A driver stuck at a checkpoint who no longer answers the radio. A field coordinator evacuated in a hurry without headquarters knowing who approved the trip. A security incident jotted in a notebook, never escalated, that resurfaces two years later in an employment tribunal. If you run an NGO or CSO working in fragile contexts, these situations are not fiction: they are your teams' daily reality, and they directly engage your legal, financial and moral responsibility as an employer. Yet in many organizations the security system still relies on scattered Excel files, WhatsApp groups and the memory of a few key people.

Duty of care — the organization's obligation of diligence towards those who work for it — is no longer just an ethical requirement: it has become a compliance issue scrutinized by donors, insurers and judges. In this article, we review the legal foundations of duty of care, the concrete components of a robust system, how to document it so that it withstands an audit or a dispute, and ways to fund safety costs sustainably. We will also see how a platform like Abvius helps embed this diligence in your daily processes, from headquarters to the field.

NGO duty of care: protect, track and fund the safety of your field teams

Reading time: ~13 min

1. Duty of care: definition and legal foundations
2. Why duty of care is becoming a major compliance issue
3. The components of a complete duty of care system
4. Documenting to prove: the safety audit trail
5. Funding safety: security costs and donor budgets
6. Abvius: equipping duty of care, from headquarters to the field
7. Setting up your system in 5 steps
8. Mini FAQ

Duty of care: definition and legal foundations

Duty of care, or the duty of diligence, is the obligation for an organization to take all reasonable measures to protect the health, safety and well-being of the people who work for it: headquarters staff, expatriates, national staff, volunteers, consultants and, increasingly, the teams of partner organizations. In the international solidarity sector, where teams operate in conflict, epidemic or disaster zones, this duty takes on a particular dimension: exposure to risk is part of the mission, but it must be identified, reduced, accepted knowingly and supported.

A legal obligation, not just a moral one

Under French law, the employer has a general safety obligation (article L.4121-1 of the Labour Code): it must take the measures necessary to protect the physical and mental health of its employees, including on assignments abroad. Case law has recognized the inexcusable fault of employers whose employees were victims of attacks while on mission, where the organization was or should have been aware of the danger without taking appropriate protective measures. Internationally, the Steve Dennis v. Norwegian Refugee Council case (Oslo court, 2015) marked the sector: the NGO was found negligent after the kidnapping of an employee in Kenya, notably because existing security procedures had not been rigorously applied or documented.

The lesson of these disputes is twofold. First, having security policies is not enough: it is their effective, traceable application that is examined. Second, duty of care is not limited to expatriates: national staff, who make up the vast majority of humanitarian personnel and bear the heaviest toll of violence, must benefit from equivalent measures, failing which the organization is exposed to legal claims and major reputational risk.

What the duty of diligence concretely covers

Duty of care covers a broad spectrum: risk analysis before any assignment, information and informed consent of deployed people, security training, communication and tracking tools, travel protocols, incident and crisis management, insurance and medical coverage, psychological support after a critical event, and governance accountability (the board must be able to show it oversees the security policy). Sector frameworks — notably the Global Interagency Security Forum (GISF) guides aimed at small and medium NGOs — provide proven frameworks for structuring this approach without reserving it for large organizations.

Why duty of care is becoming a major compliance issue

The figures speak for themselves. According to the Aid Worker Security Database, 2025 was the most dangerous year ever recorded for humanitarian workers: 907 were killed, wounded or kidnapped, compared with 833 in 2024. At least 350 aid workers lost their lives, an overwhelming majority of them national staff, with Gaza and Sudan accounting for the heaviest tolls. The spread of low-cost armed drones also extends the threat to areas once considered relatively safe, complicating traditional risk analyses.

At the same time, the financial context is tightening. Cuts to official development assistance force NGOs into painful budget trade-offs, and safety budgets — training, equipment, dedicated staff — are among the threatened items, just as risk exposure increases. It is precisely in this squeeze that duty of care becomes a compliance issue: an organization that cuts its security spending without documented analysis, without governance validation and without informing the teams concerned weakens its legal position in the event of an incident.

Donors, for their part, increasingly build security risk management into their due diligence: existence of a safety policy, country security plans, incident management mechanisms, appropriate insurance coverage. A patchy duty of care system can weigh on a capacity assessment, delay contracting or come out unfavourably in an audit or field visit. Conversely, an organization able to produce in a few clicks its risk analyses, validated mission orders and incident register sends a strong signal of organizational maturity.

The components of a complete duty of care system

A robust duty of care system combines policy, process and tooling. Here are the essential building blocks.

Risk analysis and security plans

Everything starts with mapping risks by country and area of intervention: threats (conflict, crime, road, health and digital risks), vulnerabilities specific to the organization and its staff profiles, and mitigation measures. This analysis feeds regularly updated country security plans, standard operating procedures (travel, communications, curfews, no-go areas) and trigger thresholds — suspension of movements, hibernation, relocation, evacuation.

Travel management and visibility on people

Headquarters and bases must know at all times who is where. This requires systematic, validated mission orders, movement tracking (radio or phone check-ins, waypoints), and an up-to-date emergency contact list. This is often the weak link: when mission orders circulate by email and approvals are given verbally, reconstruction after the fact becomes impossible.

Incident and crisis management

Every incident — even minor, even a near miss — must be reported, recorded, analyzed and followed by corrective actions. The incident register feeds trend analysis and demonstrates, in the event of a review, that the organization learns from experience. Added to this are a predefined crisis cell, decision trees and simulation exercises.

Training, insurance and support for people

• Security training adapted to the context (HEAT or equivalent for high-risk areas, systematic briefings before deployment);
• Verified insurance coverage: repatriation, disability, death, including for national staff — a point too often neglected;
• Medical follow-up and psychological support after a critical incident;
• Transparent information to people about the risks, formalized through informed consent.

Documenting to prove: the safety audit trail

In duty of care as in financial management, the golden rule of auditors and judges is the same: what is not documented does not exist. Your organization may have briefed every person before departure, validated every trip and handled every incident — if nothing attests to it, your diligence carries no weight in a dispute or an audit finding. Building a safety audit trail means ensuring that every decision leaves a timestamped trace: who requested, who approved, on the basis of what analysis, under what conditions.

Concretely, this traceability covers mission orders and their hierarchical approvals, successive versions of security plans and their distribution date, briefing and training attestations, incident reports and their action plans, crisis cell decisions, and waivers granted (with their justification). The medium used makes all the difference, as the comparison below shows.

This traceability requirement echoes the one you already know for your expenses: the digital audit trail applied to safety follows the same logic as the one your donors require for cost justification. An organization that has structured one already has the reflexes to structure the other.

Funding safety: security costs and donor budgets

Security has a cost: a safety focal point, training, communication equipment, suitable vehicles, reinforced insurance, guarding, psychological support. The good news is that most major humanitarian donors recognize the eligibility of safety costs, whether charged as direct costs to projects (guarding a base, training a programme's teams, equipment) or covered by indirect and overhead costs (global security policy, headquarters focal point). They still need to be explicitly budgeted from the proposal stage, documented, and justified line by line.

Budgeting duty of care from the proposal stage

Three reflexes are needed. First, systematically include a safety line in every project budget in risk areas, calibrated on the risk analysis — a budget with no security costs in a volatile context is a warning sign for an informed donor, not proof of efficiency. Second, pool intelligently: some costs (regional safety focal point, travel tracking platform) can be shared between projects through a documented allocation key. Finally, trace execution: real-time budget monitoring of safety lines makes it possible to detect underspending — often the symptom of measures not applied — or an overrun to renegotiate by amendment before it becomes an ineligible expense.

Local partners' duty of care, a blind spot of localization

The localization of aid transfers a growing share of implementation — and therefore of risk — to national and local NGOs, which suffer the majority of security incidents but rarely access the safety funding, insurance and training enjoyed by international organizations. For an intermediary NGO, duty of care extends to this partnership chain: provide security budgets in sub-grants, share risk analyses and alerts, and never implicitly transfer a risk that a partner lacks the means to manage. Donors are increasingly attentive to this in reviewing partner monitoring systems.

Abvius: equipping duty of care, from headquarters to the field

Abvius is an ERP designed for NGOs and CSOs, bringing Finance, Operations and MEAL together on a single platform. Without replacing your safety policy or your security focal points, it provides the traceability and management backbone a duty of care system needs to be demonstrable.

• Approval workflows: mission orders, travel requests and waivers follow configurable approval circuits, with a timestamp at each step — who requested, who approved, when and under what conditions;
• Electronic signature: security briefing attestations, informed consents and signed policies are formalized and archived without paper circuits;
• Native audit trail: every action on the platform is traced, making it possible to reconstruct in minutes the full history of a mission or incident during an audit or donor due diligence;
• HQ-field centralization: bases enter data as close to the event as possible, and headquarters has a consolidated real-time view, including in multi-country contexts;
• Real-time budget monitoring: each project's safety lines are tracked as they go, with consumption alerts, securing both the protection of teams and the eligibility of expenses;
• Automatic donor reporting: operational and financial safety data feed your reports directly, with no re-entry.

These functions rely on secure hosting and fine-grained access rights — an essential point when handling team location data in sensitive areas. To learn more, visit abvius.org.

Setting up your system in 5 steps

Structuring duty of care does not require building everything at once. Here is a realistic path, even for a mid-sized organization.

1. Take stock: list what exists (policies, plans, insurance, informal practices) and compare it with a recognized framework such as those of the GISF. Identify the most critical gaps — often the traceability of approvals and the incident register.
2. Formalize the policy and responsibilities: have governance validate a safety policy that defines risk appetite, roles (board, management, focal points, base heads) and decision thresholds. Without board sponsorship, the system will remain fragile.
3. Equip the key processes: first digitize mission orders with approval, the incident register and the archiving of signed briefings. This is the foundation of your safety audit trail.
4. Budget and fund: include safety costs in your project budgets and donor negotiations, including for your local partners, and track their execution in real time.
5. Test, learn, revise: run at least one crisis exercise per year, analyze reported incidents, and update plans and training accordingly. Document each revision: it is proof of a living system.

Mini FAQ

Does duty of care apply to national staff and partners?

Yes. The duty of diligence covers everyone working for the organization, regardless of status or nationality. National staff, who suffer the majority of incidents, must benefit from measures equivalent to those of expatriates. For partners, the duty of diligence requires at the very least not transferring risks without transferring the means to manage them.

Are security costs eligible for donor funding?

In the vast majority of cases, yes: major humanitarian donors accept safety costs as direct or indirect costs, provided they are budgeted, justified and traceable. The risk of ineligibility mainly comes from expenses not planned in the budget or insufficiently documented.

What is the difference between duty of care and a business continuity plan?

Duty of care protects people; the business continuity plan protects the organization's ability to function in the event of a shock. The two overlap (an evacuation falls under both) but should not be confused: a solid continuity plan does not, by itself, demonstrate diligence towards teams.

What does an NGO risk by neglecting its duty of diligence?

Human consequences first, then legal ones (inexcusable fault, damages, liability of leaders), financial ones (deductible or refusal of insurance cover, audit findings) and reputational ones — with, ultimately, an impact on donor trust and the ability to raise funds.

Summary

In a context where violence against aid workers is reaching record levels and budgets are shrinking, duty of care is emerging as a pillar of NGO and CSO compliance, alongside financial management or anti-fraud efforts: a legal obligation towards teams, a due diligence criterion for donors, and a revealer of organizational maturity. The key is to move from informal diligence to demonstrable diligence — analyzed, validated, traced and funded. To go further, see our guides on managing mission orders, risk mapping and the business continuity plan. And if you would like to see how Abvius can equip your safety system, from travel approval to donor reporting, contact our team: we would be happy to discuss your field challenges.