Identifying vulnerabilities upstream

This article is written to meet the following sections of the Standards:

BRCGS Food Safety Issue 8	5.4.2 Vulnerability assessment 5.4.4 Status verification of raw materials 5.4.1 Provision of knowledge and information
BRCGS Packaging Issue 6	3.8.2 Vulnerability assessment 3.8.1 Obtaining information
BRCGS Agents & Brokers Issue 3	4.8.2 Vulnerability assessments 4.8.1 Provision of knowledge and information
BRCGS Storage & Distribution Issue 4	3.5.3.1 Fraud vulnerability assessment 10.3.3.2 Vulnerability assessment 10.3.3.1 Information
FSSC 22000 Version 5.1	2.5.3.1a) Identify food defence threats 2.5.4.1a) Identify food fraud threats
IFS Food Version 7	4.20.2* Fraud assessment scope 4.20.3* Monitoring of food fraud 6.2* Food defence scope 6.3 Monitoring of food defence
SQF Edition 9	2.7.1.2 i) and ii) Methods, responsibilities and criteria 2.7.2.2 Food fraud mitigation plan

The requirements
Upstream
Scope of custody
Team
Threats
Supply-chain mapping

The requirements

Identifying threats

The product defence plan must identify threats and vulnerabilities from:

Historical evidence.
Claims which may make fraud more economically attractive.
Supply issues which may make fraud more economically attractive.
Theft.
Malicious contamination due to sabotage or terrorism.

Assessing vulnerability

The product defence plan must assess the identified threats to establish vulnerability, considering:

Materials which are purchased from countries that have less regulation or governance and therefore may be more vulnerable to fraud.
Formats which make it easier to hide fraud, such as powdered materials.
Complexities and weaknesses in the supply-chain which may provide opportunities for fraud.
The ability to identify threats on delivery.

Claims

Materials which hold a claim tend to demand a higher value. The assessment must define which are at risk such as claims regarding:

Certification.
Recycled content.
Organic.
Provenance.
Breed and variety.
Protected food name status.
Production techniques.
Identity preserved.
Trademarks.
Nutritional health claims.
Compositional.
Allergenic.

Horizon scanning

A systematic process of horizon scanning must be in place, to identify emerging threats in the upstream supply-chain. Where a new or increased threat is identified, this must be fed into the assessment.

Upstream

The supply-chain is made up of three pieces:

Upstream
Internal
Downstream

The assessment needs to be completed for upstream, internal, and downstream vulnerabilities.

Scope of custody

Just like you must have a scope for HACCP, a scope for your product defence plan is essential as well. This must detail:

The type of threats considered – fraud, sabotage, and terrorism.
The extent of your business’ accountabilities and responsibilities.
Where physical and financial custody is transferred to your business and then on to the next custodian.

Custody

Physical custody is where you have possession of the materials.

Financial custody is where you own the materials.

Upstream scope

The scope of the upstream assessment looks at your suppliers and your suppliers, suppliers. It also considers the parts which you’re accountable for. The upstream aspect is typically known as VACCP or your vulnerability assessment – but we explained in Understanding product defence VACCP doesn’t make any sense and you can’t have a vulnerability assessment without considering threats.

Team

The members of the team which are essential for identifying vulnerable threats upstream are the procurement and the technical roles, as they have the necessary knowledge and experience.

Threats

The upstream assessment must look at threats from fraud, sabotage, and terrorism. It must identify vulnerabilities from:

Known and plausible threats.
Materials which generate a claim.
The supply-chain.

Supply-chain mapping

The purpose of supply-chain mapping is to identify vulnerabilities in the supply-chain, back to the point of assurance. The point of assurance is where the authenticity of the material can be assured.

Conducting supply-chain mapping is a complicated and time-consuming process, therefore it’s important to only carry it out where necessary – on threats that you’ve identified as vulnerable.

Become a ninja at identifying vulnerabilities upstream

This article is an overview of the subject of identifying vulnerabilities upstream. If you’re looking to gain in-depth knowledge on this subject, we’d recommend you purchase our eLearning course.

Identifying vulnerabilities upstream
£26.00 (plus VAT) Add to Basket

Product defence