More than 1,000 aid workers killed in three years, according to the United Nations; a 2025 close to the all-time record, driven by the crises in Gaza and Sudan; attacks that now also target hospitals and first responders, as the trade press pointed out in mid-October. For NGO and CSO directors, these figures are not an abstraction: behind every field mission, every signed mission order, every vehicle leaving the base, there is an employer's responsibility. And yet, in most organizations, safety remains funded at the margins, tracked in scattered Excel files, and painfully justified during donor audits. Duty of care — the obligation of diligence towards your teams — has become a legal, financial and compliance issue in its own right, which controllers and finance coordinators can no longer treat as a residual budget line.

This article offers an operational and financial reading of duty of care: what the obligation covers, how much a safety system really costs, how to fund it and negotiate it with your donors, and above all how to trace every expense so that it withstands an audit. We will also see how an integrated management platform like Abvius makes it possible to centralize safety management between headquarters and the field, from budget to audit trail, without multiplying tools.

NGO duty of care: protect your teams, secure your budgets and your compliance

Reading time: ~12 min

1. Duty of care: from moral obligation to legal requirement
2. 2026, a turning point: what the figures say about violence against aid workers
3. How much does security cost? Mapping safety expenses
4. Funding duty of care: building the dialogue with donors
5. Tracing and documenting: the safety audit trail
6. Centralizing HQ–field management: what Abvius brings
7. Best practices: 5 steps to structure your system
8. Mini FAQ

Duty of care: from moral obligation to legal requirement

Duty of care is the obligation on an organization to take all reasonable measures to protect the health, safety and well-being of its collaborators — employees, volunteers, national and international staff, and increasingly the teams of implementing partners. Long seen as an ethical commitment, this obligation has gradually become judicialized: several emblematic cases, in Europe and North America, have seen employees or their beneficiaries obtain compensation after a security incident, on the grounds that the employer had not put in place a prevention system proportionate to the risk.

What the obligation concretely covers

In practice, an NGO's or CSO's duty of care is assessed on a bundle of elements: a documented and updated risk analysis for each area of intervention, safety plans and standard operating procedures, team training before deployment (HEAT-type or a contextualized equivalent), suitable equipment, travel tracking mechanisms, medical and evacuation arrangements, adequate insurance, and psychosocial support after an incident. Two dimensions are systematically examined in a dispute or audit: did the organization know (was the risk identified?) and did it act accordingly (were the measures funded, implemented and traced?).

Duty of care and donor compliance: an inevitable convergence

Institutional donors now include safety in their partner assessment grids. Funding agreements frequently require a formalized security policy, incident management procedures, and the ability to show that funds earmarked for team protection were indeed used for that purpose. Duty of care thus joins the classic field of compliance: as with anti-fraud or safeguarding, it is no longer enough to act — you must be able to prove it, with supporting documents and an audit trail.

2026, a turning point: what the figures say about violence against aid workers

The annual report on aid worker security published in summer 2026 by Humanitarian Outcomes paints a stark picture: violence against aid personnel remains close to historic records, with Gaza and Sudan accounting for the majority of deaths. Notably, the report stresses that the threat increasingly comes from state actors, which complicates classic acceptance and access-negotiation strategies. The United Nations noted in the spring that more than a thousand aid workers have been killed in three years. At the same time, a coalition of European NGOs published a joint statement calling on states and donors to protect those who protect — including by properly funding safety systems.

Three operational realities follow for finance directors and field coordinators. First, the overwhelming majority of victims are national staff and local partner teams: in the era of aid localization, duty of care can no longer stop at expatriates. Second, the sharp contraction in humanitarian funding mechanically forces trade-offs — and security, an "invisible" cost as long as nothing happens, is an obvious casualty of cuts. Finally, the most dangerous areas are also those where direct supervision is hardest: remote management requires reliable, real-time data, not monthly Excel consolidations.

How much does security cost? Mapping safety expenses

First difficulty: most organizations do not know what their safety system really costs, because expenses are scattered across budget lines, projects and cost centers. A rigorous mapping generally distinguishes four families of costs.

• Dedicated staff costs: headquarters safety focal point, regional security advisors, guards, base focal points — including the share of time of coordinators who take on the function on top of their job.
• Equipment and infrastructure costs: vehicles and their equipment (radios, first-aid kits, trackers), securing premises and guesthouses, telecommunications, personal protective equipment.
• Service and prevention costs: pre-deployment training, subscriptions to risk analysis or travel tracking services, specific insurance (medical evacuation, repatriation, war risks), safety audits.
• Incident response costs: evacuations, temporary relocations, medical and psychosocial support, crisis management — unpredictable by nature, and therefore to be provisioned.

This mapping is not a theoretical exercise: it conditions budgeting (what share as direct project costs, what share as overhead?), negotiation with donors, and the ability to demonstrate, with figures, that the organization takes its duty of diligence seriously. Analytical budget monitoring by purpose — and not only by accounting nature — is essential here: the same fuel invoice may fall under programme logistics or a security evacuation, and only rigorous analytical allocation makes it possible to reconstruct the full cost of the system.

Funding duty of care: building the dialogue with donors

Good news: most major humanitarian donors explicitly recognize the eligibility of safety costs, whether charged as direct costs or covered by indirect costs. The difficulty lies elsewhere: in fragmentation. A safety system protects an entire mission, but it is funded by projects with different durations, rules and coverage rates. Three approaches combine in practice.

Three complementary funding approaches

The first is to enter safety costs as direct costs in each project budget, pro rata to a documented allocation key (headcount, activity volume, geographic presence). This is the most transparent approach, but it requires constant allocation discipline and a key that is defensible in an audit. The second goes through indirect costs or shared costs: the system is carried by the structure and re-invoiced via the flat rate or a shared-cost allocation grid. The third, still emerging, mobilizes dedicated funding: specific lines for strengthening safety capacity, notably for local partners, or pooled funds. For intermediary organizations that pass funds down in cascade, the question is compounded by a requirement of fairness: budgets transferred to local partners must include their own safety costs — a point on which sector evaluations remain severe.

Arguing for safety in the face of budget cuts

In a context of funding reductions, the reflex to ring-fence safety must be prepared. The most effective argument with a donor is not moral but managerial: a serious incident costs, in interrupted activity, evacuations and legal liability, far more than the prevention system; and a partner unable to protect its teams is a partner that will suspend its activities, and therefore its results. The data must be available: full cost of the system, history of incidents and their costs, costed scenarios. This is precisely what consolidated multi-project, multi-donor budget monitoring provides.

Tracing and documenting: the safety audit trail

Duty of care is played out as much in documentation as in action. In the event of an incident, the first questions will concern what was known, decided and traced: was the risk analysis up to date? Had the mission order been approved according to the procedure? Did the security briefing take place? Who authorized the trip, and on what basis? The same questions, asked this time by a donor auditor, will concern expenses: did this invoiced training actually take place, and for which participants? Does this guarding correspond to a contract, timesheets and traced payments?

The comparison of management modes is telling:

The common point of artisanal approaches is that they make compliance rest on people's memory and goodwill — exactly what is lacking in contexts of high staff turnover and heavy operational pressure, that is, dangerous contexts. Safety traceability must be an automatic by-product of processes, not an end-of-project documentation chore.

Centralizing HQ–field management: what Abvius brings

This is where a management platform designed for NGOs, CSOs and their partners comes into its own. Abvius brings finance, operations and MEAL together in a single environment, which makes it possible to treat duty of care as what it is: a cross-cutting process, and not a pile of files.

Concretely, organizations using Abvius rely on:

• Real-time budget monitoring, with multi-axis analytical allocation: safety expenses can be identified at any time, by project, by donor, by base, and compared to budget — no more year-end reconstruction.
• Approval workflows: mission orders, purchase requests for safety equipment, and advances for travel in risk areas follow approval circuits configured to your delegation scheme, with electronic signature and timestamping.
• Native audit trail: each transaction keeps its full history and attached supporting documents, from commitment to payment — exactly the level of rigor required by a donor audit or a liability claim.
• HQ–field centralization: country teams enter data as close to the operation as possible, including in limited-connectivity contexts, and headquarters has the same data, with no double entry or manual consolidation.
• Automatic donor reporting: safety expenses appear in financial reports in the expected formats, with linked supporting documents, turning audit preparation into a simple extraction.

This foundation obviously does not replace your risk analysis or your safety focal point: it gives them the means to steer, prove and arbitrate on reliable data rather than on impressions.

Best practices: 5 steps to structure your system

To move from diffuse safety management to a manageable, auditable duty of care system, we recommend a five-step approach.

• 1. Formalize the framework and responsibilities. A safety policy validated by governance, an explicit delegation scheme (who authorizes what, up to which risk level), and integration of duty of care into employment contracts and partnership agreements.
• 2. Map and budget the full cost. List all existing safety expenses across the four cost families, define a dedicated analytical nomenclature, and build a consolidated safety budget with its allocation key between projects and structure.
• 3. Negotiate funding upstream. Systematically include safety in project proposals, document the allocation key, include local partners' safety costs in cascade budgets, and provision for incident response.
• 4. Equip critical processes. Digitize first mission orders, travel approvals, safety purchases and training tracking, with traceable workflows and an automatic audit trail rather than scattered files.
• 5. Monitor, test, improve. Periodic budget-versus-actual review of safety expenses, compliance indicators (rate of mission orders approved before departure, rate of briefings completed), post-incident lessons learned and updating of the risk analysis.

Mini FAQ

Are security costs eligible for donor funding?

In the vast majority of cases, yes: major humanitarian and development donors recognize the eligibility of safety costs, as direct costs and through indirect costs. The usual conditions apply: inclusion in the approved budget, demonstrable link to the project, documented allocation key and complete supporting documents.

Does duty of care apply to local partners and their teams?

Legally, each organization is first responsible for its own employees. But sector frameworks and donors expect intermediary organizations to enable their partners to meet their own duty of diligence: safety budgets included in sub-grants, sharing of security information, access to training. Providing nothing exposes you to growing reputational and contractual risk.

What must you be able to present in an audit or liability claim?

Three bodies of evidence: the framework (safety policy, dated risk analyses, procedures), the decisions (approved mission orders, travel authorizations, reasoned waivers, with authors and timestamps), and the expenses (contracts, invoices, proof of service delivered, analytical allocation). A continuous digital audit trail covers all three without reconstruction effort.

Our organization is small: where do we start without a dedicated budget?

Start with what costs almost nothing: a designated focal point, a simple risk analysis per area, a systematic and traced mission order procedure, and an analytical nomenclature to identify your existing safety expenses. You will generally discover that you already spend more than you thought — and you will have the figures to request funding for them.

Summary

The continuing deterioration of aid worker safety makes duty of care an obligation that no NGO or CSO can any longer treat at the margins: it is at once a legal responsibility as an employer, an issue of programme continuity and a compliance area scrutinized by donors. The answer lies in a demanding triptych — map and fund the full cost of safety, trace every decision and every expense, centralize management between headquarters and the field — which digitized processes finally make sustainable day to day. To go further, see our other articles on NGO compliance and financial management, or contact our team to see how Abvius can equip your duty of care system, from budget to audit.