risk Managers, Global Mobility Directors, HR leads, or Security teams, depending on how the organisation is structured. The key is that someone owns it clearly, with defined authority and access to the resources needed to act.

In larger organisations, a cross-functional group often governs the travel risk programme, drawing together HR, legal, security, finance, and operations. Each function contributes a different perspective: legal ensures compliance, HR manages communication with travellers, security assesses threats, and finance controls the budget for assistance services.

Where organisations often struggle is in the gap between policy ownership and operational execution. A policy can be well-written and still fail if no one has the authority to act on it during a crisis, or if the response process has not been tested in advance. Assigning ownership is necessary but not sufficient; the responsible person or team must also have a clear escalation path, a vetted assistance provider, and the ability to make decisions under pressure.

What happens when a duty of care policy fails during a crisis?

When a duty of care policy fails during a crisis, the consequences fall into three categories: harm to the employee, legal exposure for the organisation, and lasting reputational damage. In the most serious cases, a policy failure means an employee does not receive timely help, and that delay can have life-altering or fatal consequences.

Policy failures during crises tend to follow recognisable patterns. Common causes include:

No real-time visibility of where employees are when an incident occurs
Slow response times because the assistance provider lacks local assets or operational depth
Unclear escalation procedures that create confusion about who should act and when
Policies that were written for low-risk travel and were never updated to reflect high-risk destinations
Dependence on a single point of contact or single crisis management resource that becomes overwhelmed

The operational record of what can go wrong in real environments is well documented. During the Arab Spring, organisations that lacked evacuation arrangements were unable to move their people quickly. When Russia invaded Ukraine, the difference between those who had pre-arranged emergency response capability and those who did not was the difference between a managed extraction and a chaotic scramble. Speed and pre-positioning matter enormously; the industry standard response time of three to seven days is simply not adequate in a fast-moving crisis.

From a legal standpoint, a documented policy failure creates a clear record of negligence. Courts and regulators will examine whether the organisation identified the risk, whether it had a plan to address it, and whether that plan was actually capable of delivering the protection it promised. A policy that exists on paper but cannot be executed in practice offers little legal protection.

How should a duty of care policy be reviewed and updated?

A duty of care policy should be reviewed at least annually and updated whenever there is a material change in the organisation’s travel patterns, the geopolitical environment, or the regulatory landscape. Policies that are written once and left unchanged quickly become misaligned with operational reality, particularly for organisations whose employees travel to high-risk countries where conditions shift rapidly.

A structured review process should examine the following:

Incident history: What happened during the review period? Were there near-misses, escalations, or cases where the policy was tested? What did those reveal?
Destination risk changes: Have any of the organisation’s regular destinations changed in security or medical risk profile? Does the policy still reflect current threat levels?
Provider performance: Did the assistance provider respond within acceptable timeframes? Were there gaps in capability, coverage, or communication?
Regulatory updates: Have there been changes to health and safety law, employment legislation, or guidance standards such as ISO 31030 that require the policy to be updated?
Employee feedback: What do travelling employees report about the support they received? Are they aware of the policy and confident in how to use it?

Beyond the annual review, policies should be tested through tabletop exercises or live simulations. A policy that has never been stress-tested is an unknown quantity. Running scenarios, a medical emergency in a remote location, a security incident in a high-risk country, a sudden political crisis requiring mass evacuation, reveals gaps that a document review alone will not surface.

Continuous monitoring of the global threat environment should also feed into the policy on an ongoing basis. Country risk ratings change. Political situations deteriorate without warning. A policy that was adequate for travel risk management in a stable environment may need rapid adjustment when that environment changes.

How NGS helps organisations meet their duty of care obligations

Northcott Global Solutions provides end-to-end travel risk management and emergency response capability designed to help organisations fulfil their duty of care responsibilities in practice, not just on paper. Services are aligned with ISO 31030 and built around the operational realities of international business travel, including travel into complex and high-risk environments.

24/7 monitoring and itinerary tracking via the Aurora platform, giving organisations real-time visibility of their travelling employees
Pre-travel risk assessments and briefings calibrated to destination risk levels, from low-risk business travel to hostile environment deployments
Emergency response and evacuation with an average urban response time of 40 minutes or less, compared to the industry standard of three to seven days
Medical assistance and evacuation coordinated end-to-end, from hospital admission through to safe return home
Security risk management including close protection, threat assessments, and crisis response across 190+ countries
Mass emergency communication through SIREN, enabling rapid contact with all travellers simultaneously during a developing crisis

Whether your organisation is reviewing its current policy, responding to a gap identified during an incident, or building a travel risk programme from the ground up, NGS can provide the operational depth and specialist expertise to support you. Contact the NGS team to discuss your duty of care requirements.