RISK ASSESSMENT · FOOD FRAUD AND VACCP

Food Fraud Vulnerability Assessment: Scoring VACCP Without Guessing

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 14 min read

Food fraud is intentional deception for economic gain using food. BRCGS Global Standard Food Safety Issue 9 handles it in clause 5.4, product authenticity, claims and chain of custody, and the FSSC 22000 additional requirements include food fraud mitigation. A VACCP assessment scores each raw material on opportunity and motivation, then on the strength of existing control. The Food Fraud Vulnerability (VACCP) Risk Assessment Template (RA18) is R690.

What food fraud is, and how it differs from food defence and food safety

Food fraud is intentional deception for economic gain using food, and BRCGS Issue 9 handles it at clause 5.4, product authenticity, claims and chain of custody. Food defence, assessed through TACCP, addresses deliberate acts intended to cause harm. Food safety, controlled through HACCP, addresses hazards that arise without anyone intending them. The hazard can look identical in all three cases. The motive is different, so the assessment method, the team and the controls are different too.

This distinction is not academic. It decides what your register looks like. A HACCP study works forward through your process steps. A food defence assessment works through points of access and the people who hold them. A food fraud assessment works through raw materials and the supply chains that deliver them, and it asks a question your HACCP study never asks: who would make money from this, and would we notice?

The 2013 European horsemeat incident is the clearest illustration. The Food Safety Authority of Ireland announced on 15 January 2013 that DNA testing had found horse meat in beef products on sale in Irish and British supermarkets. Some products were later found to be almost entirely horse. Horse meat is not a safety hazard in itself, and the incident was reported as a mislabelling and traceability failure rather than an acute health event. No HACCP plan in Europe was designed to detect it, because HACCP looks for hazards, and this was a business model.

Melamine adulteration of dairy in China in 2008 shows the second pattern. Melamine is nitrogen rich, and the Kjeldahl and Dumas methods used to measure protein do not distinguish nitrogen from melamine from nitrogen in amino acids. Adding it raised the apparent protein figure. It was an economic act with a severe health outcome, and it worked precisely because it defeated the routine test. That is what makes food fraud a vulnerability question rather than a hazard question: the fraudster designs around your controls.

In one line: HACCP scores process steps against hazards nobody intended, TACCP scores points of access against people who intend harm, and VACCP scores raw materials against people who want margin. Our published guide to food defence and TACCP sets out the full definitional comparison, so this article stays on the vulnerability assessment itself.

Sites conflate the two intentional assessments more often than they conflate either with HACCP, and it is the single most reliable way to collect a finding in this area. Keep the two registers separate even where one team writes both.

HACCP asks what can go wrong. VACCP asks who would gain, and whether your current checks would catch them.

The seven recognised types of food fraud

Seven types cover the field: dilution, substitution, concealment, unapproved enhancement, mislabelling, counterfeiting, and grey market production, theft and diversion. The draft Codex text adopted at Step 5 on 28 November 2024 covers the same ground in six categories of its own. The Food Authenticity Network, led by LGC, groups these under four headings, with the first four treated as adulterant substances. Naming the type matters because each type is defeated by a different control.

Codex is developing its own guidelines on the prevention and control of food fraud through the Codex Committee on Food Import and Export Inspection and Certification Systems. That text was adopted at Step 5 by the 47th session of the Codex Alimentarius Commission on 28 November 2024 and identifies six types: addition, substitution, dilution, counterfeiting, misrepresentation, and concealment of information about food safety or quality. It is still in development, so do not cite it as a finalised standard, but the overlap with the seven type model is close enough that a register built on either will map to the other.

Why the certification schemes require a vulnerability assessment

Every GFSI recognised scheme requires a documented food fraud vulnerability assessment because the 2013 horsemeat and 2008 melamine incidents both proved that a certified site with a working HACCP plan can still ship an adulterated product. GFSI itself does not certify anyone. It benchmarks schemes, and the schemes it recognises now carry the requirement in their own words.

In BRCGS Global Standard Food Safety Issue 9, published 1 August 2022 and still the current issue, product authenticity, claims and chain of custody is section 5.4. That is where the documented vulnerability assessment for raw materials lives, together with the requirements around claims and the systems that support them. It does not stand alone. Clause 3.5.1, supplier approval, is one of the twelve fundamental requirements of Issue 9, and a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. A vulnerability assessment that identifies a high risk material, and a supplier approval programme that never mentions it, is a gap between two clauses that an experienced auditor will find in the first hour.

For FSSC 22000, food fraud mitigation is one of the FSSC additional requirements, the set of scheme specific requirements that sit on top of ISO 22000:2018 and the sector prerequisite programme standard. FSSC 22000 Version 7 was published in May 2026, replacing Version 6, and the additional requirements remain part of the scheme. If you are working through that transition, our complete guide to FSSC 22000 Version 7 in South Africa sets out the dates and the change list.

There is also a legal reason that has nothing to do with certification. Section 61 of the Consumer Protection Act 68 of 2008 imposes liability on producers, importers, distributors and retailers for harm caused by unsafe goods, product failure, defects or hazards, or by inadequate instructions or warnings, and it does so irrespective of negligence. Section 41 deals with false, misleading or deceptive representations. If an adulterated raw material reaches a consumer through your brand, the vulnerability assessment is part of what you produce to show what you assessed and what you did about it.

What a VACCP assessment must contain

Clause 3.5.1 of BRCGS Issue 9 is a fundamental requirement, and the assessment that feeds it contains a scope statement, a named team with evidence of competence, a complete raw material list including packaging and outsourced processes, a supply chain map for each material, a scoring method written down before it is used, the scores themselves with reasons, a mitigation plan with owners and dates, horizon scanning evidence, and a review record. Nine parts. Most registers arrive with fewer than half of them.

The two that get left out most often are the competence evidence and the horizon scanning evidence. BRCGS expects the individual or team doing the assessment to understand food fraud, including knowledge of the raw materials the site uses and the principles of vulnerability assessment. In practice that means training records, not a job title. The Food Fraud (VACCP) and Food Defence (TACCP) course at R1,450 is the shortest route to that evidence for a team of two or three, and it covers both assessments so you are not buying the same competence twice.

1. Define the scope honestlyEvery raw material, every processing aid, every packaging material that carries a claim or a printed statement, every outsourced process such as contract blending or third party storage, and every service that touches the product. Packaging is where most scopes stop too early.
2. Map the supply chain per materialNot “supplier X”. Name the grower or primary producer where you can, then the processor, the trader or broker, the importer, the agent and the transporter. Count the steps. The number of hands between origin and your gate is one of the strongest predictors of vulnerability you have.
3. Write the scoring method before scoringDefine what a 1 and a 5 mean for opportunity and for motivation, in words, with examples from your own materials. Define the bands and what each band obliges you to do. A method written after the scores is a method built to justify them.
4. Score inherent vulnerabilityOpportunity multiplied by motivation, with a written reason in each row. The reason column is what the auditor reads. A score with no reason is a number, not an assessment.
5. Record existing controls and their evidenceName the control, the document that describes it, the person who owns it and the record that proves it happened. A control with no record does not reduce a score.
6. Re-score with controls appliedControls reduce opportunity. They do not reduce motivation. Re-score opportunity only, and calculate the residual vulnerability. This keeps the assessment honest and it stops the register drifting to green.
7. Write the mitigation plan for anything above the thresholdAction, owner, date, and the evidence that will close it. Then put review dates on the calendar and link the whole register to your supplier approval programme.

How to score vulnerability: opportunity, motivation and control

Score two things and record a third, which is how the RA18 register at R690 is built. Opportunity, from 1 to 5, is how easily this material could be adulterated or substituted without your current checks noticing. Motivation, from 1 to 5, is how much money is available from doing it. Multiply for an inherent score out of 25. Control strength, from 1 to 5, is recorded separately, and it works by reducing opportunity on the second pass.

Opportunity is a property of the material and the chain, not of the supplier’s character. Score it on physical form, on the number of intermediaries, on whether the material is bought on a specification you can test, and on how hard the relevant test is. Whole peppercorns are harder to falsify than ground pepper. A material bought direct from a single named processor has less opportunity than the same material bought through two traders.

Motivation is a property of the market. Score it on the value gap between the genuine material and the plausible substitute, on price volatility over the past two years, on supply shortage, and on whether a premium claim rides on the material. A crop failure or a currency move that widens the gap raises motivation for every buyer in the market at the same time, which is why horizon scanning feeds this column and nothing else does.

Set the bands and the obligation each one carries before you score. We use 1 to 6 as low, 8 to 12 as medium and 15 to 25 as high, which uses every possible product of two scores from 1 to 5 without leaving a gap. Low means the existing controls stand and the material is reviewed annually. Medium means a named monitoring action with a frequency. High means a written mitigation plan with an owner and a date, and a shorter review interval.

Worked example: seven materials scored

The table below is a worked example built to show the method, not a statement about any real supplier, product or company. The scores are illustrative. Your own scores must come from your own materials, your own chains and your own control records, and the reason column is what makes them defensible.

Two things about this table matter more than the numbers. The first is that low scores appear in it. A register in which every material lands in the medium band tells an auditor the team scored to avoid work rather than to find out anything. The second is that control strength moves the opportunity column and nothing else. Skimmed milk powder and frozen fish fillet share the same inherent score of 16, and they separate only because one has a stronger control history.

The raw material characteristics that raise vulnerability

Six characteristics do most of the work in a vulnerability score, and the 2013 horsemeat substitution carried most of them: price volatility, complex supply chain, geographic concentration, ease of substitution, economic incentive and testing difficulty. Score each material against all six and the opportunity and motivation figures stop being opinions. Materials that carry four or more of these should never sit in the low band without a written justification.

Add a seventh in practice: whether the material carries a claim. Organic, halaal, kosher, free range, non GMO, single origin, fair trade and variety claims all move value onto a piece of paper, and paper is cheaper to falsify than food. Any material supporting a claim on your pack belongs in the assessment even where the material itself is cheap, because the fraud target is the certificate, not the commodity.

How horizon scanning works and where to get intelligence

Horizon scanning is the routine of checking external sources such as the RASFF Window and the FDA import alerts for emerging fraud in your commodities, recording what you found, and deciding whether it changes a score under clause 5.4 of BRCGS Issue 9. Auditors want a dated log rather than a folder of printouts: which sources were checked, what was relevant, what was not, and which register rows changed as a result.

• RASFF Window, the European Commission’s public database of Rapid Alert System for Food and Feed notifications, searchable from 2020 onward at webgate.ec.europa.eu. Filter by product category and by hazard category to see what is being detected and where.
• United States FDA import alerts, published at accessdata.fda.gov, which list products and firms subject to detention without physical examination. Browsing by country and industry shows you which commodities are under sustained suspicion.
• Food Authenticity Network, led by LGC and run as a public private partnership at foodauthenticity.global. Open access guidance, authenticity methods, centres of expertise and a document library. This is the source to use when you need to know whether a test for a given adulterant exists at all.
• UK Food Standards Agency alerts at alerts.food.gov.uk, a searchable list of food alerts, allergy alerts and product recalls, filterable by type and date.
• National Consumer Commission product recalls at thencc.org.za, which publishes product safety recalls notified in South Africa across food and non food categories.
• Europol and INTERPOL Operation OPSON reports, the annual joint operation against counterfeit and substandard food and drink. The OPSON XIV results reported seizures worth EUR 95 million across 31 countries, more than 11,500 tonnes of food and 1.4 million litres of beverages, with 631 individuals reported to judicial authorities.
• Your own data, which most sites ignore. Unexplained supplier price drops, sudden willingness to supply a scarce material, changes in certificate of analysis format, goods receiving rejections, mass balance variance, customer complaints about taste or colour, and laboratory results drifting toward a specification limit rather than sitting around a mean.

Set a frequency and keep it. Quarterly is workable for most manufacturers, monthly if you buy heavily traded commodities. Assign it to a named person, give them thirty minutes and a template, and require an entry even when the answer is that nothing changed. A log with four dated entries a year and two register changes is stronger evidence than fifty pages of unread alerts.

Mitigation that stands up at audit

Mitigation stands up at audit when it is specific to the material, owned by a person, evidenced by a record and proportionate to the score. Six controls carry most of the weight: the raw material specification, supplier approval at clause 3.5.1 of BRCGS Issue 9, testing, mass balance, traceability, and authenticity testing where the claim or the value gap justifies the cost. Generic statements about supplier relationships carry none.

Supplier approval is where a food fraud finding usually turns into a bigger problem, because clause 3.5.1 is a fundamental requirement of BRCGS Issue 9 and a major non-conformity against its statement of intent is a fail, and certification is off the table. What happens to the audit itself is then agreed between the auditor, the certification body and site management: it can end there, or it can carry on as a non-certification gap audit. Either way a further full audit is needed before the site can be certified. If your VACCP register puts a material in the high band and the supplier file for that material contains a two year old questionnaire, the two documents contradict each other in writing. The Supplier and Purchased Material Approval Risk Assessment Template (RA11) at R690 is the pack that closes that gap, because it scores approval method against material risk instead of applying one questionnaire to everyone.

Traceability is the other control that has to work under pressure rather than on paper. A withdrawal caused by an authenticity failure moves faster than a microbiological one, because the customer usually finds out from a laboratory or a journalist rather than from you. The Traceability, Withdrawal and Recall Risk Assessment Template (RA20) at R690 scores where your trace breaks: at rework, at bulk decanting, at blending, and at the point where a batch code stops travelling with the product.

The difference between mitigation and detection

FSSC 22000 carries food fraud mitigation, not food fraud detection, in its additional requirements. Mitigation reduces the chance that adulterated material ever reaches you. Detection finds it after it has arrived. Specification, supplier approval, contract terms, shortening the chain and buying direct are mitigation. Testing, mass balance, traceability exercises and certificate verification are detection. A plan built only from detection controls is a plan that accepts the fraud and tries to catch it, and auditors are increasingly willing to say so.

Both are needed, but they answer different questions and they should be labelled differently in the register. Ask of each control: does this stop it happening, or does it tell me it happened? A high band material with three detection controls and no mitigation control is a material you are still buying blind. Paprika bought through a broker is a supply chain problem wearing a laboratory costume.

There is a practical reason to keep the labels separate. When a score has to come down, only mitigation moves the opportunity column much. Detection controls raise the chance of catching a fraud in progress, which is worth having, but they do not make the material harder to adulterate. Sites that write “increase testing” against every high band row usually find the residual scores barely move, and that is the method working correctly rather than failing.

How often to reassess, and what triggers a review

Review the whole assessment at least annually, and review affected rows immediately whenever the picture changes. BRCGS deals with the requirement in clause 5.4, and your own procedure should state the interval and the triggers in writing so that the review is a scheduled task with an owner rather than something that happens the week before an audit.

• A new raw material, a new packaging material carrying a claim, or a new outsourced process
• A new supplier, or a change of source, sub supplier or manufacturing site within an existing approved supplier
• A change of broker, agent, importer or transport arrangement, even where the material and price are unchanged
• A sharp price movement in either direction, particularly a drop nobody can explain
• A supply shortage, crop failure, drought, export restriction or currency move affecting one of your commodities
• A new claim on the label, or a change to an existing one
• A relevant notification from your horizon scanning sources, or a public incident in one of your commodities anywhere in the world
• An internal signal: a failed traceability exercise, a mass balance variance outside tolerance, a certificate that could not be verified, or a customer complaint about identity, taste or colour

Record every review, including the ones where nothing changed. A register with a single date on it tells an auditor the document was written once. A register with four dated reviews, two of which changed a score with a stated reason, tells them the system is alive. That difference is worth more at audit than any amount of extra detail in the rows themselves.

The findings that come up

BRCGS Issue 9 writes food fraud findings against clause 5.4, and they cluster in a small number of places, almost all of them structural rather than technical. The assessment exists but its scope is short, its scores have no reasons, its controls have no records, or its output never reaches the supplier approval programme. Fix those four and most of the rest disappear.

• Scope stops at raw materials. Packaging carrying a claim, processing aids, outsourced blending or storage, and services are left out. Packaging is the most common omission and the easiest for an auditor to spot from your artwork.
• One score for the whole site. A single line saying raw materials are medium risk. Vulnerability is a property of a material and its chain, so the register has to run by material.
• Motivation scored on the supplier’s honesty. Rows justified with “long standing supplier, trusted”. Motivation is set by the market, not by the relationship, and the relationship belongs in the control column.
• Controls credited with no evidence. A score reduced because testing is done, and no sampling plan, no laboratory report and no action record when a result failed.
• No competence evidence for the team. BRCGS expects the individual or team to understand food fraud and the principles of vulnerability assessment. Job titles are not records. Training certificates are.
• Horizon scanning is a folder, not a log. Printouts filed with no dates, no decisions and no link to a register row. The auditor wants to see a scan that changed something.
• The mitigation plan is all testing. Every high band row answered with “increase analysis”. No specification change, no supplier action, no attempt to shorten the chain.
• Claims with no chain of custody. Organic, halaal, free range or single origin on the pack, with certificates on file that were never verified with the issuing body and no reconciliation of certified input against certified output.
• Mass balance never run, or run only on the easy material. A reconciliation on packaging film and none on the blended commodity that scored 20.
• VACCP and TACCP merged. One document trying to be both, thorough on materials and thin on access points, or the reverse. The auditor reads the thin half.
• No review after a public incident. A widely reported fraud in one of your own commodities, and a register whose last review date is eleven months old.

Where a finding has already been written, the correction is rarely another version of the same document. Work back to why the register was thin: usually no method, no owner and no time. Our guide to BRCGS Issue 9 implementation sets out how the sections connect, and the complete guide to food hygiene audits covers how findings are graded and closed out.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.