Most multinational employers have gaps in their duty of care programs that they are not aware of, starting with war risk exclusions that sit as defaults in their business travel accident plans, according to Kelly Trail, director of global travel risk management at HUB International.
"The defaults in many BTA plans is to have a war risk exclusion," Trail said. "And unless you're specifically targeting and requesting that exclusion to be modified or removed, it's often there. And a lot of times employers don't realize that until something happens."
She said the scale of the operating environment makes the stakes clear. There were 204,000 recorded conflict events globally last year, and employers with people deployed in elevated-risk regions need three things at a minimum: documented risk assessments for every assignment location, contracted evacuation vendors who can respond before an incident rather than after, and tested communication protocols.
"No documentation means no program," Trail said. "Just saying we had a plan, we talked about what to do – without evidence of that, that's not a defense. It basically may as well have not existed."
Trail said every multinational employer should have six things in place, regardless of how many locations they operate in or how high-risk those locations appear.
The first is a pre-deployment risk assessment for every assignment location. She said this applies to all locations, not just the ones that appear dangerous, because a traveler's personal profile can change the risk level of any destination.
The second is a contracted medical evacuation and repatriation vendor. Trail said the relationship needs to exist before a crisis, not during one.
"They are overwhelmed," she said of evacuation providers during active events. "They are focusing on who their clients already are and not potential new business. So you want to have those relationships in place before something happens."
The third is a 24/7 assistance provider that covers all operating regions — someone employees can call day or night for medical or security support.
The fourth is a war risk and political violence coverage audit. Trail said this is where most gaps hide. The default exclusion in many BTA plans means an employer may believe its workforce is covered in a conflict zone when the policy says otherwise.
The fifth is an emergency response and employee communication protocol that has been tested and is known to staff before an incident occurs.
"During a crisis, it's not the time to be scrolling through emails to find contact numbers," she said.
The sixth is a regular duty of care policy review using current risk data – at a minimum once a year, and more often for employers operating in volatile environments.
Trail said one of the most common mistakes she sees is employers relying on government travel advisories as their primary risk intelligence. She said those advisories are a useful starting point but should not be the only tool.
"That is a fantastic start, but what else?" she said. "Those Department of State advisories should just be one tool in your arsenal. They can at times be politically motivated. They may not be as nuanced as you need in terms of specific regions within a country."
She recommended supplementing them with Centers for Disease Control advisories, intelligence from a global assistance provider, and equivalent advisories from other countries to get a broader picture of risk.
Trail said the operating environment is shifting in ways that make duty of care more demanding, not less. She cited data showing that 52% of global insurers identify declining public healthcare capacity as a key driver of rising costs — and said employers should treat that as a permanent change.
"We should plan on this being a structural shift, not a temporary disruption," she said.
When asked what single gap she sees most often when reviewing an employer's duty of care program, Trail pointed to the absence of pre-deployment risk assessments — particularly for locations that are perceived as lower risk.
"We often don't see those pre-deployment risk assessments, particularly for locations that might be deemed lower risk," she said. "And I do think that's important to have plans for every location."
She returned to the point she made at the start of the conversation.
"If there is no documentation, there is no program."
