VACCP vs TACCP: Food Fraud and Food Defence Explained

VACCP (Vulnerability Assessment Critical Control Point) protects food from fraud: deliberate, economically motivated adulteration, substitution or mislabelling for profit. TACCP (Threat Assessment Critical Control Point) protects food from deliberate attack driven by ideology, grievance, extortion or malice. HACCP, by contrast, deals with unintentional hazards.

All three ask what could go wrong and what stops it. The difference is motive. A HACCP plan will not catch a supplier diluting olive oil, and a fraud assessment will not stop an angry employee tampering with a mixing tank.

If your site holds FSSC 22000, BRCGS or another GFSI-recognised certificate, auditors will expect a documented food fraud vulnerability assessment and a food defence plan. This guide explains both, with a worked example from a UAE spice importer.

HACCP vs TACCP vs VACCP: comparison table

What is TACCP and food defence?

TACCP is a structured assessment of deliberate threats to food, followed by proportionate defences. The main reference is PAS 96:2017, the BSI guide to protecting and defending food and drink from deliberate attack, produced with the UK Food Standards Agency.

PAS 96 describes threats including malicious contamination, extortion, espionage, counterfeiting, cybercrime and economically motivated adulteration. Many sites use TACCP for malicious threats and run fraud through a separate VACCP. A food defence plan typically covers:

• Perimeter security, locks and key control
• Restricted access to raw material stores, mixing rooms, water tanks and chemical stores
• Screening and supervision of staff, contractors and visitors
• Tamper-evident seals, protection of control systems and recipe data, and a route for reporting suspicious behaviour

What is VACCP and food fraud?

VACCP assesses your raw materials, products and supply chain to find where fraud is likely and how to prevent or detect it. It looks at opportunity and motivation: high-value or price-volatile materials, long supply chains and adulteration that is hard to detect.

Types of food fraud with examples

Food fraud is rarely meant to make anyone ill, but it can when the adulterant is toxic. Melamine-contaminated infant formula caused kidney illness in many infants, and lead chromate has been reported in turmeric in some markets.

GFSI, FSSC 22000 and BRCGS requirements

The GFSI benchmarking requirements expect certification programmes to include a food fraud vulnerability assessment with a mitigation plan, and a food defence threat assessment with a food defence plan. Schemes such as FSSC 22000 and BRCGS Food Safety therefore include requirements for both. Wording and review frequency differ between schemes and versions, so check the current scheme document. For how the schemes compare, see FSSC 22000 vs ISO 22000 vs BRCGS.

How to carry out a food fraud vulnerability assessment

The SSAFE food fraud vulnerability assessment tool is a well-known free tool that guides a team through opportunity, motivation and control questions. Whatever tool you use, the steps are similar:

1. Form the team: purchasing, QA, technical and someone who knows market prices.
2. List materials: raw materials, ingredients, packaging and relevant finished products.
3. Map the supply chain: manufacturer, packer, broker and country of origin.
4. Gather intelligence: fraud history, price changes, shortages and authority alerts.
5. Assess vulnerability: ease of adulteration, difficulty of detection, value, supplier relationship and existing controls, scored consistently.
6. Decide mitigation: specific controls, owners and testing frequency for high-risk materials.
7. Document and review: at least annually and after triggers such as a new supplier, price spike, fraud alert or recall.

Mitigation controls

Worked example: a UAE spice importer

A spice importer in Sharjah supplies saffron and ground turmeric to restaurants and retailers. The QA manager leads a VACCP review with the purchasing manager and warehouse supervisor.

Saffron

Saffron is high value, easy to bulk out and has a long fraud history, with known adulterants including safflower, marigold petals and dyed fibres. The team rates it highly vulnerable and agrees to:

• Buy whole threads only, from approved suppliers
• Specify against the ISO 3632 saffron standard, including colouring strength
• Check every lot visually and microscopically, with risk-based laboratory testing
• Escalate offers priced well below market to QA

Turmeric

Ground turmeric comes in large volumes from several packers, and unapproved colours have been reported in some markets. The team rates ground product high and whole rhizomes lower, and agrees to:

• Set specification limits for lead and chromium, with periodic testing
• Screen for unapproved dyes and added starch
• Audit the two packers with the longest supply chains

A short TACCP review of the warehouse adds restricted access to the saffron store, a sealed-load check at receiving and a visitor log. Both assessments are reviewed at management review.

Common mistakes

• Copying a generic template without assessing your own materials
• Treating a certificate of analysis as proof of authenticity
• Mixing food fraud and food defence in one vague document
• Scoring everything low risk to avoid testing costs
• Leaving purchasing out of the team, though they see market signals first

Key takeaway: HACCP controls accidental hazards, TACCP defends against deliberate attack and VACCP prevents fraud for profit. Certified sites need a documented assessment and plan for both, built on real supply chain knowledge and reviewed whenever risk changes.

Frequently Asked Questions

What is the difference between VACCP and TACCP?

VACCP assesses vulnerability to food fraud, which is economically motivated: adulteration, substitution, dilution or mislabelling for profit. TACCP assesses threats of deliberate attack motivated by harm, ideology, grievance or extortion, such as malicious contamination or sabotage. Both are proactive risk assessments, but they involve different people, questions and controls, so most sites keep them as separate documented assessments.

Is VACCP mandatory?

VACCP is not a legal term in most countries, but food fraud vulnerability assessment is required by GFSI-recognised schemes such as FSSC 22000 and BRCGS. If your site holds or is seeking one of these certificates, you need a documented assessment and mitigation plan. Food law also requires honest labelling, so confirm local expectations with your regulator, such as Dubai Municipality, ADAFSA, SFDA or FSSAI.

Which foods are most vulnerable to food fraud?

Foods with high value, complex supply chains or adulteration that is hard to detect are reported most often. Common examples include olive oil, honey, saffron and other spices, fish and seafood, basmati rice, fruit juices, milk products and meat. Your own assessment should focus on the materials you actually buy, from the suppliers you actually use.

How often should a vulnerability assessment be reviewed?

Most schemes expect at least an annual review, plus a review whenever something changes: a new supplier or material, a sharp price movement, a published fraud alert, a recall or a relevant audit finding. Check your certification scheme for its exact requirement, and record each review even when nothing changes.

Next steps

If you are responsible for food fraud or food defence, the Food Fraud and Food Defence (VACCP and TACCP) course covers vulnerability and threat assessments in practical terms. For a wider view of certified systems, see Advanced Food Safety Management and Compliance.

To keep building, read our guides to food traceability and recall readiness, FSSC 22000 vs ISO 22000 vs BRCGS and how to build a HACCP plan. Not sure which course fits? Speak to a counsellor.