Food Defence Review NZ: Scope, People and Next Steps

A food defence review starts more clearly when the business agrees what it wants reviewed, who can contribute and who will make the resulting decisions. An owner, operations manager or quality team may be starting this work, refreshing an existing arrangement or clarifying a customer's request.

This guide helps New Zealand food businesses organise that starting conversation. It provides a planning brief rather than a complete threat-assessment method. The aim is to commission useful work and identify learning needs without mistaking a meeting, a document or a course certificate for a completed assessment.

Agree the purpose and the applicable requirements

Write one sentence explaining the decision the review should support. For example, the objective may be to establish whether the existing arrangements need a structured review after a business change. That is a planning objective, not evidence that the arrangements are effective or that a particular assessment outcome has been reached.

BSI's current PAS 96:2026 overview describes a proportionate food defence approach that builds on established food safety controls. It identifies the publication as guidance, rather than a set of requirements. Its overview does not make the same controls appropriate for every organisation.

Keep a separate note of anything the business is actually obliged to meet. Identify the current document, applicable scope and exact wording of a customer condition, certification requirement or production or destination-market rule. If its application is unclear, record who will resolve it. Do not turn an overseas requirement or a guidance recommendation into a general New Zealand obligation.

Agree the intended deliverable: a defined review brief, a request for competent assessment, or a plan for addressing an identified learning gap. State what will remain undecided until the relevant evidence and expertise are available.

Define the scope of the food defence review

Use the terms consistently. The IFS Product and Food Defence Guideline, version 2 distinguishes unintentional food safety hazards from intentional interference and economically motivated fraud. The Hazard Analysis and Critical Control Point (HACCP) system addresses food safety hazards and controls; Threat Assessment and Critical Control Points (TACCP) supports food defence threat assessment; Vulnerability Assessment and Critical Control Points (VACCP) addresses vulnerability to food fraud. These areas have connections, so the distinction should help coordinate work rather than create isolated files. The IFS guide supports its own standards; it is not a general New Zealand legal checklist.

For the planning brief, describe the relevant business, operation, products and activities at a high level. Note whether the intended review concerns one site, a defined business unit or agreed interfaces with other organisations. A broad instruction to review 'everything' can leave contributors with different understandings of what they are expected to consider.

Record boundaries in plain language. Say what is included, what is outside this engagement and which related work will be handled separately. If an excluded matter could affect the review, name the owner responsible for clarifying that relationship. Excluding something from a meeting does not establish that it is unimportant or adequately controlled.

For a refresh, identify the approved previous version and the reason for reopening it. Ask whether the proposed scope still describes the operation. Keep this as an organising step; the brief itself does not assess threats, rank risks or prescribe protective measures.

Choose the people and decision owners

AFVA recommends naming one coordinator and an accountable business decision-maker. The coordinator organises information, keeps the brief current and follows up unanswered questions. The decision-maker confirms scope, resources and who can authorise the next stage. These can be the same person where that suits the business, but the responsibilities should remain clear.

Invite input according to the agreed operation. Consider which people understand day-to-day activities, the food safety system, people management, purchasing, logistics and relevant business information. Participation should follow the knowledge needed, rather than assuming that the quality manager knows every part of the business or that every contributor needs the same training.

Ask each contributor to identify the information they can confirm, the decisions they can make and anything outside their knowledge. Arrange additional competent input where needed. Avoid recording agreement by people who have not seen the relevant question or who cannot authorise the proposed action.

In a small business, one person may cover several functions. A short record of responsibilities and limits is more useful than a lengthy committee list with no clear owner.

Prepare a useful private brief

Keep the initial brief concise enough for the intended people to use. AFVA suggests including:

• Purpose: the decision or task the review is intended to support.
• Scope: the approved high-level description and boundaries.
• Context: the current system or review version and the reason for the work.
• People: the coordinator, decision-maker and agreed contributors.
• Requirements: references to applicable documents and questions about their application.
• Outputs: what the next stage should produce and who will use it.
• Open questions: what remains unknown and who will obtain clarification.

Keep sensitive operational and security details within the business's approved information arrangements. Agree who needs access, which version they will use and how any necessary exchange will occur. A public training enquiry usually needs a high-level description of the learning task, rather than the business's detailed security information.

Use a brief document list instead of copying large files into every message. Give each relevant record a title, version or date, owner and approved location. That lets the review team request what it is authorised to use while avoiding unnecessary duplication. The list shows where information is held; it does not establish that the information is accurate or current.

Record decisions and unresolved questions

Keep a short decision log alongside the brief. Separate what has been agreed from what is assumed, proposed or awaiting evidence. A useful entry states the question, available information, decision or uncertainty, person responsible and next action. Date it so later contributors can understand what was known at the time.

The following non-security records are AFVA's suggested planning tools. They organise the work; they are not evidence that the food defence assessment or controls have passed. Adapt the headings to the business and any applicable requirements.

On a small screen, swipe sideways to view all columns.

Close a question only when the relevant person has supplied an answer that supports the decision. If a document is missing or inconsistent, record that limitation and its effect on the next step. Do not fill a blank with an unsupported assumption simply to make the brief look complete.

Connect the review with learning and follow-up

Use the agreed tasks to identify learning needs. Someone contributing operational information may need a different depth of understanding from the person expected to coordinate or challenge an assessment. Ask what each person should be able to explain or do afterwards, and which work still needs experienced or specialist support.

Our guide to staff food safety training and workplace competence explains how to connect learning with assigned tasks and site instruction. Where HACCP course selection is the immediate question, use the separate comparison of AFVA's HACCP training options. Those guides answer broader learning questions; this brief should retain its food defence review purpose.

Before the planning conversation ends, agree who will approve the scope, obtain unresolved information, arrange learning and commission any further work. Choose a follow-up date appropriate to those tasks. Record any limits on what can proceed. An agreed future meeting is a management action, not proof that assessment, implementation or effectiveness checking has happened.

Avoid common planning mistakes

• Beginning with a template title: agree the question and operation first, then choose a suitable working format.
• Treating guidance as a universal rule: distinguish helpful methods from the exact obligations applying to the business.
• Leaving authority unclear: identify who can confirm information, authorise scope and approve the next work.
• Copying a previous review without checking its scope: record the version being refreshed and why it is being reconsidered.
• Sending more information than the recipient needs: use an approved exchange and a proportionate brief.
• Closing actions on attendance alone: distinguish course completion from the business's outstanding assessment and implementation tasks.

If the planning discussion identifies a current concern about product safety, use the business's established escalation arrangements and obtain appropriate advice. Do not wait for routine training or this planning exercise to resolve an active concern. This article does not provide an incident-response or product-release procedure.

Explore AFVA's TACCP Food Defence Training

AFVA's TACCP Food Defence Training is a self-paced, foundation-level online course for food business owners, managers and food safety teams. Check its current outline, entry expectations, assessment and terms.

Successful completion provides the stated Access Food course-completion certificate, rather than plan approval, a security guarantee or competence to lead every assessment. Choose learning against your responsibility and arrange further practical support where needed.

Browse the AFVA training catalogue for other learning needs. For an initial discussion, describe your operation at a high level, the learners' roles and the task you want the learning to support.

General information only. The planning steps are recommendations, not a complete TACCP method or an assessment of your operation. Requirements depend on the business, activities, applicable law, destination market, contract and certification arrangements. Confirm the current requirements and obtain appropriately competent advice for decisions about your own food defence arrangements.