Afaik the (TACCP/VACCP/HACCP) topic is currently a minefield of interpretive confusion, often from both internal and external POVs.
I enclose below a February 2016 “Review” which attempts to compare some European (eg GFSI, PAS) and USA (eg MSU, FSMA) viewpoints. Offhand, it appeared to me that the differences are more evident than the similarities. A few quotes –
For example, VACCP isn’t anywhere in FSMA’s "Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food" document. And, there are no references to “food fraud.” However, there are references in the document to EMA: “We [FDA] continue to believe that hazards that may be intentionally introduced for economic gain will need preventive controls in rare circumstances, usually in cases where there has been a pattern of economically motivated adulteration in the past. Economically motivated adulteration that affects product integrity or quality, for example, but not food safety, is out of the scope of this rule.”
Later in "Risk-Based Preventive Controls for Human Food" document, Response 402 stresses EMA is out of the scope of FSMA, unless people are sickened: “We [FDA] define hazards to only include those agents that have the potential to cause illness or injury. Economically motivated adulteration that affects product integrity or quality, for example, but not food safety, is out of the scope of this rule. We continue to believe that there is benefit in taking this preventive approach to economically motivated adulteration, and not solely on enforcing the preexisting misbranding and adulteration provisions of the FD&C Act after a violation occurs.”
However, there is some confusion because FDA refers to a food defense risk analysis as a “vulnerability assessment,” according to FFI’s (Food Fraud Initiative) report.
In fact, PAS 96:2014, “Guide to protecting and defending food and drink from deliberate attack,” published by the British Standards Institute, makes no distinction between EMA or food fraud and intentional contamination and identifies them all as threats. Though the guide covers TACCP in detail, including assessing vulnerabilities and risks and setting up critical controls, it makes no specific reference to VACCP.
I couldn’t see any more recent reviews than the above but the practical situation may be “fluid”.
Note that the GFSI, ver7 Guidance referred above seems presently scheduled for 2017.
VACCP and HACCP (and TACCP),2016.pdf 559.59KB
PS - shortly after the above, mainly VACCP-related, article the same source issued this (comparative) TACCP focused document. IMO it's a more difficult read than the VACCP one. It includes a BRC definition of TACCP.
TACCP and HACCP,2016.pdf 501.12KB