When the Skies Close, We Still Fly: Why Safety, Security, Business Continuity and Duty of Care Must Become Board-Level Priorities

Business travel is no longer a transactional service. Business travel resilience has become an enterprise-wide priority.

When people are moving across borders, operating critical assets, and working in increasingly volatile environments, boards need confidence that they know where their people are, understand the risks they face, and can act when normal systems fail.

The board should mandate an enterprise-wide travel-resilience framework, assign executive accountability, establish emergency decision rights, and require regular testing across the entire ecosystem.

When the Plan Became Reality

On 28 February, something that had been a hot topic in many boardrooms became a reality overnight.

Within hours, bombs and missiles were in our skies.

Airspace closed. Flights were cancelled. Borders became more difficult to cross. Schools closed. Businesses moved to working from home. Anxiety and uncertainty became a reality for people who had never experienced anything like it before.

Some employees were stranded overseas. Others were offshore on rigs and vessels, working in neighbouring countries or supporting critical infrastructure that could not simply stop.

Our own teams were experiencing many of the same pressures, but we had a responsibility to remain calm, focused, and operational. Clients needed answers-

Where are our people? Are they safe? Who can we move? How do we move them? Where can they go? What happens next?

Within hours, normal business rules had changed.

Travel policy, procurement processes, approval chains, and commercial considerations could no longer be the primary drivers. Safety and security became the priority.

In that moment, we became, in effect, the fourth emergency service for our customers.

We supported clients with flight charters, emergency movements, ground transportation, accommodation, and repatriation. For one client, we helped move more than 150 employees out of Iraq within 48 hours.

We supported the demobilisation of a rig, identified safe zones, monitored airspace and changing security conditions, issued advisories, and held client briefings.

Working around the clock, most importantly, we remained at the end of the phone. When normal processes became too slow or complex, our people worked alongside clients to determine what needed to happen, aligning and executing the process.

In a crisis, having a policy is not enough. The ability to execute it is what matters.

What the Crisis Exposed

The crisis also tested our own business continuity.

Our World Service Centre had been designed and tested so that calls, communications, and operational support could be transferred and maintained if repatriation became necessary. We had visibility of employees and dependants, activation procedures, escalation routes, and supplier relationships.

We monitored security intelligence, airlines, ground suppliers, professional risk-management organisations, and client requirements.

But a crisis is not only an operational event. It is a human event; behind each employee is a family.

Alongside operational support, we introduced wellbeing initiatives and a simple daily check-in so employees could tell us how they were doing. Where someone was struggling, we reached out.

Sometimes they needed support. Sometimes they needed time away from work. Sometimes they simply needed someone to listen.

It reinforced a fundamental principle. Duty of care is not simply about getting people home. It is about looking after people throughout the crisis.

For our organisation, the experience reinforced the value of preparation.

For others, it exposed material gaps. Some organisations had business continuity and evacuation plans, but not all plans covered dependants. Some had already restricted travel based on intelligence and risk assessments; others continued to operate normally until the situation deteriorated.

Some had detailed risk assessments around critical infrastructure. Others discovered they did not have a complete picture of where their people were.

That is not simply a travel problem. It is a board-level resilience issue.

One of the most fundamental questions a CEO should be able to answer in an emergency is: “Where are our people?”

Yet fragmented travel providers, bookings outside approved channels, incomplete dependent

information, and inaccessible passport or nationality data meant some organisations could not answer with confidence.

In a crisis, these are no longer administrative shortcomings.

They become operational, financial, reputational and potentially life-safety risks.

If you cannot see your people, you cannot effectively protect them or maintain critical operations.

Prevention Before Evacuation

The best crisis response is sometimes the journey that never happens. Business travel risk management should begin before a booking is made.

Organisations should consider destination risk, security intelligence, political and civil disruption, border restrictions, airspace exposure, traveller profile, business criticality and alternative routing.

An employee travelling to a major financial centre presents a different risk profile from an engineer entering a high-risk environment, an offshore worker, a critical-project team or an employee travelling with dependants.

Risk needs to be understood in context. The objective is not to stop business travel. It is to enable informed travel and avoid preventable exposure.

When aircraft seats are disappearing, hotels are filling, borders are changing and airspace is closing, waiting several hours for approval can mean losing the only viable option.

In a crisis, speed becomes part of safety. Governance remains essential, but it must be designed for the environment in which it operates.

A policy that cannot be activated quickly is not resilient. Good governance is not about creating more approvals. It is about establishing clear decision rights, financial authority and accountability before the event.

The crisis also created the accountability question: Who owns the safety of your people when the unexpected happens? HR? Security? Travel? Procurement? Risk? Operations? The CEO?

The answer cannot be a single department. It must be an ecosystem of accountability.

Every organisation should know who activates the response, who has visibility of employees and dependants, who can authorise emergency travel and spend, who can override normal policy, who communicates with employees and families, who manages evacuation and repatriation, and who remains accountable until people reach a safe location.

Duty of care is not a travel responsibility. It is a leadership responsibility.

 The New Business Travel Resilience Model

Imagine you are the CEO and you receive a call at 7:00am: “Airspace is closing. We need to account for our people.”

Can your organisation immediately answer:

• How many employees are currently travelling?
• Where exactly are they, and who is travelling with them?
• How quickly can we contact them?
• Who has authority to act and spend?
• If borders or airspace closed tonight, what would we do?

If those answers cannot be produced quickly and confidently, there is a gap in the organisation’s resilience strategy. That gap should not be left until the next crisis.

The future of business travel is not simply travel management; it is travel resilience across seven connected stages:

• Prevent: Understand risk before travel through intelligence, policy, traveller profiles and destination information.
• See: Maintain reliable visibility of travellers, destinations and relevant dependant information.
• Protect: Provide alerts, advice and support throughout the journey.
• Respond: Move quickly from normal travel management into crisis response.
• Repatriate: Coordinate flights, charters, hotels, ground transport, borders and alternative routes.
• Recover: Support employees and families and restore business operations.
• Learn: Review the response, close gaps, update the programme and test again.

That is how resilience is built.

The Travel Ecosystem: Technology, Data and the Human Factor

Technology can provide real-time traveller visibility, automated alerts, policy controls, emergency communications, dashboards and reporting. But technology cannot be the only answer.

Systems can fail. Communications can be disrupted. Supplier platforms can become unavailable. True resilience therefore requires technology and contingency: alternative communication channels, backup processes, human escalation, and the ability to operate when normal systems are unavailable.

Data is equally important. Organisations increasingly hold sensitive information including passport details, nationality, location, travel history, emergency contacts, and dependant information. The board must ask two questions:

• Do we have the information we need?
• And are we protecting it properly?

The same data that enables duty of care can create significant exposure if it is compromised.

Cybersecurity, access controls, data minimisation, retention, and supplier security need to be treated as part of the resilience framework, not as separate IT considerations. Data resilience is part of employee resilience.

The traditional travel-management model needs to change. A travel partner should not simply book flights. It should be integrated into the client’s wider risk, security, HR, procurement and business-continuity ecosystem.

When a crisis happens, you should not be asking: “Who do we call?” You should already know.

The relationship extends beyond the travel partner itself.  Airlines, charter operators, hotels, ground transport, security providers, local agents, airports, technology platforms, and communications networks all form part of the response chain.

The question is not simply, “Is our travel provider resilient?” It is, “Is the ecosystem we depend upon resilient?”

The Five Board Priorities:

1. Mandate enterprise-wide travel resilience: Treat travel risk, duty of care, and continuity as a connected leadership agenda, not a transactional service.
2. Create visibility and control: Consolidate where it improves oversight, maintain accurate employee and dependant data, and minimise leakage outside approved channels.
3. Define accountability and emergency authority: Name the executive owner and pre-agree activation criteria, policy overrides, financial authority, communications, and repatriation responsibilities.
4. Integrate and test the ecosystem: Connect travel with Risk, Security, HR, Procurement, and Operations. Then test people, process, technology, communications, suppliers, and contingencies.
5. Measure resilience, not only travel performance: Track how quickly the organisation can see, contact, support and move people, alongside continuity, financial, client, and reputational exposure.

Every company should approve an enterprise-wide travel-resilience framework and require management to:

• Appoint an accountable executive owner.
• Document emergency decision rights and financial authorities.
• Establish a reliable single view of employees and relevant dependants.
• Integrate travel, risk, security, HR, procurement, and continuity processes.
• Establish clear cyber and data-security controls across the ecosystem.
• Conduct regular end-to-end testing, with material gaps reported to the board.

If the airspace closed tonight, could we account for every person, communicate with them, understand their risk, make decisions quickly, move them safely, support their families, and continue operating?

Can we prove it? Not through a policy, a presentation, an annual compliance exercise. Through a test.

Resilience is demonstrated under pressure. We plan for growth, budgets, transformation, and technology. But leadership is tested when everything stops being normal.

That is when processes, technology, partnerships, and culture are tested. You do not discover whether your organisation is resilient when the crisis starts; you discover whether you prepared for it.

Employees and their families do not care which department owns the policy. They care that someone knows where they are, that someone answers the phone, that someone has a plan, that someone has the authority to act. They care that someone will get them home.

That is the responsibility of leadership. That is duty of care. That is resilience.

Because when the skies are clear, everyone can operate. Leadership is what happens when the skies close. And when they do, we still fly.