People Risk Management: The New Frame for Corporate Duty of Care
TL;DR: People risk management (PRM) reframes corporate duty of care as a continuous program covering traveler safety, health, wellbeing, and operational continuity. Anchored by ISO 31030:2021, PRM pairs policy, intelligence, and technology so employers can anticipate threats across every work location. Modern programs measure risk reduction, not just incident response.
Drawing from 8+ years building AI-powered corporate travel platforms, the pattern that holds up in audit is simple: governance before technology, and KPIs tied to the questions plaintiff attorneys actually ask after a serious incident. This article walks through the PRM frame, the ISO 31030 standard, the metrics that survive quarterly executive review, and the operational handoffs that separate defensible programs from compliance theater.
From Duty of Care to People Risk Management: What Changed
The duty-of-care doctrine entered corporate travel through case law in the 1990s, obligating employers to take reasonable steps to protect employees abroad. For two decades it was interpreted narrowly — emergency assistance contracts, pre-trip briefings, and insurance coverage. People risk management reframes the obligation as a continuous process rather than a reactive one. Per the GBTA 2025 BTI Outlook, 71% of travel buyers now rate traveler safety and wellbeing as a top-three program priority, up from 48% in 2019. The 2021 publication of ISO 31030, the first international standard on travel risk management, codified the shift. International SOS's 2025 Risk Outlook reports that 65% of senior risk professionals expect employee risks to rise in 2026, driven by civil unrest, extreme weather events, and healthcare disruption. The implication for buyers: duty of care alone is no longer a defensible posture. For broader context, see our guide to business travel safety risk categories.
Duty of Care (Legacy) vs People Risk Management (Modern)
| Dimension | Duty of Care (Legacy) | People Risk Management (Modern) |
|---|---|---|
| Trigger | Incident reported | Continuous risk monitoring |
| Scope | Business trips abroad | Business trips, remote work, relocations, local staff |
| Risk categories | Security, medical emergencies | Security, health, wellbeing, operational, reputational |
| Primary standard | Case law + industry best practice | ISO 31030:2021 |
| KPIs | Incident count, response time | Risk reduction %, traveler compliance, policy coverage |
| Technology | Assistance provider hotline | Live traveler locator, risk intelligence feeds, policy engine |
| Program owner | HR or Legal (reactive) | Cross-functional (Security, HR, Travel, Finance, Legal) |
| Reporting cadence | Annual review | Monthly scorecard + real-time alerts |
The Four Pillars of People Risk Management
ISO 31030 and the GBTA Risk Committee's 2024 framework converge on four pillars that structure a defensible PRM program. First, governance: a written policy, a defined risk-tolerance threshold, and a named program owner reporting to the C-suite. Second, intelligence: continuous threat data from sources like the U.S. Department of State travel advisories, the Overseas Security Advisory Council (OSAC), WHO disease outbreak reports, and commercial feeds from International SOS, Riskline, or Crisis24. Third, operations: pre-trip risk assessment tied to approval workflows, in-trip traveler tracking with two-way messaging, and post-trip debriefs that feed back into risk scoring. Fourth, assurance: measurable KPIs reviewed quarterly by executives and auditable records. The U.S. GSA Federal Travel Regulation (41 CFR Chapters 300–304) applies the same four-pillar logic to federal employees. Private employers increasingly mirror the structure to defend against negligence claims.
ISO 31030:2021 — The International Reference for Travel Risk Management
ISO 31030:2021, titled "Travel risk management — Guidance for organizations," is the first consensus-driven international standard for managing risk to traveling workers. Published in September 2021 after a three-year drafting process, it was developed by ISO Technical Committee 262 (Risk Management) with contributions from employers, risk providers, and labor representatives across 20+ countries. The standard is not certifiable in the way ISO 27001 is — it is a guidance document — but it is increasingly cited in enterprise RFPs, insurance underwriting, and legal defenses. ISO 31030 maps directly onto ISO 31000 (enterprise risk management), giving boards a familiar structure. Its key additions versus pre-2021 guidance: explicit coverage of remote workers and extended business trips, a traveler-centric risk assessment model, and documented post-incident review requirements. According to a 2024 Riskline survey of 450 travel managers, 42% of large employers now reference ISO 31030 in supplier agreements.
Measuring PRM: KPIs That Hold Up in Audit
Executive sponsors fund programs that report numbers. The most defensible metrics map onto ISO 31030 Annex B and reflect what plaintiff attorneys ask about in deposition after a traveler incident.
- Policy coverage ratio — share of booked trips passing pre-trip risk assessment (target: 100%).
- Traveler locator latency — median time from booking to last-known-location refresh (target: <15 minutes for live itinerary platforms).
- High-risk destination compliance — share of trips to Level 3/4 State Department advisory countries with documented approval (target: 100%).
- Incident response time — median time from alert trigger to traveler contact (target: <30 minutes).
- Program training completion — share of travelers who completed the annual safety briefing (target: 95%).
- After-action review completion — share of serious incidents with a documented AAR within 30 days (target: 100%).
The U.S. GSA uses a similar scorecard for federal travel, published in the FY2024 Federal Travel Manager Report. Private-sector buyers can adapt it directly without reinventing the metric set.
Operationalizing PRM Across the Trip Lifecycle
A PRM program lives or dies at three operational handoffs.
Pre-trip. Risk screening fires at the booking request, not at ticketing. The traveler sees the destination's current advisory level, required briefings, and any policy exceptions before payment. For Level 3/4 State Department advisories, approval routes to a security officer, not a line manager.
In-trip. The traveler's live itinerary feeds a locator with two-way messaging. Country risk changes — per OSAC alerts, WHO outbreak notices, DOT NOTAMs, or carrier IROPS — push to the traveler and the risk team simultaneously. Mass-notification capability must be tested quarterly; the IATA 2024 Safety Report notes that 38% of airline-affecting disruptions require passenger-side action within four hours.
Post-trip. Incidents feed back into destination risk scoring. A wellbeing pulse survey closes the loop on fatigue, burnout, and policy friction — because duty of care now includes mental health per the WHO 2024 Mental Health at Work guidelines. For program design patterns, see our traveler wellbeing programs guide.
Where Travel Code Fits
Travel Code is a BYOD overlay platform that runs alongside your existing TMC and booking tool — it is not a TMC itself. For people risk management, the overlay model matters because the live itinerary (the backbone of any traveler locator) stays in your current booking system while risk intelligence, policy enforcement, and real-time duty-of-care alerts run centrally across sources. Travelers do not change behavior, procurement does not re-run a TMC RFP, and the risk team gets a single pane of glass. RateGuard, Travel Code's continuous rate re-shopping engine, is priced at 25% of validated savings and funds the overlay. Learn more at the duty-of-care hub or the BYOD overlay page.
Common Pitfalls in Early PRM Programs
- Confusing travel risk with duty of care. Travel risk management is a method; duty of care is the legal standard it serves.
- Over-indexing on security, under-indexing on health and wellbeing. Per GBTA 2024, mental-health incidents on business trips rose 34% year-over-year — yet many programs still have no wellbeing KPI.
- Treating remote workers as out of scope. ISO 31030 explicitly includes extended remote work and relocations.
- Buying intelligence feeds without wiring them to policy. A dashboard that risk doesn't act on is a legal liability, not a mitigation.
- Running annual exercises instead of quarterly. Incident response memory decays within 90 days per FEMA preparedness research.
Frequently Asked Questions
Is people risk management the same as duty of care?
No. Duty of care is the legal obligation an employer owes to employees under tort law and employment statutes. People risk management is the operational discipline — governance, intelligence, operations, and assurance — through which that obligation is discharged. PRM is how modern employers prove duty of care was met.
What is ISO 31030 and does my company have to comply?
ISO 31030:2021 is the international guidance standard for travel risk management. It is not a certifiable standard (unlike ISO 27001) and compliance is voluntary. However, courts, insurers, and enterprise buyers increasingly reference it as the de facto standard of reasonable care, so programs that ignore it are harder to defend when challenged.
Who owns the PRM program in a typical company?
Ownership varies by size. In Fortune 500 enterprises, PRM typically reports to a Chief Security Officer or Chief Risk Officer with dotted lines to HR, Travel, Legal, and Medical. In mid-market firms, the Travel Manager or Head of HR usually owns it with external advisory from an assistance provider such as International SOS, Crisis24, or WorldAware.
What are the top three KPIs to launch with?
Start with (1) policy coverage ratio — the share of booked trips that pass pre-trip risk screening, (2) high-risk destination approval compliance, and (3) incident response time. These three are the first metrics defense counsel ask about after a serious incident and are directly actionable from booking data.
How does PRM handle remote workers and digital nomads?
ISO 31030 treats extended remote work, work-from-anywhere arrangements, and relocations as in-scope for travel risk management. The program should document duration thresholds (for example, >30 days triggers a full assessment), tax and immigration review (see our business travel compliance checklist), and health-system access in the destination country.
Where does PRM intersect with business travel insurance?
Insurance is a mitigation layer, not a program. Underwriters increasingly ask about PRM maturity in their questionnaires — a documented ISO 31030-aligned program typically produces 5–15% premium reductions on travel accident, medical evacuation, and kidnap-and-ransom policies per 2024 broker surveys.
Sources Cited
- GBTA 2025 Business Travel Index Outlook — Global Business Travel Association
- ISO 31030:2021 — Travel risk management, guidance for organizations
- International SOS 2025 Risk Outlook — annual senior risk-professional survey
- U.S. Department of State Travel Advisory System (Levels 1–4)
- Overseas Security Advisory Council (OSAC) country reports
- WHO Mental Health at Work Guidelines, 2024
- IATA 2024 Safety Report
- U.S. GSA Federal Travel Regulation, 41 CFR Chapters 300–304
- Riskline 2024 Travel Manager Survey
