What are the cost items of a programme?
Mostly people’s time, one-off in the first year and recurring afterwards, plus a few external costs: testing, supplier audits, external support and sometimes equipment. The table separates them so that you can budget without surprises.
Cost item | Nature | What makes it vary | How to keep it under control |
|---|---|---|---|
Threat assessment | One-off, then reviewed at least annually | Number of buildings, sensitive areas and external storage areas | Structured walk-through by area, a grid written once and reused |
Food fraud vulnerability assessment | One-off, then reviewed at least annually | Number of materials, packaging items, outsourced processes and suppliers | Justified groupings, scores carried over from one year to the next |
Horizon scanning on fraud and threats | Recurring | Number of sensitive materials and origins | Fixed list of sources, scheduled checks |
Writing and integrating the plans | One-off | Existing system (suppliers, specifications, internal audit) | Build into existing procedures rather than a separate binder |
Staff training | Recurring | Headcount, turnover, seasonal workers | Short module in induction, targeted training for the team |
Authenticity testing | Recurring | High-risk materials, label claims | Risk-based frequency, certificates of analysis spot-checked |
Supplier audits or certification | Recurring | Uncertified suppliers of at-risk materials | Prefer suppliers certified to a GFSI-recognised standard |
Physical measures | One-off, then maintenance | Outcome of the threat assessment | Start with organisational measures |
Testing the food defence plan | Recurring (IFS: within each 12-month period) | Number of scenarios tested | One targeted exercise a year, recorded |
How much internal time should you plan for?
It depends less on the size of the site than on the complexity of its purchasing. A site that buys few materials from a few certified suppliers moves fast. A site that buys dozens of spices, oils or ingredients through traders, and claims origins on its labels, needs much more.
Site profile | Characteristics | Relative workload |
|---|---|---|
Simple | Few materials, certified suppliers, no origin claims, a single standard | Low: a few team sessions, a short annual review |
Intermediate | Several families of materials, some traders, printed packaging, one or two standards | Medium: a project of several weeks, part time |
Complex | Many sensitive materials, long supply chains, origin or status claims, outsourced processes, several standards | High: a project followed by top management, with a timetable |
The workload falls into six stages: a review of what exists, the two assessments, writing the plans, implementation (suppliers, specifications, testing plan, access measures), training and the first test, then the review. Top management’s time is not negligible: it approves the conclusions and arbitrates them at management review, as BRCGS (1.1.4) and IFS (1.3.1) require.
One item is often forgotten: competence. BRCGS (4.2.1 and 5.4.1) and IFS (4.20.1 and 4.21.1) require people with appropriate knowledge, and FSSC 22000 Version 7 (2.5.3 and 2.5.4) competent personnel. Training the team before starting costs less than redoing an assessment challenged at audit.
What do physical measures cost?
Less than people fear, if they are decided after the threat assessment. BRCGS (4.2.3) requires controls for raw materials and products identified as being at particular risk and, where prevention is not sufficient or possible, systems to identify any tampering. It does not prescribe any equipment.
Many effective measures are organisational and cheap: a register of visitors and contractors, drivers accompanied on site, named keys for the ingredient room, padlocks on tanker hatches, numbered seals checked against the delivery note, a dock door kept closed outside loading, named user accounts on process controllers. Heavy investments, such as fencing or electronic access control, are justified only for a significant threat that these measures do not cover.
How do you keep testing costs under control?
By letting the vulnerability assessment set the frequency. BRCGS (5.4.4) requires assurance and/or testing processes for raw materials at particular risk; IFS (4.20.3) a mitigation plan that includes its testing and monitoring methods. Neither requires every batch of every material to be tested.
Four levers reduce the bill without reducing protection:
- buy in whole form when the recipe allows, rather than ground or blended;
- shorten the supply chain and favour certified or audited suppliers;
- require a certificate of analysis for each batch and spot-check it in a laboratory accredited for the method;
- concentrate testing on materials rated “high” and on those that carry a label claim.
The GFSI’s 2014 position makes the same point: possible control measures range from monitoring to specification management, through origin verification and supplier audits. Testing is only one tool among several.
Can the programme be funded?
Partly, for training. In Morocco, training staff in food defence and food fraud may fall under the special training contracts (contrats spéciaux de formation, CSF) run by OFPPT (Office de la formation professionnelle et de la promotion du travail, the national vocational training office), according to OFPPT rules and the company’s eligibility. We give the rule, the source and a simulation, never a promised amount: see our CSF and OFPPT funding page.
Pooling also reduces the cost. A site certified to BRCGS, IFS and FSSC 22000 at the same time needs only one threat assessment and one vulnerability assessment, provided they cover the widest scope: that of IFS Food Version 8, which includes packaging materials and outsourced processes.
What does having no programme cost?
More, and without warning. On the certification side, a missing plan, or one never applied, can lead to a major non-conformity. On the commercial side, a BRCGS-certified buyer must approve its suppliers on a basis that covers their food defence and product authenticity plans (3.5.1.2): without those plans, the supplier questionnaire or audit fails. On the incident side, a significant authenticity incident means notifying the certification body within 3 working days (BRCGS 3.11.4), and a recall carries its own costs.
On the legal side, Morocco’s Law no. 13-83 on the repression of fraud in goods (loi n° 13-83 relative à la répression des fraudes sur les marchandises) punishes deception about the nature, composition, species or origin of goods. A manufacturer that buys an adulterated material without having assessed it risks selling it on as it is.
Budgeting checklist
The method that drives these costs is set out in our food defence and food fraud guide and in our food fraud vulnerability assessment method.