ISO Compliance Insights & Best Practices

Journey Risk Assessment: A Clear Guide to the 5 Factors

A journey risk assessment is how an ISO 39001 road traffic safety management system reaches the one place it actually matters: the trip somebody is about to make. Policies do not prevent collisions. Decisions about route, timing, vehicle, driver and load do, and those decisions have to be made before the vehicle moves.

This guide covers the five factors a journey risk assessment weighs, when a journey needs one at all, and how to keep the process from becoming a form nobody reads.

Journey risk assessment: the five factors and the controls each one produces — Five factors — and the first question is always whether the journey is needed at all.

The five factors of a journey risk assessment

Factor	What to check	Control it produces
The journey	Is it necessary? Could it be a call, a courier, or rail?	Elimination — the only control that works every time
The route	Road type, junctions, known blackspots, roadworks, crossings	A specified route, not the fastest one the app offers
The timing	Hours driven, darkness, weather, fatigue windows, schedule pressure	Departure times, breaks, overnight stops
The driver	Licence, experience on this vehicle and terrain, health, hours already worked	Who may take this journey, and who may not
The vehicle and load	Suitability, maintenance status, safety features, securing, weight	Vehicle selection, pre-use checks, loading requirements

The first row does most of the work and is the one organizations skip. A journey risk assessment that starts at “which route” has already accepted the trip, and the safest kilometre is the one nobody drives.

How this connects to ISO 39001

ISO 39001 asks you to identify the road traffic safety performance factors you can influence and to set objectives against them. Journey planning is where exposure, speed, route choice, vehicle condition, driver fitness and journey purpose all become controllable in a single decision. Our guide to RTS performance factors covers the three kinds and how to choose the ones you can actually move.

Which journeys need one

Assessing every trip individually is unworkable for a fleet doing hundreds a day, and assessing none is indefensible. The practical answer is tiering:

Standing assessments for repeated, familiar journeys — a fixed delivery round on known roads. Reviewed periodically and when something changes.
Trip-specific assessments for the exceptions: long distances, unfamiliar territory, hazardous loads, night driving, adverse weather, remote areas, or a new driver on an established route.
Escalated assessments where the risk is high enough to need a named approver — cross-border, high-value or high-hazard movements, or journeys into areas with security as well as safety risk.

Write the triggers down. A rule that says “any journey over four hours, any journey after dark, any journey with a load outside the standard profile” is one anybody can apply. “Assess where appropriate” is one nobody will.

The dynamic half nobody documents

Conditions change after departure. A journey risk assessment is worth little if the driver has no authority to stop, divert or delay when weather closes in or fatigue arrives early. State plainly that the driver may abort, that doing so carries no penalty, and who to notify. That single sentence is the difference between a document and a control.

Making the process survive daily use

Keep it short enough to be done honestly. A ten-minute form for a two-hour trip gets copied from last week. One page that changes the plan beats five that get initialled.
Put the schedule under the assessment, not over it. If the delivery time is fixed before the risk is assessed, the assessment cannot change anything — and schedule pressure is a leading contributor to work-related road collisions.
Feed collisions and near-misses back in. Every incident is evidence about a route, a time of day or a vehicle type. If it does not change the next assessment, the loop is broken.
Include contractors and grey fleet. Employees driving their own cars on business, and subcontracted hauliers, are usually outside the process and inside your duty of care.
Record the decision, not just the form. What was changed as a result — a later departure, a different vehicle, a second driver — is what an auditor and an investigator will look for.

Where journey risk assessments fail

They assess the driver only. Driver behaviour is the easiest thing to blame and the hardest to change alone. Route, schedule and vehicle are organizational decisions and usually the bigger lever.

They are done by the office, not with the driver. The person who has driven the route knows about the junction that floods. A desk-based assessment misses it.

Weather is treated as an input, not a trigger. A forecast that would have changed the decision has to be checked before departure, not attached to the file afterwards.

Fatigue is measured in driving hours only. The shift before the drive counts. A driver who has loaded for six hours is not fresh because the wheel time is short.

Frequently asked questions

Is a journey risk assessment required by ISO 39001?
The standard does not name the document. It requires you to identify and control your road traffic safety performance factors, and journey planning is the usual operational control through which route, speed, timing, vehicle and driver factors are managed.

Who should complete it?
Whoever plans the work, with the driver. Approval for higher-risk journeys should sit with a manager who can change the schedule, because that is often the control that matters.

How often should standing assessments be reviewed?
At least annually, and whenever the route, vehicle type, load, schedule or driver population changes — plus after any incident on that journey.

Does it apply to employees using their own cars?
Yes, in substance. Grey fleet journeys carry the same duty of care, and the vehicle checks are harder rather than unnecessary.

What about security risk on the route?
Assess it in the same document where it applies. Separating safety from security produces two plans that contradict each other on the same road.

Where this leaves you

Build the journey risk assessment around the question of whether the journey is needed, then work through route, timing, driver and vehicle in that order. Tier it so routine trips run on standing assessments and exceptions get real attention, write the triggers down so the rule is applicable, and give the driver explicit authority to stop or divert. Record what the assessment changed — if the answer is never anything, the process is documentation rather than control.

References

ISO 39001:2012 — road traffic safety management systems.
HSE — driving and riding safely for work — the duty of care over work-related road risk.