1. iJET.com (C) iJET International, Inc. All rights reserved. 1 Travel Risk Management and Duty of Care Mark Donohue, VP Risk Management Programs OPERATE GLOBALLY WITH CONFIDENCE iJET INTERNATIONAL (C) iJET International, Inc. All rights reserved. June 18, 2014 iJET.com

2. (C) iJET International, Inc. All rights reserved. 2  Current Events  What is Duty of Care?  Why should you care?  Who owns Duty of Care within the Government?  Where does the Government stand?  How does an Department/Agency get started?  Summary  Resources  Q & A Agenda

3. iJET.com (C) iJET International, Inc. All rights reserved. 3 Introduction to Risk Management Egypt Eurozone Crisis Egypt Eurozone Crisis Syrian Civil War Iraq Syrian Civil War Iraq Kyrgyzstan Thailand Kyrgyzstan Thailand South Sudan Yemen South Sudan Yemen Middle East North Korean Yemen Middle East North Korean 2014 Timeline 2013 2009 2010 2011 2012 Turkey Brazil Ukraine Venezuela

4. iJET.com (C) iJET International, Inc. All rights reserved. 4 What are the Risks? POSSIBLE IMPACTS TO: Personnel Operations/Productivity Data/Equipment Financial/Legal Reputation Medical Issues Crime Political/ Labor Instability Natural Disasters Pandemic Disease Terrorism

5. iJET.com (C) iJET International, Inc. All rights reserved. 5 Travelers  Locations Airlines, Hotels, Conferences, Etc  Technology USB drives Mobile phones Teleworking Social Networks Where is Information Vulnerable?

6. iJET.com (C) iJET International, Inc. All rights reserved. 6 Reality Check Dying in an airplane accident = 1 in 4.7 million (top 78 airlines) 2 What are the odds? 1 National Safety Council (2011)-Injury facts 2 OAG Aviation & PlaneCrashInfo.com accident database (1993-2012) 3 National Safety Council – historical odds Dying in a terrorist attack = 1 in 9.3 million 3 Dying by choking on food = 1 in 3,842 1 Dying from exposure to smoke or fire = 1 in 1,419 1 Dying in a motor vehicle accident = 1 in 108 1

7. iJET.com (C) iJET International, Inc. All rights reserved. 7 Why Should You Care? What does the JFTR/JTR Say?

8. iJET.com (C) iJET International, Inc. All rights reserved. 8 The $42 Million Tick Bite  March 27, 2013: A jury in Bridgeport, Connecticut, awarded a student and her parents $41.7 million in damages after she contracted encephalitis from a tick bite on a school hiking trip near Mount Panshan in China.  The judge found the school negligent by “failing to warn students and parents that they could be subject to insect-transmitted disease in China, failing to ensure students took insect bite precautions before and during the trip, failing to include medical personnel on the trip, and failing to make advance arrangements to return any injured or ill students to the United States”. How would a Department or Agency deal with this? Source: Connecticut Post online (www.ctpost.com/local/article/Jury-awards-42M-in- Chinese-tick-bite-case-4389978.php)

9. iJET.com (C) iJET International, Inc. All rights reserved. 9 Who Owns Duty of Care? Cross-Functional Support Global data consolidation and reporting Compliance monitoring Pre-trip training Pushed alerts Standards of care Auditable systems Risk disclosure Lower liability Policy and procedures Corporate insurance programs 3 rd Party Liability Coverage Mobile device security Risk assessment and predictive intelligence Incident notification Crisis and evacuation plans Coordinated response Pre-trip health planning Immunizations Medical assistance and evacuation for international travelers Plan development/ implementation Monitor assets at risk Travel HR/Legal/IT Security Medical COOP Organization/ Leadership Employee

10. iJET.com (C) iJET International, Inc. All rights reserved. 10 Traveler Safety Continuum WHERE DOES YOUR AGENCY STAND?

11. iJET.com (C) iJET International, Inc. All rights reserved. 11 Starting a Conversation  How does a department/agency educate travelers about the medical and security risks of travel into a country prior to departure on international travel?  How does a department/agency provide access to medical and security professionals prior to international travel?  What are the pre-travel policies/processes prior to International travel? Are these processes country specific?  How is compliance to these processes enforced?  Do departments/agencies keep travelers informed of events occurring in the country they have traveled into?  Is a department/agency prepared to respond to medical events affecting travelers while they are abroad?  Has your department/agency had travelers affected by medical events while traveling abroad?  Do departments/agencies have a Travel Risk Management team to respond to medical & security events?  How would a department/agency provide a response capability for Major events? (Earthquakes, Civil Unrest, etc.)

12. iJET.com (C) iJET International, Inc. All rights reserved. 12 Benchmarking A Program  The TRM3 TM model provides a way to assess your travel risk management program based on key process areas TRM3 is a trademark of iJET International, Inc. Travel Risk Management Maturity Model (TRM3) Your Score: 3.00 is in the 81 Percentile Level 3 Level 3 is referred to as "Proactive"...

13. iJET.com (C) iJET International, Inc. All rights reserved. 13 Measuring Program Maturity Reactive (1) Ad hoc. Few policies. Chaotic in the event of an emergency. Basic travel risk management policies defined and documented. Primary focus on incident response. Consistent execution of travel risk management processes. Metrics collected and reviewed. Cross- organization support. Program integrated throughout organization. Defined (2) Proactive (3) Managed (4) Optimized (5)

14. iJET.com (C) iJET International, Inc. All rights reserved. 14 TRM3 TM – 10 Key Process Areas (KPAs) TRM3 is a trademark of iJET International, Inc. Policy/Procedures Training Overarching KPAs

15. iJET.com (C) iJET International, Inc. All rights reserved. 15  What happens when travelers deviate from the regulations? Airlines, hotels, rental cars, limousines, travel management companies (TMC), and online booking tools  Who do approvers go to for travel risk related questions? Adding vacation to official trips Proper medical coverage  Miscellaneous Are there tools to flag deviations? Are approvers trained to deal with deviations? Are approvals delegated? Understanding Travel Policy WHAT DOES JFTR/FTR SAY?

16. iJET.com (C) iJET International, Inc. All rights reserved. 16  Education Policy/Compliance Best Practices Processes Requirements  Management Team – Travel Risk Management Team (Duty of Care) Collaborative Travel Risk Management Group to identify/develop responsibilities respective of functionality Cross functional support (TMO, HR/Legal, Security, Medical) COOP Planning  Personal Protection Traveler Tracking/Commercial Travel Office/Online Booking Records Travel Department (focal point) Pre-Trip safety, medical, and security What department is primarily responsible for traveler’s safety Training ALL EMPLOYEES

17. iJET.com (C) iJET International, Inc. All rights reserved. 17 TRM3 TM – 10 Key Process Areas (KPAs) TRM3 is a trademark of iJET International, Inc. Risk Assess- ment Policy/Procedures Training Risk Disclosure Risk Mitigation Risk Monitoring Response Overarching KPAs Management KPAs

18. iJET.com (C) iJET International, Inc. All rights reserved. 18  Risk Assessment: Ensure that each trip or assignment is evaluated for risk as part of the decision process  Risk Disclosure: Ensure that each stakeholder understands the nature of threat, its impact, and what should be done to mitigate the risk  Risk Mitigation: Strategies and solutions that will result in a level of risk that is acceptable to all parties  Risk Monitoring: Around the clock (24/7) process to monitor the current threat environment for changes  Response: Provide traveler with a process for reporting problems and getting assistance Key Process Areas - Management

19. iJET.com (C) iJET International, Inc. All rights reserved. 19 TRM3 TM – 10 Key Process Areas (KPAs) TRM3 is a trademark of iJET International, Inc. Data Management Risk Assess- ment Policy/Procedures Training Notification Communication Risk Disclosure Risk Mitigation Risk Monitoring Response Overarching KPAs Management KPAs Infrastructure KPAs

20. iJET.com (C) iJET International, Inc. All rights reserved. 20 Top 10 Reasons Things Fail  #10:Department/Agency does not know what to do in an emergency  #9: Bad data  #8: Primary and backup person are not available  #7: Mobile devices don’t always work  #6: Third-party response resource does not know what is going on  #5:No or limited access to emergency response services  #4:Plans and protocols are not maintained  #3:Plans and procedures are too complex  #2:Personnel are not properly trained  #1:Cost sensitivity delays response

21. iJET.com (C) iJET International, Inc. All rights reserved. 21 Summary  Identify and evaluate the risk  Identify your resources  Set an acceptable level of risk  Develop a plan for mitigating the risk  Educate and communicate the plan  Monitor and benchmark the results An effective program should:

22. iJET.com (C) iJET International, Inc. All rights reserved. 22 Resources  Travel Risk Management Maturity Model (TRM3 TM )  GBTA Foundation’s Managed Travel Index & Benchmarking Tool (includes travel risk management self-assessment)  Webinars  GTAC Panelists  Attendance at Conferences Global Congress, GBTA, ASIS, etc.

23. iJET.com (C) iJET International, Inc. All rights reserved. 23 Questions?

24. iJET.com (C) iJET International, Inc. All rights reserved. 24 Thank you!