Even Mature Risk Management Programs Need an Occasional Tune-Up

Finastra director of global travel management and workplaces Mauro Ruggiero knew that the financial software company had a well-developed travel risk management program, but an independent assessment revealed some gaps.

With employees traveling in high-risk locations including Iraq, Pakistan, Israel and Lebanon and given the general responsibility as a corporation to protect employees, Finastra already had numerous risk management best practices in place. It was working with International SOS and monitoring its employee travel, ready to follow up and chase down employees if something happened in the area in which they were traveling.

"I was confident to say we had a very mature approach in how we protect our travelers when they are out and about," Ruggiero said.

Assessing the Program

At the suggestion of Advito, the consultancy of BCD Travel, Finastra's travel management company, Finastra's travel and security teams worked with BCD and Advito to analyze their travel risk management program, seeing how well it aligned with ISO standards on risk management.

"They could come in, take a look at that as a third party, 10,000 feet above, and give us an unbiased view, tell us where we could improve and score us," Ruggiero said.

As Ruggiero had assessed, the analysis showed Finastra's risk management program was "well-managed" in "several areas." However, there were others where "we needed to do a better job," he said.

One major gap was that Finastra lacked a separate travel risk policy, which "was not something that was even on our radar," according to Ruggiero. The company now is putting that together, with hopes that will be approved by its policy committee in a month or so, he said.

The assessment also showed a need for Finastra to improve its communication around its travel risk management program, Ruggiero said. That new communication effort will kick off once the new policy is approved.

"We already have the traveler intranet page that houses a lot of the traveler risk components that we offer, such as International SOS link and a list of cities that are high-risk," he said. "We have it all, but we learned we need to tie it together better."

Part of the communication strategy will be a form for travelers to acknowledge they understand the risk management resources that are available to them, Ruggiero said. Travelers going to high-risk areas will have a separate, more detailed acknowledgement document. Ruggiero said he is hopeful that will also drive higher use of ISOS by travelers, which currently has "very low utilization."

Keeping it Fresh

Ruggiero said communication would be an ongoing process, which also was a recurring theme at the annual Global Travel Risk Summit in Houston earlier this summer, co-produced by HospitalityLawyer.com and The BTN Group. Several speakers highlighted how business travelers often remain unaware of resources available to them.

For example, Jason Selvon, co-founder of risk and crisis management firm RISRR Global, said 60 percent of travelers are not using the U.S. State Department's Smart Traveler Enrollment Program to stay updated on destination-specific safety information. At the same time, Selvon said information—particularly on the legal and medical side—from embassies often can be out of date, as many work with small staffs with limited resources, so effective communication must be backed up by a company's own efforts.

"You have to take that as face value and do your own research, build your own logistical pipeline and support network in those countries," Selvon said. "If you're traveling down to Colombia often because there's a huge client out there, send someone out to ensure you know what car rental organization you want to use, what hotels you want to use and how far you should stay from the embassy."

Ross Pratt, SVP and managing director of the Americas for TMC Wings Global Travel, recommended random testing of travelers who frequent high-risk destinations. That can help ensure they remain aware of related risks and that they are not falling into patterns that could put them in danger.

"Maybe the person goes on rotation and has been on the same rotation for 10 years and keeps going to the same place over and over again," Pratt said. "Do you just forget about them and think they know what they're doing?"

Avoiding Complacency

Duty of care remains the top priority of BCD clients, and risk management figures in the other top priorities per the TMC's most recent annual client survey, BCD Travel Global Crisis Management senior program manager Christine Connolley said. As such, she's "definitely seeing a demand" for travel security program assessments to align with the ISO 31030 standards published a few years ago.

"It's so exciting to have this real framework and approach to risk management," she said. "We can really go in and fine tune with clients their programs to make sure their employees are really traveling safely and they're really fulfilling their duty-of-care obligations."

One of the most frequently identified need for improvement is establishing internal stakeholders rather than having the majority of the responsibility fall on the travel manager, who is "rarely equipped to handle an emergency" such as a traveler needing medical assistance, Connolley said. The assessment can help build a "cooperative endeavor" between security, HR, finance, legal and executive management for risk management.

"If they don't have that, all the dominoes fall, and it just goes back to the travel manager, who is almost powerless," she said. "And they can't be available 24 hours a day."

Beyond the assessment, Connolley said it's also critical for traveler feedback to gauge risk management, which can be accomplished by adding security questions to post-trip feedback surveys. For example, she recalled a recent trip where she arrived at a hotel to find the door to the connecting room had been left unlocked.

"If my employer asks me, 'How was your trip; did you feel safe?' and I can report that back to my employer, they can go back to the preferred hotel and address it," Connolley said. "The traveler is on that front end and is going to be your best testament to that experience."

Even when it seems like all the best practices are in place, however, maintaining a risk management program is a never-ending job.

"Any company that doesn't do an assessment is sorely missing the boat on a great opportunity to improve," Ruggiero said. "Even if it's 99 percent there, there's still that 1 percent you can improve, and that shouldn't be looked at as a negative."