Most organisations do not have a travel risk management programme. They have a travel booking process, an insurance policy and a set of assumptions. Those three things are usually enough — right up to the point where a traveller is in the wrong district when a protest turns, or is injured on a road at night four hours from a hospital that can treat the injury.
The gap is rarely money. It is sequencing. Organisations buy evacuation cover before they can say who is travelling where, and write a policy before deciding who is allowed to say no.
Start with the traveller list, not the policy
The first question in any programme review is simple and uncomfortable: at any given hour, can you name every person of yours who is on a trip, where they are, and who approved it? Organisations that cannot answer that will fail every subsequent control, because approvals, tracking and crisis response all depend on it.
- A single register of movements, including consultants, board members and partner staff travelling on your budget.
- Named approvers by destination tier, not by seniority alone.
- A destination risk rating that is dated and reviewed, not inherited from a government advisory page.
- Evidence that the traveller received a briefing they can actually recall.
Tier the destinations, then tier the controls
A uniform policy applied from Kigali to Mogadishu is either too heavy for the first or too light for the second. Three tiers are usually sufficient. Standard destinations run on corporate policy and vetted ground transport. Enhanced destinations add a pre-travel briefing, tracked movement, no-go areas and an in-country focal point. Controlled destinations require written executive approval, verified medical and evacuation cover, a communications plan with satellite backup, and a documented abort authority.
A control the traveller cannot describe from memory is not a control. It is a paragraph.
The risks that actually materialise
Across African programmes, the harm distribution is stubbornly consistent. Road traffic collisions dominate serious injury and death. Opportunistic crime around airport transfers and after-dark movement follows. Medical events — including ordinary cardiac and gastrointestinal emergencies — produce more evacuations than security incidents. Terrorism is the risk most discussed in board papers and the least likely to touch a given traveller, though its concentration in hospitality venues used by international visitors keeps it operationally relevant.
Programme design should follow that distribution. Driver vetting, journey timing rules and a workable medical pathway will prevent more harm than any amount of threat reporting.
Journey management for the routes that need it
- Route plan filed before departure, with expected timings and a defined check-in schedule.
- Driver and vehicle identity confirmed to the traveller before arrival — verified at the kerb, not accepted from a name board.
- No inter-city road movement after dark as a default rule, with exceptions granted individually and recorded.
- Documented abort criteria and a named person authorised to invoke them without headquarters consultation.
- A missed check-in procedure that begins with a call and ends with an escalation clock, tested at least annually.
Duty of care is evidence, not intent
In a serious incident, the questions asked afterwards are documentary. Was the destination assessed before approval? Was the traveller briefed on the specific risks of that destination? Was the medical arrangement verified rather than assumed? Was the incident response executed as written? Organisations that keep this record routinely find the review straightforward. Those that reconstruct it afterwards rarely do.
What good looks like at twelve months
A mature programme is unglamorous. Trips are approved in a day. Briefings are two pages and specific. Travellers know three things without checking: who to call, what triggers an abort, and where to go. Incidents are reported because reporting is easy and non-punitive. And once a year, the on-call roster rehearses a missed check-in, a hospitalisation and a detention — with the people who would actually take those calls.