GROUP AUDIT PROGRAMMES

Running a Hygiene Audit Programme Across Many Sites: A Guide for Franchise Groups, Retail Chains and Multi Site Caterers

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 24 min read

A group hygiene audit programme is the head office system that audits every outlet against one checklist and one scoring model, sets visit frequency by risk, tracks repeat findings on a shared dashboard and escalates a failing site before an environmental health practitioner has to. Under R638, each premises still needs its own certificate of acceptability and its own trained person in charge. ASC Food Safety runs recurring hygiene audits and 5 star certification for South African groups, backed by online training and ASCloud.

What is a group hygiene audit programme?

A group hygiene audit programme is the planned set of hygiene audits a head office or franchisor runs across all its outlets, with shared objectives, one audit standard, a schedule set by risk, calibrated auditors and a defined way of acting on results. Head office manages it, while each outlet stays legally responsible for its own premises.

For what a single audit covers, from the R638 framework to the 11 step process, read our complete guide to food hygiene audits. This article is for the operations director or group food safety manager who has to make 20, 80 or 300 audits add up to one reliable picture.

The international guidance is ISO 19011, Guidelines for auditing management systems. ISO published the fourth edition, ISO 19011:2026, on 27 May 2026, and it replaced the 2018 edition. The Chartered Quality Institute describes the revision as evolutionary, with more guidance on remote auditing and digital tools. In the 2018 edition, clause 5 set out the programme cycle: set objectives, weigh risks and opportunities, establish, implement, monitor, then review and improve. It said the extent of a programme should reflect the size, nature, complexity, risks and maturity of what is audited, and that multiple locations need particular attention in the design, planning and validation of the programme.

What the programme document should contain

• Objectives. For example: every outlet at or above the target rating, and no outlet trading without a valid certificate of acceptability.
• Scope. Every premises, format and person in charge, including commissaries and food transport.
• Audit criteria. R638, the group’s operations manual and brand standards, and good manufacturing and hygiene practice.
• Frequency rules. How risk sets the number of visits per outlet, and what triggers an extra visit.
• Auditors. Who audits, their competence and how they are calibrated.
• Reporting and escalation. Report turnaround, the dashboard, and what a poor score leads to.
• Review. How the programme itself is reviewed, at least once a year.

Who is responsible: head office, the franchisee or the person in charge?

Under R638, the person in charge of each food premises carries the legal duties, and the certificate of acceptability is issued for that premises in that person’s name. A franchisor or head office sets the standard and checks it, but the outlet’s legal duties do not move to head office because a group audit programme exists.

Regulation R638 of 22 June 2018, made under the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972, defines the person in charge as a natural person who is responsible for the food premises or the owner of the premises. In a franchise that is normally the franchisee or the manager they appoint, not the franchisor. For a contract caterer it is usually the unit manager. Enforcement sits with municipal environmental health practitioners; the Garden Route District Municipality, for example, states that its municipal health department enforces R638 in its area.

What R638 says that matters for a group

• Regulation 3(1): no food handling on premises without a valid certificate of acceptability. Every outlet, kiosk and commissary needs its own.
• Regulation 3(6): changes to certified premises that relate to regulations 5 and 6 need advance written notice to the local authority, so build this into refit plans.
• Regulation 3(8): when the person in charge is replaced, the local authority must be told in writing within 30 days. In a large group this is easy to miss.
• Regulation 3(9)(a): the certificate is not transferable from one person to another or from one premises to another.
• Regulation 10: the person in charge must be trained, make sure staff are trained, assess the impact of training, keep training records for an inspector and make sure the regulations are complied with.

The franchise agreement is where audit rights live

Your right to audit, to visit unannounced and to act when an outlet keeps failing comes from the franchise agreement, the operations manual or, for caterers, the service contracts. In South Africa, franchise agreements fall under section 7 of the Consumer Protection Act 68 of 2008. As Fluxmans Attorneys explain, the agreement must be in writing and signed by or for the franchisee, must include a cooling off clause, and the regulations require a disclosure document at least 14 days before the franchisee signs. We are food safety auditors, not lawyers, so ask your franchise attorney to check that the agreement actually supports the audit and escalation rules you plan to use.

How do you make every audit score mean the same thing?

Use one checklist, one scoring model and one written scoring guide for every outlet, then calibrate the auditors who use them. Without calibration, 88 per cent from one auditor and 88 per cent from another are not the same result, and a league table built on those numbers will send head office to the wrong outlets.

Build the checklist once, with modules

Start with a common core for every premises, mapped to the R638 regulations: certificate and person in charge, structure and facilities, cleaning, pests, waste, protective clothing, personal hygiene, temperature control, storage, training and records. Then add modules for your formats, such as a drive through, in store bakery, central kitchen or school canteen. Outlets can then be compared within a format, and the core across the whole group.

Decide which items are critical. A missing handwash basin or high risk food held at unsafe temperatures should never be offset by clean floors, so cap or fail the score when a critical item fails. Then write a scoring guide that shows what full, partial and zero marks look like. “Cleaning adequate” means different things to different auditors; “no visible food residue on food contact surfaces and a cleaning schedule signed for the last seven days” does not.

Calibrate the auditors

1. Train on the guideEvery auditor works through the scoring guide with worked examples before their first group audit.
2. Joint auditsNew auditors audit alongside an experienced auditor and score independently. Compare the scores item by item afterwards.
3. Shadow scoringOnce or twice a year, two auditors score the same outlet on the same visit. Agree a tolerance for the difference in total score and investigate anything wider.
4. Rotate auditorsAvoid one auditor visiting the same outlet every time. Familiarity drifts scores up or down without anyone noticing.
5. Watch the numbersCompare each auditor’s average score and finding rate with the group, and talk to anyone consistently far from the rest.

The 2018 edition of ISO 19011 included the performance of audit team members in the monitoring of an audit programme, and calibration is how a group puts that into practice. For the skills to plan audits, write findings that stand up and follow up corrective action, our Internal and Supplier Auditing Practices course (20 hours, R3 500, about USD 215 · EUR 187 · GBP 160 · AED 787) covers audit programmes and plans, opening and closing meetings, corrective action and reporting.

How often should each site be audited?

Set audit frequency by risk rather than by habit. ISO 19011 ties the extent of an audit programme to the nature, complexity and risks of what is audited. For a food group, that means outlets with high risk menus, weak recent scores, repeat findings, new managers or recent complaints are audited more often than stable, lower risk outlets.

Risk factors to score for each outlet

• Menu and consumers: raw meat and poultry, cook chill, ready to eat foods, allergens, and vulnerable consumers such as schools and hospitals.
• Volume: trading hours, covers and delivery volumes.
• Performance: the last rating, the trend, open critical findings and repeat findings.
• People and premises: a new person in charge or franchisee, high turnover, a refit or a pest trend.
• Signals: complaints, an inspector visit or a supplier incident.

A workable starting point

These tiers are a planning aid, not a legal requirement. Review each tier after every audit, and let certificate validity set the latest date for the next audit. ASC’s audit process and rating system explains how validity works for each rating.

If your group is working towards FSSC 22000

Most restaurant and retail groups run R638 hygiene programmes, not certified systems. If you do pursue FSSC 22000, the FSSC 22000 Version 7 scheme allows multi site certification with sampling only for certain categories, including E (catering and food service) and FI (retail and wholesale). Part 2 clause 2.5.18 requires the central function to audit the management system, itself and all sites at least annually, or more often based on a risk assessment, using trained internal auditors. Under Part 3, a group with 20 sites or fewer has every site audited by the certification body; above 20, the minimum sample is 20 plus the square root of the number of sites above 20, rounded up, so 56 sites means at least 26 audits. If the central function or any site fails, the whole organisation does not gain certification.

Should group hygiene audits be announced or unannounced?

Use both, because they do different jobs. Announced audits suit certification, document review and time with the person in charge. Unannounced visits show how the outlet runs on an ordinary Tuesday. Daily digital self checks by each outlet fill the gaps between visits and tell head office where to send the auditor next.

ASC’s own rating scheme already uses surprise visits: a Gold certificate is typically valid for 12 months, with a potential unannounced inspection before expiry. For your own programme, write the unannounced visit rules into the franchise or service agreement: who may visit, when, and what happens if access is refused. Contract caterers also need the client’s site access rules.

If an outlet does well at announced audits and poorly at unannounced checks, that gap is a finding in itself: the outlet prepares for audits instead of running to standard, which usually points to supervision and culture. Our hygiene audit preparation tips describe what ready every day looks like.

What should a group hygiene dashboard show?

A useful dashboard shows each outlet’s latest score and rating, the trend over recent audits, open corrective actions and how old they are, repeat findings, certificate of acceptability status and training coverage. League tables help, but only when every score behind them comes from the same checklist and calibrated auditors.

The fields that earn their place

• Outlet, format, region, franchisee and person in charge.
• Certificate of acceptability held and in the current person in charge’s name.
• Latest score, rating, certificate expiry and the trend over recent audits.
• Open findings by severity, with due dates and days overdue.
• Repeat findings flagged by checklist item.
• Training coverage for the person in charge and food handlers.
• Pest activity trend, complaints and inspector visits.

League tables without the side effects

League tables motivate owners, but they also tempt people to argue about scores instead of fixing kitchens. A few rules keep them useful:

• Rank within a format and region, so a food court kiosk is not compared with a full kitchen.
• Show movement since the last audit; the most improved outlet deserves attention too.
• Keep the league table for internal use. Customers and landlords should see certificates, not rankings.

Tracking repeat findings

Code every checklist item and record findings against the code. An outlet repeat is the same item failing at consecutive audits at one outlet; a group repeat is the same item failing at many outlets. They need different responses.

An outlet repeat usually means the corrective action treated the symptom: the cold room was cleaned, but the cleaning schedule never changed. A group repeat usually points to head office: equipment that cannot hold temperature, a supplier delivering warm product or an unclear operations manual. Fix those centrally and the finding drops across the group. Our list of the most common hygiene audit findings is a good place to check which items tend to repeat, and the short Overview of Root Cause Analysis course (4 hours, R649, about USD 40 · EUR 35 · GBP 30 · AED 146) helps area managers get past the first answer.

What happens when a site keeps failing?

Agree an escalation ladder before you need it. Each step needs a trigger, an owner and a deadline, moving from a corrective action plan to a follow up audit, a support visit, a formal notice under the franchise or service agreement and, as a last resort, stopping food operations at the outlet until it is safe.

1. Result below targetThe person in charge submits a corrective action plan. Critical findings are made safe on the day.
2. Evidence checkFindings closed without photos or records stay open.
3. Follow up auditA targeted or full re-audit within an agreed period. In ASC’s scheme, a 1 star result earns no certificate, and corrective action and a re-audit are required.
4. Support visitIf the follow up still falls short, a specialist works on site with the person in charge and the team gets targeted training.
5. Formal noticeRepeated failure goes to the operations director for a formal notice under the agreement, with a fixed re-audit date.
6. Stop the riskIf food safety cannot be assured, the owner withdraws high risk items or stops food handling until the problem is fixed. Further steps follow the agreement and legal advice.

How do you link training to audit findings?

Map every recurring finding to a role and a course. R638 already requires the person in charge to be trained, to make sure staff are trained, to run routine assessments of the impact of training and to keep training records for inspectors. Audit findings are the most direct evidence of whether that training is working.

Blanket refresher training rarely changes a finding. Train the people whose tasks caused it, then check the item at the next audit. Recorded properly, that check becomes evidence for the routine assessment of training impact that regulation 10(1)(c) asks for.

Rand amounts in this table convert at roughly USD 61, EUR 53, GBP 46 or AED 225 per R1 000 at September 2026 rates.

For groups, the problem is administration. ASC’s training platform offers bulk enrolment, manager dashboards and completion reports for audit files, so head office can see which outlets still have untrained staff. Franchise groups including KFC and Spur train their teams with ASC.

Each outlet also needs documents that prove its controls. The TK11 Basic Food Safety Document Templates Toolkit (R699, about USD 43 · EUR 37 · GBP 32 · AED 157) gives you editable policies, procedures, forms, checklists and records aligned to R638, a practical base for one common document set across your outlets. TK11 is licensed per legal entity: head office buys one licence, and each franchisee or operating company that runs its own food safety system buys its own.

Where does pest control fit in a group programme?

Pest control is where a group contract pays off. R638 regulation 10(3) requires the person in charge to take effective measures to prevent or eliminate flies, other insects, rodents, birds and other pests. Pest findings recur across similar buildings, so one contractor and one report format keep the evidence consistent.

When every outlet uses a different pest company, each site has a different report and device map, and head office cannot see whether rodent activity is rising across a region. Agree these once, for every outlet:

• Service frequency by outlet risk, with call out response times.
• Numbered device maps and service reports that record activity and proofing recommendations.
• Trend reports per outlet and for the group, and a chemical register at each outlet.
• A pest risk assessment per premises, reviewed after changes. Our guide to the pest control risk assessment covers what goes into one.

The auditor reviews the pest file, then walks the drains, door gaps, refuse area and dry stores. Proofing recommendations left open from one service to the next belong on the dashboard, because the owner has to fund them.

How should head office handle a complaint or an EHP visit at one site?

Treat it as a group event with a local owner. The outlet’s person in charge deals with the customer or the inspector on the day. Head office supports the investigation, checks whether the same cause could exist at other outlets and decides whether they need an unannounced visit too.

On the day

• The person in charge cooperates with the environmental health practitioner, shows the certificate of acceptability and makes training records available, as regulation 10(1)(d) requires.
• Make any immediate risk safe and hold suspect food rather than discarding it.
• Record what the customer reported, without offering a diagnosis.
• Notify head office within the agreed time, with photos and any inspection report.

In the following days

• Investigate the root cause, then check other outlets that use the same supplier, equipment, recipe or procedure.
• Book a follow up audit at the affected outlet and, if the cause could be group wide, unannounced checks elsewhere.
• Close the inspector’s findings in writing within the time given, raise the outlet’s risk tier and report the outcome to the board.

Contract caterers should agree in advance who informs the client and who pays for structural findings.

How do you roll out ASC’s 5 star rating across a group?

Start with a baseline audit round at every outlet, agree the target rating for the group, then move each outlet onto a recurring schedule tied to its certificate’s validity and risk. Platinum and Gold certificates are typically valid for 12 months and Silver for 6 months, so the rating itself helps set the audit rhythm.

ASC’s rating runs from Platinum, Gold, Silver and Bronze certificates down to 1 star, where no certificate is issued, benchmarked against R638 and good manufacturing and hygiene practice. The full scoring and validity rules are in our hygiene audit guide, and the reasons groups choose ASC are set out in how ASC leads the way in food hygiene audits.

1. List the estateEvery premises, format, person in charge and certificate of acceptability status.
2. Brief the outletsExplain the programme, the target rating, the escalation ladder and the support available before the first visit.
3. Run the baseline roundAudit every outlet in a short window so the first results are comparable and the league table starts on a fair footing.
4. Support the lowest scorersCorrective action plans, targeted training and a re-audit for outlets that do not reach a qualifying rating.
5. Set the scheduleAssign each outlet a risk tier and a re-audit date that falls before its certificate expires.
6. Show the resultOutlets display their certificates, and certified clients can be listed on the ASC client database.

The certified hygiene audits client database lists each client’s rating and certificate expiry date and whether the certificate is still active. It supports verification and reference checks, which helps contract caterers whose clients ask for proof.

What should the board see?

Boards need a short, consistent view: the share of outlets at or above the target rating, the trend, overdue critical actions, repeat findings, certificate and training gaps, incidents and inspector visits, and the decisions needed. Keep outlet detail in the dashboard and bring only exceptions and decisions to the board.

A one page board pack

• Coverage and results: audits completed against plan, and outlets at each rating against last quarter.
• Exceptions: outlets below target, and where each sits on the escalation ladder.
• Legal and people: certificate of acceptability and training gaps.
• Repeats: the top group repeat findings and the central fix for each.
• Events: complaints, inspector visits and any prohibition order, with status.
• Decisions: spend, contract changes or policy changes needed.

At least once a year, review the programme itself, following the review and improvement step in ISO 19011: were objectives met, audits done on schedule, auditors consistent and effort placed where the risk was? Record what you change. Groups that report on food safety culture can add the culture index from the Culture Pack to the same page.

The same thinking applies upstream. Our guide to supplier and co-packer hygiene audits covers that side, and hygiene audits in company canteens covers the contract catering client’s view.

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for site specific advice.