Quick answer: Colour-coded government travel advisories are diplomatic products, not safety measurements, and they are not a duty-of-care defence. Five things every organisation gets wrong about travel safety ratings, and what boards must do instead.
Originally published on LinkedIn: 6 June 2026.
Picture the scene: it is 22 May 2026, the conflict in Iran is escalating, and a senior executive needs to authorise an urgent trip to the Gulf. They check a government website or a subscription travel app, see a "Level 1" or a green "Low Risk" icon for the United Arab Emirates, and clear the travel. In most boardrooms this passes for due diligence. It is not. Relying on a single colour-coded indicator to protect personnel is a material error in duty of care and a governance failure, and as legal standards shift toward ISO 31030, safety and risk professionals must recognise that a non-delegable duty of care requires "reasonably practicable" judgment, not the procurement of a vendor platform.
Advisories are diplomatic products, not safety manuals
Government travel advisories are not objective risk measurements. They are political-administrative products drafted by generalist desk officers in foreign ministries whose primary client is the issuing government, not the employee on the ground. Three institutional incentives shape them at the expense of accuracy: liability avoidance, where the political cost of failing to warn exceeds the diplomatic cost of warning; bilateral diplomacy, where advisories that damage a partner state's tourism or investment interests attract intense pushback; and template consistency, where uniform language across countries strips out life-saving nuance for the sake of administrative ease. What an advisory omits matters as much as what it states. A board that inherits a political stance instead of a data-driven risk profile is outsourcing its risk tolerance to a diplomat with an entirely different agenda.
The maps disagree
During the Iran conflict in May 2026, Australia raised the UAE and Qatar to its highest "Do Not Travel" level while the United States held a much lower "increased caution" rating for the same destinations in the same week. This is not an anomaly, it is the rule: leading commercial country-risk maps agree with one another only 41 percent of the time. A rating that changes with the traveller's passport is not a measurement of the place, it is an indicator of diplomatic relations. A risk basis that inherits these swings without independent analysis will not stand up to scrutiny after an incident.
The country is the wrong unit of analysis
A single national tier or colour code cannot carry the weight organisations place on it, because it erases the variables that actually determine who gets hurt: demographics such as a male day-visitor against a female traveller, duration of stay such as a 24-hour transit against a two-week assignment, location and route such as a CBD hotel against a rural highway segment, and timing such as a Monday morning commute against a Saturday night outing. Compressing all of this into one national label discards the route, segment and timing factors that constitute the real safety of a journey.
The roads are killing your people, not the headlines
There is a wide gap between perceived and actual harm. Advisory language is driven by high-profile events such as terrorism and civil unrest, yet the dominant preventable causes of traveller death are road trauma and cardiac events. A program anchored to an advisory tier is blind by construction to this reality: 42 destinations currently sit in benign consensus tiers of 1 or 2 despite road-death rates exceeding 20 per 100,000 people. Thailand is rated Tier 1, "safe," yet records a road-death rate of 32.7 per 100,000, and much of Sub-Saharan Africa sits above 28 per 100,000 under the same safe label. The advisory says proceed; the road says otherwise.
Procurement is not competence
Many organisations believe a subscription to a travel risk platform satisfies their legal duty of care. It confuses procurement with competence. A software subscription delivers a feed of passive alerts, not judgment, and duty of care is non-delegable. Meeting the "reasonably practicable" test for a specific itinerary requires five things: identifying the foreseeable harms, considering the available means of eliminating or minimising each, weighing severity, likelihood and reasonableness of treatment, recording the analysis, and recording the decision together with its basis. Risk criteria must be defined in advance and approved by the board, not inherited from a vendor's default settings. A vendor product can form part of the evidence; on its own, it does not satisfy the test.
The shift from colour-coded reliance to defensible assessment is not a luxury, it is a requirement of modern corporate governance. Organisations must move to a capability-based model, aligned with ISO 31030, built on multi-source data and journey-specific analysis. The cost of that standard is a modest share of the travel budget; the cost of a defenceless failure is extraordinarily high, and it is borne personally by the named officers whose assessment fails to withstand scrutiny. If your organisation's strategy relies on a single green light, ask the question that matters: if a traveller were seriously harmed tomorrow, what document would you hand the coroner?
Tony Ridley, MSc, CSyP, FSyI, SRMCP advises boards and executive teams on building defensible, journey-specific travel risk assessment frameworks that go beyond advisory tiers and vendor feeds, replacing single-source colour codes with board-approved criteria, multi-source data and recorded judgment capable of withstanding post-incident scrutiny. Organisations seeking to close the gap between a subscription dashboard and a genuine duty-of-care standard are welcome to reach out to discuss a defensibility review of their current travel risk architecture.