Food safety in the UK has never been more complex. Between tightening regulatory requirements, global supply chains, and the ever-present risk of intentional adulteration, food businesses today need more than just a HACCP plan. They need a complete food protection strategy that includes both TACCP and VACCP.
At FooddSure, we work with food businesses across London, Surrey, and the wider UK to implement robust food safety management systems. Whether you're preparing for a BRCGS audit, responding to a compliance gap, or simply looking to strengthen your food defence protocols, this guide will walk you through exactly what TACCP and VACCP mean, how they differ from each other and from HACCP, and what your business needs to have in place.
Most food businesses are familiar with HACCP — Hazard Analysis and Critical Control Points. It is the cornerstone of food safety management, designed to identify and control biological, chemical, and physical hazards that could occur during food production.
HACCP was originally developed to ensure food safety for NASA space missions, and it remains a legal requirement for food businesses operating in the UK under Regulation (EC) No 852/2004. It is excellent at managing unintentional hazards — the kind that arise through contamination, poor hygiene, or temperature failure.
But HACCP has a significant gap: it was not designed to address deliberate, intentional threats to food. That is where TACCP and VACCP come in.
TACCP stands for Threat Assessment and Critical Control Points. It is a food defence framework that focuses specifically on deliberate, malicious threats to food products and production sites.
The core aim of TACCP is to think like a potential attacker. A TACCP assessment asks: who might want to cause harm to our products, our brand, or our consumers, and how could they do it? This might include:
TACCP goes beyond the physical product itself. It also covers site security, IT systems, employee background checks, and access control procedures — all the touchpoints where a motivated individual could cause deliberate harm.
Because of this broader scope, TACCP typically requires cross-functional input. It is not just a job for the food safety team; it needs HR, site security, IT, and senior management to be involved.
VACCP stands for Vulnerability Assessment and Critical Control Points. While it also deals with intentional adulteration, its focus is distinctly different from TACCP — it is specifically concerned with economically motivated food fraud.
A VACCP assessment asks: where in our supply chain are we vulnerable to someone adulterating, substituting, or misrepresenting our ingredients or products for financial gain?
Classic examples of the kind of threats VACCP is designed to prevent include:
Critically, VACCP applies primarily to incoming raw materials — before they arrive at your site. The vulnerability assessment produces a fraud mitigation plan that guides your procurement and supplier approval processes.
At FooddSure, we help businesses structure VACCP assessments that are practical, auditable, and aligned with BRCGS and SALSA requirements.
The most common source of confusion is that TACCP and VACCP both deal with intentional adulteration — but they approach it from entirely different angles.
TACCP is about malicious threats — deliberate acts motivated by a desire to cause harm, fear, or disruption.
VACCP is about vulnerabilities — points in your supply chain where someone might exploit a gap for economic gain.
Another way to think about it: VACCP looks at where fraud could happen; TACCP looks at what threats could be deployed and by whom. Used together, they form a complete food defence strategy.
| Feature | HACCP | VACCP | TACCP |
|---|---|---|---|
| Focus | Unintentional food safety hazards | Food fraud / economically motivated adulteration | Deliberate malicious threats / food defence |
| Motivation | Accidental contamination | Financial gain | Harm, terrorism, sabotage, extortion |
| Scope | Internal processes | Supply chain / incoming materials | Entire operation, including IT, personnel and site |
| Output | HACCP plan | Fraud mitigation plan | Food defence plan |
| Team | Food safety team | Technical + procurement | Cross-functional, including HR, security and IT |
| Standards | BRC, SQF, ISO 22000 | BRCGS V9 Clause 5.4 | BRCGS V9 Clause 4.2.1 |
Food defence is not just best practice in the UK — it is increasingly a formal requirement under major food safety certification schemes.
The BRCGS (British Retail Consortium Global Standard) for Food Safety Version 9 includes specific clauses that food businesses must comply with:
SALSA (Safe and Local Supplier Approval), SQF, and FSSC 22000 all have comparable food fraud and food defence requirements. If you are seeking or maintaining accreditation under any of these standards, TACCP and VACCP documentation is non-negotiable.
Beyond certification, the UK Food Standards Agency (FSA) expects food businesses to have appropriate management systems in place that address both unintentional and intentional threats. Following Natasha's Law in 2021, regulatory scrutiny of food labelling and supply chain transparency has intensified considerably.
The FooddSure team is experienced in helping businesses across multiple sectors — from food manufacturers to hospitality operators — meet these requirements efficiently and without disruption to daily operations.
One question we hear frequently is: does our team actually need formal training in TACCP and VACCP, or is documentation enough?
The short answer is both. BRCGS Clause 4.2.1 explicitly states that individuals responsible for threat assessments must demonstrate understanding of food defence risks. That means documented training records are important as well as practical competence in running assessments.
TACCP and VACCP training typically covers:
At FooddSure, our consultancy and training services are designed to upskill your team and put the documentation in place to satisfy both internal audits and external certification bodies. We tailor our approach to your industry sector, site size, and current level of compliance.
It is important to understand that HACCP, TACCP, and VACCP are not alternatives — they are complementary layers of a complete food protection system.
Together, these three frameworks provide 360-degree protection for your food products, your brand, and your customers. Businesses that implement all three are significantly better positioned to prevent incidents, pass audits, and respond effectively if something does go wrong.
FooddSure supports businesses in building integrated food safety management systems that cover all three areas — tailored to your specific processes, supplier relationships, and regulatory obligations.
In our experience working with food businesses across the UK, we see a number of recurring issues when it comes to food defence and food fraud management:
At FooddSure, we not only help you build the right documentation but also support you in embedding these processes into your daily operations.
At FooddSure, we provide end-to-end support including gap analysis, team facilitation, documentation development, training delivery, and pre-audit review. Whether you are starting from scratch or looking to strengthen an existing system, our consultants can work alongside your team at your site or remotely.
Understanding the difference between TACCP and VACCP — and knowing how to implement both alongside your existing HACCP system — is no longer optional for UK food businesses. It is a baseline expectation from certification bodies, retailers, and regulators alike.
At FooddSure, we are committed to making food defence and food fraud compliance accessible, practical, and proportionate for businesses of every size. From initial consultancy through to training delivery and audit support, our team is here to help you build a food safety management system that protects your products, your people, and your reputation.
Contact FooddSure today for a consultation and take the first step towards a more resilient food defence and food fraud strategy.
Get in Touch