Food fraud and food defence plans for small manufacturers

What GFSI auditors ask for, how to score your raw materials and your site, and a template you can start from.

4 min read

The short answer

GFSI schemes ask for two assessments. A food fraud vulnerability assessment (VACCP) looks at each raw material and asks how likely it is to be substituted, diluted or mislabelled, then sets controls in a mitigation plan. A food defence threat assessment (TACCP) looks at your site and asks where someone could deliberately contaminate product, then sets controls such as access restrictions. Review both at least once a year, and keep the records.

The basics

Two assessments, two different questions

	Food fraud (VACCP)	Food defence (TACCP)
The risk	Cheating for money: substitution, dilution, mislabelling, counterfeiting	Deliberate harm: sabotage or malicious contamination
What you assess	Each raw material and packaging item, and its supply chain	Your site, people and processes
Typical controls	Approved suppliers, certificates of analysis, testing, specifications, buying from shorter supply chains	Access control, visitor and contractor records, locked chemical stores, tamper-evident seals
SQF Edition 9	2.7.2 vulnerability assessment and mitigation plan	2.7.1 threat assessment and food defence plan
BRCGS Issue 9	5.4 product authenticity, claims and chain of custody	4.2 food defence

FSSC 22000 has equivalent food fraud and food defence requirements. Check clause numbers against the current version of your scheme.

Step by step

Building the food fraud assessment

List every raw material

Include packaging and anything carrying a claim, such as organic, halal or country of origin.

Score the vulnerability

For each item, consider its price and value, history of fraud, how complex the supply chain is, and how easy fraud would be to spot.

Rate high, medium or low

A simple three-level rating is enough for most small sites, if you write down why you chose it.

Set controls for the high ones

Approved suppliers, specifications, certificates of analysis, periodic testing, or switching to a shorter supply chain.

Example

A worked example

A small sauce manufacturer might score three of its raw materials like this:

Raw material	Why it could be a target	Rating	Control
Honey	High value, known history of dilution with syrups	High	Approved supplier only; COA each lot; test one lot a year
Dried oregano	Known history of bulking with other leaves	Medium	Approved supplier; visual check at receipt; COA
Table salt	Low value, little reason to cheat	Low	Approved supplier; no extra control

Illustrative example, not a real site. Your ratings depend on your suppliers and your own history.

Food defence

Building the food defence plan

Walk the site and ask where someone could get to product, ingredients or chemicals without being noticed. Then set controls that fit your size.

Access: who can get into production, storage and the chemical store, and through which doors.
People: visitor and contractor sign-in, and staff knowing to question someone they don’t recognise.
Goods in and out: deliveries checked and sealed, finished goods stored securely.
Sensitive points: open product areas, water supply, bulk ingredient tanks.
Responsibility: one named senior person owns the plan. SQF requires this.

Test the plan at least once a year, for example by checking whether an unknown visitor would be stopped, and record what you found.

Audit day

What the auditor will look for

A documented method

How you scored vulnerability and threat, not just the result.

Controls that are real

If the plan says COA on every lot, the auditor will ask to see them.

An annual review

Dated, with any changes recorded, plus a review after any incident or supplier change.

Where EthicalHub fits

Keep the evidence where you can find it

In EthicalHub, supplier management holds approved suppliers, specifications and certificates, with expiry alerts, and delivery logs record the lot and COA for each delivery. That’s the day-to-day evidence your mitigation plan depends on. On the Enterprise plan, scheme workflows for SQF, BRCGS and FSSC 22000 sit on the same records.

See how it works for your site

A free 20-minute walkthrough. Plans from $69 a month per site.

Book a free walkthrough

Questions

Food fraud and food defence: common questions

What is the difference between food fraud and food defence?

Food fraud is deliberate cheating for money, such as substituting, diluting or mislabelling an ingredient. Food defence is about deliberate harm, such as sabotage or malicious contamination. Fraud is assessed with a vulnerability assessment (often called VACCP); defence with a threat assessment (TACCP).

Do small manufacturers need a food fraud plan?

If you are certified to, or working towards, SQF, BRCGS or FSSC 22000, yes. All three GFSI schemes require a food fraud vulnerability assessment with a mitigation plan, and a food defence threat assessment with a plan. Australian food law doesn’t name these plans, but your customers’ schemes do.

How often should we review the assessments?

SQF Edition 9 requires the food defence plan and the food fraud assessment to be reviewed at least once a year. Review sooner if something changes: a new supplier, a new raw material, a price spike, or a security incident.

Can we combine TACCP and VACCP into one assessment?

Many sites do, using one table with a column for the type of threat. That’s acceptable as long as fraud vulnerabilities and malicious threats are both clearly assessed and each has its own controls.

Know your weak spots before the auditor does.

Supplier records, certificates and delivery evidence in one place.

Book a free walkthrough How it works for food manufacturers