VACCP and food fraud consulting, see the risk before it reaches your shelf

VACCP, Vulnerability Assessment Critical Control Point, is the GFSI-endorsed framework for assessing food fraud risk, the food fraud parallel to HACCP: a structured, documented approach to identifying and controlling intentional economic adulteration threats in a supply chain. Food fraud is the intentional deception for economic gain using food, and can include adulteration, substitution, dilution, mislabelling, counterfeiting, and grey market diversion or theft. VACCP focuses on susceptibility or exposure to food fraud across raw materials, ingredients, and suppliers, identifying vulnerable points in the supply chain and not hazards at process steps.

VACCP and TACCP address different motives. VACCP, Vulnerability Assessment Critical Control Point, addresses economically motivated adulteration, food fraud carried out for financial gain, often occurring in the supply chain before a product reaches your facility. TACCP, Threat Assessment Critical Control Point, addresses intentional, malicious contamination, tampering, sabotage, or terrorism, carried out by someone seeking to cause harm. A useful way to remember the distinction: VACCP is about profit motive, TACCP is about malicious intent. Both are required under GFSI-recognised certification schemes, but they are managed as separate documented programmes with different methodologies, since the mitigation for a profit-motivated supplier substitution differs from the mitigation for a malicious insider.

A food fraud vulnerability assessment, FFVA, is the documented output of the VACCP process: a structured review of raw materials, ingredients, and suppliers against recognised food fraud categories, scoring each for vulnerability based on factors such as economic anomaly, price volatility creating incentive, historical fraud incidents for that ingredient type, and the difficulty of detecting adulteration through normal quality checks. GFSI compliance requirements for food fraud prevention were published in 2017 with implementation required from January 2018, meaning a documented FFVA is a non-negotiable requirement for any facility holding or seeking SQF, BRCGS, FSSC 22000, or other GFSI-recognised certification, covering every ingredient and material in scope, not only high-risk commodities.

Food fraud is generally assessed across seven categories: dilution, mixing a liquid ingredient with a lower-value liquid. Substitution, replacing an ingredient or part of a product with another substance that resembles it. Concealment, hiding the lower quality of a food ingredient or product. Unapproved enhancements, adding unknown materials to food to enhance attributes. Mislabelling, placing false claims on packaging for economic gain. Counterfeiting, copying a brand name, packaging, or formulation without authorisation. Grey market production, theft, or diversion, including sale of excess unreported product or stolen goods. An ingredient can present vulnerability across more than one category simultaneously.

Olive oil, honey, tea and coffee, and alcoholic beverages have long been recognised as high-value, high-vulnerability categories due to their economic value and the relative ease of adulteration without easy detection. Reported food fraud incidents increased by approximately 10% in 2024, with early data indicating a similar increase for 2025, and industry analysis projects significant increases across specific categories including nuts and seeds, eggs, dairy, fish and seafood, and cocoa, often driven by supply shortages, climate-related crop failures, and resulting price volatility that increases the economic incentive for fraud. Olive oil enforcement actions in 2025 included a seizure in Portugal of over 16,000 litres of cooking oil falsely labelled as olive oil alongside more than 80,000 counterfeit labels, and a Europol-coordinated operation across 29 countries dismantling multiple criminal networks targeting counterfeit and substandard food and drink.

Horizon scanning is the ongoing monitoring of external information, commodity price trends, supply shortages, regulatory alerts, media reports of fraud incidents, and industry intelligence, to identify emerging food fraud risks before they affect your supply chain. Because food fraud vulnerability is dynamic, a price spike or supply shortage for a specific ingredient can sharply increase the economic incentive for fraud within weeks, a vulnerability assessment conducted once and never revisited can miss exactly the kind of fast-moving risk that horizon scanning is designed to catch. BRCGS specifically requires horizon scanning activities as part of its food fraud requirements.

A food fraud gap assessment reviews existing FFVA documentation against the seven GFSI food fraud categories, checking whether every ingredient and material in scope has been assessed, not only commodities considered high-risk, whether vulnerability scoring reflects current market conditions and not historical assumptions, whether mitigation measures, supplier approval, authenticity testing, COA review, are proportionate to the vulnerability identified, and whether a horizon scanning process exists to keep the assessment current between formal reviews.

The most common gaps are: an FFVA covering only ingredients the business already considers high-risk, missing vulnerabilities in ingredients that haven't historically been a problem but have recently become economically attractive to fraud. Vulnerability scores based on assumptions from when the assessment was first written, not updated as prices, suppliers, or sourcing regions changed. Mitigation measures that don't match the vulnerability level, basic COA review for a high-vulnerability ingredient, or expensive authenticity testing for a low-vulnerability one. No horizon scanning process, meaning the assessment only gets revisited on a fixed annual schedule regardless of what's happening in the market. VACCP and TACCP combined into a single undifferentiated exercise, producing mitigation strategies that don't clearly address either economically motivated adulteration or malicious contamination well.

Food fraud vulnerability is closely linked to supplier approval, since many fraud opportunities arise in the supply chain before an ingredient reaches your facility. Controls proportionate to vulnerability level typically scale from basic approved supplier status and certificate of analysis review for low-risk ingredients, through supplier questionnaires covering fraud history and periodic testing for medium-risk ingredients, to fraud-specific risk assessment, defined-frequency authenticity testing, batch-level verification, annual supplier audits, and independent laboratory testing for high-risk ingredients. The FFVA determines which level applies to each ingredient, and the supplier approval programme implements the corresponding controls.

Our consulting work moves fast. For an ingredient portfolio of typical size, conducting the assessment across the seven GFSI categories and producing the documented FFVA typically takes 1 to 2 weeks. Setting up an ongoing horizon scanning process typically takes a further few days. For businesses with an existing FFVA needing review, a gap assessment typically takes 2 to 3 days.

Yes. The food fraud vulnerability assessment, horizon scanning programme design, mitigation and testing plan design, and FFVA documentation are all available remotely, since they primarily involve reviewing ingredient and supplier information against fraud category criteria and market intelligence. We work with clients worldwide.