HACCP vs TACCP vs VACCP: Differences Explained

HACCP (Hazard Analysis and Critical Control Points) controls accidental hazards. It asks what could unintentionally make food unsafe, from pathogens to metal fragments. In Primority, HACCP plans sit within Food Safety Management.

TACCP (Threat Assessment and Critical Control Points) covers deliberate threats such as tampering or sabotage. It asks how someone could intentionally cause harm to consumers or to your brand. This is food defense.

VACCP (Vulnerability Assessment and Critical Control Points) covers food fraud such as substitution, dilution or mislabeling. It asks where someone could realistically cheat for financial gain.

What does VACCP mean?

VACCP stands for Vulnerability Assessment and Critical Control Points. It is a structured method for finding where your raw materials, ingredients and packaging are vulnerable to food fraud, and putting proportionate controls in place. Fraud is not always a safety issue, but it often is: melamine added to infant formula and pet food to inflate protein readings is one of the best known cases.

HACCP, TACCP and VACCP compared

Why HACCP alone is not enough

HACCP was designed to control unintentional hazards. It assumes everyone in the supply chain is trying to make safe food. Deliberate threats and economic fraud break that assumption, so they need their own risk logic. HACCP still does its job: if you are building or reviewing your hazard analysis, the HACCP Hazard Builder is a good place to start.

Three common mistakes weaken these assessments:

1. Treating TACCP as security paperwork. Locks and cameras are controls, not an assessment. TACCP needs realistic threat scenarios and a judgment of likelihood and impact.
2. Reducing VACCP to supplier approval. Supplier approval is a control. VACCP needs an understanding of market forces, ingredient scarcity and how hard fraud would be to detect.
3. Copying HACCP thinking into TACCP and VACCP. Critical control points do not translate cleanly to deliberate or economic risk. Different risks need different controls.

The three are connected, though. Tampering often happens at steps HACCP never considers, such as a warehouse where a disgruntled employee could add a foreign body. Fraud can happen at packing, when a cheaper ingredient is swapped in. That is why many sites keep the three assessments distinct but review them side by side, with one team able to see the whole picture.

What is TACCP?

TACCP is the assessment behind your food defense plan. It looks at intentional adulteration driven not by money but by a desire to harm people or a business. The threat could come from outside, or from inside: an employee with a grievance, or someone passed over for promotion.

A TACCP assessment typically covers:

• Who might want to cause harm, and why
• Site access for staff, contractors, visitors and deliveries
• Vulnerable points in the process, such as open product, intake points and storage
• Insider risk and personnel controls
• Internal threats, such as a disgruntled employee, as well as external ones, which SQF Edition 10 now asks sites to consider explicitly

Because TACCP crosses into security, HR and IT, it can fall off the food safety radar. Giving it a named owner on the senior team keeps it in view.

What is VACCP?

VACCP focuses on economically motivated adulteration. Whenever a cheaper material can pass for an expensive one, someone may be tempted to substitute it. Seafood species swaps and lower grade olive oil sold as extra virgin are familiar examples.

A VACCP assessment looks at each raw material, ingredient and packaging item and considers:

• History of fraud for that material
• Market pressure, such as price rises or shortages
• Supply chain complexity and how opaque it is
• How easy the fraud would be to carry out, and how hard to detect
• Your existing controls, such as testing, certification and supplier audits

How to run a vulnerability assessment

These steps apply to both a food fraud (VACCP) and a food defense (TACCP) assessment.

1. Build the team. Include technical, procurement, operations and, for TACCP, security and HR. Give one senior person overall responsibility.
2. Define the scope. List every raw material, ingredient, packaging item and finished product, and map the process and site.
3. Gather intelligence. Use fraud incident databases, industry alerts, government sources and supplier information to understand known threats.
4. Assess each item or step. Score likelihood and impact, considering fraud history, market pressure, ease of access and detection difficulty.
5. Rank the vulnerabilities. Focus effort where the risk is significant rather than spreading controls evenly.
6. Put proportionate controls in place. Examples include supplier approval and audits, authenticity testing, tamper evident packaging, access control and staff awareness.
7. Record and train. Document the assessment, the reasoning behind each score and the controls, and make sure the right people understand them.
8. Test and review. Challenge the plan, for example with a scenario exercise, and review it at least annually and whenever a trigger occurs.

Common review triggers include new suppliers or sourcing regions, ingredient price volatility, process changes, workforce turnover, security incidents or near misses, and regulatory or retailer updates. If reviews only happen before audits, the system is already behind reality.

How BRCGS, SQF and FSSC 22000 handle food defense and fraud

All three GFSI recognized schemes require a documented food defense threat assessment and a food fraud vulnerability assessment, each with a mitigation plan and regular review.

What auditors look for is consistent across schemes. Each risk type should be explicitly identified, the assessment logic should be defensible, controls should be proportionate and evidence based, responsibilities should be clearly owned, and reviews should happen when risk conditions change, not just annually.

Frequently asked questions