Part of the food fraud pillar of the TAAG Learning Center, together with GFSI schemes and food safety audits.
Table of contents
Why fraud needs its own assessment
A HACCP plan starts from one premise: hazards appear unintentionally, through a process failure, a contaminated raw material or human error. Food fraud does not fit that logic. Someone, at some point in the chain, deliberately decides to substitute, dilute or falsify in order to make money, and also tries to avoid being noticed.
That is why the industry distinguishes three complementary approaches:
- HACCP: unintentional food safety hazards.
- TACCP (food defense): intentional threats aimed at causing harm, with ideological or behavioral motivation.
- VACCP (fraud vulnerability): intentional acts with an economic motivation.
The FSSC 22000 guidance on fraud mitigation sums it up with an idea that is useful for the team carrying out the assessment: you have to "think like a criminal". The question is not what can fail, but where it would be easy and profitable for someone to cheat.
What GFSI requires and how it is reflected in the schemes
In 2014, the Global Food Safety Initiative published a position paper in which its board decided to incorporate two fraud mitigation steps as new key elements: requiring companies to carry out a fraud vulnerability assessment and to have a control plan. Those requirements entered Benchmarking Requirements version 7, published in 2017, and are mandatory for the schemes GFSI recognizes, such as those described in our article on GFSI audits.
According to GFSI's 2018 technical document, there are three requirements:
- A documented vulnerability assessment procedure to identify potential vulnerabilities and prioritize mitigation measures.
- A documented plan specifying the measures implemented to mitigate the public health risks arising from the identified vulnerabilities.
- That this plan be supported by the organization's food safety management system.
GFSI defines fraud vulnerability as the susceptibility or exposure to a fraud risk, understood as a gap that could put consumer health at risk if left uncorrected. And it clarifies something that reassures many quality teams: the auditor is not expected to detect fraud or to certify that the program is able to prevent it. What the auditor reviews is the approach: whether it is company-wide, whether it was built by a multidisciplinary team, whether it is documented, whether it is reviewed and what sources of information support it.
The FSSC 22000 case
The FSSC 22000 scheme version 6 includes additional requirement 2.5.4, applicable to all food chain categories. It requires carrying out and documenting the assessment with a defined methodology, covering the processes and products within scope, implementing mitigation measures for significant vulnerabilities and maintaining a documented plan, with verification procedures, that complies with applicable legislation and is kept up to date.
How to carry out the assessment step by step
The FSSC 22000 guidance (version 2, July 2023) proposes a work sequence that serves as a reference even if your plant is certified under another scheme:
1. Assemble the team
Fraud cuts across purchasing, logistics, quality, corporate security and sales. GFSI notes that the person in charge of the program is accountable for the whole, but does not have to carry out every task: the control of stolen goods, for example, may already be in the hands of logistics or security.
2. List raw materials, packaging and products
The scope runs from what comes in (raw materials, packaging material) to what goes out (semi-finished and finished product). Similar materials can be grouped to start with, and the analysis deepened in the groups where significant vulnerabilities appear.
3. Assess the vulnerability factors
FSSC 22000 lists, among others:
- Economic vulnerability: how attractive the fraud is. A jump in the price of a raw material is a warning sign.
- History: whether it has already happened or whether there are recent cases in the industry.
- Detectability: how easy it is to detect and whether a routine analysis exists.
- Access to raw materials, packaging and finished product along the chain.
- Supplier relationship: a long-standing relationship is not the same as a spot purchase.
- Industry certifications of independent authenticity or chain of custody.
- Supply chain complexity: length, origins and points where the product is transformed.
4. Define which vulnerabilities are significant
Not everything identified requires a measure. A matrix similar to the HACCP one can be used (likelihood by consequence), bearing in mind that profitability is a key factor in likelihood. GFSI recommends being exhaustive in identification and also documenting the vulnerabilities concluded to be low: that conclusion, if well founded, is part of the evidence.
5. Design the mitigation and document the plan
Measures can be preventive or control measures. FSSC 22000 mentions as verification the checking of origin and label, laboratory analyses, supplier audits, third-party certification and specification management. The plan is integrated into the management system with the same elements as any other program: training, internal audits, management review, corrections, corrective actions and records.
6. Review
Vulnerabilities change. The FSSC 22000 guidance itself recalls that horsemeat in beef products was not considered a vulnerability requiring control until the 2013 scandal occurred. We analyze it along with other episodes in our article on landmark food fraud cases.
Tools that help
The FSSC 22000 guidance mentions SSAFE's vulnerability assessment tool, free to use and backed by the GFSI board, and monitoring services such as HorizonScan. It also recommends mapping the supply chain, including socioeconomic, geopolitical, behavioral and historical factors. No tool replaces the team's judgment: its role is to organize information and leave a record of decisions. Documentary food traceability of each lot also relies on that record.
The place of laboratory analysis in the plan
Analysis is one mitigation measure among others, not the whole plan. Where it is decided to use it, the vulnerability assessment should determine which raw materials to test, how often and with what method: species identification in fish and meat, isotope profiles or syrup markers in honey, searching for unauthorized dyes in spices. The details of each technique are in our article on analytical methods for authenticity.
In the US, the regulatory framework pushes in the same direction from another angle. The FDA states that, under the Food Safety Modernization Act (FSMA), companies must apply preventive controls against hazards introduced intentionally for economic gain. There the focus is on fraud that affects food safety; the VACCP assessment of GFSI schemes also covers purely economic fraud.
Common mistakes
- Treating the assessment as an appendix to HACCP and analyzing only health hazards, leaving out fraud with no direct health impact.
- Limiting the scope to the plant, when vulnerabilities lie in purchasing, logistics and suppliers.
- Doing the assessment once and not reviewing it when suppliers, prices or context change.
- Testing samples without criteria, instead of directing the laboratory at the significant vulnerabilities.
- Not documenting why a vulnerability was considered low.
Conclusion
The fraud vulnerability assessment has been a requirement of every GFSI-recognized scheme since 2017, but its value goes beyond the audit: it forces you to look at the supply chain with the logic of someone who wants to deceive. A good plan identifies many vulnerabilities, justifies which ones are significant, assigns each proportionate mitigation and verification measures, including laboratory analysis where appropriate, and is reviewed whenever the context changes.
About TAAG
Discover how TAAG's laboratory services provide analytical evidence to the food safety management system on which the fraud mitigation plan relies.
Frequently asked questions
What is the difference between VACCP and TACCP?
Both address intentional acts, but with different motivations. VACCP assesses vulnerability to fraud, whose driver is economic gain. TACCP corresponds to food defense, against acts that seek to cause harm for ideological or behavioral reasons. HACCP, in contrast, covers unintentional hazards.
Since when has GFSI required a fraud vulnerability assessment?
GFSI announced the decision in its 2014 position paper and incorporated it into Benchmarking Requirements version 7, published in 2017. Since then, recognized schemes such as FSSC 22000, BRCGS, SQF or IFS must include a vulnerability assessment and a mitigation plan.
How often should the assessment be reviewed?
The FSSC 22000 guidance insists on reviewing it regularly because vulnerabilities change with context, for example when prices rise or a supplier changes. The prudent approach is to set a documented periodic frequency and also review it whenever there is a significant change in the organization or the market.
Does the auditor have to detect whether there is fraud in my plant?
No. According to GFSI, the auditor is not required to detect fraud or to state that the program prevents it. The auditor reviews the approach: that the assessment is company-wide, multidisciplinary, documented, reviewed and based on solid sources of information.