What Is TACCP? Threat Assessment for Food Defence, Explained
TACCP is the threat assessment for deliberate attacks on food. This guide covers what it is, how it differs from HACCP and VACCP, which standards require it, and what keeping one current actually takes.
Most food safety systems are built for accidents. TACCP — Threat Assessment and Critical Control Points — is built for intent: someone deliberately trying to harm your product, your business, or the people who eat what you make. It sits alongside HACCP, which covers unintentional hazards, and the food fraud vulnerability assessment, which covers adulteration done for money.
The distinction matters because the three ask different questions and produce different controls. A microbiological hazard is managed by process. An economically motivated substitution is managed by specification and testing. A deliberate attack is managed by who can reach the product, when, and unobserved. This guide is an overview: what TACCP is, where it is required, and what keeping one current actually takes.
What is TACCP?
TACCP stands for Threat Assessment and Critical Control Points. It is a structured assessment of deliberate attacks on food — contamination, tampering, extortion, sabotage — and of the controls that would prevent or detect them. The method was set out in PAS 96, the guide published by BSI with the UK’s Department for Environment, Food and Rural Affairs and the Food Standards Agency[1].
A TACCP assessment works backwards from the attacker rather than forwards from the process. It asks who would want to cause harm, what they would gain, where in the operation they could reach product, and what would have to be true for them to succeed. The output is two documents: a threat assessment recording what was considered and why, and a food defence plan setting out the controls in place, the gaps, the owners and the review schedule.
How is TACCP different from HACCP and VACCP?
The three assessments are separated by motive, not by hazard. The same substance in the same jar can belong to any of them, and the response differs entirely depending on which one it is.
| Assessment | Motive | Typical control |
|---|---|---|
| HACCP | No intent — accident or process failure | Process control, critical control points, verification |
| VACCP | Economic gain | Specification, authenticity testing, supplier approval |
| TACCP | Intent to cause harm | Access control, tamper evidence, personnel, early warning |
Rodenticide in a jar of baby food is a TACCP matter if it was placed there to make an extortion threat credible, and a HACCP matter if it entered through a pest-control failure. The laboratory result looks the same; the investigation, the notification duties and the corrective action do not. That is why the assessments stay separate even when the same team runs all three, and why food fraud prediction and food defence are treated as different disciplines with different evidence bases.
Which standards require a TACCP threat assessment?
Food defence is a requirement in every major GFSI-benchmarked standard, and in US law for businesses shipping there. The assessment itself is usually called a threat assessment in the standard text; TACCP is the method most sites use to produce one.
- FSSC 22000 version 6 — a documented threat assessment under clause 2.5.3, kept current, with a food defence plan and verification[2]
- BRCGS Food Safety Issue 9 — clause 4.2 is Food Defence, renamed from site security, and requires a documented threat assessment[3]
- IFS Food version 8 — requirement 4.21.2: a food defence procedure and plan shall be documented, implemented and maintained to identify potential threats and define food defence measures[4]
- FDA Intentional Adulteration rule — a written food defence plan for covered facilities under FSMA, with vulnerability assessment and mitigation strategies[5]
The wording differs between schemes. The expectation does not: a documented, reasoned assessment, reviewed on a defined cycle, that can be evidenced when an auditor asks what informed it.
An assessment is only as current as the threat picture behind it.
iComplai watches for deliberate attacks on food worldwide, works out which of them bear on your products, your suppliers and your markets, and records what was seen and when. Your threat assessment stops being an annual memory exercise and becomes a dated evidence trail.
See how TACCP monitoring worksWho attacks food businesses, and why?
PAS 96 frames food defence around the attacker rather than the hazard, because motive is what makes an attack foreseeable. A small set of profiles covers most recorded cases, and each one reaches the product by a different route.
- Extortionist — contaminates to make a threat credible; the product is a hostage and publicity is part of the leverage
- Disgruntled insider — acts on grievance, using the access the role already grants, usually during a notice period or after a dispute
- Ideological attacker — seeks fear and publicity, often through a symbolic brand or country of origin
- Opportunist or copycat — imitates a case that has just been publicised
That last profile is the reason publicity matters operationally. After a single needle contamination in Australian strawberries in September 2018, Queensland Police recorded 186 contamination reports nationally across 68 brands, of which 15 were confirmed hoaxes[6]. One act became a category-wide event in under two months. An attack on somebody else can change your own risk position within days, which is why the copycat window belongs in the same watch list as emerging risks rather than in a yearly review.
What does a TACCP assessment involve?
A TACCP assessment maps the operation, identifies every point where an attacker could reach product, and judges each one on how easily it could be exploited and how severe the outcome would be.
The scope runs the chain end to end: raw material receipt, storage, processing, packing, distribution — and the disposal of rejected or recalled stock, which is routinely forgotten and has produced real cases of its own. It covers physical and personnel access, including contractors and visitors, and the human factors: recruitment, notice periods and how grievance is handled. Each threat is scored, mitigations are assigned to named owners, and the assessment is signed off by a team rather than an individual. Most sites reuse the HACCP team and add security, HR and IT.
The practical difficulty is that a scenario on paper is hard to score without evidence. A team that knows what has actually been tried elsewhere, and how it was done, scores its own scenarios very differently from one working out of imagination.
How do you keep a TACCP assessment current?
“Kept current” is the requirement auditors probe hardest, because most sites can produce an assessment and few can show what informed it since the last review. Currency means three things: a dated record of the threat landscape actually monitored, not just the conclusion drawn from it; a link from each plan change back to the event that triggered it; and a review that is event-driven as well as calendar-driven. A publicised attack in your category, a dispute or redundancy programme at a co-manufacturer, or a recalled product turning up back on a shelf are all reasons to revisit the assessment before the annual date arrives.
What that looks like in practice is unglamorous. Screening produces far more candidates than alerts, and the value is in the triage — the record of what was read and rejected is as much a part of the evidence trail as what was escalated.
| Date | What came up | Verdict |
|---|---|---|
| 12 Oct | Refrigeration at hundreds of supermarkets remotely turned up to 50 °C overnight; chilled and frozen food thrown away — France | Sent — the attack reached the food, not just the systems |
| 2 Sep | Convenience store pursues legal action over intentional food tampering filmed in a viral video — Philippines | Sent — imitation risk for the market |
| 1 Sep | Gift-card tampering scam at a grocery retailer — Australia | Set aside — tampering, but not food |
| 26 Aug | 82 tonnes of sesame seed intercepted, adulterated with dust, mould and inferior grains — Nigeria | Fraud, not defence — the motive is money |
Those are four cases from iComplai’s food defence screening, between late August and mid-October 2026[7]. Two of the four were worth sending on. One was tampering but not food. One had an economic motive, which makes it a fraud question rather than a food defence one. A site running continuous risk assessment can show an auditor each week’s reading and the decision attached to each line — which is a different conversation from producing a plan dated eleven months ago. That is what TACCP monitoring does as a standing service rather than an annual project.
TACCP FAQ
What does TACCP stand for?
TACCP stands for Threat Assessment and Critical Control Points. It is the assessment of deliberate attacks on food — contamination, tampering, extortion and sabotage — and of the controls that would prevent or detect them. The method was set out in PAS 96, published by BSI with the UK’s Defra and Food Standards Agency.
Is TACCP mandatory?
TACCP itself is not written into EU or UK law, but a documented food defence threat assessment is required by FSSC 22000 version 6 clause 2.5.3, BRCGS Food Safety Issue 9 clause 4.2 and IFS Food version 8 requirement 4.21.2, and a written food defence plan is required by US law for facilities covered by the FDA Intentional Adulteration rule. In practice, any certified site needs one.
What is the difference between TACCP and VACCP?
Motive. VACCP, the food fraud vulnerability assessment, covers adulteration and substitution done for economic gain, where the attacker wants profit and no attention. TACCP covers acts intended to cause harm, where publicity may be the point. The two produce different controls: specification and authenticity testing on one side, access control and tamper evidence on the other.
How often should a TACCP assessment be reviewed?
At least annually, and whenever something changes: a new site, process, supplier or co-manufacturer, a restructuring or redundancy programme, or a publicised attack in your category or market. Auditors increasingly ask what informed the review, so the threat landscape monitored between reviews should be recorded with dates, not reconstructed from memory.
What has changed in your threat picture since the last review?
See how continuous food defence screening keeps a TACCP assessment current, in one walkthrough.
Talk to iComplaiWhere these claims come from
- BSI, Defra and the Food Standards Agency. PAS 96:2017 — Guide to protecting and defending food and drink from deliberate attack. bsigroup.com
- Foundation FSSC. FSSC 22000 Version 6 scheme documents — additional requirement 2.5.3, food defence. fssc.com
- BRCGS. Food defence in the Global Standard Food Safety Issue 9, clause 4.2. brcgs.com
- IFS. IFS Food Version 8 standard, requirement 4.21.2 — food defence procedure and plan. ifs-certification.com
- US Food and Drug Administration. FSMA Final Rule: Mitigation Strategies to Protect Food Against Intentional Adulteration (21 CFR Part 121). fda.gov
- Australian Broadcasting Corporation. Strawberry needle contamination scare: woman charged after months-long investigation — Queensland Police reporting 186 contamination reports nationally across 68 brands, 15 of them hoaxes, November 2018. abc.net.au
- iComplai food defence screening. Four cases from worldwide screening, late August to mid-October 2026.