TESCO FOOD MANUFACTURING STANDARD

TESCO FOOD MANUFACTURING STANDARD Version 6 Tesco Group Quality

This page is intentionally blank

Tesco Food Manufacturing Standard Author: Daniel Kingdon Product: Food Date Issued: November 2007 Owner: Daniel Kingdon Applicable to: All food except raw produce (see TPPS) Date Revised: March 2015 Document No: 20347 Country: Group Revision Due: March 2017 Tesco Stores Ltd. All Rights Reserved. This document is supplied by Tesco for use of the immediate recipient

Contents Section Page 1. Introduction i 2. Scope i 3. Key changes i 4. The sections and layout ii 5. Clause scope definitions iii 6. Auditing of the Standard v 7. Review v 8. Training v The Standard 1 Glossary 78 Appendix 80 The Standard Section/sub-section Page Management systems 1. Management commitment and control 1 2. Food safety, HACCP and quality management 3 3. Raw material, packaging and outsourced process supplier management 8 4. Product development 11 5. Finished product specifications 13 6. Customer complaints, product withdrawal and recall, and incident management 14 Facilities 7. External areas and site security 17 8. Design and construction of premises 19 9. Design and construction of equipment 23 10. Employee facilities and personal protective equipment 25 People management 11. Training 32 12. Personal health and hygiene 34 13. Ethical trading and agency labour 39 Operational controls 14. Process control 42 15. Traceability 49 16. Foreign object control and detection 51 17. Calibration and verification 56 18. Weight, volume, size and count control 58 19. Product labelling and coding 60 20. Product inspection and analysis 62 21. Environment, water and waste management 63 22. Operational hygiene 66 23. Cleaning programme 69 24. Pest management 72 25. Maintenance 75 26. Transport 77

1. Introduction Welcome to version 6 of the Tesco Food Manufacturing Standard (TFMS). This standard has been developed to outline the requirements to which manufacturers must comply in order to begin supplying, and thereafter continue supplying Tesco, either directly or indirectly. The standards support our commitment to ensuring all Tesco brand products are safe, meet legal requirements, and always meet customer expectations with respect to quality, provenance and responsible sourcing, building trust in the Tesco brand and supply chain. This version builds upon Tesco s approach of ensuring that standards can be applied in a way that manages risk and grows capability. It is intended to be interpreted by our suppliers across the world, in a way that allows individual sites to put controls in place that are appropriate to them and their industry, and proportional to the risks specific to their products, their processes and their site environment. Full application of the standards will support suppliers in driving improvement, a reduction in non-conforming products, and therefore help to reduce waste and cost. The review was undertaken by a global working group led by the Tesco Group Quality Technical Policy and Standards team and included technical managers, auditors and suppliers from the entire Tesco business and supply chain, and has utilised feedback and commentary received from both the global working group and wider consultation. Tesco wishes to acknowledge all the experts who have contributed to the preparation of this standard. 2. Scope TFMS can be applied to food manufacturing operations supplying, or intending to supply, Tesco at any stage of the supply chain. The scope does not include packing operations handling unprepared fresh produce as these are included in the scope of the Tesco Produce Packing Standard (TPPS). In some instances the TFMS will refer you to a separate Tesco Requirements for Suppliers document (formerly known as Codes of Practice ). These documents contain more detail relating to Tesco expectations against a specific subject (e.g. foreign object detection). Compliance to TFMS or any separate Tesco Requirements for Suppliers does not replace the need for compliance to relevant legal standards in the country of manufacture or the intended country of sale. 3. Key changes This is the first full review for 2 years and you will find that TFMS has a fresh look, fewer clauses, which have been written using language that is both translatable and easy to understand, whilst maintaining the aim of the clause. Some clauses have been moved between sections to create a structure that is more aligned to the arrangement of quality management systems, and factory process and people flows. For example, packaging supplier approval is now included in Raw material, packaging and outsourced process supplier management. Other clauses have moved to align with the area of risk, for example, glass breakage requirements have moved from Building fabric to Foreign object control and detection. Duplication and overlap of requirements has been removed to ensure our expectations are clear, for example, Allergen control has been built into Process control which now includes requirements where material segregation is required for any reason. In addition, nearly all training clauses that were included in specific topic sections have been consolidated into the Training section. The use of obligatory lists has been reduced to avoid the implementation of controls which are unnecessarily excessive in relation to the risks that are being managed, encouraging suppliers to demonstrate a risk management approach and proportional controls. In addition to the overall restructuring of the standard we have also increased our focus in certain areas, including: authenticity controls, emphasising a proactive approach alongside product testing. management commitment requirements are also more prominent, as analysis identified this area as a common root cause of audit non-conformance. the time given for locating product during a recall / withdrawal scenario has been reduced from 4 hours to 2 hours, to ensure the retrieval of the most important information first. the introduction of Protector Line to ensure suppliers and their employees have a safe, independent means of raising any concerns confidentially. i

4. The sections and layout The standard organises Tesco requirements into sections by subject. The diagram and example below indicates how the standard is laid out and how each section should be interpreted and used. This provides an overview of the content of the section. In addition, this box explains why it is of value for suppliers to comply with this section This presents the title of the section This highlights the section number This indicates the number of the clause This provides useful information relevant to the application of the requirements in the section If this is marked, the site must have a documented policy/procedure that has been fully implemented If this is marked, the site must have comprehensive, accurately completed records to demonstrate compliance If this is marked, compliance to the clause will be verified through thorough observation of the site This indicates whether this is a requirement or an aspiration for the site, and the scope of the requirement This presents the title of the clause This provides details of what the site and/or personnel must do or have in place to be compliant with the clause This provides guidance on what Tesco believes to be best practice. WGLL is not a requirement ii

5. Clause scope definitions Suppliers must use the decision tree below to assess their products through every step of their process, to determine what levels of care are required at each specific point in their process. For further guidance relating to your product please refer to Tesco Guidance for Suppliers 80030 Food manufacturing care level decision tree, contact your Tesco Technical contact or Group Supplier Assurance. High Medium Base 1. Are products or ingredients within the area open to the environment? e.g. not packaged, not enclosed in tanks, pipework Yes 2. Is the product ready to eat* or ready to re-heat*? Yes 3. Can the product support the growth of pathogenic bacteria? E.g. Salmonella, E.coli, Listeria Yes 5. Has the product undergone full cooking, equivalent to 70 C for 2 minutes prior to entering the High area? No No No No Base Medium (Raw products) 4. Could the finished product be contaminated by raw foods*** handled on the site that may contain Salmonella, where survival might be a subsequent concern? Yes Medium (Processed products with further controls) High (Care) No Medium (Processed products) Yes High (Risk) *This includes products that are likely to be eaten without adequate cooking, e.g. pizza toppings ** Where the product will be cooked by the consumer (e.g. raw washed vegetables, raw meat), the answer to this question is No ***Raw foods on site include raw milk, raw meat and poultry, raw nuts, raw cocoa It is important to note that simply because a particular level of care is required at a particular point in the process, this same level of care does not necessarily need to be applied across all areas of the site. For example, the area in which a chilled ready meal is assembled in a tray and is sealed requires the controls detailed in the High clauses of the standard. This does not mean that High controls are necessarily required in all areas of the site and process, if the decision tree assessment of the product at those points in the process determines that Medium (or Base) controls are required. In this way, simply because a particular area of a site or process requires High controls, it does not make the site a High site. The table below provides a summary of the levels of care and can be used as a sense check for the decision tree assessment. iii

Base Medium Medium requirements must be complied with in addition to Base requirements. High High requirements must be complied with in addition to Medium and Base requirements. Aspirational What Good Looks Like (WGLL) Aim Purpose Summary Minimum site controls Open product site controls Contamination prevention controls Contamination elimination controls To ensure the minimum controls necessary everywhere To minimise the contamination of open products that fall into 3 distinct categories To minimise the opportunity for the contamination of products where hygiene is essential To ensure conditions applicable to higher risk product are met These are practices which must be adopted across all production and manufacturing facility areas, including storage areas, irrespective of the product or process methods. In general these clauses apply where product and/or raw materials are covered or enclosed and therefore not exposed to potential contamination. Raw products Processed products Processed products with further controls High care High risk These practices apply to the processes and areas of the production facility where all the following apply: product is uncovered or open, therefore exposed to potential contamination, and product is not ready to eat or ready to heat These practices apply to the processes and areas of the production facility where all the following apply: product is uncovered or open, therefore exposed to potential contamination, and product is ready to eat or ready to heat, and product cannot support the growth of pathogenic bacteria, e.g. Salmonella, E.coli, Listeria, and finished product cannot be contaminated by raw foods* that may contain Salmonella, where its survival may be a subsequent concern These practices apply to the processes and areas of the production facility where all the following apply: product is uncovered or open, therefore exposed to potential contamination, and product is ready to eat or ready to heat, and product cannot support the growth of pathogenic bacteria, e.g. Salmonella, E.coli, Listeria, and finished product can be contaminated by raw foods* that may contain Salmonella, where its survival may be a subsequent concern These practices apply to the processes and areas of the production facility where all the following apply: product is uncovered or open, therefore exposed to potential contamination, and product is ready to eat or ready to heat, product can support the growth of pathogenic bacteria, e.g. Salmonella, E.coli, Listeria, and product has not undergone full cooking equivalent to 70 C for 2 minutes, prior to entering the High area These practices apply to the processes and areas of the production facility where: product is uncovered or open, therefore exposed to potential contamination, and product is ready to eat or ready to heat, and product can support the growth of pathogenic bacteria, e.g. Salmonella, E.coli, Listeria, and product has undergone full cooking equivalent to 70 C for 2 minutes, prior to entering the High area Products and areas where this typically applies Products/areas include piped liquids (e.g. milk, fruit juice, wine), storage areas. Products include raw meats, raw vegetables, washed raw vegetables that are ready to cook by the consumer. Products include bread, biscuits, ice cream (where raw milk is not processed on site), frozen pizza, hot fill / cook in pack products, preserved products (canned, dried, ph/acidity) This includes products that are likely to be eaten without adequate cooking, e.g. pizza toppings *Raw foods on site include raw milk, raw meat and poultry, raw nuts, raw cocoa Products include hard cheeses, fermented meat, nuts, some seeds, chocolate, peanut butter, ice cream where raw milk is processed on site *Raw foods on site include raw milk, raw meat and poultry, raw nuts, raw cocoa Additional product segregation controls from raw materials is required Products include washed fresh salad garnish, sandwiches, chilled ready meals, pizza with salad or dairy desserts with non - high components Products include cooked meats, pâté, houmous, prepared meals without garnishes Additional air quality controls are required in the area These practices are elements we believe will help move standards forward within the supply base. These are not prescribed requirements but will be viewed favourably by Tesco if implemented and may become TFMS clauses in the future. These are examples of what we believe to be current best practice. This is only intended to provide suppliers with ideas and offer a guide of what might work to meet the requirement, they are not obligatory. As the supplier and product expert you must determine the most effective method of complying with Tesco requirements and be able to demonstrate this during an audit. Following WGLL does not necessarily mean you have satisfied the requirement of the clause. iv

A glossary has been provided to help with the understanding of Tesco terminology. It is recommended that you use the Glossary to ensure understanding in the context of this standard. 6. Auditing of the Standard Tesco will undertake audits against this standard of manufacturers and will determine the degree of compliance to each section. Further information on the Tesco audit process can be found within Tesco Requirement for Suppliers 60348 Technical audit process for suppliers. This can be found on the Tesco Technical Library (TTL) or obtained from your Tesco Technical contact. There is a likelihood that some non-conformances will be raised through the audit and these will be categorised as: Critical - Failure to meet a food safety standard or a legal standard; where this failure puts the customer and or Tesco brand integrity at risk, or would do if Tesco product was being handled on site (in the case of Approval audits). Major A deficiency which requires prompt attention to prevent a potential food safety failure or legal issue from arising; where this failure may potentially put customers or brand integrity at risk, or would do if Tesco product was being handled on site (in the case of Approval audits). A major non-conformance may be raised where a number of related minor non-conformances are identified, indicating a general lack of control in a particular area. Minor A deficiency which requires attention to improve Good Manufacturing Practice standards, Due Diligence documentation (our ability to defend a legal challenge) or to achieve compliance with Tesco standards. Recommendation - A deficiency against an aspirational clause. Other recommendations may also be made during the audit, which the supplier must include within their corrective action plan. Depending on the category of non-conformances and numbers identified, sites will receive a specific rating according to the table below: Approval audit* Ongoing maintenance audit Result/rating Meaning Non-conformances Approved Approval audit is successful (pending close out of nonconformances) Not approved Approval audit is not successful 0 critical non-conformances 0-3 major non-conformances There is no limit on the number of minor non-conformances 1 or more critical non-conformance 4 or more major non-conformances 35 or more total non-conformances where at least 2 are majors 0-4 minor non-conformances only Blue Fully meets expectations Green Satisfactory 5-14 minor non-conformances only Amber Improvement needed Double amber** Red Improvement needed Not Satisfactory*** 0 critical non-conformances 0-3 major non-conformances 15-34 minor non-conformances No more than 34 non-conformances in total Same as Amber but with a previous Amber or a previous Red 1 or more critical non conformance 4 or more major non-conformances 35 or more total non-conformances where at least 2 are majors *An approval audit may be the first audit of a site prior to Tesco production, an audit to extend the scope (e.g. additional product type or production line) or may be a further audit of a previously not approved site. ** Double Amber status is used for sites which have been rated Amber on consecutive audits and those which have been rated Red then Amber in consecutive audits. ***Sites that receive a Not Satisfactory rating will need to immediately contact their Tesco Technical contact. 7. Review The content of the standard will be regularly reviewed and amended as required. 8. Training The standard is supported by clear guidance and training material available to all. Please speak to your Tesco Technical contact for information on TFMS training and availability. If you have any questions on the application of this standard (e.g. your site audit) please contact your Tesco Technical contact. If you have any questions on the standard please contact the Group Quality Technical Policy and Standards Team at gqtps@uk.tesco.com. v

Management commitment and control Section 1 The site s senior management must be able to demonstrate that they are fully committed to the implementation of the Tesco Standard and to processes which facilitate continual improvement of product safety and quality management. This is essential as without this commitment the site will not have the support necessary to deliver safe, legal and quality products for Tesco customers. P R O Number Scope Item Detail What Good Looks Like P 1.1 Base Quality policy The site must have a documented quality policy which states the site s intention to consistently produce safe and legal products of the specified quality, whilst ensuring that all customer obligations and requirements are met. P O 1.2 Base Resource and organisational structure This must be: signed by the person with overall responsibility for the site effectively communicated to all site employees The site s senior management must provide the human and financial resources to produce safe and legal products at the right quality for Tesco, maintain Good Manufacturing Practices and meet the requirements of this Standard. An organisational structure chart must be in place showing management responsibilities and authority. The quality policy is displayed around the site at key employee locations. Structure charts show details of the technical, quality, cleaning, maintenance and training teams. P R 1.3 Base Management review and corrective action Details of deputising cover for personnel with responsibility for legal, safety and quality issues must be documented. Systems must be in place to ensure that the management team regularly review the Good Manufacturing Practices on site and this will include the safety, legality and quality of product supplied to Tesco. The senior management team must ensure that any corrective actions resulting from the review are implemented in a timely and effective manner. Sites which are part of a larger company share the learnings from their management reviews across the group. 1

P R O Number Scope Item Detail What Good Looks Like R 1.4 Base Management notification O 1.5 Base Representation during audit for Tesco The site must have systems in place to ensure that the relevant Tesco Technical contact is notified of any safety, legality and quality issues that are identified with product, that directly affect or may have the potential to affect Tesco product. The Tesco Technical contact must be involved in the final decision for handling affected Tesco product. Your Tesco Technical contact must be informed as soon as possible, of any enforcement notices, pending prosecutions, judgements, or approaches from the media etc, where there may be an impact on Tesco product, our reputation or the site s ability to supply. This may include the following, although this is not an exhaustive list: Food Safety enforcement Environmental enforcement Health & Safety enforcement Contact with the Media Anonymous internal or external contact, e.g. whistle-blower The most senior operational manager available on site at the time of the audit must participate in the opening and closing meetings. Other relevant representatives must be available as required during the audit. An up to date Tesco contacts list is in place. 2

Food safety and quality management Section 2 Hazard analysis, risk assessment and the quality management of manufacturing processes ensure that safe and legal products are consistently produced to the agreed specification and desired quality. Therefore both HACCP and quality management are fundamental in supporting the required due diligence of all processes. Internal auditing assesses the effectiveness of site procedures and policies in maintaining the safety, legality and quality of products. It supports the identification of the potential need for procedural change or employee retraining is required and enables continuous improvement. P R O Number Scope Item Detail What Good Looks Like P R O 2.1 Base Quality management system P R 2.2 Base Document control, completion and retention The site must have a Quality Management System (QMS), which is maintained, documented and regularly reviewed, annually as a minimum. The QMS must include procedures and records as required to meet the requirements of the Tesco standard within a quality manual. The manual must be available to key site employees and integrated into day to day operations. All documents related to legality, quality and product safety must be adequately controlled, authorised and the correct versions must be in use. Alterations to records must be appropriately authorised and a change log maintained. All records must be accurate and fully complete. All documentation and records must be retained for a defined period with consideration given to: any legal or customer requirements the product life specific Tesco requirements P R 2.3 Base Prerequisite programmes All documentation and records must be available within 4 hours from request. All environmental, operational and Good Manufacturing Practice controls that are necessary to produce safe and legal food must be in place. This may include the following, although this is not an exhaustive list: cleaning, sanitising and disinfection foreign object controls maintenance programmes for equipment and buildings material segregation controls e.g. allergens personal hygiene requirements pest management 3

P R O Number Scope Item Detail What Good Looks Like processes to prevent cross-contamination purchasing storage, distribution and transportation arrangements training utilities and services (e.g. compressed air, ice, steam, ventilation, water etc.) waste controls P R 2.4 Base The use of HACCP The control measures and monitoring procedures for the pre-requisite programme must be clearly identified and documented. The site must have a HACCP food safety system, which is maintained, implemented and documented. The HACCP system must be based on Codex Alimentarius principles which include a minimum of: identifying the hazards (occurrence and severity, microbiological, chemical, physical and allergenic) determining CCP s establish validated critical limits monitoring and control measures corrective actions documentation procedures (documents must be signed by the person completing the check, and then verified by an authorised person) verification procedures (can include internal audits, review of complaints and testing results) P R 2.5 Base HACCP team The HACCP plan must be developed by a multi-disciplinary team which has the correct product knowledge and expertise. The team leader must have an in-depth knowledge of HACCP and be able to demonstrate competence and experience. This can be demonstrated by: the quality of the plan and its adherence to the Codex principles successfully completed, formal and up to date HACCP training demonstrable, extensive experience in implementing and/or training HACCP no site history of HACCP related major non-conformances arising from third party audits Other team members must also have knowledge of HACCP, product, process and the associated hazards. In the event that the site (or wider company) does not have the appropriate in-house The team leader has completed a recognised HACCP qualification. The whole HACCP team have been trained. A schedule of refresher training is in place to ensure all team members are up to date. 4

P R O Number Scope Item Detail What Good Looks Like P R 2.6 Base Product and its intended use R 2.7 Base Process flow schematic knowledge (either product expertise and/or HACCP), external expertise may be used. However the day-to-day management of the food safety systems must remain the responsibility of the site. A full description of the product must be documented including relevant safety information. This may include the following, although this is not an exhaustive list: composition origin of ingredients physical or chemical structure (e.g. water activity, ph etc.) treatment and processing (e.g. heating, freezing, salting) packaging (e.g. modified atmosphere, vacuum) storage and distribution conditions (e.g. with specified temperatures) durability and required shelf-life instructions for use The intended use of the product by the customer, must be described, defining the target consumer groups, including the suitability of the product for vulnerable groups of the population (e.g. infants, elderly, pregnant women, and people with allergies). A flow diagram must be prepared to cover all products, product categories and/or processes as appropriate. This must set out all aspects of the food process operation within the HACCP scope, from raw material receipt through to processing, storage and distribution. The diagram must include: plan of premises and equipment layout raw material flows including introduction of utilities and other food contact materials, e.g. ice, water, gas and packaging people flows sequence and interaction of all process steps critical control points process delay (maturation) outsourced processes and subcontracted work rework and recycling key segregation All documents must be validated, signed and dated by the HACCP team. R O 2.8 Base Training Personnel in the factory who monitor critical controls must have an understanding of HACCP and have specific training against the latest version of the relevant monitoring procedure. P R 2.9 Base Review The HACCP plan must be reviewed at a pre-determined frequency (annually as a minimum) or prior to changes of product/process which may affect product safety. This may include changes in the following areas, although this is not an exhaustive list: 5

P R O Number Scope Item Detail What Good Looks Like P R 2.10 Base Internal audits P R 2.11 Base Internal audits minimum requirements supply or specification of raw materials or packaging process steps (including storage and/or distribution) site layout or flow introduction of new or modification to existing equipment new product development Internal audits of the quality system must verify whether activities comply with the documented procedures, policies and work instructions to ensure food safety, legality and quality are maintained. Audits must also evaluate the effectiveness of the procedures. Internal audits must include an assessment of all site activities, against this Tesco standard as a minimum. When a site is part of a group, full internal audits must be conducted at each site. P R 2.12 Base Internal audits frequency and scheduling This must include, although this is not an exhaustive list : the HACCP plan and controls all aspects of the prerequisite programmes Good Manufacturing Practices (where not included as prerequisites) segregation controls (where applicable) process controls cleaning (audit must include an inspection during the main cleaning operation) site fabrication traceability training, including temporary staff recall plan and incident management controls off-site storage or service providers Tesco policy requirements The frequency of audits must be determined by risk assessment, but annually as a minimum, and completed to a schedule. Where the risk assessment determines that more than one audit is required they must be scheduled to occur evenly throughout the production year. Audits must be completed so as to encompass night shifts, weekend working, and any out of hours activities. R 2.13 Base Auditors Auditors are demonstrably competent to carry out their activity, through training, work experience or qualification and have good knowledge of the processes and areas. The internal audit is completed at staggered times throughout the year, so as to allow continual checks and focus on each area. Auditors are trained to a recognised auditing qualification. 6

P R O Number Scope Item Detail What Good Looks Like External auditors are acceptable. P R 2.14 Base Audit records Records of audit results must be available and include: who was present what and where was audited which document versions were referred to Evidence/copies of non-conformances found and a non-conformance log must be kept. Auditors are independent of the area being audited (e.g. the production team manager audits the intake systems.) Auditors have attended training in this standard. Evidence of all documentation used or seen is referenced or copied and retained with the audit. R 2.15 Base Audit corrective action R 2.16 Base Third party/tesco audits Audit reports must detail non-conformances, recommendations and corrective actions. These must be brought to the attention of the person responsible for the activity audited. Timescales and corrective actions must be agreed by the auditor and the person responsible for the area being audited. The completion of corrective actions within agreed timescales must be verified. The timescales must be appropriate to the product risk. Agreed corrective actions arising from audits conducted by third parties/tesco must be implemented in agreed timescales and verified. Audit results are scored and trend analysis takes place where possible. Results are used as key performance indicators for the business, highlighting trends and areas where improvement is necessary. Sites within a group share learnings. 7

Raw material, packaging and outsourced process supplier management Section 3 An effective supplier approval and management process ensures that sites receive safe and legal material, of the desired quality, from reputable suppliers. This in turn reduces the risks relating to safety, legality and quality to the finished product and consumer. It is essential that the site takes the responsibility to manage the risk within their raw materials and supplier base with respect to quality, provenance and responsible sourcing, to enable customer trust in the supply chain. P R O Number Scope Item Detail What Good Looks Like R 3.1 Base Supplier risk assessment All suppliers to the site must be assessed to determine the overall potential risk associated with their materials on an ongoing basis. Supplier risk assessments must be reviewed annually and when existing suppliers change the materials they are supplying. This must take into consideration: any known defects or potential problems associated with the material and/or supplier (e.g. allergenic materials, foreign objects, microbiological or chemical risks, likelihood of substitution or fraud) supplier performance history (e.g. percentage of rejections at delivery, response to rejection or issues, quality and specification conformance) audit result history whether deliveries are accompanied with Certificates of Analysis or Conformance R 3.2 Base Supplier approval and monitoring The outcome of the risk assessment must be used to determine: method of supplier approval method of supplier monitoring type and frequency of raw material sampling and testing Any raw material and packaging suppliers to the site must be approved, annually as a minimum and receive ongoing assessment. The approval and monitoring process must be based on the outcome of the supplier risk assessment carried out on each supplier and include one or a combination of the following depending on the level of risk: first party audit to the principles of this standard by a competent and trained auditor. The audit must have a satisfactory result and no unresolved critical or major nonconformances prior to supply. a recognised and valid third party audit, with a satisfactory result and no unresolved critical or major non-conformances prior to supply. for suppliers assessed as low risk, self-audit questionnaires are permitted. 8

P R O Number Scope Item Detail What Good Looks Like R 3.3 Base Agent supplier approval R 3.4 Base Packaging supplier approval R 3.5 Base Approval of contingency suppliers Where any sort of audit is required, full reports and corrective action plans must be available to view on site. Where raw materials are purchased from agents the site must know where the agent has purchased the raw material from. A system must be in place to ensure the supplier to the agent meets the correct manufacturing standard and where risk assessment determines an audit is required the site must have evidence of that audit. Packaging suppliers must be approved and monitored. Food contact packaging must comply with the legislation in the country of product sale in relation to safety. For suppliers of food contact packaging (and/or pack inserts), approval must be by a minimum of one of the following methods: BRC/IoP or similar certification first party audit to the principles of BRC/IoP standard by a competent and trained auditor selection from a Tesco preferred supplier list, where this is available Audits must have a satisfactory result and no unresolved major non-conformances prior to supply. Approval of suppliers of non food contact packaging may follow the same principles as for food contact packaging suppliers, or it may be by a site self-assessment questionnaire. For all packaging where audits are used for approval or monitoring, full reports and corrective action plans must be available to view. Site supplier approval systems do not need to be applied to suppliers of Tesco dedicated branded trays and crates, where used, e.g. for prepared salad, bread Where contingency suppliers are used, these must be assessed to ensure there is no risk to the safety, legality and quality of the finished product, or any reduction in traceability. Details of any contingency supplies must be recorded, and your Tesco Technical contact must be informed and provide documented authorisation prior to using these materials. Agents are certificated to the BRC Agents and Brokers standard 9

P R O Number Scope Item Detail What Good Looks Like R 3.6 Base Raw material and packaging and specifications R 3.7 Base General requirements for outsourced processes R 3.8 Base Outsourced processes mid process All raw materials, including packaging, must have an agreed specification, including Tesco requirements where relevant, that is signed by both the Tesco supplier and the raw material supplier. All outsourced processes must be visible on the process flow schematic and declared to your Tesco Technical contact. Outsourced process providers must be approved in the same way that raw material and packaging suppliers are approved and receive ongoing assessment, annually as a minimum. Raw material, products and packaging from outsourced processes must be subject to normal intake checks. For outsourced processes where the material or product returns to the site full specifications must be in place which describe the product, packaging and processing detail accurately. Outsourced processes must be approved and receive ongoing assessment, annually as a minimum. The approval and monitoring procedure must be based on risk and include one or a combination of: first party audit to the principles of this standard by a competent and trained auditor. The audit must have a satisfactory result and no unresolved critical or major nonconformances prior to supply. a recognised and valid 3rd party audit, with a satisfactory result and no unresolved critical or major non-conformances prior to supply for suppliers assessed as low risk, self-audit questionnaires are permitted. P R 3.9 Base Outsourced processes at end of process Where audits are required, full reports and corrective action plans must be available to view on site. For outsourced processes where the material or product does not return to the site (goes directly on to Tesco) the outsourced processor site must be approved by Tesco unless you have prior documented agreement from your Tesco Technical contact. 10

Product Development Section 4 Product design and development procedures, including risk assessment, ensure that new products, processes or changes to product, packaging or manufacturing, results in the production of safe and legal products, consistently to the agreed specification. It is understood that during an approval audit, prior to any production for Tesco, test and trial results may not have been completed on Tesco products or production. P R O Number Scope Item Detail What Good Looks Like R 4.1 Base Formulation changes Changes in formulation must be adequately assessed for legal, safety and quality issues, discussed and agreed with your Tesco Technical contact. All product development must be assessed against the HACCP plan by the HACCP team to ensure the HACCP is still appropriate. R 4.2 Base Factory trials The site must undertake and document factory trials and complete thorough testing to verify product formulation and manufacturing processes are capable of producing safe and legal products. P R 4.3 Base Shelf life testing The site must have a development handover process that ensures that approved development formulations and packaging materials are correctly transferred to manufacturing for the first production run and that the specification is consistently achieved. Shelf life must be established through testing. As a minimum this must include: product formulation microbiological growth packaging process and material factory environment subsequent storage conditions likely consumer use temperature stability Records must be retained. 11

P R O Number Scope Item Detail What Good Looks Like R 4.4 Base Nutritional testing Nutritional testing must be carried out and checked against proposed product label and specification prior to launch. Manual calculations can be used in some instances; however this must be agreed by your Tesco Technical contact. R 4.5 Base Product claims R 4.6 Base Packaging performance Where a nutritional claim is made (e.g. <2% fat, high in omega 3, Free From) these claims must be challenged and verified using worst case scenarios. Where product claims are made, documentary evidence must be available on site to substantiate these. This may include, although this is not an exhaustive list: Provenance Welfare Allergens Speciation Free from GMO free Method of production(e.g. not from concentrate) or slaughter Method of ingredient growing (e.g. organic/chemical free) Suitable for vegetarian or vegans Any quantitative recipe claims Performance and durability of product and packaging must be conducted through testing (e.g. transit trials, stack testing.) Packaging design and testing must take into account how the product is sold (e.g. sale in store or supply direct to the consumer.) 12

Finished product specifications Section 5 Detailed, accurate specifications ensure that safe, legal products are supplied to the agreed quality. It is understood that during an approval audit, prior to any production for Tesco, specifications may not be in place. P R O Number Scope Item Detail What Good Looks Like R 5.1 Base Specification completeness R 5.2 Base Specification format Agreed Tesco specifications must be in place and available on site for all launched products. In addition the specifications must be: agreed by both parties complete describe the product, packaging, raw material supply and processing detail accurately up to date (e.g. review frequency appropriate to product every 2 years as a minimum) Specifications must be in the format agreed with your Tesco Technical contact. In the event paper specifications are in use they must be signed by both the supplier and your Tesco Technical contact. Tesco Technical Library (TTL) is used for specification management. P R 5.3 Base Site documents R O 5.4 Base Using Tesco Technical Library correctly Where internal, site specific specifications are used they must be controlled and accurately reflect the current Tesco specification. Where your Tesco business unit specifies you must use the Tesco Technical Library, the supplier must use employees who are trained to operate the system to ensure the following information is up to date, although this is not an exhaustive list: supplier and site details that the specifications are associated to the correct site that all alerts have been acknowledged specifications are complete, active and up to date with the correct product history Site technical employees must be familiar with Technical Library and where to access the policies and guidance relevant for their products. 13

Customer complaints, product withdrawal and recall, and incident management Section 6 Investigation and analysis of customer complaints can increase product quality, supports continuous improvement and can prevent minor issues progressing into major incidents, which can all affect customer trust, as well as put them at risk. Effective management of emergency situations enables appropriate decisions and communications to be made by authorised people, resulting in the protection of customers, the product and business continuity. P R O Number Scope Item Detail What Good Looks Like P 6.1 Base Complaints procedure P R 6.2 Base Complaints handling procedure R 6.3 Base Complaint handling and investigation A complaints policy and procedure must be in place This must be part of the site incident management procedures where necessary. All complaints must be captured on a record and be given a unique reference. The record must include: the product information the nature of the complaint the method of reporting (e.g. phone, email, media) Complaints from all sources must be covered in the procedure. These must include, although this is not an exhaustive list: customer representatives (e.g. technical managers, buyers, support office) stores (store returns, distribution centre rejections) retailer customer complaints departments law enforcement bodies output from internal or customer quality assurance processes e.g. testing panels site internal departments (e.g. operational departments) All complaints must be investigated or directly cross reference to complaint reduction action plans. The complaint handling procedure must identify what steps are taken depending on the type of complaint (e.g. foreign object, alleged illness, quality, quantity etc.) The investigation must determine whether the complaint is product specific (isolated) or is an issue which is likely to affect more than one product. Full records must be kept and the outcome of the investigation promptly reported to relevant personnel and departments. A defined number of complaints linked by complaint type, product or production line will trigger a review. 14

P R O Number Scope Item Detail What Good Looks Like Corrective actions must be effective to prevent a re-occurrence. Mechanisms must be in place for briefing corrective action with the relevant departments. P R 6.4 Base Complaint monitoring and trend analysis P 6.5 Base Incident management Where requested the full corrective actions must be reported to Tesco. Complaint levels and trends must be monitored. The site must have complaint targets and thresholds and a complaint reduction plan. When levels reach the threshold or if there is a significant increase an investigation must be prompted. Information from trend analysis of complaints must be communicated to the site management, production teams and your Tesco Technical contact. Procedures must be in place to manage all incidents and potential emerging issues which could affect food safety, legality and quality. The procedures must include a defined incident management team. Issues could include the following, although this is not an exhaustive list: disruptions to operations and distribution, water and energy supplies, labour and communications fire, flood and other natural disasters sabotage and malicious contamination vandalism and terrorism food safety, legality and quality issues Complaint numbers and type are tracked against units sold. Complaint trend information is graphically displayed on notice boards at suitable locations. A multi-disciplinary complaints action team meet, review trends and plan appropriate corrective actions at a defined frequency. The likelihood of the occurrence of the identified issues must be risk assessed. A communication plan must be in place to manage potential incidents. R 6.6 Base Contacts Key contact information must be maintained. Contact information (both working hours and emergency out of hours) must include the following, although this is not an exhaustive list: internal contacts 15

P R O Number Scope Item Detail What Good Looks Like P R 6.7 Base Withdrawal and recall plans Tesco suppliers of both raw materials and services local government and enforcement bodies The site must have a system in place to enable the effective withdrawal and recall of products should this be required (e.g. where safety, legality or quality is in doubt or there is a reputational risk). The procedure must include in detail, although this is not an exhaustive list: how to report an incident to Tesco the full process of traceability identifying key points in production and distribution how product will be withdrawn or recalled from distribution and sale All affected products must be located within 2 hours of the withdrawal/recall being started. Reconciliation of product must be verified against production records. The withdrawal/recall of Tesco brand products from Tesco stores will be managed by Tesco. R 6.8 Base Notifying Tesco P R 6.9 Base Mock recall and incident management Any communication with external bodies, Government or enforcement agencies, regarding Tesco branded products must be co-ordinated by Tesco. Any issue that impacts on supply or affects the brand integrity must be reported to Tesco. A mock recall (or mock incident) must be undertaken by the site to test the effectiveness of the system and the incident management team s understanding of the recall procedures. The test must occur at a annually as a minimum. Out of hours tests must occur at least every 2 years. There must be documented evidence that all aspects of a recall have been undertaken. The records could include, although this is not an exhaustive list: the mock scenario for the test a chronology of actions taken, including team meetings minutes from the recall team meeting contact checks evidence of tracing where the affected products are located within 2 hours a review of the test and any corrective action taken Mock recall is not to be confused with the traceability test. 16

External areas and site security Section 7 Maintenance of the site boundary and the external areas, combined with good site security, minimises the risk of unauthorised access. It also reduces the potential for contamination, adulteration or damage to the products as well as minimising the risk of pest infestation and entry to the facility. P R O Number Scope Item Detail What Good Looks Like R O 7.1 Base Site boundaries O 7.2 Base External maintenance O 7.3 Base External storage units O 7.4 Base External pipework P R 7.5 Base Photographic recording equipment P R 7.6 Base Control of visitors and contractors The site must comply with local regulations regarding approval or registration of premises and site usage. Boundaries must be clearly defined and where appropriate have adequate perimeter fencing. A site plan must be available. The external areas must be maintained in good order. Where buildings are surrounded by grassed or planted areas, they must be regularly tended, well-maintained and free from items that could potentially harbour pests. The areas immediately surrounding buildings on site must have adequate drainage to prevent pooling of water and allow for cleaning. If the external maintenance is the responsibility of another party (e.g. neighbouring site, landlord etc.) the site must work with those parties to ensure external areas do not pose a risk. External units (including silos, containers and tanks) must be kept locked and have restricted access. Connecting pipes for bulk tanks or silos must be maintained in a clean condition, and stored off the floor or capped at both ends when not in use. The use of photographic/recording equipment must be controlled. Only equipment authorised by the site must be permitted on site. All visitors and contractors must report on arrival and sign in prior to entering the production and storage areas. Proof of identity must be required for persons unknown to the site. A system must be in place to adequately supervise visitors and contractors. This must include a manager being accountable for their movements. The site is surrounded by secure fencing and is monitored by security cameras. Vegetation is more than 1 metre from production and storage buildings All external structures are sited on a sealed base to help prevent pest ingress Visitor and contractor procedures include a declaration of any intended use of photographic/recording equipment. Entrance to the site is via a manned security barrier/check point. There is a list of approved 17