On this page
- What the requirement is, and why it exists
- Structuring food defense and food fraud vulnerability assessments
- Step-by-step implementation of mitigation plans and controls
- Example
- Before your audit
- Questions people ask
- Can a postharvest unit use a generic food fraud risk assessment template?
- How often must food defense and food fraud risk assessments be reviewed?
- Are food defense and food fraud requirements Major Musts under IFA v6 Aquaculture?
- Does a postharvest unit need a food defense plan if it holds a GFSI certification?
- Reference documents
The short version
- Postharvest units must implement documented risk assessments and mitigation plans for food defense and food fraud.
- Food defense systems must address threats of deliberate contamination, physical tampering, and uncontrolled site access.
- Food fraud risk assessments evaluate vulnerabilities such as counterfeit chemicals, non-food grade packaging, and raw material substitution.
- Mitigation plans and risk assessments must undergo mandatory annual reviews or updates whenever relevant operational changes occur.
What the requirement is, and why it exists
Under the GLOBALG.A.P. Integrated Farm Assurance version 6 for Aquaculture and Chain of Custody version 6.1 standards, postharvest units must maintain formal systems to mitigate deliberate threats. Section AQ 10 and Section AQ 16 establish mandatory Major Must requirements governing food defense and food fraud mitigation across primary handling, processing, packing, and storage operations. These rules apply to Option 1 individual producers operating postharvest handling units, Option 2 producer group central facilities, and subcontracted postharvest operations under Section AQ 28.
Standard food safety management systems, such as HACCP, focus primarily on preventing unintentional or biological contamination during routine production. In contrast, food defense and food fraud rules address intentional threats driven by malicious intent or financial gain. Establishing rigorous vulnerability assessments ensures that postharvest facilities protect products against intentional contamination, economic adulteration, and brand damage.
Compliance leads, quality managers, and internal auditors must treat food defense and food fraud mitigation as distinct compliance domains. Principle AQ 10.01 mandates a documented food defense plan to control malicious contamination threats, while Principle AQ 16.01 and Principle AQ 16.02 require a documented food fraud vulnerability assessment and mitigation plan. Non-compliance with these Major Must criteria prevents certification or leads to immediate certificate suspension.
Structuring food defense and food fraud vulnerability assessments
Developing a compliant risk management framework requires evaluating two separate hazard categories across facility operations. Principle AQ 10.01 governs food defense, requiring management to identify potential malicious threats, deliberate contamination, and physical tampering. The assessment must examine physical security, intake points, external storage hoppers, visitor protocols, and worker awareness training.
Principle AQ 16.01 establishes the food fraud vulnerability risk assessment, which focuses on economically motivated adulteration. Management must analyze supply chain vulnerabilities, including counterfeit chemicals, non-food grade packaging materials, species or raw material substitution, and fraudulent documentation. Under Principle AQ 17.01, producers must maintain verified specifications for all inputs and services relevant to food safety to support fraud mitigation.
Important: Both food defense and food fraud risk assessments are Major Must requirements that must be reviewed annually and customized to the specific production scope.
Step-by-step implementation of mitigation plans and controls
Implementing effective mitigation controls at a postharvest handling unit requires systematic execution across operational departments. Quality leads must coordinate with procurement, site maintenance, security, and warehouse personnel to establish verifiable safeguards. Management must follow a structured five-step implementation sequence:
- Form a multidisciplinary risk team comprising quality leads, postharvest supervisors, purchasing agents, and facility maintenance staff.
- Perform a physical site walk-through to map access control points, ice manufacturing units, chemical stores, packaging warehouses, and dispatch bays.
- Conduct written risk assessments evaluating malicious contamination threats under Principle AQ 10.01 and food fraud vulnerabilities under Principle AQ 16.01.
- Formulate and deploy documented mitigation plans establishing physical locks, supplier verification checks, emergency procurement rules, and staff awareness signs.
- Review and update both assessments annually, or immediately whenever new suppliers, packaging materials, or processing equipment are introduced.
Common finding: Auditors frequently issue Major Must non-conformances when postharvest units use unedited generic risk templates or omit annual review dates.
| Requirement | What the auditor checks | Evidence to have ready |
|---|---|---|
| Criteria AQ 10.01 | Physical security, visitor logs, intake point monitoring, and employee awareness training | Documented food defense plan, threat assessment, visitor logs, and worker training records |
| Criteria AQ 16.01 | Vulnerability identification covering counterfeit chemicals, non-food grade packaging, and substitution | Documented food fraud risk assessment customized to scope and annual review records |
| Criteria AQ 16.02 | Implementation of specific mitigation measures addressing identified supply chain fraud threats | Written food fraud mitigation plan, approved supplier lists, and packaging food-grade certificates |
| Criteria AQ 17.01 | Approved supplier specifications, emergency procurement rules, and food safety risk evaluations | Supplier specification files, approved vendor register, and emergency procurement logs |
| Criteria AQ 28.01.03 | Completion of annual internal self-assessment covering all postharvest principles and criteria | Completed internal audit checklist not older than 12 months for every postharvest unit |
Example
During an annual audit of a salmon packing facility operating as a central postharvest unit, the auditor inspected the packaging store and ice manufacturing plant. While the facility maintained a written HACCP plan, the food fraud risk assessment was an unedited generic template, and the external ice hopper lacked physical access locks. The auditor raised two Major Must non-conformances under Criteria AQ 10.01 and Criteria AQ 16.01 for unmitigated defense and fraud vulnerabilities.
To resolve the non-conformances, the quality team customized the food fraud assessment to evaluate packaging vendor certificates and fitted padlocks to the ice hopper. In addition, management delivered food defense awareness training to intake staff and updated the internal self-assessment log.
Before your audit
- Verify that documented food defense and food fraud risk assessments are reviewed and dated within the past twelve months.
- Ensure food defense plans specify physical security controls, access limits, and intake point monitoring for all postharvest facilities.
- Confirm that food fraud vulnerability assessments evaluate counterfeit chemicals, non-food grade packaging, and raw material substitution.
- Check that worker, visitor, and subcontractor food defense awareness training is documented with signed attendance logs.
- Review approved supplier lists and food-grade specification certificates for all primary packaging materials under Criteria AQ 17.01.
- Conduct and archive an annual internal self-assessment covering all postharvest principles and criteria under Criteria AQ 28.01.03.
Questions people ask
Can a postharvest unit use a generic food fraud risk assessment template?
Criteria AQ 16.01 permits using a generic risk assessment as a starting framework, but mandates that it must be customized to the specific production scope. Using an unedited template without site-specific customization results in an immediate non-conformance.
How often must food defense and food fraud risk assessments be reviewed?
Criteria AQ 10.01 and Criteria AQ 16.01 require annual reviews of food defense and food fraud risk assessments. Assessments must also be updated immediately whenever relevant operational, facility, or supply chain changes occur.
Are food defense and food fraud requirements Major Musts under IFA v6 Aquaculture?
Yes, Principle AQ 10.01, Principle AQ 16.01, and Principle AQ 16.02 are all classified as Major Must requirements. Facilities must demonstrate one hundred percent compliance to achieve or maintain GLOBALG.A.P. certification.
Does a postharvest unit need a food defense plan if it holds a GFSI certification?
Under Criteria AQ 28.06.01, maintaining a valid GFSI-recognized post-farm gate certification satisfies postharvest food safety system criteria. However, auditors still verify that site-specific food defense and food fraud mitigation plans are implemented and active during the audit.
Reference documents
- GLOBALG.A.P. Integrated Farm Assurance Smart/GFS – principles and criteria for aquaculture, v6.0_Mar23, Section AQ 10, Section AQ 16, Section AQ 17, Section AQ 28
- GLOBALG.A.P. Chain of Custody – control points and compliance criteria, v6.1_Nov22, Section CoC-SC 1.10, Section CoC-SC 1.14
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo