Can we merge risk assessment for Food Fraud and Food Defense?

Can we merge and someone share a merge risk assessment for Food Fraud and Food Defense?

Regards, 

Mandark

Hi Mandark,

It is not something that I have considered doing but BRCGS Guidance does state that you can consider food defence and food fraud together, if that is a more effective use of time and resource. Whilst there is some cross-over there is quite a lot of difference in criteria as outlined below.

4.2 Food defence

The following clauses mirror those concerning food fraud (section 5.4), so the site can choose to consider food defence and food fraud together, if that is a more effective use of time and resource, or separately if the company prefers, providing both food authenticity and food defence are robustly assessed and managed.

5.4 Product authenticity, claims and chain of custody

Note that the security of products, while under the management control of the company, is also an important aspect of fraud prevention. Security of products is covered in section 4.1 and food defence in section 4.2; this section focuses on the sourcing of raw materials and their vulnerability within the supply chain.

BRCGS Global Standard for Food Safety Issue 9 Clause 4.2.2 Guidance for Documented assessment of security:

The company must undertake a threat assessment of the risks inherent to the operation

to prevent malicious intervention. The threat assessment needs to consider both external threats (e.g. individuals or organisations gaining unauthorised access to the site, building or products) and internal threats, such as malicious tampering by staff who are authorised to be on site.

Each area (e.g. warehouses, processing areas and external storage areas) needs to be assessed in terms of how vulnerable the product is to contamination. Sensitive or restricted areas, such as open product areas, are likely to be the most vulnerable; the vulnerability of the packaged product will depend on the nature of the packaging. Details of IT systems and data protection should also be included in the assessment.

BRCGS Global Standard for Food Safety Issue 9 Clause 5.4.3 Guidance for Food Fraud Vulnerability Assessment:

Typical information to incorporate into the assessment includes:

• any emerging issues and information identified in clause 5.4.2

• historical evidence of substitution or adulteration of the ingredient

• cost/value of the material

• availability (e.g. a poor harvest may restrict availability and may increase the potential for adulteration)

• sophistication of routine testing to identify adulterants

• country of origin

• length and complexity of the supply chain

• supply chain model

• controls that are already in the supply chain.

Food Fraud should also be considered as part of Section 3.5 Supplier and raw material approval and performance monitoring, particularly clauses:

3.5.1 Management of suppliers of raw materials and packaging

3.5.2 Raw material and packaging acceptance, monitoring and management procedures

Kind regards,

Tony

Hi Mandark,

I recommend you DO NOT try to merge food fraud and food defense risk assessments.  While it might seem like you would save time it's going to ulitmately make your risk assessments more complicated and harder to complete, review and update. 

Food fraud risk assessments should focus on incoming raw materials while food defense risk assessments should be based on the physical activities done on your site, plus the physical structures and systems to control access to various parts of your site.  So you're really assessing different things and looking for different hazards. 

It's easier for you if you keep them separate, and your auditors will thank you for it as well!

Karen

Karencontable has a point; while there are a few seemingly similar parts to these, they really address very different aspects of food safety. Food Defense has to do with things on site, under your immediate control. Food Fraud really has to do with trying to control or discover attempted hijacking or cloning of your components or product which typically happens outside of your immediate control.

I've done both in the past and recommend keeping them separate. It's easier for an auditor to review when they're separate, and it's easier to justify your reasoning as it becomes a bit jumbled between the two.