Travel Risk In the Philanthropic Sector

Most mission-driven organizations aren't unaware ofrisk. They're just unequipped for it.

Every year, mission-drivenorganizations send staff, volunteers, and donors into complex environmentsaround the world. They write a travel policy, send out a security briefing, andtreat the duty of care obligation as met.

It isn't. Not even close.

The most expensive vulnerability inmost mission-driven organizations isn't a headline-grabbing security incident.It's an infrastructure gap, the space between knowing travel risk exists andactually being able to do something about it when it does.

The Threat Landscape Is Not Theoretical

In 2024, the Aid Worker SecurityDatabase documented 861 aid workers affected by major security incidents across42 countries. That's 383 killed, 308 wounded, 125 kidnapped, and 45 detained orarrested, the second consecutive year to set records for both victims andfatalities. Overall incidents rose 36 percent from 2023 to 2024.

The exposure isn't limited toconflict zones. Sub-Saharan Africa alone saw 2.6 million people displaced inthe Liptako-Gourma region and 2.8 million in the Lake Chad Basin, geographieswhere many development and humanitarian nonprofits operate every day. Morebroadly, 56 percent of international business travelers reported an incident oremergency during their travels in 2025.

Mission-driven organizations don'tget to choose safer geographies. Their work takes them into exactly theenvironments where these numbers are highest, and rising.

What an Infrastructure Gap Actually Looks Like

Infrastructure gaps rarely announcethemselves. They show up as policies nobody has tested, emergency contactsnobody can reach at 3 a.m., and coverage that looks complete on paper until themoment it's needed.

In our experience working withnonprofits and philanthropic organizations, these gaps tend to cluster in a fewpredictable places:

•    The travel policy that exists but has never been run through a real scenario or is not incident or risk focused.

•    The volunteer and donor trips that operatewithout the same duty of care framework that protects staff

•    The insurance coverage everyone assumes iscomprehensive until a claim reveals the exclusions

Why Mission-Driven Organizations Are Especially Vulnerable

Nonprofits are not short onawareness. Most know travel risk is real. What breaks down is the operationalcapacity behind that awareness:

•    Travel risk usually falls to someone alreadyjuggling program management, HR, or finance

•    Small teams have no local security contacts andno 24/7 coverage

•    Growth outpaces the organization's ability toformalize what used to work informally

•    Leadership assumes a signed vendor contract isthe same thing as a functioning program

‍

The Cost Nobody Is Tracking

A security incident is visible andexpensive. The infrastructure gap that allowed it is not, until the billarrives:

•    A remote medical evacuation can run $150,000 to$300,000

•    Duty of care liability cases have costorganizations anywhere from $129,000 to $41.5 million

•    Donor trust, once shaken by a mishandledincident, rarely rebuilds as fast as funding does

•    Leadership time consumed by crisis response andlitigation instead of mission delivery

This Has Already Happened, and Been Litigated

This isn't a hypothetical risk. Courts have already ruled against organizations that treated duty of care as acheckbox instead of an operational discipline:

€420,000   paid  by a Norwegian NGO after failing to provide adequate duty of care to an  employee.

€129,000   paid  by a French company after an expat contractor died in a terrorist attack with  no demonstrable protective measures in place.

$41.5M   paid  by a U.S. school after a student contracted a tick-borne illness on a school  trip due to inadequate pre-trip planning.

‍

None of these organizations acted with malice. Each had good intentions and a policy on paper. What they lacked was the infrastructure to back it up, and that gap is exactly what a courtlooks for when determining liability.

What Closing the Gap Actually Requires

1. Structured Prevention BeforeAnyone Travels

Pre-travel risk assessment, security briefings, and itinerary tracking aren't paperwork. They're how predictable risks get caught before departure instead of after.

2. Real Response Capability, NotJust a Policy

A duty of care program only mattersif someone can actually pick up the phone. Real-time access to medical and security expertise is what turns a policy into protection.

3. Recovery Planning Built inAdvance

Organizations that know how they'llmaintain mission delivery and communicate with stakeholders after an incident recover. Organizations that improvise in the moment don't.

The Bottom Line

Security incidents are recoverable. Infrastructure gaps compound quietly for years before most organizations address them, usually right after the first real incident forces the question. Before your next donor trip or field deployment, it's worth asking a harder question: does your organization actually have the infrastructure behind its travel policy, or just the policy?

Thisarticle is a summary of our complete findings.

Read the Full White Paper: Travel Risk in thh Philanthropic Sector

‍