Strong food defence isn't about suspicion, it's about confidence: knowing exactly where your facility stands, and knowing it holds up. We build the threat assessment and the plan that gets you there.
TACCP, Threat Assessment Critical Control Point, is a structured methodology for identifying and mitigating the risk of intentional, malicious contamination of food. As defined in PAS 96:2017, TACCP requires an organisation to think like someone motivated by harm, not financial gain. It addresses threats that may be internal, such as a disgruntled employee or a contractor with unsupervised access, or external.
TACCP focuses on people, access, and behaviour, identifying where someone with malicious intent could interfere with product, and what would stop them, instead of focusing on ingredients or supply chain steps, which is the focus of VACCP and food fraud. The two are easy to confuse because both produce a "vulnerability assessment" and both are required under GFSI-recognised schemes, but they answer fundamentally different questions: VACCP asks where in the supply chain someone might substitute or dilute a product to make money. TACCP asks where in your facility someone might deliberately contaminate product to cause harm.
This distinction matters practically because the mitigation strategies differ. A VACCP mitigation might be additional authenticity testing on a high-risk ingredient. A TACCP mitigation might be restricting unsupervised access to a mixing area, or reviewing who has the ability to alter a formulation in the plant's control system. Treating both as a single undifferentiated "vulnerability assessment" risks producing mitigation strategies that don't address either threat type well.
Across all GFSI-recognised standards, food defence has moved from a background requirement to an active, scrutinised audit focus area. The gap auditors increasingly find isn't the absence of a documented plan, it's the gap between what's documented and what happens day to day: mitigation strategies that exist on paper but aren't monitored, or a threat assessment that was written once and never revisited as the facility changed.
A TACCP assessment examines four areas of access and control, since a person with malicious intent could exploit a gap in any of them, individually or in combination.
Perimeter access, deliveries, and visitor management. Who can get onto the site, and how is that controlled and recorded?
Access to processing areas, storage, and ingredient handling within the facility. Once someone is on site, what can they reach unsupervised?
Hiring practices, access privileges, and behaviour monitoring for employees and contractors. Insider access is a significant share of realistic threat scenarios.
Access to formulation, process control, and supplier information systems that could be used to facilitate or conceal intentional contamination.
The four pillars are deliberately broad because TACCP isn't only about a stranger getting past a fence. A significant share of realistic threat scenarios involve someone who already has legitimate access, an employee, a contractor, a delivery driver, using that access in a way it wasn't intended for. This is why personnel security and access privileges receive as much attention in a thorough TACCP assessment as perimeter fencing and visitor logs.
As of April 2026, every compliance deadline under the FDA's Intentional Adulteration Rule has passed, including the extended deadline for very small businesses.
The FDA Intentional Adulteration Rule, 21 CFR Part 121, addresses the risk of wide-scale public health harm from deliberate contamination of food. It requires covered facilities to have a written food defence plan with five components.
Identifying significant vulnerabilities at each point, step, or procedure in the food operation, using TACCP or CARVER plus Shock methodology.
Mitigation strategies addressing significant vulnerabilities, monitoring procedures confirming they're applied consistently, and corrective action procedures for when they aren't.
Verification procedures confirming monitoring is occurring and corrective action decisions are appropriate. As of April 2026, all compliance deadlines, including for very small businesses, have passed.
The practical implication of all deadlines having passed is that active FDA inspection for compliance is now a real, current risk for any covered facility without a documented plan, not a future date to plan around. For facilities that have a plan but haven't reviewed it recently, the more common risk is that the plan no longer reflects the facility: new equipment, a new access point, a change in contractor arrangements, or a personnel change in a role with formulation access, none of which automatically trigger a plan update unless someone is specifically watching for it. BRCGS Issue 9, Clause 4.2 requirements go further than the IA Rule in one respect: BRCGS requires the threat assessment to evaluate three categories, fraudulent activities, sabotage, and terrorism, where the IA Rule focuses primarily on wide-scale harm scenarios. A facility meeting only the IA Rule's scope may have a gap against BRCGS's broader three-category requirement.
Food defence is relevant to any food business, regardless of size, since the Intentional Adulteration Rule's deadlines now apply broadly and GFSI schemes require it across the board.
Covered facilities that haven't yet developed a food defence plan, now facing active inspection risk with all IA Rule deadlines passed.
Operations whose food defence plan hasn't been reviewed since a significant facility, equipment, or personnel change.
Operations that may have assumed an exemption still applies, now that the extended deadline for very small businesses has also passed.
Operations needing their threat assessment to cover all three BRCGS categories, fraud, sabotage, and terrorism, not only the IA Rule's scope.
Operations that have treated food fraud and food defence as a single undifferentiated exercise, needing the two separated into appropriately targeted programmes.
Businesses needing to reassess personnel security and access privileges following organisational changes, new contractors, or new system access arrangements.
We cover the full scope of food defence planning, from first threat assessment through to ongoing verification.
A review of existing food defence documentation against TACCP methodology, IA Rule requirements, and GFSI scheme requirements.
A structured threat assessment across the four security pillars, identifying access points and behaviours a person with malicious intent could exploit.
Development of a documented plan covering all five components required under the FDA Intentional Adulteration Rule and GFSI scheme requirements.
Design of mitigation strategies addressing identified access and behaviour vulnerabilities, proportionate to the facility's size and risk profile.
Development of monitoring procedures confirming mitigation strategies are applied consistently, and verification procedures confirming monitoring occurs.
Extension of an existing IA Rule-focused plan to cover BRCGS's three required threat categories: fraud, sabotage, and terrorism.
Review of combined food fraud and food defence documentation, separating the two into appropriately targeted assessments and mitigation strategies.
Review of hiring practices, access privileges, and formulation system access as part of the personnel and data security pillars.
Design of a system to flag when facility, equipment, or personnel changes should trigger a food defence plan review.
A TACCP assessment is only as effective as the people applying it day to day. Staff who understand what an unusual request, an unscheduled visitor, or an out-of-pattern access attempt might mean are a meaningful extension of the controls themselves. We recommend pairing this consulting programme with food defence awareness training, and where food fraud is also a concern, our VACCP and food fraud training covers the related vulnerability assessment perspective. We can advise on the right combination during the initial consultation.
The process follows a defined sequence. Our part of the process typically takes 1 to 2 weeks.
| Stage | What happens | Our role | Duration |
|---|---|---|---|
| 1. Facility walkthrough | The facility is walked across all four security pillars to identify access points and current controls. | We conduct the walkthrough and document findings. | 1 to 2 days |
| 2. Threat assessment | A structured TACCP threat assessment identifies significant vulnerabilities at each point, step or procedure. | We conduct the assessment using TACCP methodology. | 2 to 3 days |
| 3. Mitigation strategy design | Mitigation strategies are designed for each significant vulnerability identified. | We design mitigation strategies proportionate to your facility. | 2 to 3 days |
| 4. Monitoring procedures | Monitoring procedures are developed to confirm mitigation strategies are applied consistently. | We develop monitoring procedures and documentation. | 2 to 3 days |
| 5. Corrective action procedures | Corrective action procedures are developed for when mitigation strategies aren't properly implemented. | We develop the corrective action framework. | 1 to 2 days |
| 6. Verification procedures | Verification procedures are developed confirming monitoring occurs and decisions are appropriate. | We develop the verification schedule and documentation. | 1 to 2 days |
| 7. Implementation | The food defence plan is put into practice across the facility. | We provide implementation support during the first cycles. | 1 to 2 weeks |
| 8. Periodic reanalysis | The plan is reviewed periodically and following any significant facility, equipment, or personnel change. | We support periodic reanalysis and plan updates. | Ongoing / annual |
Our gap assessment tests whether your plan reflects how your facility operates today, not how it operated when the plan was written.
The assessment reviews existing food defence documentation against TACCP methodology, the FDA Intentional Adulteration Rule's five required components where applicable, and BRCGS or FSSC 22000 food defence requirements.
It typically includes a facility walkthrough examining the four security pillars, outside security, inside security, personnel security, and data and cyber security, to identify access points a person with malicious intent could exploit, and a review of whether mitigation strategies, monitoring, and verification procedures are documented and being followed in practice.
We compare the documented plan against current facility layout, equipment, and access arrangements.
We assess outside, inside, personnel, and data/cyber security across the facility.
We confirm whether monitoring and verification procedures are documented and performed in practice.
We produce a written gap assessment with a prioritised action plan.
If you also need a food fraud (VACCP) assessment, we can scope both together while keeping the methodologies and outputs appropriately distinct.
The same gaps appear across food defence reviews regardless of sector. Knowing where these gaps cluster is the most effective preparation.
A food defence plan that exists as a document but has never been tested against the facility's actual layout and access points often describes a facility that no longer quite matches the one being audited.
Mitigation strategies that address obvious external threats, fencing, visitor logs, while overlooking insider access, despite internal personnel representing a significant share of realistic threat scenarios.
Monitoring procedures for mitigation strategies that exist on paper but aren't performed leave no evidence the plan is operating day to day, even if the underlying mitigation, a locked door, a restricted system, is technically in place.
A threat assessment that hasn't been reviewed since a significant facility change, new equipment, new access point, or change in contractor arrangements no longer reflects the facility's actual vulnerabilities.
TACCP and VACCP treated as a single combined exercise without distinguishing malicious-intent threats from economically motivated ones results in mitigation strategies mismatched to the actual threat type, such as authenticity testing where access control was needed, or vice versa.
A plan built solely to satisfy the FDA Intentional Adulteration Rule's scope, focused on wide-scale harm scenarios, may not cover BRCGS's broader three-category requirement of fraud, sabotage, and terrorism.
Understanding how these three frameworks relate clarifies which addresses which type of risk.
| TACCP (food defence) | VACCP (food fraud) | HACCP | |
|---|---|---|---|
| Motive addressed | Malicious intent, harm | Economic gain, profit | Unintentional hazards |
| Focus | People, access, behaviour | Ingredients, supply chain | Process steps, CCPs |
| US regulatory basis | 21 CFR Part 121 (IA Rule) | 21 CFR Part 117 Subpart G | 21 CFR Part 117 Subpart C |
| Our consulting | TACCP/Food Defence | VACCP/Food Fraud | HACCP |
What drives the timeline and cost of a food defence project. We provide a written proposal with a fixed fee after the initial consultation.
Timeline
How long our consulting work takes
Cost factors
What drives the consulting fee
No existing food defence plan. Our consulting work, from walkthrough to implementation-ready plan, typically takes 1 to 2 weeks.
Review of an existing plan against current IA Rule and GFSI requirements. Typically 2 to 3 days.
Extending an IA Rule-focused plan to cover BRCGS's fraud, sabotage, and terrorism categories.
Separating a combined food fraud and food defence exercise into two appropriately targeted programmes.
Larger facilities with more access points, contractors, and systems require a more extensive walkthrough and assessment.
A single-site operation requires less work than a multi-site business needing consistent food defence plans across locations.
A gap assessment only, a full plan build, or an ongoing reanalysis review service each carry different fees. All scopes are defined in writing before work begins.
For businesses needing both TACCP and VACCP work, combined engagements are scoped together for efficiency.
Answers to the questions we hear most often from businesses building or reviewing food defence plans.
TACCP, Threat Assessment Critical Control Point, is a structured methodology for identifying and mitigating the risk of intentional, malicious contamination of food. As defined in PAS 96:2017, TACCP requires an organisation to think like someone motivated by harm, not financial gain. It addresses threats that may be internal, such as a disgruntled employee or a contractor with unsupervised access, or external. TACCP focuses on people, access, and behaviour, identifying where someone with malicious intent could interfere with product, and what would stop them, instead of focusing on ingredients or supply chain steps, which is the focus of VACCP and food fraud.
TACCP and VACCP address different motives. TACCP, Threat Assessment Critical Control Point, addresses intentional, malicious contamination, tampering, sabotage, or terrorism, carried out by someone seeking to cause harm. VACCP, Vulnerability Assessment Critical Control Point, addresses economically motivated adulteration, food fraud carried out for financial gain, often occurring in the supply chain before a product reaches your facility. A useful way to remember the distinction: VACCP is about profit motive, TACCP is about malicious intent. Both are required under GFSI-recognised certification schemes, but they are managed as separate documented programmes with different methodologies and mitigation strategies.
The FDA Intentional Adulteration Rule, under 21 CFR Part 121, is a component of FSMA addressing the risk of wide-scale public health harm from deliberate contamination of food. It requires covered facilities to conduct a vulnerability assessment identifying significant vulnerabilities at each point, step, or procedure in their food operation, identify and implement mitigation strategies at those points, and establish food defence monitoring, corrective action, and verification procedures. As of April 2026, all compliance deadlines under the Intentional Adulteration Rule have passed, including the extended deadline for very small businesses, meaning active FDA inspection for compliance is now a real risk for any covered facility without a documented plan.
A food defence plan under the FDA Intentional Adulteration Rule requires five components: a vulnerability assessment identifying significant vulnerabilities at each point, step, or procedure. Identified mitigation strategies addressing those significant vulnerabilities. Food defence monitoring procedures to confirm mitigation strategies are being applied consistently. Food defence corrective action procedures for when mitigation strategies are not properly implemented. Food defence verification procedures confirming that monitoring is being conducted and decisions about corrective actions are appropriate. The plan must be in writing and reanalysed periodically or when significant changes occur.
TACCP is the recommended methodology for conducting the threat and vulnerability assessment that the FDA Intentional Adulteration Rule requires, though CARVER plus Shock is also accepted as an alternative methodology. Under BRCGS Issue 9, a documented food defence threat assessment using a defined methodology is required, and the assessment must evaluate three threat categories: fraudulent activities, economically motivated adulteration, sabotage, and terrorism. This three-category requirement makes BRCGS food defence expectations broader than the FDA Intentional Adulteration Rule, which focuses primarily on wide-scale harm scenarios and not economically motivated adulteration, which falls under VACCP and food fraud programmes instead.
A TACCP assessment typically examines four areas of access and control: outside security, covering perimeter access, deliveries, and visitor management. Inside security, covering access to processing areas, storage, and ingredient handling within the facility. Personnel security, covering hiring practices, access privileges, and behaviour monitoring for both employees and contractors. Data and cyber security, covering access to formulation, process control, and supplier information systems that could be used to facilitate or conceal intentional contamination. A thorough assessment considers how someone with malicious intent could exploit a gap in any of these four areas, individually or in combination.
A TACCP gap assessment reviews existing food defence documentation against TACCP methodology, the FDA Intentional Adulteration Rule's five required components where applicable, and BRCGS or FSSC 22000 food defence requirements. It typically includes a facility walkthrough examining the four security pillars, outside security, inside security, personnel security, and data and cyber security, to identify access points a person with malicious intent could exploit, and a review of whether mitigation strategies, monitoring, and verification procedures are documented and, more importantly, being followed.
The most common gaps are: a food defence plan that exists as a document but has never been tested against the facility's actual layout and access points. Mitigation strategies that address obvious external threats while overlooking insider access, despite internal personnel representing a significant share of realistic threat scenarios. Monitoring procedures for mitigation strategies that exist on paper but aren't performed, leaving no evidence the plan is operating day to day. A threat assessment that hasn't been reviewed since a significant facility change, new equipment, new access point, or change in contractor arrangements. TACCP and VACCP treated as a single combined exercise without distinguishing malicious-intent threats from economically motivated ones, resulting in mitigation strategies mismatched to the actual threat type.
No. The FDA Intentional Adulteration Rule's compliance deadlines, including the extended deadline for very small businesses, have all now passed as of April 2026, meaning the requirement applies broadly across covered facility sizes, with the scale and complexity of the plan adjusted to the facility's size and risk profile. GFSI-recognised schemes including SQF, BRCGS, and FSSC 22000 require a documented food defence threat assessment regardless of facility size where the scheme applies. A smaller facility's plan will be proportionately simpler, but the requirement to have one, and for it to reflect the facility's actual access points and operations, applies regardless of size.
Our consulting work moves fast. A facility walkthrough and threat assessment typically takes 2 to 3 days, and developing the full food defence plan, mitigation strategies, monitoring and verification procedures, typically takes 1 to 2 weeks. For facilities with an existing plan needing review against current FDA Intentional Adulteration Rule and GFSI scheme requirements, a gap assessment typically takes 2 to 3 days.
Documentation review, mitigation strategy design, and monitoring and verification procedure development are available remotely. The facility walkthrough and threat assessment, examining outside security, inside security, personnel security, and data and cyber security, is best conducted on-site, since it depends on the physical layout, access points, and operations specific to your facility. We can scope a hybrid approach combining an on-site assessment with remote plan development.
You can commission any of these on their own, with an agreed scope and a written quote, without taking on ongoing consulting. See all food safety services.
Where visibility stops at the business that invoices you.
Read about A supply chain review →Where fabrication, zoning or flows are the underlying problem.
Read about A facility hygiene assessment →To put monitoring effort where the hazard is.
Read about Supplier risk classification →Tell us about your facility, your access points and your current food defence documentation. We will tell you exactly where the gaps are.