What an advance work report should give your detail
MXSG Intelligence Desk | Reviewed by Mike Mees, Chief Strategy Officer | Current as of 18 October 2026
An advance work report is a decision document, not a destination guide. It should open with a go/no-go call and the one or two concerns that drive it, then give the detail lead a status for every location, route and movement, each with the date it was last verified. If the lead has to call someone to make sense of a line in the report, that line isn't finished.
Key judgments
- The report should lead with a decision. A go/no-go call, the primary concern and the secondary concern belong on the first page, before any background. High confidence.
- Status beats description. Each element at each site (access, egress, room, Wi-Fi, nearest emergency room) should carry a status such as clear, caution or warning, plus the detail behind it. High confidence.
- Stale information is the quiet failure mode. A route timed a week before arrival, or an emergency number nobody has called, can be wrong on the day. Every entry needs a "verified on" date and a trigger for re-checking. Moderate confidence.
What a good advance report contains
The structure below mirrors the MXSG Advance Work Report. Whatever template you use, these are the questions it has to answer.
1. Bottom line up front. Go, conditional go or no-go. The primary concern (for example, the airport arrival window) and the secondary concern (for example, leisure venues with less control). Three lines, no more.
2. Arrival. Aircraft or terminal handling, the threat level at the terminal, primary and backup vehicles and drivers, primary and alternate routes with timings at the expected hour, and the departure plan. Route timings should be driven at the same time of day the principal will travel.
3. Lodging. Physical security and access control, room selection (floor, sight lines, connecting rooms for the team), counter-surveillance observations, network security, the housekeeping window, primary and secondary egress, the nearest emergency room with drive time, and the check-in protocol.
4. Business venues. Entry and exit points, holding rooms, who controls access, staging for vehicles, and any public exposure such as street-level entrances or press.
5. Leisure venues. These usually carry more exposure than business sites because they are less controlled and more likely to be shared online. Each needs the same element-by-element treatment and a clear note on whether independent movement by the principal or family is authorized.
6. Movement schedule. Date and time, movement, team assignment and notes for every leg. This is the page the team will use most, so it should match the itinerary exactly.
7. Communications and emergency protocols. Check-in schedule, duress procedure, virtual kidnapping response, medical emergency, vehicle breakdown or compromise, and what to do if hostile surveillance is detected.
8. Recommendations, ordered by urgency. Numbered, specific and assigned. "Rear entrance arrival at Venue B, ADVANCE to confirm 45 minutes prior" is a recommendation. "Remain vigilant" is not.
9. Emergency resources. Embassy or consulate, local emergency numbers, hospitals with distances, medical evacuation provider, and the team's own contacts. Numbers for HIGH or CRITICAL environments should be called and confirmed, not copied.
What it should leave out
- Country background the team already has. Put the wider threat picture in the travel risk intelligence brief and reference it.
- Copied advisory text. Summarize what the official advisory means for this itinerary and link to it.
- Anything unverified presented as fact. Mark gaps as gaps. A known unknown is useful; a confident error is dangerous.
- Insecure delivery. The report describes where a principal will be and when. Deliver it encrypted or password-protected, and keep distribution to the people who need it.
How the advance report relates to the intelligence brief
The travel risk intelligence brief answers "what is the threat environment here, and how serious is it?" The advance work report answers "given that environment, how do we move this person through these places on these dates?" The brief should drive the advance: if the brief rates criminal and kidnap risk as the leading domain, the advance should show how arrival, lodging and movement controls address it. ISO 31030, the international guidance standard for travel risk management, treats journey management, accommodation, transport and incident management as parts of the same risk treatment process, which is a useful check that nothing has fallen between the two documents.
Indicators that an advance needs to be re-run
- A change in the official travel advisory level for the destination or a region on the route.
- A new security alert from the embassy or consulate covering the area.
- Demonstrations, strikes or major events announced for the travel dates.
- A change of hotel, venue, driver or vehicle.
- Any sign the itinerary has been exposed, such as a public post, press inquiry or unexplained contact with the hotel.
Sources
- International Organization for Standardization, ISO 31030:2021 Travel risk management: Guidance for organizations. iso.org. Reliability: high.
- Bob Quick for BSI, executive summary of BS ISO 31030:2021, hosted by GSA Global. gsaglobal.com. Reliability: moderate to high (practitioner summary, not peer-reviewed).
- U.S. Department of State, Overseas Security Advisory Council (OSAC), country Crime and Safety Reports. osac.gov. Reliability: high (official).
- U.S. Department of State, Smart Traveler Enrollment Program (STEP). step.state.gov. Reliability: high (official).
- Erin Drake, S-RM Insights, analysis of virtual kidnappings targeting hotel guests in Mexico, 5 August 2020. s-rminform.com. Reliability: moderate.
This article is general guidance derived from open-source materials and MXSG practice, current as of 18 October 2026. It is not a tailored assessment for any traveler, trip or event.