1Food Safety Audit ExpectationsforCostco SuppliersVersion 1.0 Copyright 2014. Costco Wholesale CorporationThis document is proprietary to Costco Wholesale and should not be distributed without express permission from Costco1V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

2Table of Contents.-(Clicking on a Title Will Navigate to that Section of the Document)-General Audit Requirements. 4Costco Audit Requirements – Food and Produce . 4Costco-Approved Audit Companies . 5Accepted Facility Audit Types and Scoring Requirements . 6GFSI (Global Food Safety Initiative) Audits. 6Primary Packaging Manufacturers (Food-Contact) . 7Distribution Center/ Warehouse Audits . 7cGMP Audits . 8Costco GMP Audit . 8Costco Small Supplier Audit . 8Animal Welfare Audits . 8Corrective Action Plans (CAPs) – All Audits and Costco Addendum . 9Re-Audit Criteria: GFSI and Costco Audits . 10Audit Databases . 11EFA (Enterprise Facility Audit). 11TraQtion . 12Azzule Systems (Fresh Produce) . 12Costco-Specific Food Safety Requirements. . 13Costco Auditor Evaluations (Shadow Audits) . 13Country-Specific Requirements for Costco International Regions . 13HACCP and Preventive Controls (FSMA) . 13Microbiological Testing . 15Environmental Sampling Program Requirements . 15Test and Hold Requirements . 152V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

3Water Testing Requirements . 16Allergens . 16Foreign Material Detection . 18Pest Control . 20Good Manufacturing Practices . 21Gloves: No Bare-Hands Contact . 21Hand Washing Sinks. 21Hair Restraints . 22Product Traceability . 22Product Code Dates . 22Approved Supplier Program . 22Produce Audit Requirements. . 23Facilities and Field-Packed Commodities – Accepted Standard Audit Types . 24Facilities and Field-Packed Commodities – GFSI Certifications . 24Corrective Actions – Certification Audits and Costco Addendum. 26Re-Audits: GFSI, GMP, GAP . 26Sanitation Verification (Facilities) . 26Test and Hold Requirements . 26Produce-Specific Good Agricultural Practices (GAP). 28Costco Food Safety Contacts. 293V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

4General Audit Requirements.Costco’s Food Safety CommitmentFood safety and food quality are interrelated objectives - both of which require deliberate planning,execution, and monitoring. Food safety audits are vital to maintaining the highest possible food safetyand quality standards for food products. Audit reports provide accurate information on the complianceand overall food safety status of current and prospective suppliers, while also providing a framework forfuture improvements.To ensure confidentiality, audit information will only be shared internally between the Costco FoodSafety Audit Team and Costco Buyers. The Costco Food Safety Audit Team will review audits to identifyopportunities for improvement and ensure that corrective actions are completed, while the Costcobuying staff will use audit information to guide purchasing decisions.Costco Audit Requirements – Food and Produce All locations/facilities that process, pack, warehouse, or distribute consumable products (, beverages, supplements) or supply food-contact packaging materials to Costco arerequired to have an annual third-party food safety audit. Suppliers located in China mustcomplete two food safety audits per year. Fresh produce suppliers that grow, harvest, pack, cool, process, store, and distribute produceitems are required to have an annual third-party food safety audit. All produce suppliers in Chinamust complete two food safety audits per year. To be accepted by Costco, audits must be performed by a Costco-approved audit company. Theonly exception is for new suppliers who wish to submit a previously-completed audit (within thepast 12 months) for review. The full audit report must be submitted to Costco, in addition tocorrective action responses for each deficiency. If a previously-completed audit report isaccepted, the supplier’s anniversary audit must be a Costco-approved audit scheme and shall beconducted by a Costco-approved audit company. Costco will only accept audits/certifications performed while the audit site is fully operational.While preferable, suppliers are not required to be producing product, cultivating or processingcrops for Costco at the time of the audit. However, similar products and processes must bewitnessed by the auditor.4V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

5Costco-Approved Audit CompaniesCostco will only accept audits or certifications from the approved list of audit companies below. If asupplier ships to Costco in multiple countries, they must use an audit company that is approved-for-useby all countries they supply product to.To ensure objectivity in the audit process, Costco requires audit companies to rotate their auditors everythree years (at minimum).Out of consideration to site employees, and to prevent auditor fatigue, Costco expects each audit day tobe limited to no more than 10 hours.United StatesAustralia - same as U.S. with the addition of:AcertaAIB InternationalAsure QualityAUS-MEAT / AUS-QUALBSI GroupControl UnionDNV-GLEagle Food RegistrationsEurofinsFoodChain ID (formerly Cert ID)Food Safety Net ServicesIntertekLRQALSQA (GAP audits only. No facility audits.)MérieuxNSF InternationalPMCPrimus Auditing Operations (PAO)Safe Food CertificationsSCS Global ServicesSGSTUV USA / TUV NordUL-STRWQS-QIMA / QIMA (formerly Asia FoodBureau VeritasInspection)Taiwan - same as U.S. with the addition of:ValidusCanada - same as U.S. with the addition of:Bureau VeritasSAI GlobalFrance - same as U.S. with the addition of:AfnorBureau VeritasDekraJapan - same as U.S. with the addition of:Bureau VeritasJFICKorea - same as U.S. with the addition of:Bureau VeritasMexico - same as U.S. with the addition of:Bureau VeritasGlobal STD certificationSpain - same as U.S. with the addition of:AenorApplusBureau VeritasBureau VeritasU.K. / Iceland - same as U.S. with the addition of:Bureau Veritas* U.K. will accept BRC Certifications or SalsaAudits regardless of audit company. The UK also acceptsISO Certifications.5V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

6Accepted Facility Audit Types and Scoring RequirementsGFSI (Global Food Safety Initiative) Audits Costco accepts BRC, SQF, IFS, GFSI Global Markets Program Assessment, and FSSC 22000audits (annual FSSC surveillance audit with Costco Addendum must be shared with Costcoregardless of certification expiration date). All GFSI surveillance audits must be shared withCostco. A Costco GFSI Addendum must be completed for each GFSI scheme listed above. If the GFSIAddendum is not completed when requested by Costco, the audit company must return to thesite and complete the Addendum at the audit company’s expense. If a supplier cancels theaddendum when one is required, the audit company will return to the site at the supplier’sexpense to perform the addendum.All certification and recertification audits must be current (within the past 12 months). Costco willonly accept GFSI certifications from Costco-approved audit companies (except for new suppliers).The audit company must post the preliminary audit results in the appropriate Costco audit databasewithin 7 calendar days. Suppliers must notify Costco immediately via email or phone in the eventtheir GFSI certification becomes suspended or cancelled.Costco’s GFSI Score RequirementsBRCGrade B or aboveSQFTotal preliminary score of 85 or aboveIFSTotal preliminary score of 85 or aboveFSSC 22000 Successful Certification (audits are not scored)GFSI Global Markets Program Assessment for Primary Production.GlobalMarketsProgramAssessmentInitial Assessment must meet Basic Level at 90% or aboveSecond Year Assessment must meet Intermediate Level at 75% or aboveThird Year Facility must obtain full GFSI Certification or complete aGMP/GAP Audit per Costco’s requirements.6V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

7GFSI Global Markets Program Assessment for Manufacturing.Initial Assessment must meet Intermediate Level at 80% or aboveGlobalMarketsProgramAssessmentSecond Year Assessment Facility must obtain full GFSI Certification orcomplete a GMP Audit per Costco’s requirements. Note: Costco prefers the assessments to be conducted by a Costcoapproved audit company. In the rare event that Costco-approvedaudit companies are not available to the supplier, Costco will requirethat the chosen audit company be accredited against ISO/IEC 17065and/or ISO/IEC 17021. The audit company shall be accredited by anIAF member Accreditation Body which can be found on the IAFwebsite: Suppliers must notify Costco in advance toverify that the audit company meets these requirements.Primary Packaging Manufacturers (Food-Contact)Costco accepts Packaging Audit reports (i.e. bag, film, clam shell) from a Costco approved Auditcompany. Costco will accept either a GFSI Certification or the audit company’s unique PackagingAudit.Scoring Requirement: Costco will defer to audit scheme scoring requirements.N60 Addendum (Only Applicable to Suppliers of Raw Beef to Costco Facilities)All suppliers that provide raw beef protein components to Costco’s Tracy, CA and Morris, IL meatplants must also complete an N60 Addendum. Costco will accept both the Costco N60 Addendumas well as N60 audits developed and performed by Costco-approved audit companies.Scoring Requirement: Costco will defer to audit scheme scoring requirements.Distribution Center/ Warehouse AuditsCostco accepts Distribution Center/ Warehouse Audits when conducted by a Costco approved auditcompany. Costco will accept either a GFSI Certification or an audit company’s unique DistributionCenter / Warehouse Audit form.Scoring Requirement: Costco will defer to audit scheme scoring requirements.7V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

8cGMP Audits (Supplements and Pharmaceutical Industry)Costco accepts cGMP audits (Current Good Manufacturing Practice) when conducted by a Costcoapproved audit company. cGMP audits verify that manufacturing facilities and processes aredesigned, implemented, monitored, and controlled appropriately.Scoring Requirement: Costco will defer to audit scheme scoring requirements.Costco GMP AuditCostco GMP audits are required to be unannounced. The audit must be conducted within a 90-dayaudit window from the date of the previous audit (45 days before/after audit anniversary date).Audit companies will contact suppliers to schedule audits within the specified timeframe.During the scheduling process, the audit company will ask the site to provide blackout dates (if any).A blackout date is a period of time in which the site will not be operational or producing Costcoproduct or like product. Blackout dates are strictly limited to non-production days and will not begranted for any other reason. Unless blackout dates are provided by the site, all days within the 90day audit window will be considered “audit ready” dates. If a site is not operational on an auditready-date, the audit must be rescheduled within the original 90 day window at the supplier’sexpense. It is advisable to check with your audit company regarding their cancellation policy andassociated fees.The majority of Costco GMP audits can be completed in a single audit day, though certain auditsmay require a second day due to the size, complexity, and readiness of a facility.Scoring Requirement: Minimum score of 85 in each category. No Critical Findings.Costco Small Supplier AuditSuppliers that have fewer than 25 employees and have not previously completed a third-party foodsafety audit are eligible for a Costco Small Supplier Audit. Unlike the Costco GMP Audit, SmallSupplier Audits are always announced. Small Supplier Audits are intended as an introduction toCostco’s food safety program and are to be performed on a one-time-basis only. All subsequentaudits completed for Costco must be either a Costco GMP audit or GFSI Certification with CostcoAddendum.Scoring Requirement: Minimum score of 75 in each category. No Critical Findings.Animal Welfare AuditsFacilities that slaughter, convert animals into food, or have an on-farm environment (i.e. layinghens, dairy cattle, etc.) are required to have an annual animal welfare or certification audit. Pleaserefer to the Costco Animal Welfare Audit Expectations Document for further information.8V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

9Corrective Action Plans (CAPs) – All Audits and Costco AddendumA Corrective Action Plan or Corrective Action Report (CAP or CAR) is an outline of all non-conformancesfound during the audit that should address the following: Employee(s) responsible for corrective actions Root Cause Analysis Corrective Action Preventive Plan Completion Date (or estimated completion date)Corrective Action Plans must be submitted to, reviewed, and approved by the third-party auditor or auditcompany. The CAP must be uploaded to the appropriate audit database within 14 calendar days of theaudit being posted. During the anniversary or re-certification audit, the auditor will confirm that allcorrective or preventive actions from the previous year’s audit have been implemented.GFSI certification and surveillance audit non-conformances must be addressed per schemerequirements.Non-conformances identified in Costco GMP, Small Supplier, or Costco GFSI Addendum reports must beaddressed with a corrective action response if the total score is below 98%. During the site’s anniversaryaudit or re-audit, the auditor will verify that non-conformances from the previous audit have beensatisfactorily addressed. If Costco GMP or Addendum non-conformances from the previous audit are notcorrected by the time of the anniversary audit, each repeat non-conformance will be awarded a score of“0” points. Corrective actions will still be required for audits scoring 98% and above, but these do notneed to be submitted to Costco for review. Scoring and corrective action requirements for Costco auditsare listed in the table below.Corrective Action RequirementsScoreRatingAction98 - 100%ExcellentCorrective Actions required, but do not needto be submitted to a Costco audit database85 - 97%Satisfactory 85% total score for scored GFSI schemes;Grade C or below for BRCUnsuccessful certification for FSSC 22000 85% in any category: GMP audit 75% in any category: Costco Small SupplierFailedCorrective Actions requiredCorrective Action and Re-Audit Requiredwithin 60 days9V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

10Re-Audit Criteria: GFSI and Costco AuditsAudit companies are required to notify Costco of all failed audits within 24 hours. A failed audit of anytype will trigger an announced re-audit within 60 days of the initial audit date. All corrective actionsidentified in the original audit must be verified during the re-audit.Failed GFSI audits will trigger a Costco GMP re-audit within 60 days, independent of GFSI requirementsfor maintaining Certification. For Costco GMP and Small Supplier audits, the re-audit completion datewill become the new anniversary date.Failing the Costco GFSI Addendum with a critical failure or a total score of less than 85 could result in are-audit. Costco will make re-audit determinations on a case-by-case basis.Costco will require re-audits under the following circumstances: Direct product contamination is observed by the auditor. The site does not take documented corrective actions when critical limits are not met. Employees with sores, infected wounds or other infectious illnesses are observed in direct contactwith exposed food, primary packaging, or production / storage areas. Allergens are present in the facility, but an allergen control program has not been developed. A documented SSOP Program (Standard Sanitation Operating Procedures) has not been establishedand/or implemented. A documented Food Safety Plan or HACCP Plan has not been established (as per regulatoryrequirements). A written pest control program is inadequate or has not been established. Facility water is not from a potable source. The facility has been issued an FDA warning letter (Form 483). Water potability is not tested by a certified laboratory and records are not maintained (annual testingfor municipal water sources and quarterly for well water). Finished products are not properly coded for traceability. Evidence of decomposed pests in the interior of the facility (including decomposed pests in traps). Pests or evidence of pests (such as fecal matter) on, or in any food ingredient, food contact surface,packaging material, or finished product (common pests include, but not limited to: insects, spiders,rodents, amphibians, mammals or birds). A product recall, serious incident, or Costco concern will initiate an immediate Costco GMP audit.These audits will be conducted independent of the anniversary audit timeline and will not impactGFSI Certification, if applicable.Note: – Applicable to Suppliers that Manufacture In, or Import to, the United States10V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

11 The facility cannot provide proof of FDA registration for the Bioterrorism Act, or are not incompliance with USDA requirements. A Hazard Analysis has not been established per FDA Preventive Controls requirements or USDAregulations. A hazard analysis is a systematic review that identifies, evaluates and controls hazardswhich are significant for food safety.Audit DatabasesAudit reports and corrective actions will be uploaded to a Costco audit database by the audit companyand must be translated to a language accepted by that country – i.e. English for the U.S. (please e-mailyour Costco food safety contacts for country-specific requirements). Audit companies are required toupload Costco audit reports (GMP, Small Supplier, Distribution/Warehouse and Packaging audits) andpreliminary GFSI certification reports within 7 calendar days from the date an audit is completed. Eachfacility is required to submit their corrective action plan (CAP) to the audit company within 14 calendardays of the audit report being posted to a Costco audit database. For Certification audits, the finalversion of the GFSI audit will be posted upon issuance. GFSI audits will follow the Certification Programowners’ timetable for posting.EFA (Enterprise Facility Audit) DatabaseWith the exception of fresh produce operations, all facilities are required to be registered in the EFA(Enterprise Facility Audit) database. As of the publication date of this document (11/30/2018), onlythe U.S. and Canada are active within the EFA database – though all Costco countries will eventuallyjoin EFA. For now, suppliers to other Costco countries should clarify their database registrationrequirements with a member of the respective Costco food safety team or their Costco buyers.Facilities that supply the U.S. can request registration forms by e-mailing [email protected]. Facilitiesthat supply Canada can e-mail [email protected]. If a facility supplies product to both Costco U.S.and Costco Canada, completed registration forms should be sent to the Costco U.S. team. Costco foodsafety staff will complete the actual registration process in the system.Because EFA is designed to hold audit documents for Costco’s internal reference only, facilities willnot have access to the EFA system. Only suppliers (the business that receives purchase orders fromCostco) will be credentialed in the system. Credentialing is a process in which Costco grants EFAaccess to verified supplier contacts. Credentialed users will have visibility to the status of audits, butwill not have access to the documents themselves. Suppliers who need access to audit documents canrequest these from the facility that paid for the audit, or from the audit company if a data-sharingagreement is in place. Credentialed supplier contacts can access the EFA database by following thelink sp11V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

12TraQtionAll facilities currently registered in the TraQtion database will be transitioned to EFA as their TraQtionregistrations expire. New and prospective Costco suppliers will be required to register in EFA, notTraQtion. Costco audit coordinators will contact each facility when they are eligible for EFAonboarding. If you have questions on the transition from TraQtion to EFA, please send an e-mail tothe Costco Food Safety Team: [email protected] Systems (Fresh Produce)Costco is using Azzule Systems to manage Fresh Produce audit information (i.e. audit reports,corrective actions, and certificates). Suppliers in Azzule are expected to maintain complete supplychain transparency for all product(s) sold to Costco. To that end, suppliers and audit companies shouldadhere to the following requirements.1. Suppliers should instruct their audit company to submit their Costco Addendum(s) using theAzzule Auditing Software.2. Additionally, audit companies should submit 3rd party food safety audits using the AzzuleAuditing Software or audit company Supply Chain Program (CB SCP), depending upon auditscheme. This submission process will post the audit to the auditee’s Supply Chain Program(SCP).3. Costco suppliers can then access their SCP to transfer the audit to Costco’s Azzule site. If thesupplier is not the auditee, they can retrieve the audit and then send to Costco’s Azzule site.The most current Costco Food Safety Audit Expectations and Addendum documents can be foundthrough this link on the Azzule dumsandexpectations.aspxFor Azzule related questions please contact Azzule Support by email at [email protected] or byphone:U.S.A 1 805-354-7127Mexico 52 66 77 16 50 37Chile 56 32 332504512V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

13Costco-Specific Food Safety Requirements.Costco Auditor Evaluations (Shadow Audits)Auditor evaluations are a key component of Costco’s Food Safety Audit Program because they enableus to determine auditor competency. This process, known in the industry as a Shadow Audit, takes placeduring audits at our suppliers’ facilities. During a shadow audit, a member of the Costco Food Safety staffwill accompany the auditor for the entire duration of the audit. Once the audit is completed, the Costcoemployee will complete a written auditor evaluation, which will be submitted to the audit company.During the evaluation, the Costco employee will examine all documentation reviewed by the auditor andwill also walk the entire facility during the inspection (interior and exterior). In addition, the Costcoevaluator will take notes during the audit on any observations that may have been overlooked in theaudit - though these items are not discussed until after the auditor is finished with the closing meeting.At no time are the Costco observations used for audit purposes, nor do they impact audit scoring. Toensure that Costco’s concerns are addressed, facilities must provide Costco with an e-mailed correctiveaction response for each observation.Costco appreciates supplier cooperation with this important program.Country-Specific Requirements for Costco International RegionsAll of the countries that Costco does business in have unique legal requirements that suppliers mustfollow. Questions on country-specific requirements for international regions should be directed to theappropriate Costco food safety team(s).HACCP and Preventive Controls (FSMA)HACCP Defined (Hazard Analysis Critical Control Point)According to the FDA, “HACCP is a systematic approach to the identification, evaluation, and control offood safety hazards based on the following seven principles.”Principle 1: Conduct a hazard analysis.Principle 2: Determine the Critical Control Points (CCPs).Principle 3: Establish critical limits.Principle 4: Establish monitoring procedures.Principle 5: Establish corrective actions.Principle 6: Establish verification procedures.Principle 7: Establish record-keeping and documentation procedures.13V1.0 Updated 4/17/19Costco Food Safety Audit Expectations

14Preventive Controls DefinedFSMA (Food Safety Modernization Act) – A U.S. Food Safety Act passed into law in 2011. The Actplaces emphasis on the prevention of foodborne illness rather than reacting to outbreaks of foodborneillness. The Act contains 7 rules: Preventive Controls for Food for Humans; Preventive Controls forFood for Animals; Sanitary Transport of Human and Animal Food; Produce Safety; Foreign SupplierVerification; and Accredited Third-Party Certification (used for the Voluntary Qualified ImporterProgram (VQIP)).Preventive Controls Rule takes HACCP a step further by requiring suppliers to become more proactiveinstead of reactive. Preventive Controls are those risk-based, reasonably appropriate procedures,practices and processes that a person knowledgeable about the safe manufacturing, processing, packingor holding of food would employ to significantly minimize or prevent the hazards identified under thehazard analysis. These controls must be consistent with the current scientific understanding of safe foodmanufacturing, processing, packaging or holding at the time of the analysis.USDA & FDA HACCP Programs Seafood, Juice and low acid canned foods fall under FDA HACCP regulations and must operate aHACCP plan for their operation.USDA Regulations apply to beef, pork, poultry, catfish and egg products. Items that are regulatedby the USDA are required to operate under a HACCP ProgramAll other food types will require a preventative controls planCostco’s HACCP/Preventive Control Requirements Processing facilities that do not supply Costco product to the U.S., but do supply Costco’sinternational regions, must operate under a HACCP Program or Preventative Control Plan. Each facility must have a written Food Safety Plan that includes a detailed risk assessment. Thefacility should use the results of the risk assessment to determine whether Critical Control Points orPreventive Controls are necessary. This is a Costco requirement, independent of regulatoryguidelines. Facilities that do not have an established HACCP Plan or Preventive Control Plan at the time of the

Apr 17, 2019 · required to have an annual third-party food safety audit. Suppliers located in China must complete two food safety audits per year. Fresh produce suppliers that grow, harvest, pack, cool, process, store, and distribute produce items are required to have an annual third-party food safety audit. All produce suppliers in China