Food Fraud Vulnerability Assessment NZ: Build a Practical VACCP Review

A food fraud vulnerability assessment helps a New Zealand food business examine where economically motivated deception could affect the identity, composition or claims of what it buys and sells. The useful outcome is a reasoned assessment and workable mitigation plan, with evidence for the decisions.

For manufacturers, importers, ingredient buyers and brand owners, the starting point might be a new supplier, a changed supply route or a customer asking for a VACCP review. Begin with that question and the actual products. A completed spreadsheet alone does not establish authenticity.

What a food fraud vulnerability assessment should decide

VACCP is commonly used for vulnerability assessment and critical control points in food fraud prevention. Here, the focus is deliberate deception for economic gain: for example, a possible substitution or a composition or origin claim that is not supported. These are possible types of concern, not allegations about any ingredient or supplier.

Separate the question from accidental food safety hazards and deliberate threats intended to cause harm. HACCP addresses food safety hazards and controls; food defence and TACCP examine deliberate threats. The areas can overlap when deception also affects safety. AFVA’s separate food defence review guide explains how to organise that related review.

The assessment should tell a decision-maker which vulnerabilities need attention, why, what controls are in place and what remains uncertain. It should also identify when purchasing, product claims or use of material needs an authorised decision. It is not a test result, a finding that fraud occurred or a guarantee that no fraud can occur.

Confirm the applicable requirements before choosing a form

Identify the reason for the review. Record the current customer specification, contract, applicable certification code or other relevant requirement, its version and the products or sites it covers. Check the actual wording for scope, methods, review frequency, records and responsibilities. Resolve uncertainty with the responsible customer, scheme or competent adviser.

Do not turn a scheme document into a universal New Zealand legal obligation. For example, SQFI publishes Edition 9 food fraud guidance describing vulnerability assessment and mitigation in its scheme context. That is useful background, but it is not a substitute for checking the code and edition applying to your audit. SQFI’s code-edition guidance explains why audit timing and the applicable edition matter.

Choose a tool that supports the required scope. The SSAFE food fraud vulnerability assessment tool can be applied to an ingredient, product or wider business. SSAFE states that it does not provide specific mitigation techniques. The business still needs to decide and implement suitable actions. The practical worksheet and checklist below are AFVA recommendations, not prescribed official forms.

Build an assessment around the real material and supply chain

Describe what needs to be authentic

List the ingredients and products in scope, their approved specifications and the claims on which your business relies. For a mixture, consider whether its components need separate attention. Record the supplier, actual manufacturing or processing site where known, intermediaries and relevant repacking or handling stages. State unknown links rather than filling them with assumptions.

SQFI’s food fraud assessment explanation cautions against relying on supplier reputation alone and highlights the origin and components of purchased materials. Use that as a prompt for a better question: what relevant evidence supports this particular material and claim through the actual supply route?

Collect evidence that answers the question

• Current specifications, product codes and agreed identity, composition or origin claims.
• Relevant supplier approval information, actual site details and clear responsibilities for changes.
• Traceability and receipt information linking purchased material to the evidence supplied.
• Relevant authenticity alerts or incident information, retaining the source, date and reason it applies.
• Certificates, reports or test results with enough scope, material and batch information to judge their relevance.
• Recent changes in supply availability, price, source, formulation or handling that warrant further enquiry.

A warning sign is a reason to investigate, not proof of deception. A missing document may reflect poor administration; a low price may have an ordinary explanation. Ask a focused question, record the reply and decide what evidence is still missing. Keep commercially sensitive supplier information in the business’s approved private records.

Explain vulnerability priorities rather than relying on a score

Use the method required by the applicable scheme or customer where one is specified. Otherwise, agree a consistent method before rating materials. AFVA recommends recording the reasoning as well as the rating, so another person can follow how the evidence led to the decision.

Consider the possible economic incentive, opportunity for the material or claim to be misrepresented, and the controls that could prevent or reveal it. Ask where your knowledge is limited. Evidence that a supplier exists is different from evidence supporting a species or origin claim for the material received.

• Describe the specific vulnerability: what might be substituted, diluted or misrepresented, and at which supply-chain point?
• Identify relevant information and its limitations: what is confirmed, assumed, missing or conflicting?
• Record existing controls and why they address that vulnerability. Avoid giving credit to an unrelated certificate.
• Assign the priority using the agreed method, then explain the decision and the additional action needed.
• Reassess the remaining vulnerability only after evidence shows the proposed controls have been implemented.

A numerical total can organise priorities, but it does not repair weak evidence. If several materials share one assessment, record why their composition, claims, sources and controls make that grouping reasonable. Split the group when a material has a different vulnerability or needs a different decision.

Choose controls that address the identified vulnerability

Connect mitigation to the problem. If the uncertainty concerns an unconfirmed manufacturing site, requesting another generic certificate may not resolve it. A focused supplier clarification, relevant document review or appropriately scoped audit may be more useful. AFVA’s guide to supplier document review and audit choices discusses that separate assurance decision.

Possible practical actions include tightening an approved specification, controlling source changes, requiring relevant traceability evidence, strengthening receipt checks or agreeing appropriate authenticity testing with competent technical support. These are options to assess, not a compulsory list for every material. If analysis is needed, an appropriate external laboratory should advise on the question, sample and method.

Before relying on testing, establish what the method can and cannot show. Ask whether it addresses the suspected substitution or claim, whether sampling represents the decision being made and how results will be interpreted. Testing one characteristic does not establish every aspect of authenticity. Do not substitute an unexplained “pass” for a reasoned decision.

Name the person who implements each control, the evidence it will produce and who checks that it is working. Keep a proposed action separate from a completed action. Record restrictions or unresolved purchasing decisions until the responsible person has adequate evidence to decide the next step.

Worked example: a supplier change for a single-spice powder

Illustrative recommendation only: A manufacturer is considering the same single-spice powder from a new intermediary. Its specification requires the named spice without undeclared additions. The current paperwork does not identify the actual processing site. No fraud is established. The question is whether the proposed source can support the specified identity and composition.

The following entries show how to organise a review. They are fictional, incomplete until the stated evidence is obtained, and do not approve an actual material or provide a substitute for an applicable scheme method.

On a small screen, swipe sideways to view all columns.

In a real record, add the assessment date, named contributors, document references, priority and rationale, action deadlines, approval and next review. Preserve the earlier version when the decision changes. This makes the record useful to purchasing and operations rather than a form maintained only for an audit.

Use change triggers and a short completion checklist

Set review timing from the applicable requirements and the business’s assessment. Also define event triggers. AFVA recommends considering a changed supplier, site or intermediary; an altered ingredient or claim; unusual shortages or offers; new relevant intelligence; conflicting receipt evidence; and a concern about the effectiveness of a control. A calendar review should not delay attention to a current concern.

Before closing or approving the review, check that:

• The scope matches the actual materials, claims and supply routes.
• Relevant requirements and the assessment method are identified.
• Evidence is current enough for the decision, with gaps and assumptions visible.
• Priorities can be explained consistently.
• Each significant vulnerability has an implemented control or an open action with an owner.
• Purchasing and operational staff understand what changes or discrepancies to escalate.
• An authorised person has recorded the decision and the next review or trigger.

If a concern affects stock already held or supplied, use the business’s established hold, traceability, incident and escalation arrangements promptly. Assess any possible food safety impact with appropriate advice. A vulnerability worksheet does not by itself decide whether withdrawal, recall, notification or release is required, and a safety concern should not wait for a routine VACCP meeting.

Common mistakes that weaken the review

• Starting with a copied rating. Rebuild the reasoning for the actual material, source and claim.
• Treating unknown as low vulnerability. State the evidence gap and how it affects the decision.
• Accepting a certificate without checking scope. Match the document to the material, site, activity and question.
• Calling a proposed action an effective control. Retain implementation and follow-up evidence.
• Assuming HACCP covers the whole authenticity question. Coordinate fraud, defence and safety work without losing their different purposes.
• Using a training certificate as plan approval. Apply learning through a competent business-specific assessment and review.

Ask AFVA about a defined evidence gap or training need

AFVA’s internal audit and supplier audit support includes supplier documentation review and supplier approval system development. A focused enquiry can identify the material or claim, what evidence you have, the unanswered question and the decision you need help making. Agree the engagement scope before treating a document review as a wider audit.

For the people maintaining the review, AFVA’s VACCP Food Fraud Prevention Training is a self-paced online course covering vulnerability assessment, supplier evidence, proportionate controls and review. Successful completion provides the stated Access Food course-completion certificate. It does not approve a business’s food fraud plan or establish automatic workplace competence.

Prepare the evidence for your next decision

Choose one ingredient, supplier change or product claim that needs a decision. Bring together its current specification, supply route, relevant requirement, assessment and missing evidence. Assign who will obtain the information and who can approve the outcome.

General information only: Requirements depend on the complete food activities, products, processes, locations and sales model, together with applicable customer and scheme conditions. Use current official and scheme guidance and obtain advice for the specific business. This article does not determine fraud, certify authenticity or approve a product, supplier or mitigation plan.