There's a new
conventional wisdom in town: Wherever risk management lives within the company
structure, travel management and security both should have a seat at the table.
So BTN decided to gather some security managers and travel managers at our own
roundtable to talk about how the two functions interact in the name of travel
risk management. BTN managing editor Amanda Metcalf spoke with:
BTN: Cindy,
the way travel and security work together at Regeneron has evolved quite a bit
since you joined the company. Travel wasn't involved in risk management at all
before, right?
Cindy Shumate: When I got here a year ago, there was a small group, which consisted of
the head of global security and then two people from HR, working with our risk
provider. They thought they had integrated completely with a [passenger name
record] data transfer, but it sort of fell on deaf ears because it just wasn't
connected with the travel aspect; the two messages were somewhat disconnected.
All of a sudden, here I come. I've worked very closely with two different
travel risk providers [when working at Estee Lauder and Princeton], and it's
been a very integrated message. So I hopefully gracefully inserted myself, and
we started talking about the fact that this focus on travel risk comes out of
the fact that people are traveling. We have a natural reason to get together
and talk about this and develop this program together.
BTN: What
else is changing now that you've pulled up a chair?
Shumate: [Two
months] ago, our head of security contacted our [risk management] provider, and
now they're doing a complete assessment of our view of travel risk. Hopefully
this assessment will take us several steps closer on that maturity waterfall.
Interestingly, on March 22 when we had a need to turn to our [risk management]
provider, they told us that out of 625 PNRs that had been transferred from our
TMC into their system, 621 were lacking email addresses and cell phones. We've
been doing this data transfer without the essential pieces of information for
contacting our folks. As I've been working with the TMC, too, I've discovered
some gaps in what had been requested in HR feeds. Folks didn't really
understand what data was necessary and where it came from and how you had to
request the critical fields going from one profile system into another.
Mauro Ruggiero: We were running into the same problem maybe a year ago. We now have the
feed from our HR tool into our TMC, which keeps our profiles fresh and deletes profiles
that are no longer necessary and keeps all the contact info. And then from our
TMC, it goes into our security firm, so it's been able to fill in the gaps.
BTN: As Cindy
told that story about that data breakdown, what were you guys on the risk side
thinking?
Dan Gallagher: Listen, been there, done that. When I first started at AIG, we didn't
have anything—we didn't even have a common booking tool—probably seven or eight
years ago. We didn't even have an ability to recall or even govern where our people
were going.
BTN: So how
integrated are the risk and travel roles now?
Gallagher: We
are tied at the hip. It starts with a fit-for-purpose travel policy, and for
that to work to the level that is expected today for a large company during an
incident like London, it starts with the proper integration of the travel
information, but there's a lot more to it. For us, it's a very holistic program
that requires several components of our team to monitor and recall, but it's
also that upfront travel policy to try and prevent us from ever being in a
situation like that, then be able to understand where our people are, reach out
and touch them either with a message or physically get on the ground. It's very
closely aligned with our HR groups, as well as with our travel groups.
BTN: Tracy,
you're also on the risk side. Do you have an active counterpart in the travel
program? Do you sit down and meet with someone?
Tracy McPike: That
is Kirsten Jackson. We are now hiring ISOS. [The decision to hire a risk
management provider] came from travel. We collaborated with our HR department,
our law department. All three of us in risk management were there. Our security
facilities director was there.
BTN: Kathy,
what about at NetApp?
Kathy Rust: Our
risk management team and travel team and safety and security all work hand in
hand. Risk management actually owns the relationship with ISOS. We collaborate
in addressing issues and coming up with policy and direction to travelers.
Travel generally facilitates the messaging to travelers and to our TMC, while a
lot of decisions are made by risk management, legal, HR and so forth.
BTN: It's
always been that way?
Rust: I've
been at NetApp for seven years. When I started, risk management actually was a
part of safety and security. Over time, risk management got split off and
travel got split off, but the three have continued to stay in good touch and
collaborate on communication.
BTN: It
sounds like for everyone here, the travel management and risk management roles
are making decisions together or consulting each other. What prompted these
positive relationships?
Shumate: March
22 in London was a really great moment to emphasize that we needed some
protocol in place. The head of security and I said, "OK, the next time
something happens, you and I must be on the phone with each other immediately.
The rest of this team—we need to coalesce so that then we can build our plan
from there." But to set up protocols to severity levels—what do we do when
it's extreme versus something that's not so extreme—we're back at Step One to
build the program and the integrations and when do we need ISOS to support us
and all that kind of stuff. Sounds like we've all come through that evolution.
Ruggiero: Oh
yeah.
Rust: We have
always worked together, but we have had incidents happen in the seven years
that have underscored the need to refine processes. A few weeks after I
started, we had the [Icelandic] volcano ash cloud incident [that disrupted air
travel in Europe for six days], and that forced us into collaborating with [our
risk provider] to find all our travelers and get them home safely, and so we
improved our processes after that. And then when the tsunami hit in Japan and
we had to look at continuity of business and the risk to our employees in
Japan, we worked with risk management and put in protocols that continue to
this day. We're getting better and better over the years, and that has taken a
concerted effort.
BTN: Mauro,
you oversee both travel and risk at Misys. How did that come to be?
Ruggiero: When
we started with the integration of ISOS, we knew it was important to get the
bookings into their systems, make sure the data we were transferring was
accurate. We don't run a big shop—it's really just me and one other person
based in Dublin—so we took it over because we were going to be able to control
it. Now, we have pre-travel emails that go out from ISOS if a country [has a
risk rating of] 3 or higher. The TMC will not be allowed to book travel to
certain countries, so it comes to our team and then we basically dive in and
make sure that the traveler is aware of the dos and don'ts and give them the
information via ISOS. It just made sense to all be handled by the travel team.
BTN: How
about working with HR? Any roadblocks there?
Ruggiero: They
don't really understand travel, and then on top of it they don't always
understand risk. Most of the time, we have HR involved only if it's a long-term
assignment. We try to keep them out of it as much as we can. You get mixed
messages going back and forth to the travelers, so we try to have the travel
team deal with the majority of it.
Shumate: HR
here was referring to travel risk and the partnership with ISOS as a benefit.
They weren't really thinking that travel needed to be involved because it was
really just a voluntary benefit [for the travelers to be] able to get the
alerts or to travel with that card and the phone numbers. I came into the
conversation [to help them realize] that the data was coming from the travel
side and that in any one of these instances, it would be our TMC partner who
should be working with the travelers to then assure that we can reposition and
get them back when their initial itineraries are disrupted. There [can be] a
misperception that ISOS would take care of it. They will if that's part of your
relationship with ISOS, but it's probably not the most expedient.
Gallagher: The
data quality has to be prioritized. Risk managers and security personnel,
travel personnel have done a lot here in the United States of helping
organizations understand what their duty to care for their employees actually
entails. The liability that a company takes on when it deploys personnel for
business travel is a very real thing. I work for an insurance company. We hedge
bets for a living, and that's the approach that we took. It was a risk-based
financial approach to getting this organization to prioritize these things,
which led groups like HR to prioritize things like data quality that we rely on
for our travel management systems.
BTN: Any
other ways that you guys interact with your counterparts?
Gallagher: I hate to plug this, but: utilizing risk and their
expertise to ensure you're purchasing the right [insurance] coverages with the
right services for your organization. That gives you an ability to build an
infrastructure and policy around it.