ISO 31030 in plain terms: duty of care for traveling executives
MXSG Intelligence Desk | Reviewed by Mike Mees, Chief Strategy Officer | Current as of 18 October 2026
ISO 31030 is the international guidance standard for managing the risks of business travel. It cannot be certified against. What it gives an organization is a defensible structure: a written policy, risk assessment for the kinds of travel you actually do, controls proportionate to the risk, communication with travelers, and records. After an incident, those records are what show that duty of care was taken seriously.
Key judgments
- Any claim to be "ISO 31030 certified" is inaccurate. It is a guidance standard. Organizations can align with it and audit against it, but there is no certification scheme. High confidence.
- It is built for proportionate use. The standard applies to organizations of any type and size, and its guidance can be scaled down for a family office or a small firm with a handful of travelers. High confidence.
- Records are the most overlooked element and the one that matters most later. A sound decision that wasn't written down is hard to defend. Moderate confidence.
- The current edition remains the reference. ISO's systematic review of the 2021 edition closed on 3 September 2026. Until ISO publishes the outcome, the 2021 text is current. Moderate confidence.
What the standard is
ISO 31030:2021, Travel risk management: Guidance for organizations, was published in September 2021 by ISO's risk management committee, ISO/TC 262. It is built on the principles and process of ISO 31000:2018, the general risk management standard, and aligned with ISO 45001 on occupational health and safety.
It applies to commercial, governmental, non-governmental, charitable and educational organizations. The travelers it covers include employees and others traveling on the organization's behalf, such as contractors. It does not cover tourism or leisure travel, except where someone travels on the organization's behalf.
It defines duty of care as the "moral responsibility or legal obligation of the organization to protect the traveller from threats and risks."
What it asks an organization to do
1. Understand your context. What are your business objectives, your appetite for risk, your stakeholders, and who travels where and why? A family office whose principals travel privately has a different profile from a company sending engineers to project sites.
2. Set up the program. Leadership commitment, a written travel risk policy, objectives, clear roles and accountability. Someone has to own travel risk, and travelers need to know who that is.
3. Assess the risk. Identify threats and hazards for each destination and type of travel, analyze them, and evaluate them against criteria you set in advance. This is where a structured method such as a domain-based threat matrix earns its place: it makes assessments consistent from trip to trip.
4. Treat the risk. Avoid it, share it (for example through insurance or assistance providers), or reduce it. Reduction covers booking, accommodation, transport, journey management, medical support, information security and incident management.
5. Communicate and consult. Brief travelers before they go, keep a way to reach them while they are away, and make sure they know how to raise an alarm.
6. Monitor and review. Track incidents and near misses, survey travelers, benchmark the program and improve it.
7. Record and report. Keep the assessments, approvals, briefings and incident records. The standard's annexes add guidance on program development, minors traveling without guardians, travel during global disruption, training and accommodation in higher-risk locations.
Applying it in a small organization
You don't need a travel risk department. A proportionate version for a family office or a small firm looks like this:
- A two-page travel risk policy that names who approves higher-risk travel.
- A simple set of risk criteria, for example what overall rating requires a senior sign-off and what rating means a trip doesn't go ahead.
- A pre-trip assessment scaled to the destination: a short brief for low-risk trips, a full intelligence product and advance work for high-risk ones.
- A traveler briefing and a contact plan.
- An incident plan with named decision-makers.
- A short post-trip review.
- A folder with all of the above, kept for every trip.
What it means for principals and protective teams
- Ask your provider which part of the standard each product supports. A travel risk brief is risk assessment; an advance work report is risk treatment and journey management; a check-in plan is communication.
- Keep the paper trail. Approvals, briefings and the assessment itself should be dated and stored where they can be found.
- Review after every significant trip. The standard treats monitoring and review as part of the program, not an optional extra.
What to watch
- The published outcome of ISO's 2026 systematic review: confirmation, revision or a new edition.
- National legislation that turns parts of the standard into obligations, such as health and safety duties that reach employees traveling abroad.
- Insurer and client contract requirements that reference ISO 31030 by name.
Sources
- International Organization for Standardization, ISO 31030:2021 Travel risk management: Guidance for organizations (status and life cycle). iso.org. Reliability: high.
- ISO/TC 262, project page for ISO 31030:2021. committee.iso.org. Reliability: high (committee page maintained by a third party for ISO).
- Bob Quick for BSI, executive summary of BS ISO 31030:2021, hosted by GSA Global. gsaglobal.com. Reliability: moderate to high (practitioner summary, not peer-reviewed).
- International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines. iso.org. Reliability: high.
This article is a general summary derived from open-source materials current as of 18 October 2026. It is not legal advice and is not a tailored assessment. Consult the standard itself and qualified counsel for your organization's obligations.