Almost universally, concessions at sports stadiums (even at the college and high school levels), and other large event venues, are operated by outside contractors who are awarded the "concession" after a vetting/bidding process conducted by (probably) mid-level directors/managers of the venue. These contractors are usually multi-state regional or even national corporations. And, yes, the concession operators do track their beverage sales by cup count. Furthermore, if that cup count is significantly different from the sales register tracking at the end of the day, one or more minimum wage workers are going to be out of a job - unless there's a policy/authorization protocol already in place for dealing with situations like what occurred at Gillette on Sunday.
The larger the concession company, the more layers of management there are. My guess is that whichever corporation holds the concession for Gillette either doesn't have a policy to cover the Gillette situation or their on-site managers don't have the authority to approve the implementation of that policy and either couldn't or wouldn't contact a "higher-up" to get authorization.
Regardless, the responsibility for the debacle falls squarely on the shoulders of the concession operator, and certainly not on the Krafts themselves. However, the Krafts strike me as "the buck stops here" sort of people, so it seems likely to me that they'll take at least some measure of personal responsibility publicly at some point.