The Traveler Who Wasn't on the Map
Northwind Engineering has 2,300 active travelers and a $14M annual travel budget. Sixty-one percent of bookings flow through its TMC; the rest are made directly on supplier websites and surface only when the traveler files an expense report, typically 10–21 days later. The risk-management platform ingests TMC passenger name records only. When a 6.2-magnitude earthquake strikes a region where Northwind has a construction project, the dashboard shows 14 travelers. A project manager who booked a direct flight to the affected city is not among them. He has no power in his hotel, his traveler profile still lists a mobile number he changed eight months ago, and he reaches the 24-hour duty-of-care line 31 hours after the quake. A $60,000 annual traveler-tracking tool is awaiting approval. Client contracts in the region require documented duty-of-care compliance.
1. What should the duty-of-care team do in the first 24 hours after the call? Prioritize the actions and explain the reasoning behind the sequence.
Read the worked answer
Sequence
- Establish direct contact and confirm welfare, exact location, and immediate needs.
- Activate the TMC after-hours desk and the security provider's local team to plan movement to a safe location or evacuation.
- Notify the embassy/consulate and the corporate insurance assistance provider.
- Contact the traveler's emergency contact per policy, with his consent where feasible.
- Arrange transport only once routes are confirmed; do not promise an airlift the firm cannot deliver.
- Log every action with timestamps for the client audit trail.
Reasoning The first decision is not "was this booking in policy" but "is he safe." The 31-hour delay and the stale phone number prove the firm's data was wrong, so further reliance on the dashboard would compound the error. Challenging him about a direct booking during an emergency wastes the only reliable channel the team has. A blanket alert to the 14 known travelers before confirming their locations risks a false "all clear," which creates liability. Escalate to the crisis lead and legal as soon as evacuation is contemplated, and keep family communication factual. The incident should be documented in enough detail to satisfy the client's contractual duty-of-care evidence requirement.
2. Identify the root causes and propose a 90-day remediation plan with measurable checkpoints.
Read the worked answer
Root causes
- Channel fragmentation: 39% of bookings bypass the TMC, so the risk feed is structurally incomplete.
- Data latency: expense-report capture arrives 10–21 days late, which is useless for live risk.
- Profile decay: contact data is not validated, so even known travelers cannot be reached.
90-day plan
- Days 0–30: require TMC booking for any destination on the risk watchlist; add a pre-trip approval step that captures mobile number and itinerary for direct bookings; run a profile-cleanup campaign with a hard deadline.
- Days 31–60: deploy email/expense parsing to capture direct bookings within 24 hours; connect the HRIS feed so terminated and new travelers are reflected automatically; test a daily reconciliation report against the TMC file.
- Days 61–90: measure three checkpoints: (1) share of travelers with a verified mobile number ≥ 98%; (2) direct bookings visible within 24 hours ≥ 90%; (3) watchlist compliance ≥ 95%.
Reasoning A tool alone will not fix a process gap. The plan pairs policy (managed channel for high-risk destinations) with data capture (parsing, HRIS) and hygiene (profile validation). The checkpoints are leading indicators, not lagging incident counts, so progress is visible before the next crisis.
3. How would you build the business case for the $60,000 tracking tool? What metrics and framing would you use with the CFO?
Read the worked answer
Framing: the request is not a software purchase; it is the control that makes duty-of-care obligations auditable and prevents a repeat of an invisible traveler.
Quantification
- Invisible exposure: 39% of roughly 9,000 annual trips ≈ 3,500 trips per year outside the risk feed.
- Incident cost: one failed evacuation or liability claim can exceed the tool's annual cost many times over; use the firm's own insurance deductible and legal estimate rather than a generic figure.
- Client revenue at risk: contracts in the region condition work on documented duty-of-care; losing one contract dwarfs $60,000.
- Operational saving: automated profile validation and booking capture reduce manual reconciliation effort.
Ask: $60,000 per year, with success measured by visibility rate within 24 hours, verified contact rate, and audit evidence per incident.
Reasoning CFOs discount fear-based arguments. Anchor the case in contractual exposure and a measurable coverage gap, present the tool as closing a known control failure, and offer a 12-month review with defined KPIs. Avoid claiming the tool prevents all incidents; claim it makes the firm able to prove it responded.