Travel risk management in practice: What really happens when employees face a crisis abroad

Most organisations have a travel policy. Many have emergency contact numbers. Far fewer have examined what actually happens when an employee faces a crisis 3,000 kilometres from home, and whether their current arrangements are operationally capable of responding.

To understand what that gap looks like in practice, we spoke with Rob Ferrey and Darren Kelly of Callida Freemont, a crisis management and security consultancy with decades of experience across high- and medium-risk environments worldwide. The accounts below draw directly from incidents they managed and the patterns they have observed across organisations of every size.

This is not a theoretical discussion. It is a practical test of employer duty of care for internationally mobile employees. In practice, the gap between what organisations assume their duty of care covers and what it can deliver under pressure is wider than most HR leaders recognise.

‍

The three incidents that happen most often

Crisis management professionals who regularly support international business travellers see a consistent pattern. The dominant incidents are not kidnappings or terrorism. Those risks exist and are serious, but they are statistically rare.

The majority of response effort is concentrated in three areas:

• Crime (for example, mugging, assault, drink spiking)
• Medical emergencies
• Road traffic accidents

These are also the incidents that employees can relate to. Most people have either experienced or know someone who has been in a car accident, been unwell abroad, or had something stolen while travelling.

But that familiarity makes them no less dangerous, and it is precisely why travel risk management frameworks that only focus on extreme scenarios leave significant gaps.

‍

{{download-box}}

‍

What a road traffic accident looks like when it goes wrong

Consider a real example from West Africa. Two employees on a business trip travelling by road between states. The tyre blows out. The vehicle leaves the road and ends up in a ditch. Both employees are injured — nothing life-threatening, but significant enough: head injuries, cuts, bruises, shock. They are in a communications dead zone. No satellite phone. No reliable mobile signal.

Within minutes, the situation became more complex. As Rob Ferrey of Callida Freemont recalls: “Some were genuinely coming out to help them, others were coming out to see what they could steal.” Wallets, passports, laptops, and mobile phones were taken. The employees were shaken, injured, and without documentation or a reliable way to contact their employer.

They eventually reached a nearby village. Basic medical attention was available, though not at a standard any employer would choose. Eventually, contact was made with the office. Response vehicles were dispatched. It took roughly twelve hours from the moment of the accident until the employees were recovered, taken back to their base, and given proper medical support.

The incident was contained. It could have been significantly worse - if it had happened at night, if the injuries had been more severe, if the employees had been further from any settlement. But even as it was, the aftermath was considerable. Passports had to be replaced through the embassy. Credit cards had to be cancelled. The employees needed medical follow-up and psychological support. They could not simply resume their schedule.

The same incident in a Western European city would have been a minor inconvenience. In a country with poor road infrastructure, unreliable emergency services, and no established support network, it became a multi-day crisis management operation.

‍

When crisis management strategy is absent: a case study in organisational chaos

An oil and gas company operating offshore in Nigeria had all the physical security measures in place - reinforced structures, access controls, perimeter security. What it did not have was an effective crisis management strategy for the moment those physical measures failed.

When twelve expatriate workers were taken hostage, the method was straightforward. As Rob Ferrey recalls: "It was an inside job - someone opened the door and let the kidnappers in." What followed inside the company's crisis room was anything but straightforward. "The chief exec was running around worrying about insurance premiums. The HR team didn't really have all the contact details and didn't really set up a good way of communicating with family members who quite rightly wanted regular updates almost hourly."

External crisis management consultants were brought in to impose structure on a situation that had become chaotic within the first 72 hours. The immediate priority was not negotiating with kidnappers, which was handled by specialist hostage negotiators. It was establishing what Ferrey describes as a battle rhythm: "A tempo of operations. At seven in the morning, first meeting. These are the discussion points. Then at ten, at one, at four, at seven. Regular updates to the press, regular calls to every family." What that cadence does, he explains, is remove the noise, like stopping media from calling constantly, stopping information from leaking through frustrated employees, keeping families anchored to a predictable rhythm rather than spiralling into uncertainty.

After two weeks, a negotiated resolution was reached. The ransom, which initially demanded at around twenty million dollars, was brought down to approximately five million. The cash was physically transported to the crisis location. Then came the wait. As Ferrey describes it: "We just sat there for about another 24 hours going... they could just take the money and still not release the people. You've got to put your trust in a person that's kidnapped 12 people, which is a strange place to be." The employees were eventually released, medically assessed, and repatriated.

The financial cost was substantial. The oil rig, which the company rented at roughly one million dollars per day, remained non-operational for four weeks. Tens of millions lost before operations could resume. But numbers like that, striking as they are, are ultimately recoverable.

What is harder to recover from is what happened to the people. Twelve individuals held for two weeks under conditions no employment contract anticipates. Colleagues who remained on board, mentally checked out, unable to work, unable to leave, watching and waiting. Families who spent a fortnight by the phone, receiving hourly calls that mostly confirmed nothing had changed. The psychological care required after an incident of this kind does not conclude when the employees are released - it follows them home, into their recovery, and in some cases into their working lives long afterwards. No insurance payout addresses that. No quarterly earnings adjustment reflects it. It is the cost that does not appear on a balance sheet, and for that reason it is often the last one to be taken seriously.

‍

The recovery curve: why speed of response determines the outcome

One of the most useful frameworks for understanding the business impact of a crisis is the relationship between response speed and recovery trajectory. When an organisation detects a problem early, activates a prepared team quickly, and executes a structured response, two things happen: the acute phase of the crisis is shorter, and the recovery starts sooner. The organisation returns to something close to its pre-incident operating baseline.

When the response is slow for such reasons like non-existent crisis management plan, an untested crisis management plan “on paper”, or maybe the plan exists and has been tested but the right people are not in the room - the acute phase extends, the recovery is delayed, and the organisation never fully returns to where it was. The kidnapping case is an example of the latter. The company that experienced it eventually ceased to operate, though the relationship between the incident and that outcome is difficult to establish directly. What is clear is that the total cost - human, financial, reputational, and operational - was substantially higher than it needed to be.

This dynamic applies equally to lower-severity incidents. A medical emergency handled efficiently, with 24/7 access to multilingual medical support and a clear escalation process, may result in an employee receiving treatment the same day and returning to work within a week. The same emergency handled slowly - because the employee could not reach anyone, or reached someone who did not know how to help, or the organisation did not have relationships with local medical providers - may result in delayed treatment, complications, extended absence, and a much more expensive outcome for everyone involved.

‍

What effective travel risk management actually requires

Fulfilling an employer's duty of care for international business travellers is not a question of having the right documents on file. It is a question of whether the organisation can actually do something useful when an employee calls from the side of a road in Africa, or a hospital in Bangkok, or a hotel room in a city where civil unrest broke out overnight.

The ISO 31030 standard for travel risk management provides a useful framework here. It distinguishes between three phases: preparation before travel, support during travel, and care after the traveller returns. Each phase has distinct requirements.

• Pre-travel risk assessment needs to address the realistic risk profile of the destination, not just the most extreme scenarios.
• During travel, employees need access to support that actually works - not a phone number that goes unanswered at weekends, not a platform they have never been shown how to use.
• Post-travel, particularly after a significant incident, employees need structured support rather than an expectation that they will simply resume normal operations.

The practical failure point for most organisations is not the policy. It is the operational infrastructure - the ability to actually deliver 24/7 support, to monitor employee locations in real time, to escalate quickly when something goes wrong, and to manage the response coherently across multiple stakeholders.

💡 Learn more about WorkFlex SOS, the effective travel risk management software, here.

‍

When the system works: a different kind of crisis

Not every incident is a crime or an accident. Some duty of care emergencies develop gradually, where the employee is safe initially but risk may escalate.

One of WorkFlex SOS, our travel risk management software, recent activations took place in a severe storm conditions in Nepal. Two travellers were caught between avalanches to the north and landslides to the south. Roads were closed. Helicopter movement was severely restricted. They were sheltered, provisioned, and physically safe - but at altitude, with limited communications, in an environment where weather windows can close quickly and conditions can shift without warning.

The SOS alert was triggered. A response group was established immediately. What followed was not dramatic. There were no heroics, no last-minute evacuations. There was structure: a defined communication rhythm, regular update intervals, continuous weather monitoring, ongoing assessment of route and aviation feasibility, medical guidance appropriate to the elevation, and contingency planning for scenarios where conditions deteriorated further.

Altitude and isolation do their work quietly. Stress accumulates. Uncertainty compounds. The objective in a situation like this is not rescue per se - it is stability. Keeping people informed, supported, and ready to move when a viable window opens. The situation resolved as conditions improved and movement became possible.

What the Nepal activation reinforced is something that applies across every crisis management scenario, from a road accident in Africa to a kidnapping offshore to two travellers waiting out a storm at altitude: an alert is just a trigger. The calm, structured capability behind it is what determines the outcome. Travel risk management that consists of an alert system without the operational infrastructure to act on that alert is only half of what duty of care requires.

‍

The practical consequence for employers

Duty of care is a legal obligation. It is also a practical test that a business either passes or fails at the moment an employee needs help. The road traffic accident in Nigeria was a relatively contained incident. The kidnapping was a major crisis. Both exposed the same underlying gap:

the difference between having a policy on paper and having the operational capability to act on it.

Organisations that are serious about travel risk management need to stress-test their current arrangements against realistic scenarios. Not the headline events, but the ones that are statistically likely: a medical emergency in a country where the employee speaks no local language, a theft that leaves them without passport and cards, a road incident in an area with poor emergency service coverage. If the honest answer is that the response to those scenarios depends on who happens to be in the office when the call comes in, the gap is larger than the policy document suggests.

The investment required to close that gap is not disproportionate. The cost of not closing it - measured in employee harm, legal exposure, reputational damage, and operational disruption - consistently exceeds the cost of preparation. That calculation has not changed. What has changed is the risk environment in which business travellers are operating, and the standard to which employers are being held.