A travel program audit is a structured check of who owns business travel, what the rules are, whether they are followed, and what the supplier delivers. Ten checks cover most of it, and a finance or operations lead can run them with existing booking, card and invoice data. Each check has a clear pass or fail result, and the failures show where a deeper review is worth the cost.

The checks apply to a growing company with no travel manager and to a larger company reviewing an established program or its travel management company (TMC). A TMC is the agency that books trips, supports travellers and reports on spend for a corporate client. This site takes no supplier commission, so a finding that points away from a supplier carries the same weight as one that points towards it.

Ownership

1. Name one accountable owner. Someone must answer for travel policy, supplier contracts and traveller safety. In many companies these sit across finance, HR and an executive assistant team, and nobody holds all three. The test is simple: ask who would be called if a traveller were stranded, and who would be called if the TMC fee doubled. If the answers differ or nobody can say, ownership has failed. The travel coordinator job description shows what the role covers, whether it is a full post or part of another job.

2. Confirm who can change the program. Check who may add a supplier, approve an exception or sign a contract. Where several people can do each of these, the program drifts. Record the names and the limits of their authority in one page.

Policy and approvals

3. Read the policy against actual bookings. A written policy that nobody follows is a document, not a control. Take the last three months of bookings and test them against five rules: advance booking window, cabin class, hotel price cap, preferred supplier use and rail or air choice on short routes. Report compliance as a percentage for each rule. Anything below 80 per cent usually means the rule is unclear, unworkable or not enforced. Each of those has a different remedy, so identify which before changing the rule.

4. Trace the approval path. Pick ten recent trips and follow each from request to ticket. Note who approved, when, and whether approval came before or after purchase. Approval after purchase is notification, not control. Also check that no one approves their own travel and that approvers know the budget they are approving against.

5. Count the bookings made outside the program. Leakage is spend that bypasses the agreed channel, such as an employee booking directly on an airline site or putting a hotel on a personal card. Compare card and expense data with TMC booking data. The gap is the leakage figure. It matters because off-channel trips are invisible to traveller tracking, carry no negotiated rates and weaken the company's position at the next supplier negotiation.

TMC and supplier performance

6. Compare the contract with the invoices. Read the TMC agreement and check every fee line against what has been charged: transaction fees, management fees, out-of-hours charges, change fees and any technology fee. Look also for the contract term, the notice period and the clause on who owns the booking data on exit. Discrepancies are common and are usually small individually. Added up over a year they are not.

7. Measure service, not only price. Ask the TMC for response times, first-contact resolution, out-of-hours answer rates and the count of complaints raised and closed. If these figures are not reported, that is itself a finding. Then test the service directly: submit a change request at 19:00 on a weekday and record how long the answer takes. The check also covers the online booking tool (OBT), the self-service site travellers use. Ask what share of eligible trips are booked there. A low share means travellers distrust the tool or do not know it exists.

8. Test the hotel program. Hotel rates are where unmanaged programs lose most. Check whether the company holds negotiated rates, whether those rates appear in the booking tool, and whether last room availability (LRA) is included. LRA is a clause guaranteeing the negotiated rate even when the hotel is nearly full. Then sample ten stays and compare the rate paid with the public rate on the same night. If negotiated rates are not beating public rates, they are not worth the effort of maintaining. The guide to negotiated, dynamic and LRA hotel rates explains how to read each type.

Data and duty of care

9. Check that the data answers real questions. A reporting pack should state total spend, spend by category, average ticket price, advance booking pattern, policy compliance and the top routes and hotels. It should also be reproducible: finance should be able to reconcile the travel report with the ledger within a small margin. If the two do not match, find out why before trusting either. Data is also a security matter. Check who has access to traveller profiles, passport details and payment credentials, and how payment fraud attempts aimed at travel staff are handled. The article on AI-powered travel scams describes the current patterns.

10. Prove that duty of care works. Duty of care is the employer's legal and moral obligation to protect employees while they work, including when they travel. The test is practical. Ask for a list of every traveller currently abroad, with location and contact details, and see how long it takes to produce. Then confirm that every traveller has a 24-hour emergency number, that high-risk destinations trigger a review, and that someone is assigned to act on an alert. If the list takes more than an hour, or cannot be produced, the company is relying on luck.

Reading the results

Score each check as pass, partial or fail. Three or fewer fails, mostly in policy and data, point to housekeeping the internal team can handle. Fails in ownership, TMC contract and duty of care point to structural problems, and these are worth an outside view. A reviewer without a stake in the outcome is useful here, because an incumbent supplier will rarely advise reducing its own fees or scope.

Two cautions apply. First, a failed check is evidence to investigate, not proof of a poor supplier. Compliance gaps are often caused by policy rather than by the TMC. Second, do not change supplier because one check failed. Switching has real costs in migration, traveller disruption and lost history, and the audit may show that the current arrangement only needs a corrected contract or clearer rules.

Companies that want the audit run against their own data, or want an independent opinion on an existing TMC, can use travel management consulting for companies. The review covers the same ten areas in greater depth and ends with written recommendations, including the option to keep everything as it is.