Food fraud (VACCP) and food defence (TACCP) checklist

Food fraud: vulnerability assessment and mitigation

• A documented vulnerability assessment covers every raw material, ingredient, packaging item and finished product, including outsourced processes and traded goods (FSSC 22000 additional requirement 2.5.4; BRCGS section 5.4).
• Each material is scored for the likelihood of fraud (price, supply pressure, history, ease of adulteration, supply chain length) and the impact on the consumer and the business, with the method written down.
• Information sources are named and checked at a set interval: alerts, trade press, price movements, supplier changes, and the company's own test results.
• Mitigation measures are proportionate to the score: supplier approval level, certificates of analysis, authenticity testing, sealed supply, audits or a change of supplier.
• The mitigation plan has owners, dates and evidence of implementation, and it is reviewed at least annually and when a material, supplier or market changes.
• Staff in purchasing, receiving and QA have been trained to recognise the signs of fraud for the materials they handle.

Food defence: threat assessment and plan

• A documented threat assessment covers deliberate contamination by insiders, contractors, visitors and outsiders, at every stage from raw material to dispatch, including utilities and IT (FSSC 2.5.3; BRCGS section 4.2).
• Each threat is scored for likelihood and impact with a documented method, and the critical points (open product, water, bulk tanks, chemical stores, loading bays) are identified.
• Physical controls match the score: controlled access, visitor and contractor sign-in and escort, locks and seals on tanks and chemical stores, CCTV where justified, and tamper-evident seals on vehicles.
• Personnel controls are in place: pre-employment checks where lawful, a visible identification system, and a way for staff to report concerns without fear.
• The food defence plan has owners and dates, is reviewed at least annually, and has been tested by a drill in the last twelve months (good practice; the schemes require the plan to be implemented and reviewed).
• A product tampering or contamination incident is covered by the crisis and recall procedures, with the Department of Health and the police on the contact list.

Governance

• A named coordinator with the right authority owns both assessments, and a cross-functional team (purchasing, QA, production, security, HR) contributed.
• Both assessments link to the HACCP plan where a fraud or defence control is also a food safety control.
• Where customers or the scheme require it, the assessments and plans are available for audit with the evidence behind each score.