TACCP/VACCP-A Guidance Note
This article is intended as a guide to provide a route map for implementing both the Threat Assessment and Critical Control Point and Vulnerability Assessment and Critical Control Point risk management methodologies. It is not intended that this guide is used by an organisation as a TACCP or VACCP protocol but it highlights the processes and steps required to create one.
What are the aims of TACCP and VACCP?
Both TACCP and VACCP use the same risk management approach but there are subtle differences between the two.
Threat assessment and Critical Control Point (TACCP) helps food producers identify weak points in their supply chain and processing activities that maybe open to intentional and malicious attack. The TACCP protocol focuses on tampering, intentional adulteration of food and food defence.
Vulnerability Assessment and Critical Control Point (VACCP) focuses on food fraud as well but widens the scope to include the systematic prevention of any potential adulteration of food, whether intentional or not, by identifying the vulnerable points in the supply chain. VACCP is especially concerned with economically motivated adulteration. Examples of supply chain risks include product substitutions, unapproved product enhancements, counterfeiting and stolen goods.
If employed correctly both TACCP and VACCP help a business to minimise the chances of such an attack or to reduce the damage if an attack should occur.
TACCP and VACCP are employed by food businesses as part of a systematic approach to risk management to address the issues of malicious attack and food adulteration / fraud which will compromise food safety and product integrity. TACCP/VACCP should be used as part of a broader risk management process or as a way of starting to assess risks via a systematic approach. TACCP/VACCP, if employed correctly, can help an organisation:
- Reduce the likelihood of a deliberate malicious attack
- If an attack occurs reduce the impact on a business of that attack
- Protect an organisations reputation
- Reassure customers that the organisation is managing appropriately the risks in the supply chain and demonstrate due diligence
- Demonstrate that reasonable precautions are in place to protect the supply chain
It should be highlighted that TACCP/VACCP in itself cannot prevent an attack on an organisation. However, if conducted correctly the use of TACCP/VACCP can reduce the likelihood of an attack occurring or reduce the severity of an attack if one should occur.
How does TACCP/VACCP Compare to HACCP?
It could be considered that the TACCP/VACCP process builds upon a business’s existing HACCP as many precautions taken to protect the food safety of malt are also likely to deter deliberate malicious attack or frauds. Threat and vulnerability assessments look to document, deter, control, contain and mitigate against deliberate actions rather than the accidental or unintentional ones that HACCP addresses.
TACCP/VACCP is a risk management methodology which aligns with HACCP but has a different focus. Whereas HACCP focuses on the impact of the process on the food safety of a product as it is manufactured TACCP/VACCP considers the threats and vulnerabilities to a product within the entire supply chain. The focus of TACCP/VACCP could therefore be deemed broader than HACCP.
Where HACCP deals with pre-requisite programmes and critical control points TACCP/VACCP has response levels which highlights the criticality of the threat.
Considerations When Conducting TACCP /VACCP:
Because of the similarity of approach TACCP and VACCP studies could be run concurrently. However, it is essential that to be effective at implementing a TACCP/VACCP protocol there needs to be a systematic approach to the process. The TACCP/VACCP process seeks to provide answers to four key questions which are:
- Who might want to attack your business?
- How might they do it?
- Where is the business vulnerable?
- How can the business stop an attack?
In essence it is the role of the TACCP/VACCP team to get into the mind of a potential attacker and identify the weaknesses within their own business. Having identified those weaknesses it is necessary to identify how those weaknesses could be exploited and therefore the measures that need to be employed to ensure that they can be protected.
By this logical approach the business will have confidence that all relevant elements have been considered.
Define the Scope of the TACCP/VACCP Study:
The scope of the study should be clearly defined from the outset. This gives the TACCP/VACCP team a clear remit of the issues or processes that are to be considered as in-scope.
When considering the scope of the TACCP/VACCP study it is worth deciding:
- Whether the study covers a particular product or process.
- If it considers a single site or takes a multi-site approach.
- If it looks at a region or covers the entire organisation.
- Whether the study is short term, addressing an immediate problem or issue, or longer term covering more strategic objectives.
- The types of threats or hazards to be considered.
By deciding these critical criteria at the start of the TACCP/VACCP study it is easier to define the extent and scope of the TACCP/VACCP study.
Review Current TACCP/VACCP Measures in Place:
It is highly likely that an organisation already has a number of steps or procedures in place that can be included as part of the TACCP/VACCP study. However, there are a number of pre-requisites which are essential for an organisation to have in place for a TACCP/VACCP study to be successful, these include traceability and supplier quality assurance. If the organisation has a recognised quality standard e.g., ISO 9001 or has implemented HACCP then these pre-requisites should already be in place.
Once the organisation has identified any current measures it is important that these are assessed as being effective and this assessment documented and reviewed on a periodic basis. For example, most malting companies will have procedures in place for supplier approval, raw material specifications, intake checks, analysis and verification, traceability and site security. However, these will need to be reviewed as to whether they are fit for purpose in light of the threats identified during the TACCP/VACCP process.
As part of the review procedure, it is useful to collate any lessons learned from previous contamination or adulteration incidents experienced by the organisation. Consider what procedures were implemented in response to the incident and whether these have proven to be effective throughout the business.
Understanding the Threats and Vulnerabilities:
The three types of threat/vulnerability can be considered to be:
- Malicious contamination with materials that may present a threat to customers or consumers.
- Sabotage of the supply chain leading to supply and food issues.
- The misuse of food materials for either terrorist or criminal purposes.
Food fraud can also be considered in the threat characterisation process especially regarding the supply and use of specific barley varieties.
There are 7 main sources of food fraud that need to be considered for both ingredients and finished products within the TACCP/VACCP study which are:
- Unapproved enhancements (e.g., use of unauthorised additives)
- Counterfeiting
- Dilution (Reduction of premium grade products by dilution with lower quality material)
- Substitution (Declaring malt is made from a different variety than specified)
- Concealment
- Mislabelling (incorrect expiry dates, country of origin or malt type or variety)
- Grey market production / theft /diversion
Some of the 7 main sources of food fraud will have more relevance to the malting industry than others. For example, grey market production could be considered to be very low risk due to the high cost of production presenting a significant discouraging factor.
Having identified the threats and quantified the significance of the threats to the business there needs to be an evaluation of who is likely to attack the business and where the attack could be introduced by understanding the impact of personnel, premises, processes, services, logistics and cybercrime.
For more information, please Chat with us Ask The Expert.
