Professional Documents
Culture Documents
Food Safety Audit
Food Safety Audit
Food
Safety
Audit
Since our spin-off from PepsiCo in 1997, Yum! Brands has become a truly global company. We’re proud to be
the worldwide leader in emerging markets with nearly 17,000 restaurants, nearly twice as many as the nearest
competition. With about 2.5 restaurants per million people in the top 10 emerging markets, compared to 57
restaurants per million in the U.S., we are on the ground floor of global growth.
Importantly, we’re extremely proud of our 1.5 million associates around the globe and the unique culture we’ve
built, one that’s filled with energy, opportunity, and fun. We believe in our people, trust in their positive
intentions, encourage ideas from everyone and have actively developed a workforce that is diverse in style and
background. Yum! Brands is a place where anyone can, and does, make a difference.
Food Safety Audits (FSA) are performed in all food manufacturing facilities once per year or as determined by
the local Yum! Brands/Business Unit Quality Department. The audits may be performed by the Brand or Business
Unit QA or by third party auditors who have been selected and certified by the Yum! Brands Quality Department.
The audit format covers specific food safety and sanitation concerns. The audit evaluates the adequacy of
documentation, compliance to demonstrate procedure, effectiveness of procedures to control the process
within defined limits and the ability to implement corrective action and preventing actions plans.
The FSA was developed to specific food safety criteria required to be established within the manufacturing
facilities. The format and content of the audit are designed to allow assessment of the facility, operational
processes and systems and the demonstration of leadership and staff commitments to food safety.
Food safety is top priority at Yum! Brands and a primary focus. Our goal is to provide “Trust in Every Bite” by
maintaining an industry leading food safety program that minimizes food safety risk for our customers.
Additional information
Date: 6/28/17 Food Safety Audit
Page 3
Confidential Information — Proprietary to Yum! Brands, Inc.
Audit Strategy (Observation vs. Desk Activities) and Time
The site is expected to be prepared and meet the Yum! audit requirements each and every day of operation and to have
appropriate team members available at all times during the audit.
The audit time may vary depending on the review of the audit requirements and the complexity and preparedness of the
supplier.
The audit must dedicate ample time (approximately 50%) to verification of the supplier’s food safety and general good
manufacturing practices through physical observation in and around the facility, as opposed to ‘desk audit’ activities.
Examples include observation of work activities and processes, employee behaviors, condition of facility, environment
and equipment, interview of plant personnel, and production area records.
Legislation
It is the Yum! expectation that the supplier facility will comply with all relevant legislation and regulatory requirements
applicable to the facility and to the market of production and use, which may go beyond specific Yum! audit requirements.
It is the facilities responsibility to meet specific government/regulatory requirements (e.g. risk assessments include HACCP,
food safety plans, pre-requisite and preventative control programs.). The Yum audit is not a government regulatory audit
and is not meant to replace it.
For example if the likelihood and the severity of the hazard is high then the risk of that hazard is high. A high risk rating
would mean that urgent action is required, and regular monitoring may be needed to manage the identified risk. A medium
rating could mean that action is needed, with occasional monitoring to mitigate the risk. Actual actions required are
determined by the facility.
The below potentially useful references are provided to help the supplier in the development of their Food Fraud or
Food Defense program:
1. PAS 96:2014, Guide to protecting and defending food and drink from deliberate attack. Food Standards Agency.
http://www.food.gov.uk/sites/default/files/pas96-2014-food-drink-protection-guide.pdf
2. TACCP Treat Assessment and Critical Control, Point, A practical Guide, 2014. Campden BRI 2014.
www.campdenbri.co.uk
3. Food Defense Guide Recommendations DGAL_mai 2007, Food Defense Guidelines - Agriculture Ministery –May
2007. http://agriculture.gouv.fr/IMG/pdf/dgaln20078128z.pdf
4. The U.S. Pharmacopeial Convention (USP) Food Fraud Database. A searchable database composed of both
scientific and mainstream media reports on food fraud incidences. http://www.foodfraud.org/node
The below potentially useful references are provided to help the supplier in the development of their Food Safety
Culture program:
1. Yiannas, F. (2009). In Frank Yiannas. (Ed.), Food safety culture creating a behavior-based food safety
management system. New York: Springer, c2009.
2. Assessing Factors Contributing to Food Safety Culture in Retail Food Establishments;
http://www.foodprotection.org/files/food-protection-trends/Aug-12-Neal.pdf. This is a good reference on food
safety culture, it is geared towards retail but the principles are universal.
3. Article by Lone Jespersen. Food Safety Culture: Measure What You Treasure:
https://foodsafetytech.com/feature_article/food-safety-culture-measure-what-you-treasure/
4. Article by By Geoff Schaadt, Creating a Culture of Food Safety: http://www.foodsafetymagazine.com/magazine-
archive1/junejuly-2013/creating-a-culture-of-food-safety/
5. Best Practices for Building a Food Safety Culture; http://pgpro.com/webinars/best-practices-for-building-a-food-
safety-culture/
6. How to Create Food Safety Culture With Your Teams: http://www.foodprocessing.com/articles/2015/create-
food-safety-culture-with-your-teams/?show=all
Definitions - Non-Conformances
Foundational: critical failure or a systemic failure to comply with food safety requirements that could directly impact
human health or brand reputation:
• The Brand or BU QA department will be contacted immediately by the auditor (while still finishing the audit) to
assess current and future product production.
• This situation is expected to trigger an escalation process and prompt an immediate risk assessment by the Brand or
Business Unit QA leaders on the supplier.
Note: A foundational requirement may be scored as a P or and S according to the below definitions.
Primary: failure to comply with the requirements based on the evidence available:
• The objective evidence does not show a complete program, or the requirement is not completely being met.
• Degree of compliance warrants a lesser non-conformance to Foundational.
• Numerous instances of incomplete records.
• Significant improvement will be needed to meet expectations.
• A systematic failure to develop or implement a program
Note: A Primary requirement may be scored as an S according to the below definition.
Secondary: requirement has not been fully met but based on objective evidence food safety of product will not be
compromised:
• Single instances where an audit requirement is not being met.
• Improvements are needed to meet expectations.
• Single/isolated instances of incomplete records
• Documentation is not clearly defined.
• Degree of compliance warrants a lesser non-conformance to Primary
• The goal of this assessment is to provide a clear picture of the food facilities ability to meet food safety requirements
as set by Yum! Brands. During the assessment, auditors shall give consideration to repeat or clustered deviations
against secondary requirements to determine if these should result in Primary deviations.
Where training, testing or a program is required to be conducted/reviewed annually (12 month cycle), if it has been
more than 18 months the full non-conformance will be given, if less than 18 months but greater than 12 months the
next lesser non-conformance will be given, unless otherwise indicated.
The auditor will evaluate documented policies and procedures, past and present monitoring records and facility
conditions and practices as they exist at the time of the audit. Scoring will be based on this objective observations.
Corrective actions taken during the audit will not remove the observation nor change the scoring but will be
documented in the audit report; it is encouraged, to correct the situation immediately. Existing documentation
provided to the auditor after the conclusion of the exit meeting will not change the scoring of the audit.
Corrective actions for any non-conformance noted in this audit must be implemented and documented. Corrective
action is defined as the correction of the immediate problem as well as prevention of re-occurrence of the problem.
The above is the basic framework and requirements. The Brands and BUs can have additional audit grading criteria
requirements.
Suppliers and distributors will be selected by Brand or BU QA to participate in the Unannounced Audit Program.
Decision to participate is at the discretion of the Brand or BU QA. Unannounced audits can be conducted for routine
audits to demonstrate the maturity of the suppliers/distributors systems or selection will be based on risk
analysis/assessment (e.g., poor performance, litigation, bad press events, recall/withdrawals, financial condition,
negative history, and customer complaints).
The unannounced audit dates will be coordinated between the auditor and the Brand or BU QA department. The
supplier/distributor will be informed that they are getting an unannounced audit and will not be notified of the actual
audit date.
When will the unannounced audit be conducted? Up to 30 days (or as defined by the Brand/BU QA Dept.) before the
audit due date. For example if the last audit was done 28 Oct 2014, the unannounced audit would be conducted
between 29 Sept – 28 Oct 2015.
Will there be block out dates? Yes, program allows for a number of days (up to 5, or as defined by the Brand/BU QA) to
be blocked out from the audit as non-audited days. This is to accommodate dates where an audit would be
inappropriate (e.g. facility closures, remodels, planned customer visits etc.). Block out dates will include either five
consecutive days in one week (M-F) or a maximum of two consecutive days (M-F) dispersed weekly throughout the 30
day period. For example, a facility may block out March 16 – 20th (M-F) or they may block out two consecutive days each
week and one day on another week over the five potential weeks available in March. The supplier/distributor is
responsible to inform the auditor of the block out dates.
What if the auditor is denied access? If access is denied the site will be liable for the auditors cost per their contract
agreements. Brand or Business Unit QA will review performance for current and future production from this facility.
When does the audit start on the date of the audit? The date of the audit shall not be notified to the
supplier/distributor in advance of the audit and on the date of the audit, the audit will start no later than within 30
minutes (or as defined by the Brand/BU QA Dept.) of the auditor arriving on site.
Glossary
Alternate Minimum If a supplier's process or product makes it impossible to meet standards exactly as
Standard (AMS) written, the supplier may request an AMS from the Brand/BU QA. AMS are issued
only under extreme circumstances and only if the Brand or Business Unit QA
department agrees that the AMS are warranted. The document shall be signed by
appropriate Yum! Brands QA contact then forwarded to the supplier. All alternate
minimum standards must be maintained on file at the supplier and updated at a
minimum of annually. Alternate Minimum Standards received the day of the audit
will not count for the current audit, but will be included in future audits.
Verification Those activities, other than monitoring, that determine the validity of the HACCP
plan and whether the system is operating according to the plan.
1.2 Documented Risk Assessment available for all finished products/ingredients, packaging, environmental
concerns, equipment and processes. Risk assessments include:
(Procedure/Records)
1.2.1 What is the food safety risk (e.g. foreign material, allergen, illness, injury etc.) P
1.2.2 Assessment of risk; likelihood and severity of occurrence P
1.2.3 Communication to Brand/BU QA, the below are examples, but not limited to: P
1.2.4 Reviewed at minimum annually or when any of the following occur, but is not limited to: P
o Change in ingredients and/or recipe
o Change in processing conditions, process flow or equipment
o Updated or new processing line for Yum! products since last Yum! audit
o Change in food contact packaging, storage or distribution conditions
o Change in consumer use of finished product
o Emergence of a new risk (e.g. known adulteration of an ingredient)
o Responding to customer complaint reviews to prevent reoccurrence
o Following a recall/withdrawal
o New developments within industry including scientific information associated with ingredients,
process or product
HACCP system implemented for the identification, evaluation, and control of food safety hazards. The program
shall be based on the seven principles:
Principle 1: Conduct a hazard analysis
Principle 2: Determine the critical control points (CCPs)
Principle 3: Establish critical limits
Principle 4: Establish monitoring procedures
Principle 5: Establish corrective actions
Principle 6: Establish verification procedures
Date: 6/28/17 Food Safety Audit
Page 12
Confidential Information — Proprietary to Yum! Brands, Inc.
Principle 7: Establish record keeping and documentation procedures
2.2 All information needed to conduct the hazard analysis (Principle 1) are identified, documented and reviewed;
information shall include but is not limited to:
(Program/Record/Observation)
2.2.1 Historical hazards associated with raw ingredients, processing and food contact packaging P
2.2.2 Understanding and documentation of relevant factors that influence bacterial growth, potential chemical,
and physical hazards that are associated with the raw ingredients and specific processed food products P
2.2.3 Identification of scientific approach used to determine critical limits and these limits are clearly
understood and documented P
2.2.4 Hazard analysis completed for each process stage on the process flow chart (including rework, allergens,
foreign material, antibiotic and other additives, if applicable) P
2.2.5 No contamination with biological, chemical or physical hazards is observed F
2.2.6 No potential contamination with biological, chemical or physical hazards is observed P
2.4 Evidence that control measure selected and critical limits identified (Principle 3) are capable of consistently
controlling the hazard. Evidence shall include:
(Program/Records)
2.4.1 Critical limits are established and validated as necessary to mitigate risk P
2.5 CCPs are monitored (Principle 4) according to documented procedure with appropriate action(s) taken and
recorded (Principle 5) if CCP tolerances are exceeded. Requirements include:
(Procedures/Records/Observation)
2.5.1 CCPs shall be monitored with the frequencies and methods indicated in the HACCP program P
2.5.2 Review of records, where acceptable limits have not been achieved, corrective actions for issues found
are on file P
2.5.3 Assess that corrective actions were effective (i.e. corrective actions address root cause) P
2.6 Verification procedures (Principle 6) and record keeping and documentation procedures (Principle 7) are
established
(Procedures/Records/Observation)
2.6.1 Defined verification methods/procedures used to determine that the HACCP system is in compliance are
established and critical limits are verified P
2.6.2 Record keeping and documentation is sufficient to demonstrate the HACCP controls are established and
effective P
2.7 The HACCP plan (s) shall be developed and managed by qualified staff and shall include:
(Records/Observation)
2.7.1 Identification of persons responsible for conducting the internal HACCP review S
2.7.2 The lead individual who is responsible for the maintenance and updating of the HACCP program has had
formal HACCP (or PCQI) training P
2.7.3 Employees managing/monitoring CCPs are aware of CCPs and the critical limits in their area(s) and what
2.8 A program is established to review existing HACCP plans and any changes that impact Yum! Brands products are
communicated to Brand or Business Unit QA. Records and corrective actions are available and include:
(Procedures/Records/Observation)
2.8.1 Documented review of HACCP plans by the HACCP team annually including a revision history P
2.8.2 Review of HACCP plans prior to any changes based on food safety risk assessment in section 1.2 P
2.8.3 Changes to HACCP programs that impact Yum! Brands products or are in conflict with existing
specifications shall be approved by Yum! Brands QA prior to implementation P
2.9 Documented food allergen program that identifies allergens in raw materials and finished products and defines
the control of the allergens is established. At a minimum, the following food allergens must be addressed: peanuts,
soybeans, milk, eggs, fish, crustacean, tree nuts, and wheat. Additional allergens required by local requirements /
regulations of both the country of manufacture and the country of destination must also be included. Control
methods are effective and include the following:
(Procedure/Records/Observation)
2.9.1 Procedures are established to manage food allergens in the facility P
2.9.2 Risk assessment determined for all ingredients including an established allergen list P
2.9.3 Annual training on allergen handling practices and control, including spill management S for single
incident and P for more than one
2.9.4 Where an allergen is present in the final product, there is verification that the allergen is listed on the
ingredient label, including any allergens that are present in the facility and are a potential cross-
contact/cross-contamination risk P
2.9.5 Ingredient weighing/handling/storage practices and processing order or change over procedures
specifically address ensuring allergens are not transferred to a non-allergen containing product/other
allergen products P
2.9.6 Sanitation procedures and practices do not allow cross contact of allergens to non-allergen /other
allergen products P
2.9.7 Cross contact of an allergen to a non-allergen product or ingredient and/or cross contact of an allergen to
another allergen product or ingredient F
3.2 Leadership and employees are aware of the food safety policy (e.g. do they know where the food safety policy is
and can explain it).
Date: 6/28/17 Food Safety Audit
Page 14
Confidential Information — Proprietary to Yum! Brands, Inc.
(Observation)
3.2.1 Interviews with leadership verify understanding of the food safety policy P
3.2.2 Employees verify understanding of the food safety policy S
3.3 Methods and responsibilities related to Food Safety Culture are defined and shall include:
(Program/Records)
3.3.1 Policy/program on leadership responsibilities in support of Food Safety Culture is established P
3.3.2 Senior management reviews results (within 30 days) of internal Yum! self-audit and all external food
safety audits S for single incident and P for more than one
3.3.3 Ensures all identified food safety non-conformities in the above audits are effectively addressed to
prevent reoccurrence S for single incident and P for more than one
3.3.4 Defined tools used to measure the facilities food safety culture (e.g. employee food safety culture
surveys, other employee feedback gathering mechanisms) and follow-up actions needed S
3.3.5 If completed by Brand/BU QA, was progress made to the Yum Food Safety Culture & People Capability
Assessment little or no progress score S
3.3.6 Whistleblower procedures are established in support of food safety S
3.3.7 Reviewed annually by senior management S
3.4 There shall be evidence that significant food safety performance metrics (e.g., environmental analysis,
operators hygiene measures, microbiological analysis/ pathogen testing on products, identification of food safety
risk /zones, customer complaints) are:
(Procedures/Records/Observation)
3.4.1 Communicated and reviewed with appropriate staff S
3.4.2 Used to assess the facilities overall food safety performance strategy S
3.5 Procedures are established for conducting internal assessments on the Yum! Food Safety Audit. There is an
established link between associated supplier documents and the Yum! FSA audit requirements. Procedures shall
include:
(Procedures/Records)
3.5.1 Supplier has established a link, which describes the location of manuals, procedures and
records needed for each element in the Yum! Brands FSA audit S
3.5.2 Assessing each element of the Yum! FSA audit S
3.5.3 Conducted by a qualified auditor P
3.5.4 Corrective actions/plans are defined for all non-conformances S
3.5.5 Conducted at minimum annually P
Note: If the Brand/BU QA has accepted a GFSI recognized audit instead of the Yum FSA audit, the Yum FSA
internal assessment requirements above are still required.
3.6 All corrective actions from previous FSA Yum! Audit have been addressed.
(Records/Observation)
3.6.1 Primary nonconformance corrective action implemented or completed within the
time frame allotted P
3.6.2 Secondary nonconformance (s) corrective actions implemented or completed within the time frame
allotted S
Note: In this situation multiple audit questions could be marked down for the same finding.
Note: Complaint analysis and resolution should drive continuous improvement of the food safety culture. Customer
complaints, identification of trends, or complaints such as illness or foreign material complaints should drive a
deeper analysis to create effective corrective actions.
4.4 Food Fraud and Food Defense programs will be kept updated.
(Program/Records)
A self-audit program to review food fraud and food defense shall include:
4.4.1 Who is responsible for conducting the internal review S
4.4.2 Conducted at least annually and reviewed by management P
4.4.3 Corrective actions with timelines are developed to address areas of improvement P
⑤ Pest Prevention
Facility will have an effective preventive pest management program established to minimize the risk of
intrusion or infestation.
5.1 Supplier will have a documented pest control program with service provided by an approved Pest Management
Professional (PMP).
(Program/Record/Observation)
5.1.1 Supplier will have a documented pest control program F
Pest control program shall include:
5.1.2 The company name and designated pest management professional S
5.1.3 Company required licenses, certifications, insurance, and other permits as required by government
agencies to perform services S for single requirement and P for more than one
5.1 4 Types of pests being monitored and/or controlled P
5.1.5 Minimum of monthly inspections, and more frequent as necessary depending on risk factors P
5.1.6 The number and placement of traps shall be effective to control pests and mitigate risk of entry into
facility S for single incident and P for more than one
5.1.7 Updated certification of pest control operators as per local regulation. Note: In countries where there is
no local regulations, the supplier shall furnish documentation that pest management professional has
formal and ongoing training S
5.1.8 Updated contract on scope of service maintained S
5.1.9 How all traps, bait station, glue boards and insect glue light traps, etc. shall be labelled with date of
inspection P
Date: 6/28/17 Food Safety Audit
Page 17
Confidential Information — Proprietary to Yum! Brands, Inc.
5.1.10 Schematic map is current and dated S
5.1.11 Pesticides in use must be documented and approved for use by the relevant authority P
5.1.12 Safety Data Sheets (SDS) and product labels are available for all chemicals used S for single incident and P
for more than one
Service reports including logs are current and available for review, and include:
5.1.13 Date of service S
5.1.14 Application method used S
5.1.15 Chemicals, quantities and concentration used S for single requirement and P for more than one
5.1.16 Signs of pest activities P
5.1.17 Scheduled follow up based on pest activity, if necessary S
5.1.18 Corrective actions and recommendations are documented for frequency of activity or other issues
noted on service reports or may be listed on a separate report S for single requirement and P for
more than one
5.1.19 Individual conducting service S
5.1.20 Evidence that reports are being reviewed by the facility S
5.1.21 Trend analyses are on file for all types of pest being controlled/monitored S
5.1.22 Corrective actions are documented P
5.1.23 If pesticides are stored in the facility, they shall be secured in such a manner as not to contaminate
product, packing materials or equipment P
5.1.24 Pest control devices are effectively maintained S
5.1.25 No loose or granular rodenticide is approved for use. Bait stations (with poison bait) shall be used
outside the facility P
5.1.26 Pest control devices are located in such a manner as not to contaminate product, packaging materials or
equipment (e.g. insect light traps that use an electric grate to electrify flying insects (Insectocutors) are
not allowed if they create a risk) P
Note: Any live insect activity is an issue and should be graded accordingly. Insects should be at a very minimum on
glue boards. Active cobwebs with spiders are considered pest activity; however, old and dusty cobwebs are
evidence of poor housekeeping and should be scored in section 9.7 and should not be scored as pest activity
6.4 Supplier has established an outer garment program for persons working in direct contact with food, food
contact surfaces or food contact packaging materials.
(Program/Records)
The program shall include:
6.4.1 Employees must wear a clean outer garment that remains within the work area (does not go to and from
work) P
6.4.2 Dedicated footwear/shoe covers or foot baths will be utilized to prevent the introduction of contaminates
P
6.4.3 Where foot baths are used, they must be cleaned and free of particulates, dirt and debris and changed
often enough to keep the sanitizer concentration in the acceptable range P
6.4.4 Policy relating to the wearing of outer garment inside the processing area or away from the production
environment (e.g. removal before entering restrooms) P
6.4.5 Clothing and footwear and PPE worn by staff, visitors and contractors entering the food handling areas or
moving between low and high risk areas shall be maintained, stored, laundered (changed at least daily or
more frequent as needed) and worn so as not to present a contamination risk to products P
6.4.6 The design and condition of outer garment should be to prevent contamination of the product; as a
minimum containing no external pockets above the waist or sewn-on buttons S for single incident and P
for more than one
6.4.7 For non-disposable items (e.g. , gloves/aprons/hard hats/PPE) the condition and frequency for the
cleaning and changing shall be established S
(Observation)
• The auditor will verify the above and for finding (s) assign a nonconformance as noted in the requirement
6.6 Staff facilities shall be sufficient for the required personnel and be designed and operated to minimize the risk of
product contamination.
(Observation)
Staff changing rooms
6.6.1 Provided to enable staff and visitors to change into and out of outer garment and footwear as required P
6.6.2 Staff to keep their street clothing and personal items (including medications and cell phones) separate
from food processing and packaging areas. Cell phone use permitted if allowed by company policy and
poses no food safety risk S for single incident and P for more than one
Restrooms
6.6.3 Shall not open directly into production or packaging areas P
Lunch room/canteen
6.6.4 Maintained away from the food processing areas and shall be ventilated and have adequate lighting S
6.6.5 Shall be kept clean, organized and free from waste materials and pests S
6.6.6 Food is not stored outside of designated areas, including staff changing rooms S
6.6.7 Where eating of food is allowed outside during breaks, there shall be designated areas with appropriate
control of waste and pests S
7.2 The Foreign Material program will identify and control known internal plant risks associated with, but not
limited to, the following:
(Procedures/Records/Observation)
7.2.1 Assurance of zero wooden pallets throughout the processing area where exposed product is handled.
Wooden pallets are allowed in raw material and finished product storage areas S
7.2.2 Wood pallets used in other areas shall be of good quality and inspected. Pallets will have no exposed
nails, broken slats, splinters or debris that could cause product contamination or damage S
7.2.3 Metal detector or x-ray/imaging devices are required unless otherwise approved by Brand or Business
Unit QA based on risk assessment. The absence of metal detection or x-ray/imaging equipment will be
based on risk assessment and the use of effective alternative methods (e.g., liquids pass through a fine
mesh screen, or free-flowing product passes through magnets, filters, sieves other physical separation
equipment/technology) F
7.2.4 Screens, magnets and other approved alternative methods are regularly monitored with results and
corrective actions recorded P
7.2.5 For metal detectors and x-ray/imaging devices, verification of sensitivity is conducted by passing the
required standards, using ferrous, non-ferrous and stainless steel test pieces of the appropriate size,
based on the below table or as approved by Brand/BU QA. P
Metal type Fresh and bulk Pre-washed pre- All other products which do not
frozen poultry chopped produce fall into the first two categories
Ferrous 3.00mm 2.5mm 1.5mm
Non-ferrous 3.5mm 3.0mm 2.0mm
Stainless steel (316 4.5mm 3.5mm 2.5mm
grade)
7.2.6 Unless other methods are approved, metal detection and x-ray/imaging device systems testing must be
conducted at a minimum at start-up, at production breaks, after maintenance and when changing
products and end of shifts / production S for single incident and P for more than one
7.2.7 Whenever possible, the foreign object detection verification procedure shall specify physical
placement/location for the FO standards to simulate the conditions of least sensitivity. For example, if a
metal detector is least sensitive in the center of the aperture, this should be taken into consideration in
the placement of the metal standard P
7.2.8 Whenever possible, verification of sensitivity is conducted by passing each required standard three times
each in the normal flow of the product with the standard at the leading, middle, and trailing edge of the
product. The metal detector must detect and positively reject product with the standards S for single
incident and P for more than one
8.2 Micro and analytical testing program requirements are documented and shall assure the following:
(Procedures/Records/Observation)
8.2.1 Inbound raw materials are tested based on risk assessment and applicable Yum! minimum requirements
(e.g., QAP, specifications, antibiotic residue) at the specified frequency P
8.2.2 Hold and release program established (inbound raw materials and finished products) P
8.2.3 A documented EPTP program is established which conforms to Yum's requirements regarding microbial
analysis specific to the plant environment and products being manufactured F
8.2.4 EPTP frequency of testing shall be conducted per the Yum program P
8.2.5 Finished product pathogen testing (where applicable) conforms to Yum requirements for specific
microbial targets and frequency of testing F
8.2.6 Other finished product testing conforms to Yum requirements P
8.2.7 Water, ice and steam (that comes into contact with ingredients or finished product) shall be potable and F
8.2.8 With adequate protection through filtration (10 micron or < unless to be used at point of use or
earlier in the flow or as otherwise approved by Brands/BUs) and backflow prevention P
8.2.9 Water tested at minimum annually (must be drawn from inside the plant from different points of use),
supplier shall test for: P
o Heterotrophic Plate Count
o coliform
o E. coli (not necessary if none detected on coliform count)
o Nitrates/Nitrites (products affected by Nitrates/Nitrites, example: required for poultry)
o heavy metals: lead and mercury
o off flavors and odors
Note: Dry plants are required to test water (e.g. for hand washing purposes).
Date: 6/28/17 Food Safety Audit
Page 24
Confidential Information — Proprietary to Yum! Brands, Inc.
8.2.10 Micro and analytical testing program is reviewed at minimum annually, or more often (e.g. based on risk
assessment, customer complaints, new risk identified, etc.) by senior management S
8.2.11 A documented system for controlling of out of spec results for raw materials, in process product and
finished product is established P
8.2.12 Products temperatures at receiving, storage and loading are monitored and documented and meet the
required specifications S for single incident and P for more than one
8.3 Laboratories and testing methods are licensed/approved with documented training of lab personnel.
(Procedures/Records/Observation)
8.3.1 Laboratory testing must be in accordance with approved methods such as AOAC, FDA/BAM, or
equivalent, unless otherwise approved by Brands/BUs P
8.3.2 Procedures and practices are established to prevent any cross contamination between laboratory and
production facility P
8.3.3 Laboratory and testing equipment is clean and well-maintained S for single incident and P for more than
8.3.4 No eating, drinking or smoking allowed and no food, beverages or personal items stored S
8.3.5 External testing is done by an ISO 17025 accredited 3rd party laboratory P
8.3.6 In house micro testing is conducted by appropriately trained individuals: S for single requirement and P
for more than one
o With ongoing verification (i.e. proficiency testing with positive and negative controls). Note: there
are non-viable positive control options available
o Trained by a qualified individual (e.g. a microbiologist or equivalent through experience)
8.3.7 Records are on file and available which establish scientific basis for finished product shelf-life S
8.3.8 Any pathogen non-conforming micro for finished product for Yum! Products are fully documented and
communicated immediately to Yum! with a documented hold policy and corrective action plan F
8.4 Procedures are established for the calibration and accuracy of "key" measurement equipment and testing
equipment for labs, QC and manufacturing process, including schedules and reference standards.
(Procedure/Records/Observation)
8.4.1 Program identifies all food safety critical equipment and defines equipment that must be
calibrated and functioning for production S for single incident and P for more than one
8.4.2 Food safety critical equipment is calibrated and verified prior to placing back in to production
S for single incident and P for more than one
8.4.3 Procedure for the disposition of affected product if calibration fails P
8.3.4 Documenting methods and frequency of calibration and appropriate reference standards S
Note: key measurement equipment that is important food safety will be included (e.g. metal detection and x-
ray/imaging, pH equipment, thermometers etc.).
(Observation)
9.1.5 Segregating raw and fully cooked/ready to eat production areas (this may be a physical barrier or other
means of controlling foot and equipment traffic patterns. A simple chain or rope does not qualify as a
barrier since it can be easy crossed by employees F for actual contamination, P for potential
9.1.6 Repairs and equipment modifications are professionally completed without the use of string, tape, wire
or other improvised materials and in a manner to prevent potential contamination. P
9.1.7 Temporary repairs may be needed to complete the shifts production run and shall not pose a risk to food
safety. Repairs of this nature are acceptable as long as the repairs are labeled with date and time with
defined completion for repair indicated. S
9.1.8 Protection of equipment and product (within production) adjacent to maintenance and construction
activities P
9.1.9 Food grade lubricants are used where needed and stored separately from non-food grade
chemicals/materials S for single incident and P for more than one
9.4 Sanitation employees are trained on each task that they perform.
(Procedure, Records)
9.4.1 Sanitation procedure/SOPs used to conduct the training S for single incident and P for more than one
9.4.2 On-the-job training/other methods of training available for each employee, when applicable S
9.4.3 Training is completed annually and records are maintained S for single incident and P for more than one
9.5 A documented pre-operational inspection program is established to assess sanitation effectiveness and line
conditions (e.g. condition of belts, blades) prior to startup of production.
(Procedure, Records, Observation)
9.5.1 Pre-operational inspections documented and verified S for single incident and P for more than one
9.5.2 Deficiencies are addressed and records are maintained before production start-up P
9.5.3 Corrective actions are documented P
9.6 Facility plan to address tools and container cross-contaminations is documented/posted, implemented and
understood by employees.
(Procedure/Observation)
9.6.1 Facility program to address tools and container cross-contamination is established P
9.6.2 Tools and containers observed are used properly according to facility plan S for single incident and P for
more than one
9.6.3 Tools and containers are color coded or labeled to easily document use for food contact, non-food
contact, rework, trash, bottles, etc. S
9.7 Interior/exterior facility cleanliness and all areas are properly maintained to prevent possible product
contamination and to protect product integrity.
(Records/Observations)
9.7.1 At minimum monthly facility housekeeping inspections (including production areas, non-production areas
and surrounding grounds) are established. Records are maintained S for single incident and P for more
than one
9.7.2 Floors, walls, drains, equipment, and ceilings are clean; facility kept clean and litter free S for single
incident and P for more than one
9.7.3 No product, product contact surfaces, or product packaging material contamination observed F
9.7.4 No potential product, product contact surfaces, or product packaging material contamination observed P
9.7.5 Trash receptacles are emptied frequently to prevent overflow and kept in sanitary condition with no
offensive odors S for single incident and P for more than one
9.7.6 Chemical storage areas are segregated, clean, organized and secured S for single incident and P for more
than one
9.7.7 No condition exists which could deposit airborne contaminants S
9.7.8 Walkways and ladders over product conveying belts or open bins of ingredients are shielded with kick
plates to prevent contamination P
9.7.9 Idle equipment stored in a clean condition and manner so as to not encourage rodent/pest activity or
harborage S
9.7.10 No weeds, tall grass, or idle equipment stored within the immediate vicinity (20 feet / 6 meters) of the
building. Trees shall be appropriately trimmed to eliminate access by rodents/animals S
9.7.11 No standing water (consider recent rains) / any drainage issues or issues with down spouts are addressed
here S
⑩ Supplier Approval
The supplier will have an effective supplier approval and monitoring system to ensure that any potential
risks from raw materials (including packaging) to the safety, authenticity, legality, brand integrity and
quality of the final product are understood and managed.
10.1 A current approved ingredient & packaging supplier list is available for each production facility and will include:
(Procedure/Records)
10.1.1 Emergency contact (at minimum two) details available (name, phone and email) S for single incident and
P for more than one
10.1.2 Site address S
10.1.3 Products supplied P
10.1.4 Current list and location of outside storage and cross dock facilities being used for finished product P
10.2 Supplier approval will be based on risk assessment including risk classification which shall include but is not
limited to:
(Procedure/Records)
10.2.1 HACCP P
10.2.2 Identification of allergens processed on the same lines, and/or facility P
10.2.3 Food Fraud & Food Defense program review including vulnerability assessment for items provided P
10.2.4 Supplier food safety culture (e.g. programs, methods and responsibilities related to Food Safety Culture)
S
10.2.5 Effective traceability system established P
10.2.6 Foreign material mitigation program P
10.2.7 Visibility of the supply routes P
10.2.8 Supplier/3rd party food safety audit report (for the producing plant) P
10.3 Monitoring the performance of raw ingredients and packaging suppliers can be demonstrated and shall
include but is not limited:
(Procedure/Records)
10.3.1 Certificate of Analysis (COA) /internal testing for key parameters within an ingredient P
10.3.2 Product must be fully inspected upon arrival for any quality defects, presence of insects or any other
foreign material contamination, with all incidents investigated, recorded and effectively actioned P
10.3.3 Receiving procedures include sanitation and condition of the carrier, and requirements for accepting
incoming materials P
10.3.4 Transportation of any other foods, packaging and/or other materials in these trailers/bulk containers will
ensure no contamination risk P
10.3.5 Complaints/non-conforming product P
10.3.6 Supplier performance reviews done at least annually P
10.3.7 Corrective action taken and recorded P
10.4 Specifications will be on file for all ingredient & packaging products used in manufacturing on site. These will
include as appropriate , but is not limited to:
(Procedure/Records)
10.4.1 Regularly reviewed, at minimum annually, or when ingredient and packaging changes occur P
10.4.2 Microbial tolerances P
10.4.3 Physical parameters P
10.4.4 Chemical P
10.4.5 Allergen P
10.4.6 Quality e.g. organoleptic tolerances P
10.4.7 Food contact packaging is food grade P
10.4.8 Any other necessary requirements as required by Yum to mitigate food safety risk P
10.4.9 Approved by the supplier QA P
10.4.10 Review and amendment history / log available P
⑪ Traceability
Supplier at any given time will be able to trace 100% of the raw and finished products through all stages
of the process from point of material receiving through shipment to first external customer within a 2-
hour timeframe.
11.1 The supplier will be able to demonstrate through systems, procedures and associated documentation they are
able to trace 100% of all products produced.
(Procedure/Records/Observation)
11.1.1 Shall have a traceability program established F
11.1.2 Includes one back and one forward trace for all food products, primary packaging, semi processed
product, rework, processing aides and non-conforming product P
11.1.3 For fresh produce and animal protein foods the supplier, in addition, can trace back to its origin (e.g.
field/farm) to the first external customer (s) P
Date: 6/28/17 Food Safety Audit
Page 29
Confidential Information — Proprietary to Yum! Brands, Inc.
11.1.4 In addition, for bulk ingredients such as products stored/received in silos, the supplier shall at minimum
be able to provide all the lots and quantities that were stored in that silo since the last detail clean up
(silo was emptied and cleaned) within 2 hours P
11.1.5 Raw ingredients, food contact packaging, product in process and finished product are sufficiently labeled
(bar-code system may be used) to allow full traceability of the process P
11.2 The supplier will have a crisis team to deal with any withdrawals and recalls and can demonstrate:
(Procedure/Records/Observation)
11.2.1 Outline of responsibilities for individuals in the suppliers crisis team S for single incident and P for more
than one
11.2.2 Have access to and confirm annual management training of the Yum Brands Crisis Management Program
(see Yum! reference site on Crisis Management) – may be verified by print-out and sign-off sheet P
11.2.3 A minimum of two current supplier emergency contacts are listed in the plant profile on the Yum system
P
11.2.4 Have the current Brand/BU QA contacts P
11.3 Has a documented recall/product withdrawal procedure which includes as a minimum the following elements:
(Procedure/Records)
11.3.1 Procedures to identify, track and locate 100% of an identified product by code date/Use By Date within a
2 hour period wherever its location within the supply chain P
11.3.2 The reconciliation and disposition of recovered product P
11.3.3 Notification of Brand or Business Unit QA by telephone within two hours of incident discovery (leaving a
message on voicemail or sending a fax without personal contact is not acceptable) P
11.3.4 Decision protocol defining when and if a regulatory agency will be notified P
11.3.5 Reporting any media or regulatory officials contact to Yum! Immediately and delaying any contact with
media or regulatory officials, unless required by law (either in person or through statements), until
consultation with Yum! Crisis Core Team P
11.3.6 Replacement of the affected product at the restaurant level and responsibility for all documentation
regarding reconciliation of quantities shipped, recovered, replaced and/or destroyed S
11.3.7 All recalls/withdrawals will be documented with outcomes, root cause analysis, corrective actions, and
learnings recorded P
11.3.8 Will have retained samples which can be used for inspection as required by Brand/BU QA P
Note:
First external customer (defined as the first customer outside control of supplier) can be:
• A distribution center that distributes directly to Yum! restaurants
• Consolidator distribution centers who distribute to distribution centers
• Yum! approved supplier which uses the product as a raw ingredient
• An export facility that will export the product to another country
Freight forwarding warehouses contracted by the supplier are considered to still be in the supplier’s control and are
not the First External Customer.
11.5 Auditor verifies supplier can identity, track and locate 100% of raw materials used in Yum! Brands product to
finished lots. Auditor will select a single raw food ingredient or a food contact packaging material and ask the
supplier to trace it to finished products lots to first external customer. For fresh produce and animal protein foods
the supplier, in addition, will trace back to its origin (e.g. field/farm).
(Records/Observation)
11.5.1 >99.5% or <105% of the ingredient or food contact packaging material selected must be traced to
finished product P
11.5.2 100% of the finished product lot selected shall be traced to first external customer P
11.5.3 Trace completed within >2-4 hours S
11.5.4 Trace completed >4 hours P
Note: If the supplier uses a theoretical loss (shrink/yield) calculation for ingredients due to processing, this
calculation must be completed prior to the test during the audit.
⓭ Dairy Module
Supplier will have a risk-based dairy (milk, cheese and other dairy based foods) sourcing, transportation,
processing and cold chain management program designed to mitigate risk of micro, foreign material,
physical and chemical contamination.
13.1 A Farm/Inbound Material Program is established for Yum products and includes:
(Procedures/Records/Observation)
13.1.1 Dairy transferred in structurally sound, clean, sanitized bulk tank containers (e.g. milk) P
13.1.2 Trailers and transport containers maintain required temperature controls P
13.1.3 Microbiological and analytical testing for dairy products is conducted as required (e.g. regulatory,
QAP, specification, etc.) P
13.2 The Dairy program will incorporate all Yum! required risk mitigation steps as follows:
(Procedures/Records/Observation)
13.2.1 Food Safety hazards to be accounted for during hazard analysis will include but are not limited to: one
missing is a P, more than one F
o Biological
Bacterial pathogens
Viruses
Parasites
Fungal toxins
Human & animal health issues that may create adverse consumer perceptions or disrupt
supply chain (e.g., foot and mouth disease)
Prions for beef
o Chemical
Residues (i.e., veterinary drugs, antibiotics, additives, pesticides, sanitizers)
Heavy metals (i.e., lead, cadmium, mercury, arsenic)
Radionuclides (i.e., Strontium-90, Cesium-137, Iodine-131) ), as applicable if sourcing from
affected areas
o Physical
Extraneous animal matter (e.g., hair, fecal material, filth etc.)
Foreign material (e.g. metal, hard plastic, etc.)
13.2.2 Specific to dairy industry, the hazard analysis will consider economically motivated intentional
adulterants (food fraud) such as added materials, addition of toxic substances or dilution P
13.2.3 Dairy products shall be kept refrigerated at the temperature specified in the plant HACCP/ prerequisite
program P
13.2.4 Dairy products will be used within the specified shelf life as determined by the HACCP program P
13.2 5 Only dairy products produced from pasteurized milk will be used. In any case where unpasteurized dairy
Date: 6/28/17 Food Safety Audit
Page 32
Confidential Information — Proprietary to Yum! Brands, Inc.
is considered, a risk assessment is required and use shall be approved by the Global Food Safety Council
F
13.2.6 Each area of the plant must be maintained/recorded at the temperature specified in the plant HACCP/
prerequisite program P