Travel Risk Management Models

By JoAnn DeLuna / April 19, 2017 / Contact Reporter

The concept of tracking travelers became more prominent following 9/11, when companies realized they couldn't account for their travelers, said Jeff Winton, senior sales director and channel manager for risk analytics firm PlanetRisk. The importance companies placed on it, however, dwindled following the 2008 financial crisis, said Reed & Mackay SVP of global strategy and consulting DeAnne Dale. "It was always discussed, but it wasn't a key focus," she said. "But with the political unrest and terrorism we've had [of late], it's gone up the ladder [in importance] again," Dale said. "Duty of care has taken a much more prominent stage in the global request for proposal process for companies."

Corporations used to ask a single question in the RFP for travel management companies. Now, Dale said, companies ask much more detailed questions about TMCs' offerings and put more weight on the offering when choosing one.

TMCs and travel risk management providers also have stepped up solutions, offering more integrated tools and incorporating more data types. Booking data, for example, indicates the general city and hotel where a traveler should be, but it doesn't account for the time spent traveling between airports and hotels or time spent at offsite meetings. Other suppliers have launched solutions to fill the gaps or integrate with travel risk management providers to deliver off-channel booking data.

Travel Risk Management Through the TMC

Companies can track travelers by sending and approving travel requests through email, but that can become overwhelming, especially in crises. The most effective way is for a TMC to integrate with a corporation's travel booking-and-request process to gather the data, said iJet VP of operations George Taylor. When a natural disaster or terrorist attack occurs, the TMC can provide reports on where travelers should be, based on booking data. He suggested consolidating to three TMCS at most to keep the reports manageable. TMCs also should be able to provide booking data to third-party travel risk management providers through direct feeds or Excel reports.

Some TMCs offer more sophisticated tools for extra fees, such as map dashboards or two-way messaging tools. Most large TMCs also partner with third parties to provide medical and security assistance. Carlson Wagonlit Travel partners with International SOS, while BCD Travel partners with Anvil.

Duty of care has taken a much more prominent stage in the global request for proposal process for companies."

Reed & Mackay's DeAnne Dale

Reed & Mackay's IQprotect tool is part of the TMC's standard offering, according to Dale. Clients pay a one-time setup fee for the entire portal, including the online booking tool, mobile app, IQprotect and other offerings. Customizations, though, cost extra.

When travel managers or agents log in to IQprotect, they see a world map with iJet's country risk ratings and with pins for travelers' locations, based on itinerary information, Dale explained. And from the time an employee books travel through the end of the trip, the traveler receives notifications of any events that could affect the trip. While iJet supplies the map and emergency alert intelligence, Dale said it otherwise is not involved. If an incident occurs, travel managers can geocode an area and send blast emails or texts to travelers who may be impacted, asking them to check in by replying. Reed & Mackay also trains clients to have their travelers check in through the TMC's app proactively. The app then sends the travelers' locations back to the system. The TMC, however, avoids tracking travelers via their phones' GPS, owing to privacy laws, Dale said. The platform tracks who has checked-in and who is still unaccounted for.

Additionally, Reed & Mackay has a six-person, 24/7 Incident Management Unit whose "sole responsibility is to monitor world events, send out timely alerts and identify impacted clients," explained Dale. The IMU sends the information to the TMC's after-hours emergency team of 24 agents, which helps reaccommodate travelers.

TMCs typically work with each client to establish communication protocols for when something goes awry, whether the travel manager runs the operation, the TMC starts by contacting the travel manager, they work together or they follow another arrangement, such as contacting the company's security or risk department. Reed & Mackay also may kick attempted bookings to specific countries to travel managers for approval if the countries' security level increases, Dale said.

In addition to the travel booking data TMCs absorb, they typically receive HR feeds. Reed & Mackay also can take an expense management tool feed, which usually includes the credit card feed, Dale said. This is atypical for a TMC, however, which will often rely only on booking data, but the space is evolving with more advanced business intelligence tools.

Before Takeoff: Low-Tech & No-Tech Checklist

HR feeds are the best way to keep information 100 percent up to date because they're the most accurate, according to iJet VP of operations George Taylor. But there are other low-tech and no-tech safeguards, too:

Travel Policy: The first step in tracking travelers and keeping them safe is a travel policy that governs how travel is booked and approved. A travel policy not only helps companies manage costs but also allows them to "develop a culture around the process [and], at the basic level, allows some awareness internally of where people are traveling and when," said Taylor.

Communication Protocol: Before travelers take off, companies should develop plans for emergencies and rehearse them with travelers, he emphasized. This includes a protocol for a travel manager to reach out to potentially affected travelers or for travelers to check in by calling, emailing or texting a designated person or hotline. Two-way messaging tools, typically provided by travel management companies or third-party travel risk management providers, can automate this.

Cell Phone Number: When asked to supply the contact number at which they can be reached, some travelers provide their home or office numbers or an emergency contact. That doesn't help in emergencies, when employers need to reach travelers directly. Pre-trip approvals also are a good opportunity to ensure each traveler has provided a preferred-contact method in his or her HR file, which typically feeds to a TMC or a travel risk management provider.

Alternate Contact Route: Companies also should be open to alternative forms of contact, such as Skype or WhatsApp, Taylor said. "One of the shortcomings is that the people in charge of the programs assume that every traveler has the same ability to communicate ... when they travel, but not every traveler has a data plan," he said. It's pushing it to list Facebook as a preferred contact method, though; he's seen mostly younger travelers do this. Facebook Safety Check allows users to mark themselves as safe in crisis situations, but companies typically can't see their employees' Facebook pages.

The Evolving Concur Solution

In March, Concur upgraded its Risk Messaging tool. Among the changes: It now lives in Concur's T&E solution and offers more data feeds. For a fee, it also offers a 24/7 Active Monitoring program powered by HX Global. Concur provides travel managers a map that includes traveler locations based on data from its booking tool. Beyond what most TMCs can pull together, Concur additionally integrates data from TripLink, Tripit, expense, credit cards and e-receipts from integrated partners like Airbnb and Uber. Beyond the location map, Risk Messaging enables two-way communication capability so travel managers can message potentially distressed travelers en masse. Travelers can also check in through the Concur app, and the Risk Messenger map interface will display which travelers have checked in or not.

Concur EVP of global products Tim MacDonald claimed that before Concur clients sign up for Risk Messaging, "our customers don't know or don't see a travel plan for anywhere between 20 and 50 percent of their employees," if they are pulling only booking data from their TMC. "That's a real duty-of-care issue," he added. "We're leveraging all the location data that customers already have in Concur expense, e-receipts from our different platform partners, via credit card charges and check-ins from our mobile app, in addition to TripLink data."

This capability, according to Concur, eliminates the need to stream multiple data feeds directly into a full-service provider (which Concur does not do). Instead, the client company can deliver positive traveler identification and location information wherever the client needs it to go—primarily to an on-the-ground assistance provider.

"You need an assistance provider for a duty-of-care program," said MacDonald. "That can be International SOS, iJet, HX Global—it can be anyone—so when an employee is in trouble you have boots on the ground who can help them out."

Without Risk Messaging, MacDonald said, access to TripLink data is still possible with Concur's partner TMCs (which include the likes of Adelman, Christopherson Business Travel and Gant Travel). "Our TMC partners have either written to our API to pull that TripLink itinerary information, put it in their processes and combined it with GDS itineraries that are pushed to the assistance provider, or they're using our mid-office technology and through that they're combining the two data sets and pushing to the assistance provider," he explained.

Full-Service Travel Risk Management Providers

When building a travel risk management program, a full-service provider would be roughly analogous to hiring a general contractor when building a home: an individual could hire builders, electricians and plumbers on their own, but a general contractor has the relationships and the know-how to manage all the pieces, plus brings expertise to the table.

Firms like Anvil, ISOS and iJet bring with them data aggregation capabilities, tracking tools, map interfaces and two-way messaging, check-in functions and panic notifications. They offer 24/7 risk monitoring and they are often the ones supplying TMCs with their emergency alerts, country-level risk ratings and traveler mapping technologies. Further, they bring knowledge about insurance requirements, local medical ratings and, very importantly, relationships with a network of on-the-ground assistance providers and evacuation experts.

That said, full-service providers aren't always the right fit, but they are especially helpful for companies with considerable traveler volumes or those with travelers regularly on the ground in higher risk markets.

The reality is: Some organizations don't have a very big shop or a security shop. Whoever is handling this type of thing is maybe a one-person show," iJet's Taylor said. "The mix-and-match approach works if your magnitude of travelers … is fairly small and you can juggle some tools. But what if you had 300 people like in Paris?" That would quickly become overwhelming for a travel manager or even a security department to handle without an established and coordinated team. That's what a full-service provider brings to a crisis situation.

Additionally, companies are also realizing they need to track all employees, not just travelers. More full-service travel risk management providers are looking at the mobile distributed workforce, not just travelers, said Winton.

Ripe for Integrations & Innovation

The travel risk management arena has evolved quite a bit, but there's plenty of room for more change. Some of the latest updates:

ISOS & Uber: Last July, ISOS partnered with Uber to combine their technologies to "enhance the visibility and duty of care for global enterprise companies," and ISOS promises "enhanced duty-of-care features," for joint customers, but the companies didn't specify further.

Airbnb Upgrades: Airbnb for Business enables travel managers to see where their travelers are via the management platform. It is unclear whether Airbnb can directly feed its data into a travel risk management provider, but it can provide e-receipts to Concur to inform Risk Messaging.

Dataminr & Social Media: Startup Dataminr is an annual-subscription data feed that monitors Twitter for mentions of emergencies and unexpected events that could impact travelers. Its corporate clients, which include Fortune 500 companies, have access to the intelligence through desktop apps, integrated notifications, mobile apps and an application programming interface, explained VP of corporate security Dillon Twombly. It doesn't integrate with any TMCs, travel risk management providers or Concur, but Twombly said they're "exploring integrations with select third-party platforms."

Next Gen & Predictive Tools: GeoSure, which launched in 2013, uses proprietary and nonproprietary data from organizations like the Centers for Disease Control and Prevention, Interpol, World Bank, World Health Organization, the United Nations and human rights organizations to rate more than 7,000 cities and neighborhoods on a 1-to-100 scale on physical harm, theft, basic freedoms, disease and medical, women's safety and an overall score down to the neighborhood. "Trying to understand country-level safety is almost irrelevant to the travel community [because] it's very difficult to stick one number on a [whole] country," said GeoSure CEO Michael Becker. "We go into not just the city level but also into the neighborhood level." GeoSure also has developed analytics and safety ratings for specific traveler demographics, such as females, and is working on safety ratings specifically for LGBTQ travelers.

Planet Risk functions similarly, with access to broad data sources and use of algorithms to track granular safety scores. Its algorithms can incorporate historical data to identify activity patterns that indicate emerging threat levels. The move to predictive analytics for travel risk management is the next generation of innovation.

Return to Taking on Travel Risk Management