Food Fraud Vulnerability Assessment in 7 Steps: Method and Checklist

Who carries out the assessment, and with what method?

A multidisciplinary team, with a method written down before the first score is given. This is step 1, and the one most often rushed.

BRCGS Food Safety Issue 9 (5.4.1) requires the person or team to understand potential food fraud risks, with knowledge of the raw materials used by the site and of the principles of vulnerability assessment. IFS Food Version 8 (4.20.1) requires defined responsibilities and appropriate specific knowledge. FSSC 22000 Version 7 (2.5.4 a) speaks of personnel with appropriate knowledge and competence. The GFSI’s 2018 technical document lists the questions the auditor should ask: is the approach company-wide, was it built by a multidisciplinary team, is it clearly documented and reviewed regularly, and what sources of information support it?

In a Moroccan plant, the typical team brings together:

• purchasing, who know the suppliers, the intermediaries and the prices;
• quality, who hold the specifications and the testing plan;
• production or R&D, who know in what form each material enters the recipe;
• logistics, who see the condition of the packaging at goods-in;
• top management, who approve the work and provide the resources.

The method fits on two pages: scope, criteria, scoring scale, threshold for a significant vulnerability, horizon-scanning sources, review frequency. IFS says as much in its glossary. The method may vary from company to company, but at a minimum it identifies potential fraud activities using known and reliable data sources, evaluates the level of risk for both the product and the supply source, evaluates the need for additional control measures, develops the mitigation plan from the results and includes an annual review.

How do you draw up the list of materials to assess?

Start from the purchasing master list, not from the team’s memory (step 2). The minimum scope depends on the standard:

For each line, record the supplier, the origin, the form (whole, ground, liquid, bulk), the number of intermediaries, any label claims that depend on the material (origin, variety, organic, halal) and whether the supplier is certified. Group only what is genuinely alike: same nature, same form, same supply chain.

Step 3 gathers the information. BRCGS (5.4.2) requires processes to access information on historical and developing threats to the supply chain, and cites trade associations, government sources and private resource centres. IFS (1.2.5) requires a system that keeps the company aware of the factors that can influence food fraud risks. The GFSI’s 2018 document adds weak signals, such as a rise in commodity prices or a more complex supply chain; a poor harvest is another signal worth watching. Record every source consulted and its date: the auditor will ask for them.

Which criteria and scoring grid should you use?

BRCGS’s five criteria at a minimum, supplemented by those of IFS, scored on a simple scale applied to every material (steps 4 and 5).

Here is a sample grid, to adapt. Each criterion is scored from 1 (low) to 3 (high), the scores are added, and the total ranks the material. Also set a precautionary rule, for example: a high history score combined with a high economic score ranks the material at least medium, whatever the total. The table below illustrates the grid; these are not field results.

With this grid, a total of 7 to 11 is “low”, 12 to 15 “medium”, and 16 or more “high”. The thresholds are the site’s choice: write them into the method, and justify each score with a sentence and a source.

How do you build the mitigation plan?

By giving each material at significant risk proportionate measures, an owner and a verification (step 6). BRCGS (5.4.4) requires appropriate assurance and/or testing processes for raw materials at particular risk; IFS (4.20.3) requires a food fraud mitigation plan that includes its testing and monitoring methods. The GFSI’s 2014 position lists possible measures: a monitoring strategy, a testing strategy, origin verification, specification management, supplier audits and anti-counterfeit technologies.

Three links keep the plan alive. Supplier approval uses its conclusions (BRCGS 3.5.1.1 and 3.5.1.2, IFS 4.4.2). The laboratory testing plan includes authenticity tests, at a justified frequency. Claims are verified batch by batch: for a claimed origin, variety or assured status, BRCGS (5.4.5) requires purchasing, usage and packing records, and a mass balance test at least every six months where no certification scheme sets its own frequency.

When should the assessment be reviewed?

At least once a year, and at every event that changes the risk (step 7). BRCGS (5.4.3) requires an annual review, and a review whenever there is a change of raw material or supplier, a new risk emerges, or a significant product safety incident implicates authenticity, such as a recall. IFS (4.20.4) requires a review at least once within a 12-month period or whenever significant changes occur, and the mitigation plan is then updated if necessary.

Put the assessment on the internal audit programme (BRCGS 3.4.1) and on the management review agenda (BRCGS 1.1.4, IFS 1.3.1). Keep the successive versions: comparing one year with the next is often the best evidence that your horizon scanning works.

Which mistakes should you avoid?

The gaps we find during gap analyses look alike from one site to the next:

• a one-page assessment that rates every material “low”, with no criteria and no sources;
• packaging and outsourced processes left out, although IFS explicitly covers them;
• a generic template copied as is, listing materials the site does not buy;
• a team reduced to the quality manager, without purchasing;
• an assessment with no link to supplier approval or to the testing plan;
• no review after a change of supplier;
• a quality defect mistaken for fraud, or the reverse.

Vulnerability assessment checklist

• The method is written down: scope, criteria, scale, thresholds, sources, review frequency.
  
• The team is named, with evidence of its competence.
  
• The list covers every food material and, for IFS, packaging materials and outsourced processes.
  
• Groupings of materials are justified.
  
• Every score is justified by a sentence and a dated source.
  
• Materials at significant risk have measures, an owner and a verification.
  
• Origin, variety or status claims are verified batch by batch, with mass balance tests.
  
• The testing plan and supplier approval reflect the conclusions.
  
• The review is dated and its triggers are written down.
  
• The assessment is on the internal audit programme and on the management review agenda.
  

The overall framework, food defence included, is set out in our food defence and food fraud guide. The spice exporter case study shows the method in use, and our article on the cost of a food defence and food fraud programme helps you plan the resources.