BTN assistant editor Dawit Habtemariam gathered two small and midsize enterprise travel managers—Mapfre Insurance travel buyer Curtis Cleaves and Diamond Offshore travel manager Renee Gannaway—to wade through the challenges of travel risk management for SMEs. He then collected advice for those managers from Informatica global travel manager Rick Wakida, a veteran in the industry, and Kevin Reagan, sales manager for travel risk management provider Anvil Group.
Travel Risk Management Setup
Renee Gannaway: We have a travel management company, ATPI, who uses WorldAware. All our transactions go through their software. On my desktop, I can access wherever anyone is in the world. If there's an emergency, I can send out an email through WorldAware. [As a separate security service for our 20 most frequent travelers], we send all of their itineraries through to Global Guardian, and they are sent announcements on the countries they're traveling to; on their phone, they have an alert if there's an emergency, they have an SOS button they can push.
Curtis Cleaves: We do not have a risk management program, such as Gannaway with WorldAware. We have a very high percentage of our travel booked through our travel management company, and we have traveler tracking through there where it will give us their location, their hotel, what flights they're taking, limos and their mobile phone numbers so we can call anybody at any time. The travel management company will be proactive in rebooking travel if need be. And we also have emergency contacts for the people that travel.
Veteran View
Rick Wakida: Is it mandatory that travelers book through the designated booking channels? If not, then tools are only as good as the data that goes in, and even if it does mandate that, there are always exceptions and there are always people that don't follow policy. How is that addressed? [Also], relying on the TMC, unless they have their own tracking tool and communication tool, makes it a manual process any time there's an incident for the travel manager to follow up. If you're following up with 50 people, that's very time consuming and not scalable. Providing itineraries to Global Guardian again sounds manual. Ideally you would have an automated system where, based on the bookings, there's a queue to both providers. I'm not saying one-provider-fits-all is better, but how are they integrated and coordinated. And if you have both giving you advice, you could get conflicting instructions where one says, "This is a risky place,” and the other is like, "It's OK. Just exercise caution.” Or worse yet, during an incident, one could be like, "Shelter in place,” and the other could say, "Evacuate.” What does the traveler do in that case?
Kevin Reagan: [If using] multiple sources [of risk management] and multiple dashboards, how is it communicated to travelers what they could expect as far as communications—continuity and messaging—coming from TMCs and Global Guardian?
Communicating with & Training Travelers
Gannaway: Global Guardian does send out information on certain countries for those travelers that are always traveling. We always have our [offshore drilling] crews escorted, so we've got somebody with them when they're going into places that may not be so safe. Say we'll be going into Myanmar. That'll be a new area for us, so we'll work with the ground agents there to facilitate and make sure our travelers get from the plane to wherever they're going and then back. Our [health, safety and environment] department will discuss with them the norms, the cultures of that country. There's just surrounding water on the ocean. They don't do much interaction on land except when they're transporting to and from the airport. But they still try to inform them of the cultures, and that's handled by the agency.
Cleaves: We have a monthly newsletter to our travelers, and we cover a variety of topics. One is safety: what to look for; safety in a hotel, airport; and what to do, what not to do [like] keeping low profiles and avoiding risky areas. We have started working with our security department. We now have a female security officer at one of our locations. So we're trying to get a program set up for our female travelers; about 40 percent of our travelers are female.
Veteran View
Wakida: You're mitigating risk to both travelers and the company: traveler safety and security while they are traveling, and then some catastrophic event that could happen to the executive team could impact the viability of the company as a whole. They can get a lot more leverage out of trying to address travelers as a whole, which would incorporate female travelers, and then carve out some female traveler-specific measures.
Reagan: A general traveler awareness course would be essential for any company that is intending to send their employees internationally, conducting at a minimum annual refresher training to address any new risks that may have arisen in the past 12 months. There are a lot of things we take for granted in the United States as domestic travelers that really could expose us to some threats and risks when we go abroad, such as where to appropriately carry your cash or how to label your bags correctly or what logos to wear or not to wear. Then, if you do have the resources, identify particular employee populations [that] could pose a higher risk, such as a large contingent of lone female travelers. Or you could provide executive traveler training or LGBTQ community specific training. It would be best to focus on that as a second level, providing the general traveler training first for all employees.
Preparing for the Unknown
Gannaway: For our company and our size, we think we're meeting the needs, but you really don't know what your need is until something serious happens, right? So we could be missing something that we aren't covered on, but we don't know that at this point.
Cleaves: We have the traveler tracking. If I see anything that's happening anywhere, I notify our HR department, our security department; I work closely with our security department. We do not have an action plan if something should happen because everything would be situational, so it's hard to plan for. It's also part of a cultural shift. Our travel was pretty much unmanaged three years ago, and we're just bringing it up to speed.
Veteran View
Reagan: You can never plan for everything, from top to bottom. However, if you do recognize that there could be gaps in the program or know that improvements could be made but we just don't know where, consult with a third-party provider that can come in with an unbiased view. Some of them may even have experience in that particular industry and really do a good, thorough gap analysis and make suggestions on where they can improve their program. More often than not, we hear, "Well, nothing's ever happened, so we don't feel that our risk is too great across the globe.” Over the last five years, we have seen the regional risk of Western Europe, in particular, significantly change. Now, there are specific measures in place to mitigate risk when traveling to areas that historically would have been typically safe.
Wakida: As far as not knowing what you don't know, every company is in that position. However, from a duty of care perspective, you need to have some plans in place. I would suggest the two-by-two matrix of impact versus probability. The upper-right square—high probability, high impact to the company—you want to address those first. And then high impact, low probability or higher probability, lower impact. You don't really worry about low impact, low probability stuff, but you have to have the resources and programs in place to react. It's not like, "We have a specific plan the next time 9/11 happens or the next time a volcano erupts.” It's not event specific; it's more about the type of event. If there's an event that shuts down all the airports in Europe, how do we approach that? Who do we contact? Who do we notify in the company, and how do we address it? They may not have the resources of Fortune 1000-type companies. However that does not absolve their duty of care.
Close Calls & Making the Case
Cleaves: We've had shootings at hotels, and I've contacted HR [and] security, let them know if we had anybody in the area. We've had weather situations where there were tornadoes. We just had flash flooding at one of our locations. I try and use those for leverage with HR and security to get something more substantial put into play.
Gannaway: I've been here 11 years [and] nothing has happened, but never say never. There's always something that'll happen. Right?
Veteran View
Reagan: "Never say never.” That's exactly the place we operate from: Craft a crisis-response plan, with the help of a third-party provider if the resources are not there, for any incident on a big level. And then drill down to: What do we do in an active shooter situation, what do we do in a weather situation. Understanding what your global footprint is will be able to help better prepare what type of weather situations you could run into.
Wakida: [A shooting at a hotel where the company's travelers are staying] would be the situation I would harp on to say, "Look, those people that got shot could have been our employees. We need to do something now. We need to invest in resources or a third-party solution to provide notifications, communications, security advice.” If people die while they're traveling for your company, that's the ultimate leverage [to advocate for action], but that's too late. You want to use something that's close that they can relate to, when management can actually picture it: "Hey, that could have been us in the headlines. Right.”
Motivating Stakeholders
Gannaway: It would be nice if we could put some actual formal training in place for people going to new countries. You've got people that are on rigs that never even traveled out of the U.S. We have a big HSE department and they do a lot. They do concentrate a lot [on] offshore drilling—there are so many risks in that, just going to work everyday—but I would like to find a stakeholder that would take on training people and being more aware of different countries, areas and what to do in those situations.
Cleaves: I've looked at ISOS this year and it seems like domestically, we're OK, and in Spain, we have resources there that we can use. It doesn't look like we really have the budget at this time to do anything. I would like to use the new female security officer that we have to put together a program for our female travelers: Webex or newsletter or something and somebody they could call if they had an incident. It's been challenging. It's an afterthought: I talked to the risk people, the compliance people, the security people, and they all agreed that we need something. If we can't find a stakeholder that would want to run it or be responsible for it, then we have to come up with the funds.
Veteran View
Wakida: Make the case that reinvesting in a travel risk management program is reinvesting in your employees, who are part of the product offering. Unless the rigs can run themselves, you've got employees involved, and the duty of care to those employees could be a pretty high priority because without the employees to run it, [the company] can't provide whatever they are providing. One of the more successful ways of approaching engagement and budget is to partner with HR. They are more responsible for employees, whether they're travelers or not, so it's very logical to try to partner with them. Engage HR to include it in their benefits budget on a per-head-count basis. It's easier to get a budget on an item for traveler safety and security based on the number of travelers. If the budget and the pricing is on a per-person basis, the budget will naturally grow as the company expands and the travel base expands.
Reagan: Calculate the risk of what it means when an offshore rig goes down. How many dollars per day are we losing by not having this site be operational? What if a C-suite executive is in an unfortunate accident and either can't return to work or perishes while traveling? Utilize some case studies from the marketplace. Consult with what some other energy and oil and gas companies are doing to mitigate their risk. What sort of major losses have they incurred in the past and how did they overcome that? Calculate that risk and put it into a monetary amount so that when bringing this up the chain to the C-suite, it'll have more of an impact.