A food fraud vulnerability assessment is a list of your ingredients scored for how likely someone is to fake them and how much it would matter if they did. FDA calls food fraud economically motivated adulteration: leaving out, taking out or substituting a valuable ingredient, or adding something to make a food look better, like honey or maple syrup cut with cheaper syrups, olive oil stretched with other oils, a cheaper fish sold as red snapper, or spices colored with lead-based dyes, which FDA has found in chili powder, turmeric and cumin. The assessment goes ingredient by ingredient: what the fraud would be, a likelihood from price, past fraud, how many hands it passes through and how hard it is to test, an impact from harm to health, an allergen or a claim on your label, and a control for the ones that score high: buying closer to the source, a certificate of analysis that names an authenticity test, an outside lab test now and then. For facilities subject to the FDA's preventive controls rule, hazards introduced for economic gain belong in the hazard analysis, and certification audits that large buyers require ask for an assessment too. In the example below, a granola maker scores eight ingredients for a chain's questionnaire. Below are the steps, the rules, the example, and a free template.
The short version
- A food fraud vulnerability assessment scores each ingredient for likelihood and impact of fraud.
- FDA's examples: honey and maple syrup cut with syrups, olive oil, seafood, juice, spices.
- Likelihood: price, past fraud, how many hands it passes through, how hard it is to test.
- Impact: harm to health, an allergen, a claim on your label.
- Controls: buy closer to the source, certificates that name the test, outside lab tests.
- The preventive controls rule counts hazards introduced for economic gain.
- TaroStack keeps each lot's supplier and certificate with it, so a test result has a lot to land on. More below.
The steps
| Step | What to do |
|---|---|
| List | Every ingredient, with its supplier and where it comes from |
| Describe | What fraud would look like for each: dilution, substitution, false origin, added color |
| Score | Likelihood 1 to 5 and impact 1 to 5; the score is the two multiplied |
| Control | For high and medium scores: a closer supplier, a certificate naming the test, your own tests |
| Review | Yearly, and when a supplier, a price or the news changes |
What you ask of suppliers first is in supplier approval program template, and keeping their certificates straight in certificate of analysis tracking.
The rules
| Rule | Where |
|---|---|
| What food fraud is | Leaving out, taking out or substituting a valuable ingredient, or adding a substance to make a food look better or worth more (FDA, economically motivated adulteration) |
| Where it shows up | Honey and maple syrup, olive oil, seafood, juice, spices; lead-based dyes found in chili powder, turmeric and cumin (FDA) |
| Hazard analysis | Hazards that may be intentionally introduced for economic gain considered (21 CFR 117.130(b)(2)(iii)) |
A very small business that qualifies for the rule's modified requirements doesn't write the hazard analysis, but a buyer's questionnaire can still ask for the assessment. This is general information, not legal advice.
An example: a Logan granola maker
Cache Valley Granola Co., the made-up granola maker in Logan, Utah, I use in these examples, got a regional chain's supplier questionnaire asking for its food fraud vulnerability assessment, and scored its granola's ingredients:
| Ingredient | What the fraud would be | Likelihood | Impact | Score | Control |
|---|---|---|---|---|---|
| Honey | Diluted with cheaper syrups; origin mislabeled | 4 | 4 | 16 High | One US packer; authenticity test on each certificate; one outside test a year |
| Ceylon cinnamon | Cassia sold as Ceylon; lead-based color | 3 | 5 | 15 High | Importer testing species and heavy metals; certificate per lot |
| Maple syrup | Cut with cane or corn syrup | 3 | 4 | 12 High | Direct from a Vermont sugarhouse; grade and lot on each drum |
| Pumpkin seeds | Origin mislabeled | 2 | 3 | 6 Medium | Importer's origin statement, yearly |
| Pure vanilla extract | Synthetic vanillin sold as pure | 3 | 2 | 6 Medium | One brand; supplier statement, yearly |
| Coconut oil | Diluted with refined oils | 2 | 2 | 4 Low | None needed |
| Almonds | Unlikely | 1 | 3 | 3 Low | None needed |
| Rolled oats | Unlikely | 1 | 2 | 2 Low | None needed |
Honey scores highest: 14% of the recipe, bought through a distributor, and known for dilution. Cache Valley moves to buying straight from one packer whose certificate of analysis names an authenticity test, and sends one jar a year to an outside lab. The cinnamon scores high on impact, since lead is a health hazard, not only a cheat. What the recipe is and what it costs is in how to make granola in bulk, and the health claim on its label in health claims on food labels.
Get the template
Download the food fraud vulnerability assessment. One sheet: each ingredient, its supplier, what the fraud would be, likelihood and impact from 1 to 5, the control, the check and how often, and the record; the score and rating fill in, and a high or medium score with no control shows in red. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
An assessment says honey gets an authenticity test. When the outside lab's result comes back bad, the questions are which lot it was, which batches it went into, and which shops got them.
How TaroStack does it
TaroStack keeps each lot's supplier, with fields of your own for its certificate and tests, and follows the lot into batches.
Suppliers and lots. Each delivery is received from its supplier with its lot, and fields of your own on the lot can hold the certificate number and the authenticity result.
Lots into batches. Each batch records the lots it used, so the honey in a given run of granola is on record.
Recalls by lot. If a lot proves faked, one recall report shows which batches it went into, what's still on your shelves, and which shops and cafés got it.
| The job | Folder | In TaroStack |
|---|---|---|
| A lot's certificate and test | A folder | Fields on the lot |
| Which batches used a honey lot | Search the batch sheets | Lots on each batch |
| A supplier's track record | Memory | Every lot from that supplier |
| Who got a bad lot | Invoices | One recall report |
Receiving, lots, batches, your own fields and recalls are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.