Taccp Manual
Taccp Manual
Taccp Manual
DOCUMENT NUMBER
DATE VERSION
Prepared By : ________________________
Approved By : ________________________
TACCP is a precise analysis of vulnerable elements of the supply chain carried out by an experienced
and trusted team. TACCP, Threat Assessment Critical Control Point, is best defined as a
management process to defend a food supply chain from intentional contamination.
VACCP
Vulnerability Assessment Critical Control Point- systemic management of risk through the evaluation of
vulnerabilities (susceptibility or exposure to food fraud risk) and implementation of controls to materials
and products, purchasing, processes, premises, distribution networks and business systems by a
knowledgeable and trusted team with the authority to implement changes to procedures.
Purpose
To prevent intentional, malicious attacks and fraud within the Food Industry, whilst helping
to protect the reputation of an organization.
How
Implementation of procedures to mitigate and minimize the impact of malicious attack .
The food industry sees the safety of its products as its main concern. Over the years, industry and regulators
have developed food safety management systems which mean that major outbreaks of food poisoning are
now quite unusual in many countries. These systems typically use Hazard Analysis and Critical Control Point
(HACCP) principles which are accepted globally. HACCP has proven to be effective against accidental
contamination.
HACCP principles however have not been routinely used to detect or mitigate deliberate attacks on a system
or process. Such attacks may include deliberate contamination or fraud. Deliberate acts may have food safety
implications but can harm organizations in other ways, such as damaging business reputation or extorting
money.
The common factor behind all such deliberate acts is people. The people may be within a food business, may
be employees of a supplier to the food business, or may be complete outsiders with no connection to the food
business. The key issue being their motivation; they may aim to cause harm to human health or business
reputation, or to make financial gains at the expense of the business. In any of these situations it is in the
interests of the food business to protect itself from such attacks.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 3 of 32
1. Scope
TACCP provides guidance on the avoidance and mitigation of threats to food and food supply. It describes a
risk management methodology, Threat Assessment Critical Control Points (TACCP), which can be adapted by
food businesses of all sizes and at all points in food supply chains.
It is intended to be of use to all organizations, but may be of particular use to managers of small and medium
sized food enterprises who may not have easy access to specialist advice.
Something that can cause loss or harm which arises from the ill-intent of people
NOTE Threat is not used in the sense of threatening behavior or promise of unpleasant consequence of a
failure to comply with a malicious demand.
Asset:
An Asset is what you are trying to protect (Raw material, product, people, property,
information).
Vulnerability:
Vulnerability is a weakness or gap in your protection measures, weaknesses or gaps in the
food chain / production process that can be exploited by threats to gain unauthorized access
to an Asset.
Risk:
Risk is the intersection of assets, threats and vulnerabilities, the potential for loss, damage
or destruction of an Asset as a result of a Threat exploiting Vulnerability.
Attacker
Successful attack depends on:
Having the capability / resources / agents to carry out the attack having an opportunity to carry out the
attack
Cyber Security
Procedures used to protect electronic systems from sources of threat
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 4 of 32
NOTE: Examples of these threats are from malware and hackers intent on misusing IT systems, corrupting
them or putting them out of use.
Food Defense
Procedures adopted to assure the security of food and drink and their supply chains from malicious and
ideologically motivated attack leading to contamination or supply disruption
NOTE The term food security refers to the confidence with which communities see food being available to
them in the future. Except in the limited sense that a successful attack may affect the availability of food, food
security is not used and is outside the scope of this PAS.
Food Fraud
Committed when food is deliberately placed on the market, for financial gain, with the intention of deceiving
the consumer
Food Protection
Procedures adopted to deter and detect fraudulent attacks on food
Food Supply
Elements of what is commonly called a food supply chain
NOTE An example of a food supply chain is given in Figure 1. Figure 1 is not intended to be comprehensive.
Hazard
Something that can cause loss or harm which arises from a naturally occurring or accidental event or results
from incompetence or ignorance of the people involved
Insider
Individual within or associated with an organization and with access to its assets but who may misuse that
access and present a threat to its operations
Personnel Security
Procedures used to confirm an individual’s identity, qualifications, experience and right to work, and to
monitor conduct as an employee or contractor
NOTE 2 Personnel security principles are used to assure the trustworthiness of staff inside an organization, but
may be applied to the staff of suppliers within processes for vendor accreditation.
Systematic Management of risk through the evaluation of threats, identification of vulnerabilities, and
implementation of controls to materials and products, purchasing, processes, premises, distribution networks
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 5 of 32
and business systems by a knowledgeable and trusted team with the authority to implement changes to
procedures.
3. Threats
Threats are identified as something which can cause loss or harm, arising from the malicious
intent of individuals or groups.
Types of Threats
Economically Motivated Adulteration (EMA)
The motivation of EMA is financial, to gain an increased income from selling a foodstuff in a
way which deceives customers and consumers. This may be by either passing off cheaper
material as a more expensive one, or it may be that a less expensive ingredient is used to
replace or extend the more expensive one.
Malicious Contamination
The motivation for malicious contamination may be to cause localized or widespread illness
or death.
Extortion
The motivation for extortion by either an individual or group is financial, to obtain money from
the victim organization. Such activity is attractive to the criminal mind when the product, like
baby food sensitive or where a company is seen as rich.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 6 of 32
A small number of samples can be used to show the company that the attacker has the
capability and is enough to cause public concern and media interest.
Espionage
The primary motivation of espionage is for competitors seeking commercial advantage to
access intellectual property. They may infiltrate using insiders to report or may attack
remotely through information technology systems.
Counterfeiting
The motivation for counterfeiting is financial gain, by fraudulently passing off inferior goods as
established and reputable brands. Both organized and petty crime can cause companies
financial loss and harm to their reputation.
Cyber Crime
Crime that involves a computer and a network, the computer may have been used in the
commission of a crime, or it may be the target.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 7 of 32
4. TACCP Team
Position in the
Sr. No. Name Department/ Designation
TACCP Team
Team Leader
1
Member
2
Member
3
Member
4
Member
5
Member
6
Member
7
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 8 of 32
5. List of Ingredients
Annexure-1
S. NO. MATERIAL NAME
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
3
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 10 of 32
8. TACCP Analysis
Flow chart of assessing in the food chain:
Vendor
Identification/Sel
ection for RM/PM
Specification sent to
Vendor by the HO
OK
OK
Not
OK
Trial at Factory with blank QC Vendor Rejection
PM Approva
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 11 of 32
Flow chart-2
Consumer
Return to transporter
NOT OK
OK
NOT
Vehicle
OK
inspection Retailer
by
Distributer
Vehicle loading as per
given dispatch plan
Dispatch to Depot
Security Check
(Nos . Of boxes
Documentation
and stack
work
Flow chart-4
Flow chart-5
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 13 of 32
COMPRESSED AIR
Environmental
Air
Filter
Compressor
Storage Tank
Dryer
Pressure regulating
Valve
Distribution in Plant
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 14 of 32
Assessment of Risk
For Each identified threat the TACCCP team considers and gives a score for the likelihood of each
threat happening and for its impact.
Impact could consider death or injury, cost, damage to reputation and/or public and media perceptions
of these consequences. The likelihood of a threat happening can be judged by considering following:
a) Whether an attacker would achieve their aims if successful;
b) Whether an attacker could have access to the product or process;
c) Whether an attacker would be deterred by protective measures;
d) Whether an attacker would prefer other targets; and
e) Whether an attack would be detected before it had any impact.
The impact might be assessed in financial terms or in terms of the seniority of staff needed to deal with
it. The risk Score presented by each threat are shown in flow chart of supply chain.
PROBABILITY
1 2 3 4 5
SEVERITY
1 1 2 3 4 5
2 2 4 6 8 10
3 3 6 9 12 15
4 4 8 12 16 20
5 5 10 15 20 25
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 15 of 32
Decision Tree
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 16 of 32
Location XXXXXXXXXXXXXXXXXXXXXX
Date 01-01-2021
Ingredient, Product, Brand, Site, Refer the Annexure 1 & 3
Country or Division being
assessed:
Assessment of Risk
For Each identified threat the TACCCP team considers and gives a score for the likelihood of each threat happening and for its impact.
Impact could consider death or injury, cost, damage to reputation and/or public and media perceptions of these consequences. The
likelihood of a threat happening can be judged by considering following:
f) Whether an attacker would achieve their aims if successful;
g) Whether an attacker could have access to the product or process;
h) Whether an attacker would be deterred by protective measures;
i) Whether an attacker would prefer other targets; and
j) Whether an attack would be detected before it had any impact.
The impact might be assessed in financial terms or in terms of the seniority of staff needed to deal with it. The risk Score presented by each
threat are shown in flow chart of supply chain.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 18 of 32
TACCP ASSESSMENT
No medical
No brand image
1 Low 1 treatment 1 1 no loss
loss
required
fatal or
5 High 5 5 India impact 5 No control
catastrophic
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 19 of 32
PROBABILITY
1 2 3 4 5
SEVERITY
1 1 2 3 4 5
2 2 4 6 8 10
3 3 6 9 12 15
4 4 8 12 16 20
5 5 10 15 20 25
Threat
Severity Score TACCP
Econ
S. No Contributing factor Avg Prob Justification Risk Owner
Brand omic Risk Control
Health Seve
image al No. measure
rity
loss
1 Outside Security Measures
In plant secured with security
monitoring, lock & key facility
1.1 Physical Security 5 1 2 2.67 2 5.33 N HR
established, access to prevent
unauthorized entry.
vehicle inspection checklist
Dispatch &
1.2 Receiving Security 5 1 1 2.33 1 2.33 N implemented for loaded and empty
Security
vehicle inspection
vehicle checklist is there for loaded
1.3 Dispatch Security 2 1 1 1.33 1 1.33 N Dispatch
and empty vehicle inspection
Daily Data Back up through domain
server, password policy, system
updates & antivirus, cyber Rome fire
1.4 Mail Handling Security 1 1 2 1.33 1 1.33 N IT
wall security system, Restriction on
potable electronic & camera
equipments.
2 Inside Security Measures
Restricted areas are identified and
are under control, Colour coded
identity card available for outside
2.1 General Inside Security 5 1 1 2.33 1 2.33 N visitors & all area Under CCTV HR
surveillance
Emergency preparedness system is
there in place
1.restricted areas are identified and
are under control, Colour coded
identity card available for outside Production in
2.2 Processing Area Security 5 1 1 2.33 1 2.33 N visitors & all area Under CCTV charge
surveillance
2.emergency preparedness system
is there in place
Access control is in place. Production in
a Sugar Dumping 5 2 2 3.00 1 3.00 Y CCTV installed at sugar dumping charge
section.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 21 of 32
Threat
Severity Score TACCP
Econ
S. No Contributing factor Avg Prob Justification Risk Owner
Brand omic Risk Control
Health Seve
image al No. measure
rity
loss
Milk preparation activity happens in Production in
the supervision of production in charge
b Milk Solution Preparation
charge. CCTV installation work at
process area under progress.
Reprocessing activity performed Production in
under the supervision of the charge
production in charge. CCTV
c Reprocessing 5 2 2 3.00 1 3 N
installation work at process area
under progress.
Access control is in place.
access control is in place
Color Preparation activity happens
under the supervision of Production Production in
in charge.
d Color Preparation 1 2 3 2.00 1 2.00 N charge
Parameters of prepared color
solution are checked by Quality. As
well as color percentage also
checked for finished goods.
Only QC approved material is
released for production.
Only authorized personnel/team Production in
e RM feeding 1 5 2 2.66 1 2.66 N mates operate the PLC. Access charge
control is in place. CCTV
surveillance for monitoring under
progress.
Every issue of PM lot to the
production by PM store in charge &
further verification while receiving by Store in charge
f PM issue for packing 1 5 3 3.00 1 3.00 N
production shift supervisor.
Verification during pre startup on
machine by operator.
Pre startup & random verification in
every 2 hours by Online QA. QA/Production In
Candy weight, Unit weight, FG
g 1 5 3 3.00 3 9.00 Y 100% weighing of all FG cases as charge
Cases weight & Coding
well as the same is verified by online
QA during Pre dispatch inspection.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 22 of 32
Threat
Severity Score TACCP
Econ
S. No Contributing factor Avg Prob Justification Risk Owner
Brand omic Risk Control
Health Seve
image al No. measure
rity
loss
Next product is run only after QA
h Changeover 5 2 2 3.00 1 3.00 N QA
approval.
Access control is in place.
Checking of all vehicles condition
before loading & Unloading than
Warehousing, Loading &
I 1 1 2 1.33 1 1.33 N approval has been given. Dispatch/Security
Unloading
Also checking the vehicle as per
checklist after loading of finished
goods.
2.3 Storage Area Security
Authorized access only allowed
a RM Storage 5 1 1 2.33 1 2.33 N CCTV installation work at process Store in charge
area under progress.
Separate PM storage for Packing
b PM Storage 1 1 1 1.00 2 2.00 N materials. Store In charge
Access control is in place.
Threat
Severity Score TACCP
Econ
S. No Contributing factor Avg Prob Justification Risk Owner
Brand omic Risk Control
Health Seve
image al No. measure
rity
loss
only & consumption records also
maintained for the same.
Daily data Back up through domain
server, password policy, system
updates & antivirus ,cyber romefire
2.6 Information security 4 1 1 2.00 1 2.00 N IT
wall security system, Restriction on
potable electronic & camera
equipments
3 Personal Security Measures
Mobile phones are allowed to only
authorized personnel only.
3.1 Employee security 3 2 2 2.33 2 4.67 N HR
Identity proof verified by HR at the
time joining of employee.
Separate visitor gallery is available
for visitor.
3.2 Non Employee security 3 2 2 2.33 3 7.00 N A company employee lives with the HR
visitor during the visit to the process
area in case of inside visit.
safety & security training provided to
all new employees
3.3 Security Training 4 1 1 2.00 1 2.00 N HR
Identity proof also verified by the HR
for all security staff and recorded.
Incident Response Security
4
Measure
CCTVs are investigated, which are
installed at security gate.
4.1 Investigating Security Concerns 4 2 1 2.33 1 2.33 N IT & Admin
Meeting with security staff & give
proper instruction to them.
Emergency contact team is
4.2 Emergency Contact Security 4 1 1 2.00 1 2.00 N prepared and list is displayed at in HR & Security
all section.
Product recall/withdrawal procedure
4.3 Other plan Security 4 1 1 2.00 1 2.00 N Quality
is followed.
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 24 of 32
VACCP ASSESSMENT
2 First Aid
2 Medium low
3 Medical treatment
3 Medium
4 Hospitalization
4 Medium high
5 FATAL OR CATASTROPHIC
5 High
Vulnerability score:
PROBABILITY
1 2 3 4 5
1 1 2 3 4 5
SEVERITY
2 2 4 6 8 10
3 3 6 9 12 15
4 4 8 12 16 20
5 5 10 15 20 25
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 26 of 32
Contribution to Vulnerability
C Low Medium-Low Medium Medium-High High
on
tr Contributing factors
oll
ab
le 1 2 3 4 5
Fa Supply Chain Firm vertically Vertically integrated Supplier manufactures Upstream supplier Open market
ct integrated manufactures
or
s
Audit Strategy Robust, on-site with Robust, on-site with Immature, on-site with no Currently developing an on- No onsite audit
numerous anti-fraud limited anti-fraud antifraud measures site audit strategy
measures measures
Supplier Relationship Trusted supplier for Trusted supplier and new Some relationship Established supplier but no Un-established supplier
all purchases ingredient established previous relationship and no prior relationship
History of supplier quality No known issues Few minor issues, quickly Recurrent issues or Multiple persistent issues, Strong evidences of
& safety issue resolved resolution concern indicating no controls quality / food safety
concerns, inadequate
controls
Testing frequency Intensive – every lot Random lots, Independent yearly /less No independent testing No independent testing,
checked by buyer independently tested for frequency testing done as done, reliance on COA No COA
buyers qualification
Susceptibility of QA Very Selective, Selective, specific Selective methods, but not Methods are of limited Methods are not
methods and specs Specific methods, methods, allow for natural specific. Specs reflects the selectivity & specificity, selective or specific,
specs allow only for and analytical variability same specs reflect the same specs are broader than
natural variability ideal
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 27 of 32
U Geopolitical Single ingredient, Several components Single ingredient, originated Several ingredients, some Single / some
nc considerations from single source of sourced from geographic or transited through region originated / transited ingredients, transited
on origin with low source of low concern of some concern through geo concern area through several geo
tr concern concern area
oll
ab Fraud History No reported Moderate volume of Numerous reports, limited High volume of reports, High volume of reports,
le /substantial reports: No substantiating substantiating evidence some substantiating good substantiating
fa evidence evidence evidence evidence
ct
or
Economic Anamolities Nothing unusual Isolated Anamolities Frequent but unrelated, Common but Common and broad,
s
Anamolities focused,Anamolities Anamolities
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 28 of 32
1. Multi stage
testing by QA
before dispatch.
2. Supply as per
terms &
conditions
mentioned in
agreement with
Finished Goods transport.
3 3 1 1 1 1 1 1 1 1.25 2 2.5 N
Refer FG list 3. No quality QA &
Issue for Dispatch
economical
benefit
4. Temper
evident seal on
vehicle
5. No Fraud
history
6. Stable
XXXXXXXXXXXXXXX
Document Name: TACCP & VACCP Manual
Issue Date: 01/04/2023 Version: 7.01
Document ID: XXXX/TACCP & VACCP/M/01 Page No. Page 30 of 32