Identifying internal vulnerabilities

Relevant Food Safety Standards

This article has been written to comply with GFSI recognised schemes, including BRCGS Food Safety, BRCGS Packaging, BRCGS Agents and Brokers, BRCGS Storage and Distribution, FSSC 22000, IFS Food and SQF Food Safety.

The requirements
Internal scope of custody
Threats and vulnerabilities
Team

The requirements

Scope

The assessment must consider internal and external threats and vulnerabilities due to fraud, sabotage and terrorism.

Protection measures

The assessment must consider the current security measures.

Horizon scanning

Horizon scanning must be used to identify any future potential threats and vulnerabilities internally. Where a new or increased threat is identified, this must be fed into the assessment.

Internal scope of custody

The scope of custody for the internal piece of the assessment must consider fraud (in the form of theft), sabotage and terrorism, where your business is responsible:

For the physical custody of the materials.
For the financial custody of the transactional activities (if you’re an agent and broker).

Internal scope

The scope of the internal assessment looks at all the business activities that you’re responsible for. This can be manufacturing, storing, distributing, or even processing transactions, such as customer orders.

The internal aspect is typically known as TACCP or your threat assessment – but as we explained in Understanding product defence TACCP doesn’t make any sense and you can’t have a threat assessment without considering vulnerabilities.

Threats and vulnerabilities

When assessing threats for vulnerability internally, you need to consider:

Unauthorised access.
Data tampering.
Malicious contamination.
Theft.

Vehicles must also be considered.

Team

The members of the team which are essential for identifying vulnerable threats internally are the operational, HR, security and IT roles, as they have the necessary knowledge and experience.

Want to learn more about identifying internal vulnerabilities?

This article is an overview of the subject of identifying internal vulnerabilities. If you’re looking to gain in-depth knowledge on this subject, we’d recommend you purchase our eLearning course.

Product defence