Food Defence and Food Fraud: TACCP and VACCP Guide for Morocco

What do food defence and food fraud cover?

Two intentional risks that the HACCP plan does not cover on its own. Food defence protects the product against an act meant to cause harm. Food fraud controls protect it against deception meant to bring economic gain.

FSSC 22000 Version 7 takes its definitions from the GFSI (version 2024 of its Benchmarking Requirements). Food defence is the process of securing food, food ingredients, feed and food packaging against all forms of intentional malicious attack, including ideologically motivated attack. Food fraud is a collective term for the deliberate and intentional substitution, addition, tampering or misrepresentation of food, food ingredients, feed, food packaging or labelling, product information, or false or misleading statements made about a product, for economic gain. IFS Food Version 8 retains four forms of fraud: substitution, mislabelling, adulteration and counterfeiting.

Why does fraud belong in food safety at all? The GFSI’s 2014 position gives the answer. The fraudster does not intend to harm anyone, but the health risk often arises through negligence or lack of knowledge on their part, and it can be more dangerous than traditional food safety risks because the contaminants are unconventional: routine checks are not looking for them. That is why the GFSI decided to add two key elements to its requirements for the schemes it recognises: a food fraud vulnerability assessment and a control plan.

TACCP and VACCP: methods, not requirements

TACCP (Threat Assessment Critical Control Point) is the method described in BSI’s PAS 96 guide, built on the HACCP model. BSI’s PAS 96 page now presents the PAS 96:2026 edition, published on 31 May 2026, which BSI says reflects recent food defence cases, an updated cybercrime threat and alignment with the TACCP process. VACCP (Vulnerability Assessment and Critical Control Point) is an acronym in common use, built on the same model for fraud; the schemes themselves simply speak of a vulnerability assessment.

None of these acronyms appears in BRCGS Food Safety Issue 9, IFS Food Version 8 or FSSC 22000 Version 7. The standards speak of a “threat assessment” and a “vulnerability assessment”. Choose a method, then, because it produces the evidence the auditor expects: a defined methodology, written criteria, documented results and a plan that follows from them.

What do BRCGS, IFS and FSSC 22000 require?

All three require a written assessment, a plan, competent staff and a review. They differ on the scope of the fraud assessment, on testing the plan and on how both programmes connect to the rest of the system.

BRCGS Food Safety Issue 9

Sections 4.2 and 5.4, summarised on our hub, are backed by a tight web of links across the Standard. The HACCP hazard analysis considers fraud and malicious contamination (2.7.1). The internal audit programme covers the food defence and food fraud prevention plans (3.4.1). The raw material risk assessment considers substitution or fraud (3.5.1.1). A supplier audit covers the supplier’s food defence plan and product authenticity plan (3.5.1.2). Management review evaluates the effectiveness of the food defence and authenticity systems (1.1.4). A fraud gap can therefore be raised in several places in the Standard, not only under 5.4.

IFS Food Version 8

Requirement 4.20 calls for a documented food fraud vulnerability assessment, including assessment criteria, covering all raw materials, ingredients, packaging materials and outsourced processes. A food fraud mitigation plan follows from it, including its testing and monitoring methods (4.20.3). Requirement 4.21 calls for a food defence procedure and plan that address, at a minimum, legal requirements, critical areas and the access policy for employees, visitors and contractors, and how to manage external inspections and regulatory visits. The plan is tested for effectiveness and reviewed at least once within a 12-month period (4.21.3).

Requirements 4.20.2, 4.20.4 and 4.21.2 carry an asterisk: they require compulsory information in the summary of the IFS Food audit report. For fraud, the auditor lists the raw material groups identified as risky in the vulnerability assessment and the criteria selected. The IFS Food Version 8 Doctrine, version 5, clarifies that the part on external inspections does not apply if no law in the country of the audit requires external food defence inspections, or if the site does not export to the United States and no food defence inspection by the US Food and Drug Administration (FDA) is required. Routine food safety inspections by the authorities are not covered by this part of the requirement.

FSSC 22000 Version 7

The foundation moves into the prerequisite programmes: clause 16 of ISO 22002-100:2025, with its parts 16.2 (food defence) and 16.3 (food fraud prevention). Their detailed content belongs to the paid ISO text, which we do not reproduce. Additional requirements 2.5.3 and 2.5.4, which FSSC writes with the US spelling “food defense”, add four points: assessments and plans developed and maintained by competent personnel; plans implemented and supported by the management system; plans that comply with applicable legislation; and plans that cover the whole scope and are kept up to date. The full list of changes since Version 6 is in our article on FSSC 22000 Version 7 changes.

None of these chapters is a KO requirement at IFS or a fundamental requirement at BRCGS. That is no reason to neglect them: a missing plan, or one that has never been applied, can lead to a major non-conformity.

How do you assess threats (TACCP)?

By walking the site with a multidisciplinary team and answering three questions: who might want to cause harm, where could they act, and what would stop them or reveal what they did?

1. Build the team. Quality, production, maintenance, logistics, human resources and IT. BRCGS (4.2.1) requires knowledge of both the site and the principles of food defence.
2. Set the scope. Buildings, external storage, transport under the site’s control, water, IT systems that drive a process. BRCGS lists attacks against digital cyber-security among the incidents to plan for (3.11.1).
3. List the threats. Internal: a disgruntled employee, a temporary or seasonal worker. External: a contractor, a visitor, a driver, an intruder, extortion, activism, a cyber-attack.
4. Locate the vulnerable points. Goods-in, tankers, ingredient rooms, open vessels, the packing area, label stock, loading docks.
5. Assess and prioritise. For example, by how accessible the point is and how severe the effect would be. The standard imposes no scoring grid; it requires the one you use to be written down and applied.
6. Decide on controls. Prevent first, and detect tampering where prevention is not sufficient or possible (BRCGS 4.2.3).
7. Train, monitor, test. Staff are trained in food defence procedures (BRCGS 4.2.4), and IFS requires the plan to be tested for effectiveness (4.21.3).

If your plan includes CCTV, check your obligations under Morocco’s Law 09-08 on the protection of personal data with the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel), the national data protection authority.

How do you assess vulnerability to fraud (VACCP)?

Raw material by raw material, or group by group, using written criteria and horizon-scanning sources, and looking at the whole supply chain rather than just the goods-in dock.

BRCGS (5.4.3) sets five criteria: historical evidence of substitution or adulteration; economic factors that may make adulteration or substitution more attractive; ease of access to raw materials through the supply chain; the sophistication of routine testing to identify adulterants; and the nature of the raw material. The IFS Food Version 8 glossary offers a similar list: history of food fraud incidents, economic factors, ease of fraudulent activity, supply chain complexity, currently implemented measures and supplier confidence. It also asks for the level of risk to be evaluated for both the product and the supply source, using known and reliable data sources.

Horizon scanning feeds these criteria. BRCGS (5.4.2) cites trade associations, government sources and private resource centres; IFS (1.2.5) requires a system that keeps senior management aware of the factors that can influence food defence and food fraud risks. The GFSI’s 2018 technical document adds weak signals, such as a rise in commodity prices, and points out that an assessment may conclude that vulnerability is low or very low, as long as it is carefully conducted and clearly documented.

The same document classifies the types of fraud, with examples. The table below links them to materials a Moroccan site should examine. These are leads for your assessment, not findings.

Claims need a check of their own. When the label claims a provenance or origin, a breed or variety, an assured status or a named trademarked ingredient, BRCGS (5.4.5) requires the status of each batch of the raw material to be verified, purchasing, usage and packing records to be kept to substantiate the claim, and mass balance tests to be carried out, at least every six months where no certification scheme sets its own frequency. For a claim about the method of production (organic, halal, kosher), the site maintains the corresponding certification (5.4.6): see our Halal and Kosher page.

The step-by-step method, with a sample scoring grid, is in our guide to the food fraud vulnerability assessment.

What should the food defence plan and the food fraud mitigation plan contain?

The controls chosen, who applies them, how they are verified and when the plan is reviewed. A plan that does not carry the conclusions of the assessment is just one more document, not a plan.

The food defence plan sets out:

• the significant threats identified and the sensitive areas;
• prevention and detection controls, each with an owner;
• access rules for staff, visitors, contractors and drivers;
• what to do if tampering is suspected, linked to the incident and recall procedure;
• staff training and tests of the plan;
• the legal requirements of the country of sale, where applicable.

According to the GFSI, the food fraud mitigation plan states when, where and how to mitigate each vulnerability, using measures such as a monitoring strategy, a testing strategy, origin verification, specification management, supplier audits and anti-counterfeit technologies. IFS (4.20.3) requires it to include its testing and monitoring methods.

Both plans live inside the management system: supplier approval (BRCGS 3.5.1, IFS 4.4.2), training (IFS 3.3.4) and management review (BRCGS 1.1.4, IFS 1.3.1). In the event of a significant authenticity incident, BRCGS requires the certification body to be notified within 3 working days (3.11.4). IFS sets the same deadline for a recall or withdrawal decided by the authorities for food fraud reasons (1.2.6).

What the auditor checks

The auditor is not looking for fraud. The GFSI said so in 2014: the auditor reviews the documentation of the assessment and confirms that a plan has been developed and implemented, in the same way as they verify a HACCP plan. The 2018 document lists the auditor’s questions. Is the approach company-wide? Was it built by a multidisciplinary team? Is it clearly documented and reviewed regularly? What sources of information support it?

Under FSSC 22000, the Version 7 audit report template asks the auditor to summarise, for clause 16 of ISO 22002-100:2025, the methodology used, internal and external threats, significant threats and vulnerabilities, mitigation measures and their verification, the training and communication strategy and the periodic review, together with an overview of access control, site security and any reported breaches. For fraud, the auditor records the breadth of the assessment: the supply chain, not just the site.

What do Moroccan law and the law of the countries of sale say?

Moroccan law punishes fraud in goods. For food defence, it is mainly the laws of destination countries that add obligations.

Law no. 13-83 on the repression of fraud in goods (loi n° 13-83 relative à la répression des fraudes sur les marchandises) punishes deception about the nature, substantial qualities, composition, species, origin or quantity of goods (Articles 1 and 4). Penalties can be doubled when the fraud involves products dangerous to health (Article 2). Law no. 28-07 on the safety of food products also requires an operator with reason to believe that a product is unsafe to inform the competent authorities without delay (Article 10).

For exports, BRCGS (4.2.2) requires the food defence plan to meet, where applicable, the legal requirements of the country of sale or intended use, and FSSC 22000 asks the auditor to comment on applicable legislation, or to note that there is none. For the United States, the IFS doctrine mentions FDA food defence inspections, and BRCGS offers an additional module dedicated to the requirements of the US Food Safety Modernization Act (FSMA).

The FDA rule on intentional adulteration (21 CFR Part 121) covers companies, domestic and foreign, that must register with the FDA as food facilities: a Moroccan site registered to export to the United States falls within it unless an exemption applies. It requires a food defense plan built on a vulnerability assessment, mitigation strategies at actionable process steps, monitoring, corrective actions, verification, staff training and records; the plan is reanalysed every three years, or sooner in certain cases. Exemptions include very small businesses (under 10 million US dollars a year in sales and market value of human food, averaged over three years and adjusted for inflation), which must still be able to document that status, the holding of food other than in liquid storage tanks, and packing or labelling where the container in contact with the food remains intact.

Where should your plant start?

With an honest review of where you stand, then the two assessments, before writing a single procedure.

• Appoint an owner and a team for each assessment, with evidence of their competence.
  
• Choose the method and write it down: criteria, scoring scale, threshold for a significant vulnerability.
  
• List every raw material, packaging material and outsourced process, with justified groupings.
  
• Record the horizon-scanning sources consulted and how often they are checked.
  
• Walk the site to locate sensitive areas, goods-in and external storage included.
  
• Write both plans from the conclusions, with owners and verification.
  
• Link the plans to supplier approval, specifications and the testing plan.
  
• Train the staff concerned and test the food defence plan.
  
• Put both assessments on the internal audit programme and the management review agenda.
  
• Define the review triggers: new material, new supplier, alert, incident.
  

Our articles on the 2026-2027 requirements, the cost of a programme and the spice exporter case study take this guide further.