UNIVERSITY TRAVEL RISK: THE HIDDEN DUTY OF CARE GAP

An executive guide for Australian universities developing a modern travel-risk management

Prepared by Changing Times

Executive Summary

University travel has changed.

Academic conferences, research trips, international partnerships, student exchanges, fieldwork, placements, recruitment, sporting activities and executive travel can take university staff and students into an increasingly complex range of environments.

Yet many universities still manage travel risk through a combination of individual policies, departmental procedures, travel booking processes, insurance arrangements and traveller judgement.

The result can be a significant gap between booking travel and managing the traveller's risk throughout the journey.

Travel risk management is no longer simply about arranging an airfare, providing insurance and giving travellers a link to government travel advice.

A modern university travel-risk framework should consider the entire travel lifecycle:

Plan → Assess → Approve → Book → Track → Support → Respond → Review

International Standard ISO 31030:2021 provides a recognised framework for organisations to develop, implement, evaluate and review travel-risk policies and programmes. Importantly for universities, ISO specifically identifies educational organisations within its scope.

For Australian universities, the issue is particularly relevant because travel can involve staff, students, researchers, academics, executives, contractors and other approved travellers — each with different risk profiles and responsibilities.

This paper outlines the key components of a practical university travel-risk framework and provides a simple ten-point health check for institutions reviewing their current arrangements.

1. THE TRAVEL RISK CHALLENGE

University travel is fundamentally different from leisure travel.

A traveller may be:

• Conducting research in a remote location

• Attending an international conference

• Travelling with students

• Undertaking a clinical or academic placement

• Visiting an international partner institution

• Conducting fieldwork

• Recruiting international students

• Representing the university at an event

• Travelling to a country experiencing political or social instability

• Working with sensitive research, equipment or data

• Combining university business with personal travel

The university may therefore have responsibilities extending beyond simply getting the traveller from A to B.

Risks can include health incidents, accidents, natural disasters, political instability, civil unrest, crime, terrorism, cyber threats, transportation disruption, border issues and changes in destination conditions.

There are also less obvious risks.

• What happens if a traveller's flight is cancelled during a regional emergency?

• Who knows where the traveller is?

• Who contacts them?

• Who determines whether they should continue their journey?

• Who has authority to arrange alternative travel?

• Who knows whether several university travellers are affected by the same incident?

• And, critically, who is responsible for coordinating the response?

• A travel policy that answers these questions before an incident occurs is considerably more valuable than a collection of procedures that are discovered during an emergency.

  
  

2. FROM TRAVEL BOOKING TO TRAVEL RISK MANAGEMENT

A common misconception is that using a Travel Management Company (TMC) automatically means an organisation has travel-risk management in place.

It does not.

A TMC can provide important data, traveller visibility, booking controls, reporting and operational assistance. However, the university needs a broader framework defining its policies, risk appetite, approval processes, responsibilities and response procedures.

ISO 31030 provides a useful framework because it treats travel risk as an organisational risk rather than simply a travel-booking issue.

A mature programme should address at least seven areas:

1. Governance

Who owns travel risk within the university?

Responsibility may involve risk management, WHS, procurement, finance, international offices, security, student services and senior management.

There needs to be clear accountability.

2. Policy

The university should establish clear principles governing university-related travel.

This should cover who the policy applies to, what constitutes university travel, approval requirements, high-risk travel, traveller responsibilities and emergency arrangements.

3. Risk Assessment

Travel should be assessed according to the destination, activity, traveller and circumstances.

A senior academic travelling to a major international conference may have a very different risk profile from a group of students undertaking fieldwork in a remote location.

4. Traveller Visibility

The university needs to know who is travelling, where they are travelling, when they are travelling and how they can be contacted.

Without reliable itinerary data, emergency response becomes significantly more difficult.

5. Communication

Travellers should receive appropriate information before and during travel.

This may include destination information, health and security advice, emergency contacts and instructions for reporting incidents.

6. Assistance and Response

The university should have a defined process for responding to incidents.

This includes identifying who monitors events, who contacts travellers, who makes decisions and how emergency assistance is coordinated.

7. Review and Continuous Improvement

Travel risk should not be treated as a document that is written once and forgotten.

Policies, destinations, traveller profiles, suppliers and risks change.

The framework should therefore be periodically reviewed and tested.

3. WHAT AUSTRALIAN UNIVERSITIES ARE ALREADY DOING

The direction of travel is clear.

Australian universities are increasingly formalising travel risk within their governance structures.

For example, current university policies and procedures commonly incorporate:

• Formal travel approval

• Travel risk assessments

• Department of Foreign Affairs and Trade (DFAT) travel advice

• High-risk travel approval

• Travel registration

• Traveller location information

• Emergency assistance

• Insurance requirements

• Student-specific travel procedures

• Risk management responsibilities

Macquarie University's current travel policy, for example, links the use of its TMC with traveller health, safety and security and requires traveller location information to be available to the university.

Charles Sturt University's policy requires travel risk to be systematically considered and applies its framework to university travel including learning-abroad activities.

UNSW requires travel-risk assessment for certain higher-risk international travel, informed by DFAT advice and its specialist travel-risk provider.

Adelaide University has separate procedures addressing student travel and high-risk travel.

These approaches demonstrate an important point:

Travel risk management is becoming an integrated university governance issue rather than simply a travel-office responsibility.

The question for universities without a formal framework is therefore not necessarily whether they need a complicated system.

It is:

Do we have a consistent, documented and practical way of managing the risks associated with university travel?

4. THE TEN-POINT UNIVERSITY TRAVEL RISK HEALTH CHECK

Universities can use the following questions as a simple starting point.

01 — Do we have a university-wide travel policy?

Is there one clear policy covering university-related travel across faculties, departments and business units?

02 — Do we know who is travelling?

Can the university produce a current view of travellers and their itineraries?

03 — Can we locate travellers during an emergency?

Is itinerary information available quickly enough to identify affected travellers?

04 — Do we assess destination risk?

Are appropriate government and specialist intelligence sources used to assess changing destination risks?

05 — Do we assess traveller and activity risk?

Does the university consider factors beyond destination — including activity, traveller profile, group size and remoteness?

06 — Do we have a high-risk travel process?

Is there a clear process for approving, declining or mitigating higher-risk travel?

07 — Do travellers know what to do?

Are travellers provided with practical advice, emergency contacts and escalation procedures?

08 — Who responds to an incident?

Is there a clearly defined internal owner and escalation process?

09 — Can our TMC provide meaningful travel data?

Can the university access accurate information about bookings, destinations, travellers and changes?

10 — Have we tested the system?

Has the university actually tested its emergency travel-response process?

If the answer to several of these questions is "No", the university may have a travel-management process but not yet have a fully developed travel-risk management programme.

5. THE ROLE OF THE MODERN TMC

A TMC should be more than a supplier of airfares and accommodation.

When properly integrated into a university's travel-risk framework, a TMC can provide an important operational layer.

This can include:

• Traveller visibility

• Consolidated booking data can help establish who is travelling and where.

• Data and reporting

• Travel data can support risk assessment, management reporting and emergency response.

• Booking controls

• Policy-compliant booking channels can improve visibility and consistency.

• Changes and disruption

• A TMC can assist travellers when flights, accommodation or transport arrangements change.

• Emergency support

• The TMC can form part of the university's broader response network.

• Policy implementation

• Booking rules can be designed to support university travel policy rather than operate separately from it.

• However, the TMC should be viewed as one component of the overall framework.

The university retains responsibility for defining its governance, risk appetite, policies and decision-making processes.

6. BUILDING A FRAMEWORK DOES NOT HAVE TO BE COMPLICATED

For a university currently operating without a formal travel-risk framework, the first step does not need to be a major technology project.

A practical implementation can begin with five stages.

STAGE 1 — DISCOVER

Map the university's current travel activity.

Identify who travels, why they travel, where they travel, how travel is booked and which departments currently manage travel.

STAGE 2 — ASSESS

Identify the gaps.

Compare existing processes against the principles of ISO 31030 and the university's existing risk, WHS and governance frameworks.

STAGE 3 — DESIGN

Develop a practical university travel-risk framework.

This should define governance, approval, risk assessment, booking, traveller registration, communication and emergency response.

STAGE 4 — IMPLEMENT

Connect the policy with the operational travel process.

This is where the TMC, travel technology, traveller data and assistance arrangements become particularly important.

STAGE 5 — TEST AND REVIEW

Test the process.

A tabletop exercise involving a simulated incident can quickly reveal gaps that are difficult to identify by simply reading a policy document.

The framework should then be reviewed regularly.

7. THE BUSINESS CASE FOR ACTION

The purpose of travel-risk management is not to prevent universities from travelling.

Travel enables education, research, collaboration, innovation and international engagement.

The objective is to allow those activities to continue while ensuring that risks are understood and managed appropriately.

A well-designed framework can also provide benefits beyond traveller safety.

It can improve:

• Governance

• Accountability

• Traveller visibility

• Emergency preparedness

• Procurement oversight

• Travel data

• Policy compliance

• Financial control

• Management reporting

• Traveller experience

• Institutional resilience

Most importantly, it creates clarity.

When something goes wrong, people should not have to ask:

"Who is responsible for this?"

The answer should already be documented.

8. A PRACTICAL STARTING POINT

For universities that do not currently have a comprehensive travel-risk policy, the first step is a conversation — not a technology purchase.

A useful starting question is:

"If we had 50 university travellers overseas today and a major incident occurred in one of their destinations, how quickly could we identify them, contact them, support them and report the situation to senior management?"

If the answer is uncertain, there is an opportunity to strengthen the university's travel-risk framework.

ISO 31030 provides an internationally recognised reference point.

The university's existing risk, WHS, security, international education and travel policies provide the organisational context.

The TMC and travel technology provide the operational infrastructure.

Together, these elements can create a practical and scalable travel-risk programme.

CONCLUSION

University travel is an essential part of modern higher education.

But travel risk cannot be managed effectively simply by booking the journey and hoping the traveller has a safe trip.

A mature approach connects policy, people, processes, information and technology.

For universities without a formal travel-risk framework, there is an opportunity to establish a practical programme that reflects the institution's actual travel profile and risk appetite.

The goal is not to eliminate travel risk.

The goal is to ensure that the university understands its travel risks, has appropriate controls in place, knows where its travellers are and is prepared to respond when circumstances change.

Travel should create opportunities for universities — not avoidable risk.

ABOUT CHANGING TIMES

Changing Times works with organisations to improve the way they approach travel, traveller experience, client relationships and travel management.

We believe the modern travel partner should provide more than transactions.

Our approach combines travel expertise, commercial understanding, technology, people and practical advice to help organisations create more effective travel programmes.

For universities considering the development or review of their travel-risk framework, Changing Times can provide an independent discussion around the current state of travel management, potential gaps and practical next steps.

Contact: hello@changingtimes.net.au

Changing Times Helping organisations navigate the changing world of travel.

Evidence behind the paper

The central framework is based on ISO 31030:2021, which applies specifically to educational organisations and covers policy, programme development, threat/hazard identification, risk assessment, prevention and mitigation. ISO currently lists the standard as published and under review.

The Australian university examples are based on current published policies from Charles Darwin University, Macquarie University, UNSW, Charles Sturt University, Adelaide University and the University of Melbourne, illustrating how institutions are addressing travel approvals, traveller visibility, risk assessment, high-risk travel and emergency preparedness.