ISO 31030 travel risk management for everyone who travels on your behalf.

What it is

What is ISO 31030 and what is it used for?

ISO 31030 is the international guidance on travel risk management. It shows an organisation how to manage the risks that arise when its people travel for work, both the risks to the travellers themselves and the risks to the organisation: a medical emergency abroad, a security incident near a hotel, a stolen laptop, a cancelled flight during a crisis, a traveller who cannot be reached. It covers the policy, the programme, the identification of threats and hazards, risk assessment, and the measures that prevent or reduce harm.

The method is borrowed from ISO 31000. ISO 31030 applies that standard's principles, framework and process to travel, so an organisation that already manages risk in the ISO 31000 way will recognise the logic. ISO itself notes that the document is not a management system standard. Its value is practical: it turns duty of care from an intention in a travel policy into decisions made before each trip, with evidence that they rested on reliable information.

Current edition. ISO 31030:2021, the first edition, published by ISO in September 2021 and developed by ISO/TC 262, the risk management committee. ISO's systematic review of the document closed on 3 September 2026; ISO has not yet announced whether it will be confirmed, revised or withdrawn. Because ISO 31030 is guidance, any future edition brings no certificate transition, only a review of what your programme should adopt.

Who it is for

Who needs ISO 31030?

ISO 31030 is written for any organisation that sends people on work travel, from a charity with field staff to a university with visiting researchers. It does not cover tourism or leisure travel, except where the traveller is travelling on behalf of the organisation. Organisations usually come to Sterling for ISO 31030 from one of four starting points:

• A customer or tender asks how you protect travelling staff. Service contracts, project bids and supplier questionnaires increasingly ask for a travel risk policy and evidence that it operates. ISO 31030 gives the answer a recognised structure.
• Your insurer or board wants evidence of duty of care. A near miss, an incident or a new destination prompts questions about who approved the trip and what was known. The programme answers them before they are asked.
• Regulators and occupational safety obligations reach travel. Work-related travel is part of work. Where your safety management or local law expects travel hazards to be assessed, ISO 31030 supplies the method; we work alongside your legal advisers on the obligations themselves.
• Group companies travel on different rules. Subsidiaries book, approve and track travel in their own way, and nobody can say who is where during a crisis. One group programme with local ownership closes that gap.

Requirements

What are the main ISO 31030 requirements?

Strictly, ISO 31030 contains guidance rather than requirements, so nothing below is an audit checklist. Its main clauses, 4 to 10, set out what a travel risk management programme should address, and informative annexes add detail on programme development, minors travelling without legal guardians, global disruption, risk treatment restrictions, training and accommodation in higher-risk locations. The list is a plain-language map of the main clauses:

• Clause 4 Understanding the organisation and its context: the operating context, stakeholders, the travelling population, business objectives, risk appetite and criteria, and how travel risk management is delivered.
• Clause 5 Managing travel risk: the policy, the programme and the responsibilities that make travel risk a managed activity rather than an individual's judgement.
• Clause 6 Travel risk assessment: identifying threats and hazards for the destination, the journey and the traveller, then analysing and evaluating them against your criteria.
• Clause 7 Travel risk treatment: the prevention and mitigation measures, from approval and briefings to tracking, assistance and emergency response.
• Clause 8 Communication and consultation: telling travellers what they face and involving them, their managers and your providers in the decisions.
• Clause 9 Programme monitoring and review: checking that the programme works and stays current as destinations and circumstances change.
• Clause 10 Programme recording and reporting: keeping the records and reporting the information management needs to decide.

Implementation

How do you implement ISO 31030?

Because ISO 31030 is guidance, there is no certification audit at the end. The route is to design a programme, run it through real trips, and have your management and internal review confirm that it operates. Sterling supports the design and the first cycle; the decisions about acceptable travel risk stay with your leadership.

1. 01
   Map who travels, where and why.Confirm the entities, the travelling population, the destinations, the booking channels and the providers already in use.
2. 02
   Gap analysis: compare current practice with ISO 31030.Review policy, approvals, briefings, tracking and emergency arrangements against the guidance, keep what works and agree actions, owners and dates.
3. 03
   Set the policy, criteria and responsibilities.Leadership approves the risk appetite for travel, the approval levels by destination risk and who acts when something goes wrong.
4. 04
   Assess, treat and brief.Destination and journey assessments, treatment measures, traveller briefings and the emergency plan, put into use on real trips.
5. 05
   Exercise, review and report.Test the emergency arrangements, review incidents and the programme against its objectives, report to management and close the gaps with evidence.

Check the route before you sign. ISO describes ISO 31030 as guidance and not a management system standard, so ask any provider offering an "ISO 31030 certificate" which accredited scheme it relies on, and verify the answer with the body named. If your customer needs a certificate, ISO 45001 through an accredited certification body is the certifiable route for workplace safety, with travel addressed inside it.

Cost

How much does ISO 31030 implementation cost?

The cost follows the shape of your travel, not the length of the standard. A firm whose staff visit a few low-risk cities needs a lighter programme than an NGO with field teams in higher-risk regions. The proposal shows every component and one all-inclusive proposal.

Timeline

How long does ISO 31030 implementation take?

The pace depends on how quickly leadership agrees the criteria, how many entities are involved and how soon real trips and an exercise can test the programme. As Sterling's estimate, a first programme usually takes two to four months, and longer where many countries or higher-risk destinations are in scope.

Share any tender or insurance renewal date at the start, and we will say what is achievable by then.

Your engagement

What your ISO 31030 engagement includes

Choose the level of support that suits your team: with Design™ our consultants guide your people as they build the programme; with Drive™ we manage the work and your people decide and approve. They are alternatives, not stages. Either way, Effivity is the Automate™ layer from day one, and Sustain™ keeps the programme current afterwards.

• Travel profile, gap analysis and plan

  Who travels, where and how, compared with ISO 31030, with owners and dates agreed.

• Policy, criteria and procedures

  Approval levels, briefings, tracking and emergency response written for your organisation.

• Effivity ISO & GRC software

  Assessments, actions and incidents in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Exercise and programme review

  A tested emergency scenario and a review reported to management, with gaps closed.

• Sustain™ after launch

  Annual review, refreshed assessments and support as destinations change.

There is no ISO 31030 certificate, and Sterling does not certify, attest or validate your programme.

Often combined with

Standards organisations pair with ISO 31030

• ISO 39001ISO 39001 certification consulting to reduce death and serious injury from road traffic crashes you can influence, ready for an accredited certification audit.
• ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
• ISO 45002ISO 45002 guidance explained: how the ISO 45001 implementation guidelines work, why there is no certificate, and how Sterling applies them to your system.
• ISO 45003ISO 45003 psychosocial risk consulting: manage work-related stress and wellbeing within your ISO 45001 system.
• Process safety management (OSHA PSM and Seveso III)Process safety management compliance and requirements for OSHA PSM and Seveso III sites: applicability, gap analysis and programme build.