What does ISO 31030 cover?

ISO 31030:2021 provides guidance for managing travel-related risks across four pillars: governance (written policy with C-suite accountability), risk assessment (destination and traveler profiling), risk treatment (controls proportionate to threat level), and monitoring and review (24/7 tracking plus post-incident debriefs). It applies to organizations of any size or sector.

Is ISO 31030 certification possible?

No. ISO 31030 is a guidance standard, not a certifiable management system standard. Organizations cannot be formally certified to it. However, the framework is auditable as evidence of due diligence, and ISO/TC 262 is developing a certifiable successor expected for public consultation in 2026-2027.

How does a travel risk management platform protect employees?

Navan maintains real-time traveler visibility through centralized booking, enabling organizations to locate employees immediately during a crisis. The platform provides 24/7 emergency support, proactive risk alerts for affected destinations, and automated crisis communication workflows that help companies meet their duty-of-care obligations.

Who is responsible for TRM in a company?

TRM operates as a cross-functional responsibility spanning HR, legal, security, finance, and IT. ISO 31030 recommends naming an accountable Travel Risk Manager, typically reporting to the Chief Security Officer or COO, with a written policy approved at board or C-suite level to establish governance authority.

What types of risks does a TRM program address?

A comprehensive TRM program covers six risk categories: geopolitical (war, terrorism, civil unrest), health and medical (disease, limited healthcare), environmental (extreme weather, natural disasters), security (crime, kidnapping), cyber (data theft, border device seizure), and psychosocial (travel fatigue, inclusion-related risks for diverse travelers).

How do companies assess travel risk levels?

Organizations tier destinations into risk bands (low, medium, high, extreme) using government sources like the U.S. State Department's OSAC ratings and the UK FCDO advisories. Navan integrates destination intelligence directly into the booking flow, surfacing risk assessments before travelers confirm reservations so approval escalations happen automatically.

What is TRM (Travel Risk Management)? Guide

TRM (Travel Risk Management)

The structured process an organization uses to identify, assess, mitigate, and respond to health, security, environmental, and logistical risks affecting employees who travel for work, guided internationally by ISO 31030:2021.

Victoria Landsmann

•June 25, 2026•

5 minute read

Key Takeaways

Travel risk management (TRM) is the structured process organizations use to identify, assess, mitigate, and respond to health, security, environmental, and logistical risks facing employees during business travel.

ISO 31030:2021 is the first international guidance standard for TRM, providing a four-pillar framework: governance, pre-trip risk assessment, real-time monitoring, and post-incident review [1].
GBTA's April 2026 sentiment poll found that 79% of travel managers cite geopolitical instability as the top travel-related risk, with the figure reaching 92% among European respondents [2].
Navan provides real-time traveler tracking and 24/7 emergency support that help organizations fulfill duty-of-care obligations across domestic and international trips.
75% of business travelers say they would decline a trip if they felt their company didn't prioritize their safety and well-being [3].
ISO/TC 262 placed the standard under systematic review in April 2026, and a certifiable successor scheme is expected to enter public consultation in 2026-2027 [4].

What is Travel Risk Management (TRM)?

Travel risk management (TRM) is the structured process an organization uses to identify, assess, mitigate, and respond to health, security, environmental, and logistical risks affecting employees who travel for work. TRM encompasses everything from pre-trip destination analysis and traveler briefings to real-time incident monitoring and post-trip review, forming the operational backbone of an employer's duty of care obligations.

Unlike ad hoc safety measures or reactive responses to incidents, a TRM program creates a repeatable, auditable framework that operates before, during, and after every business trip. The goal is twofold: protect employees from foreseeable harm, and protect the organization from legal liability, financial loss, and reputational damage when incidents occur.

Transform Your T&E Management with Navan

Make business travel work for everyone.

Get started

ISO 31030: The International TRM Standard

ISO 31030:2021 is the first international standard dedicated to travel risk management, published in September 2021 by ISO Technical Committee 262 [1]. The 48-page guidance document applies to "any type of organization, irrespective of sector or size," covering commercial, governmental, educational, and non-profit entities.

The standard is non-certifiable, meaning organizations cannot obtain formal ISO 31030 certification. However, courts, insurers, and procurement teams increasingly cite it as the benchmark for reasonable care [4]. RFPs from governments, universities, and multinational corporations now routinely include ISO 31030 clauses. For a deeper look at how TRM connects to broader organizational safety responsibilities, see Navan's guide to travel risk management.

ISO 31030 structures a TRM program around four operational pillars:

Governance: A written TRM policy approved at the board or C-suite level, with named accountable roles and clear reporting lines to security or operations leadership.
Risk assessment: Pre-trip evaluation of destination, traveler profile, planned activities, and supplier exposure, tiered into low, medium, high, and extreme risk bands.
Risk treatment: Controls proportionate to the assessed tier: pre-trip briefings, medical clearances, vetted ground transportation, and escalation protocols for high-risk destinations.
Monitoring and review: 24/7 traveler tracking, incident response protocols, crisis communication channels, and post-incident debriefs that feed back into policy updates.

As of April 2026, ISO/TC 262 has placed the standard under systematic review, and industry stakeholders expect a certifiable successor scheme to enter public consultation in 2026-2027 [4].

Why TRM Has Become a Board-Level Priority

The risk landscape for business travelers has intensified. GBTA's April 2026 industry sentiment poll found that 79% of respondents cite geopolitical instability as the leading travel-related risk, with the figure reaching 92% among European respondents [2]. Employee safety concerns rose to 67% in April 2026, up from 56% in January [2].

Organizations are responding with concrete actions: 50% have adjusted travel routes or itineraries, 50% have suspended travel to specific regions, and 36% are re-evaluating their duty-of-care policies [2]. Seventy percent of travel buyers say the travel management function becomes more important during periods of disruption, with responsibilities moving closer to leadership and enterprise decision-making [2].

For companies without structured TRM programs, the consequences extend beyond safety incidents. Research from World Travel Protection found that 75% of travelers would decline a business trip if they felt their company didn't prioritize their safety [3]. Beyond recruitment and retention impacts, organizations lacking documented TRM procedures face legal exposure: ISO 31030 is increasingly cited in negligence proceedings as the standard against which employer duty of care is measured [4].

Components of an Effective TRM Program

A complete TRM program extends beyond destination risk ratings. Based on ISO 31030 guidance and current industry practice, effective programs include:

Pre-trip risk assessment. Every trip should undergo documented risk evaluation before departure. For medium-to-high-risk destinations, this means a formal approval process evaluating political stability, health conditions, crime rates, natural disaster exposure, and infrastructure reliability. The U.S. Department of State's OSAC program and the UK FCDO publish destination ratings that organizations can map directly into risk tiers [1].

Centralized booking and traveler visibility. Employees who book outside managed channels become invisible to duty-of-care travel tools. Navan's centralized booking platform maintains a real-time "who's where" capability, enabling organizations to identify and contact affected employees within minutes during a crisis.

Crisis communication protocols. Two-way communication channels between the organization's security team and traveling employees must function around the clock. Effective programs test these channels through tabletop exercises before a real incident occurs.

Post-incident support and review. TRM extends beyond the immediate crisis. Organizations must provide medical follow-up, counseling, and operational support after travel incidents, then conduct structured debriefs that feed improvements back into corporate travel policy.

Cross-functional ownership. Modern TRM programs operate across HR, legal, security, finance, and IT functions rather than sitting solely within a travel management team. Cyber threats, mental health support, and digital border risks have expanded the scope well beyond physical safety.

TRM Risk Categories

Travel risks extend beyond the obvious physical threats. A comprehensive TRM program addresses:

Risk Category	Examples	Mitigation Approach
Geopolitical	War, terrorism, civil unrest, sanctions	Destination monitoring, travel bans, route adjustments
Health and medical	Disease outbreak, altitude illness, limited healthcare	Vaccination requirements, medical screening, evacuation planning
Environmental	Extreme weather, natural disasters	Seasonal risk calendars, flexible rebooking, safe accommodation standards
Security	Crime, kidnapping, robbery	Vetted transport, hotel security standards, awareness training
Cyber	Data theft, device seizure at borders, surveillance	VPN requirements, clean device policies, data minimization
Psychosocial	Travel fatigue, isolation, LGBTQ+ or gender-specific risks	Trip frequency limits, inclusive destination assessments, mental health support

GBTA research highlights underserved populations: 36% of programs now include specific considerations for female travelers, 27% for LGBTQ+ travelers, and 23% for travelers with disabilities [3].

Travel Policy Compliance: The percentage of bookings and expenses that follow an organization's established travel guidelines, directly supporting TRM through centralized booking visibility.
Compliance: The broader adherence to internal policies and external regulations governing business travel spending, encompassing the regulatory framework within which TRM operates.

Sources

[1] ISO, "ISO 31030:2021 — Travel risk management: Guidance for organizations," September 2021, https://www.iso.org/standard/54204.html

[2] Global Business Travel Association, "April 2026 Business Travel Industry Sentiment Poll," April 2026, https://gbta.org/global-business-travel-continues-but-confidence-drops-sharply-as-conflict-costs-and-complexity-reshape-the-2026-outlook/

[3] World Travel Protection / GBTA US Risk Committee, "Crisis Averted: Closing the Gap on Travel Risk," March 2026, https://ubta.org/downloads/Presentations_from_GBTA_Utah_Meetings/gbta_crisis_averted.pdf

[4] Travel Risk & Safety, "ISO 31030 at Five Years — The Silent Benchmark in Duty-of-Care Law," 2026, https://travelrisksafety.com/insights/iso-31030-five-years-duty-of-care

Frequently Asked Questions About Travel Risk Management

Travel risk management is the structured process an organization uses to identify, assess, mitigate, and respond to risks affecting employees during business travel. It covers health, security, environmental, and logistical threats across the full trip lifecycle: pre-departure planning, in-trip monitoring, and post-incident review.
ISO 31030:2021 provides guidance for managing travel-related risks across four pillars: governance (written policy with C-suite accountability), risk assessment (destination and traveler profiling), risk treatment (controls proportionate to threat level), and monitoring and review (24/7 tracking plus post-incident debriefs). It applies to organizations of any size or sector.
No. ISO 31030 is a guidance standard, not a certifiable management system standard. Organizations cannot be formally certified to it. However, the framework is auditable as evidence of due diligence, and ISO/TC 262 is developing a certifiable successor expected for public consultation in 2026-2027.
Navan maintains real-time traveler visibility through centralized booking, enabling organizations to locate employees immediately during a crisis. The platform provides 24/7 emergency support, proactive risk alerts for affected destinations, and automated crisis communication workflows that help companies meet their duty-of-care obligations.
TRM operates as a cross-functional responsibility spanning HR, legal, security, finance, and IT. ISO 31030 recommends naming an accountable Travel Risk Manager, typically reporting to the Chief Security Officer or COO, with a written policy approved at board or C-suite level to establish governance authority.
A comprehensive TRM program covers six risk categories: geopolitical (war, terrorism, civil unrest), health and medical (disease, limited healthcare), environmental (extreme weather, natural disasters), security (crime, kidnapping), cyber (data theft, border device seizure), and psychosocial (travel fatigue, inclusion-related risks for diverse travelers).
Organizations tier destinations into risk bands (low, medium, high, extreme) using government sources like the U.S. State Department's OSAC ratings and the UK FCDO advisories. Navan integrates destination intelligence directly into the booking flow, surfacing risk assessments before travelers confirm reservations so approval escalations happen automatically.