1. What Is Threat Assessment Critical Control Points (TACCP; PAS 96)?
Threat Assessment Critical Control Points, or TACCP, is a risk-management framework for protecting food businesses against deliberate harmful acts. It evaluates potential threats, identifies vulnerabilities, and directs proportionate controls toward the risks that matter most. Its focus is intentional interference, rather than simply accidental contamination.
PAS 96, the Publicly Available Specification associated with TACCP, provides guidance for applying this approach. For agriculture and food executives, TACCP structures a concrete decision: where should the organization strengthen protection against malicious contamination, fraud, sabotage, or disruption? Consultants can use it to connect threat assessment with control design and investment priorities.
For example, a review of fruit and vegetable operations should examine growing, packing, outsourced storage, and transport handoffs—not stop at the processing plant’s perimeter.
2. Origin and Background
TACCP’s institutional background is BSI’s PAS 96 guidance series, first published in March 2008. TACCP is explicitly documented in the 2014 edition; the series’ publication date should not be treated as proof of the acronym’s first use. The 2017 edition was sponsored by the UK Department for Environment, Food & Rural Affairs and the Food Standards Agency. A single individual inventor is not established by these sources.
The framework addresses a gap in conventional food-safety management: an intentional actor may seek to circumvent normal controls. PAS 96 extended attention to people, purchasing, distribution, and business systems.
The current edition is PAS 96:2026, published July 31, 2026. BSI describes greater emphasis on cyber-enabled threats and connected operations. Organizations maintaining older assessments should therefore review their digital dependencies as well as physical protection.
3. How Threat Assessment Critical Control Points (TACCP; PAS 96) Works
TACCP begins with the potential adversary: their motivation, capability, and opportunity. It then examines vulnerable operations, potential consequences, and measures that could deter, prevent, or detect interference. Four questions guide the logic: who could attack, how could they act, where is the business vulnerable, and what protection is appropriate?
Understanding the acronym
The letters provide a useful memory aid, not a prescribed five-stage sequence:
- T — Threat: A potential source of harm arising from deliberate human intent.
- A — Assessment: Evaluation of the threat, relevant vulnerabilities, likelihood, and consequences.
- C — Critical: Concentrating attention on priority risks rather than protecting everything equally.
- C — Control: Measures that reduce opportunities for interference or improve detection and response.
- P — Points: Locations or activities where controls can intervene, including purchasing, handling, distribution, and business systems.
A practical output is a threat register connecting each scenario to a specific operation, existing protection, evidence, risk judgment, and additional action. Use consistent likelihood and impact definitions, but retain the reasoning behind each score: an ordinal rating is not a measured probability. PAS 96 includes an illustrative risk-scoring matrix.
Recommended units of analysis include supplier–ingredient relationships, receiving activities, packing operations, custody transfers, and permissions to change production or release records. Avoid assessing an entire cooperative or product category as one undifferentiated risk.
4. When to Use Threat Assessment Critical Control Points (TACCP; PAS 96)
Use TACCP when qualifying a new co-packer, outsourcing storage, changing sourcing routes, integrating an acquisition, or preparing for seasonal workforce expansion. It is especially valuable when the decision crosses food quality, procurement, operations, personnel security, and technology responsibilities.
For foodservice distribution, useful questions include whether carrier identity is reliably verified, who owns protection at custody transfers, and how suspected interference would trigger product containment.
Useful inputs include process maps, supplier relationships, access permissions, incident records, transport procedures, and credible threat intelligence. Plan for walkthroughs and evidence checks, not just a workshop.
TACCP is not a substitute for hygiene or preventive food-safety systems. PAS 96 assumes these foundations exist. It is a poor standalone tool for ordinary spoilage or accidental contamination, and can mislead when teams invent precise likelihoods without evidence.
5. How to Apply Threat Assessment Critical Control Points (TACCP; PAS 96): Step-by-Step
The following is a practical implementation workflow, rather than a reproduction of the standard’s clause sequence.
- Clarify the decision and scope.
Define the products, sites, suppliers, transport interfaces, and digital systems covered. Specify whether management is approving controls for the next harvest season, commissioning a facility, or reviewing the wider supply network.
- Assemble the team and evidence.
Bring together food safety, operations, procurement, human resources, security, and technology specialists. Gather relevant records and inspect actual practices, including temporary arrangements and off-shift operations.
- Define scenarios and units.
Assess a plausible intentional act against a particular activity or relationship. Keep accidental failures separate. Distinguish malicious harm from deception for financial advantage, while recognizing overlapping consequences.
- Construct the threat register.
Record the scenario, motivation, opportunity, vulnerability, existing controls, evidence quality, likelihood, impact, and proposed action. Restrict access to sensitive details rather than circulating an unrestricted map of weaknesses.
- Interpret and challenge priorities.
Apply consistent definitions. Challenge unsupported low likelihoods and check whether protection actually operates. Examine consumer harm, authenticity, supply interruption, and commercial consequences separately before setting priorities.
- Design controls and implementation.
Assign owners, resources, monitoring, escalation, and completion evidence. Translate priorities into a funded risk mitigation roadmap, including changes to receiving, access management, supplier assurance, and incident procedures.
- Test alternative conditions.
Reassess during peak throughput, emergency sourcing, temporary staffing, or systems outages. Ask whether the proposed controls remain workable without compromising hygiene, worker safety, or product handling.
- Align, verify, and refresh.
Resolve ownership with growers, processors, warehouses, and carriers. Check implementation through observations and exercises. Establish review triggers for incidents, new intelligence, operational changes, and ineffective controls.
Where a facility falls under US intentional-adulteration requirements, monitoring, corrective actions, verification, training, and records must be mapped explicitly to the applicable requirements—not assumed from completion of a TACCP worksheet.
6. Example: Threat Assessment Critical Control Points (TACCP; PAS 96) in Action
Fictional example: Valley Orchard Cooperative grows member-supplied apples and pears and operates a fresh-cut packing facility. It supplies regional wholesalers and is adding an outsourced refrigerated warehouse before harvest.
The operations director selects TACCP because existing food-safety reviews address contamination hazards but do not fully examine intentional interference across the expanded network. The team assesses receiving, product handling, warehouse custody transfers, and electronic release permissions.
Walkthroughs, carrier records, and account reviews reveal three weaknesses: supervision arrangements assume a permanent workforce; carrier verification varies by shift; and release permissions remain active after role changes. The team does not equate these weaknesses with evidence of an attack. It evaluates credible scenarios and documents uncertainty.
Management approves revised onboarding, verified custody handoffs, role-based permissions, and product-containment procedures. An exercise tests whether the cooperative can identify affected lots and contact downstream customers.
For this rollout, program management support can coordinate dependencies across the cooperative, warehouse, and carriers. Success means controls work during harvest—not merely that the register is complete.
7. Strengths and Limitations
Strengths
- Sharper prioritization: It directs protection toward credible scenarios rather than uniform security spending.
- Cross-functional ownership: It brings personnel, purchasing, technology, and operations into one discussion.
- Visible assumptions: It distinguishes observed protection from management’s confidence that protection exists.
- Actionable outputs: A well-designed register connects risks with controls, owners, and verification.
Limitations
TACCP cannot guarantee protection. Assessments depend on available intelligence, and concealed misconduct may remain unknown. Published research highlights the difficulty of assessing threats that continue undetected. Treat the register as a working hypothesis, not a complete inventory of possible attacks.
In application, shared warehouses, changing suppliers, and seasonal arrangements warrant particular scrutiny. A low risk rating based on normal staffing may not survive a peak-period change. Nor does a food-safety control automatically demonstrate protection against deliberate interference.
8. Common Pitfalls and How to Avoid Them
- Scoring products instead of scenarios: “Fruit is low risk” hides differences between operations. Specify the intentional act and affected activity.
- Copying the hazard analysis: An accidental-failure assessment misses motivation and circumvention. Reassess controls from an adversarial perspective.
- Trusting paperwork alone: Documents can themselves be fraudulent. Corroborate important authenticity claims rather than accepting certificates uncritically.
- Ignoring peak conditions: Test controls against temporary staffing, accelerated receiving, and emergency purchases—not only normal operations.
- Equating testing with protection: Ask what a test detects and what it cannot establish. Combine appropriate testing with preventive controls.
- Stopping at the workshop: Require implementation evidence, named ownership, and exercises. An approved document does not demonstrate an effective defense.
9. How Threat Assessment Critical Control Points (TACCP; PAS 96) Relates to Other Frameworks
Hazard Analysis and Critical Control Points
Hazard Analysis and Critical Control Points, or HACCP, identifies and controls significant food-safety hazards. TACCP adds deliberate intent and potential circumvention. Establish effective food-safety foundations first, then examine whether existing controls also protect against intentional acts. The two assessments should inform each other without being collapsed into one.
Vulnerability Assessment Critical Control Points
Vulnerability Assessment Critical Control Points, or VACCP, is commonly associated with food-fraud vulnerability assessment. It is particularly useful for ingredient substitution, false origin claims, and economically motivated adulteration. Use it alongside TACCP when purchasing incentives and authenticity are central. The boundary is not absolute: PAS 96 also addresses fraudulent deliberate acts.
FDA’s Three Fundamental Elements approach
FDA’s approach examines potential public-health impact, physical access to product, and an attacker’s ability to contaminate it successfully. Prefer this more specific assessment when addressing covered US intentional-adulteration obligations; use TACCP alongside it for broader business threats and supply-network protection.
10. Key Takeaways
- TACCP evaluates intentional threats, not just accidental food-safety failures.
- Assess specific scenarios, operations, relationships, and custody interfaces.
- Prioritize proportionate controls with explicit evidence and ownership.
- Test assumptions against seasonal and operational changes.
- Completion of an assessment does not establish protection or regulatory compliance.
11. FAQs About Threat Assessment Critical Control Points (TACCP; PAS 96)
Does TACCP cover food fraud?
Yes. PAS 96 addresses deliberate fraudulent acts as well as malicious harm. A dedicated fraud-vulnerability assessment can deepen the analysis of substitution, misrepresentation, and financial incentives.
Is PAS 96 mandatory in the United States?
PAS 96 is guidance, not US legislation. Covered facilities must meet FDA’s applicable intentional-adulteration requirements. Using TACCP does not automatically satisfy those requirements; applicability and the resulting plan should be checked with the regulatory lead.
Can smaller farms and cooperatives use TACCP?
Yes. PAS 96 is intended for organizations across the supply chain, including primary producers and smaller businesses. Keep the assessment proportionate, while retaining clear responsibilities and access to relevant expertise.
What minimum data should a team gather?
Start with process and custody maps, supplier relationships, access permissions, existing protection procedures, and incident information. Where evidence is missing, document the uncertainty and assign a verification action rather than manufacturing a reassuring score.
