Food defense and food fraud: the difference, and how to assess them with TACCP and VACCP

Food safety, food defense and food fraud: what is the difference?

The difference lies in the intent. Food safety is about hazards that end up in food unintentionally, such as bacteria, allergens or glass. With food defense and food fraud someone does it on purpose, with a different aim: causing harm or making money.

In practice they overlap. A raw material deliberately cut with a cheaper product is fraud, but it can also become a safety problem if that product contains an allergen. So assess the three topics side by side and not in separate boxes.

• Food safety: unintentional hazards such as bacteria, allergens and foreign objects, assessed with HACCP
• Food defense: deliberate attacks to cause harm, such as sabotage, poisoning or extortion, assessed with TACCP
• Food fraud: deliberate deception for financial gain, such as substitution, dilution or false origin, assessed with VACCP

Why is HACCP not enough?

HACCP looks at hazards that can arise in a process. A malicious person thinks along, picks the weakest point and adapts. A fraudster targets what nobody notices. That is why for these topics you look at motive, opportunity and vulnerability, and not only at likelihood per process step.

Many food safety schemes, such as FSSC 22000, BRCGS and IFS, ask for some form of assessment of deliberate threats and fraud, and customers ask about it during supplier audits. Which form you choose exactly, you take from your own scheme and from the requirements of your customers.

TACCP: assessing deliberate attacks

TACCP stands for Threat Assessment Critical Control Points. You do not start with what goes wrong, but with: who would want to harm us, how, and where are we vulnerable? Think of a disgruntled employee, an activist, a competitor, an extortionist or a former colleague who still has access.

For each threat you assess likelihood and impact, and look at vulnerable points: open access to tanks and silos, filling points, recipes, control systems, visitors and temporary staff. Whatever scores high gets a measure. A simple scale of low, medium and high is enough for this, as long as your team gives it the same meaning.

VACCP: assessing vulnerability to fraud

VACCP stands for Vulnerability Assessment Critical Control Points. Here you do not ask who wants to harm you, but where and for which raw material fraud is attractive and easy. Risk-increasing factors are a high price, scarcity, a long and opaque chain, difficult checks and earlier fraud cases with the same raw material.

Well-known examples from the sector are cutting honey with syrup, blending olive oil with cheaper oil, diluting spices with fillers, selling meat as another species and wrongly claiming that something is organic or from a specific region. Such fraud often goes unnoticed at a normal receiving check, because the product looks normal.

Two worked examples

VACCP example: you buy an expensive dried herb from a supplier who in turn buys from a trader. The price is high, the product is hard to judge visually and you do not know its origin. Vulnerability is high. You choose a supplier with known origin, ask for certificates and have authenticity tested on a sample basis on arrival.

TACCP example: the top of a storage tank with an ingredient is reachable by anyone on site. A disgruntled former employee could put something in it. The impact is high, the likelihood medium. You lock the tank, restrict access, withdraw access passes of departing employees immediately and set up an alert for broken seals.

Which measures fit?

Measures rest on three pillars: who goes where, how well you know your suppliers and a culture in which unusual things are reported. Choose them based on your assessment, not from a standard list, and assign each measure an owner. Below are examples you can consider, depending on what comes out of your assessment.

• Access control for site, production and storage, with registration of visitors and contractors
• Locking of tanks, silos and filling points, for example with seals
• A procedure at hiring and at leaving, including withdrawing access
• Knowing and evaluating suppliers and agreeing on transparency about origin
• Checks at receipt for seals, documents and unusual behavior
• Authenticity testing for raw materials assessed as vulnerable

How do you document it?

Record which products, raw materials and locations fall under the assessment, which threats and vulnerabilities you looked at, how you scored them, which measures you chose and who carried out the assessment. Do this with a team from quality, purchasing, production, HR and security, because no single department sees everything.

Review the assessment for a new supplier or raw material, after an incident and when signals come from your sector, and also periodically. Mind confidentiality: a food defense plan describes your weak points, so restrict who may view it and do not keep it in a folder open to everyone.

Common mistakes in food defense and food fraud

Many organizations tick this topic off for the audit and then leave it. An assessment that disappears into a folder does not protect your product and only gives false security. This is what most often goes wrong in practice, even at certified organizations:

• Treating food defense as a security project separate from food safety
• Looking only at the suppliers you know and not at the chain behind them
• An assessment that was made once and is never reviewed
• Assessing only threats from outside and not those from inside
• A plan that everyone can access
• Choosing measures without an owner or checks

How BrydgeOne supports this

The Food defense & food fraud module helps you document TACCP and VACCP assessments demonstrably. Supplier management supports evaluating and monitoring suppliers, HACCP & hazard analysis is the place for your food safety plan and with Audits you plan internal audits and record findings, for example to test your measures.