One of the clearest messages to emerge from our recent Travel Industry Mock Trial was that when an incident is examined in detail, the questions don’t necessarily begin with the moment something went wrong.
The scrutiny can focus on what happened months, sometimes years, earlier:
What risks had been identified? What checks had been carried out? Were suppliers properly assessed? Were procedures clear? Were people trained? Who was responsible? And were systems being actively used and reviewed, rather than simply sitting in a file?
Routine decisions and actions become crucial after a serious incident.
Having a process isn’t the same as managing risk
Most travel businesses have risk assessments, policies and procedures. But their existence alone doesn’t necessarily demonstrate effective risk management.
A risk assessment needs to reflect what is actually happening operationally. Supplier checks need to identify meaningful risks rather than simply complete a process. Procedures need to be understood by the people expected to follow them. And systems need to evolve as destinations, suppliers, activities and circumstances change.
How do you know if your risk management process is working?
Preparation is key
There isn’t a single document or process that makes an organisation well prepared. Effective risk management materialises from a combination of carefully-planned measures, all working together:
✅ Relevant and regularly reviewed risk assessments
✅ Appropriate supplier checks and auditing
✅ Clear policies and operational procedures
✅ Defined responsibilities and escalation routes
✅ Training appropriate to people’s roles
✅ Monitoring whether agreed procedures are actually being followed
✅ Recording and learning from incidents and near misses
✅ Following through on actions identified during audits or reviews
Importantly, there needs be a clear connection between these activities. For example; an audit that identifies an issue but doesn’t result in action has limited value. A procedure that staff don’t understand won’t necessarily protect anyone. And a risk assessment that hasn’t changed while the operation around it has, may no longer be doing its job.
Monitoring and review
One of the most valuable lessons from putting a travel incident into a courtroom setting was seeing everyday operational decisions subjected to detailed questioning.
Long-standing processes can – and should – be challenged regularly:
🗓️ When was this risk last assessed – formally or informally?
🔄 What has changed since then?
🤝 How do we know our supplier is meeting the required standards?
🚨 Would the relevant team know what to do if something happened tomorrow?
👤 Who would take responsibility?
✅ Can we demonstrate that identified actions have been completed?
The answers can tell you far more about the strength of your risk management than simply checking whether the relevant policy exists.
The responsibility for asking these questions, or at the very least noticing when there might be issues, can be shared across a range of internal and external stakeholders. As we saw in our Mock Trial, the tour operator’s representative was called to give evidence and essentially became the spokesperson for the company, but deferred responsibility to those ‘in charge of health and safety’. Arguably, everyone has a role to play in keeping customers and fellow staff safe.
Continual Improvement
As travel businesses operate in an environment that constantly changes, risk management can never stand still. New destinations are introduced, suppliers change, teams move on, activities evolve and new risks emerge.
Risk management therefore needs to be active to capture any changes:
Assess. Implement. Monitor. Challenge. Review. Improve.
This cycle can help turn policies and procedures into practical risk management – and supports organisations in identifying gaps and weaknesses before an incident exposes them.
At Sanderson Phillips, we spend a great deal of time looking at risk management through this practical lens. Sometimes the most valuable starting point isn’t introducing another process or document – it’s taking a fresh look at what is already in place and asking whether those mitigations are relevant and/or proportionate.
The opportune time to discover a weakness in your risk management is not when you’re having to defend yourself against a claim of negligence.
If you haven’t reviewed your risk management processes recently, or process gaps are apparent when you start asking questions, it may be a good time to review your approach.