Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 1, 11, and 16

[Docket No. FDA-2011-N-0146]

RIN 0910-AG66

Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Final rule.

SUMMARY:

The Food and Drug Administration (FDA or we) is adopting regulations to provide for accreditation of third-party certification bodies to conduct food safety audits of foreign food entities, including registered foreign food facilities, and to issue food and facility certifications, under the FDA Food Safety Modernization Act (FSMA). These certifications will be required for participation in the voluntary qualified importer program (VQIP) established under the Federal Food, Drug, and Cosmetic Act (FD&C Act). In addition, when the Agency has determined that an imported food is subject to certification under FSMA, the Agency may require a certification under this rule as a condition for admitting the food into the United States. FDA also expects that these regulations will increase efficiency by reducing the number of redundant food safety audits.

DATES:

This rule is effective January 26, 2016.

FOR FURTHER INFORMATION CONTACT:

Charlotte A. Christin, Office of Foods and Veterinary Medicine, Food and Drug Administration, 10903 New Hampshire Ave., Silver Spring, MD 20993, 301-796-7526.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary

I. Introduction and Background

A. FDA Food Safety Modernization Act

B. Purpose of This Rulemaking

C. The Proposed Rule

D. Public Comments

II. Legal Authority

III. Comments on What Definitions Apply to This Subpart (§ 1.600)

A. Definitions, Generally

B. Assessment

C. Audit

D. Audit Agent

E. Consultative Audit

F. Eligible Entity

G. Facility

H. Facility Certification and Food Certification

I. Food

J. Food Safety Audit

K. Foreign Cooperative

L. Regulatory Audit

M. Self-Assessment

N. Third-Party Auditor

IV. Comments on Who Is Subject to This Subpart (§ 1.601)

A. Limiting the Scope of the Rule to Regulatory Audits and Certifications

B. Exemption for Alcoholic Beverages

C. USDA Regulated Products

V. Comments on Recognition of Accreditation Bodies Under This Subpart

A. Who is eligible to seek recognition? (§ 1.610)

B. What legal authority must an accreditation body have to qualify for recognition? (§ 1.611)

C. What competency and capacity must an accreditation body have to qualify for recognition? (§ 1.612)

D. What protections against conflicts of interest must an accreditation body have to qualify for recognition? (§ 1.613)

E. What quality assurance procedures must an accreditation body have to qualify for recognition? (§ 1.614)

F. What records procedures must an accreditation body have to qualify for recognition? (§ 1.615)

VI. Comments on Requirements for Accreditation Bodies That Have Been Recognized Under This Subpart

A. How must a recognized accreditation body evaluate third-party certification bodies seeking accreditation? (§ 1.620)

B. How must a recognized accreditation body monitor the performance of third-party certification bodies it accredited? (§ 1.621)

C. How must a recognized accreditation body monitor its own performance? (§ 1.622)

D. What reports and notifications must a recognized accreditation body submit to FDA? (§ 1.623)

E. How must a recognized accreditation body protect against conflicts of interest? (§ 1.624)

F. What records requirements must an accreditation body that has been recognized meet? (§ 1.625)

VII. Comments on Procedures for Recognition of Accreditation Bodies Under This Subpart

A. How do I apply to FDA for recognition or renewal of recognition? (§ 1.630)

B. How will FDA review my application for recognition or for renewal of recognition and what happens once FDA decides on my application? (§ 1.631)

C. What is the duration of recognition? (§ 1.632)

D. How will FDA monitor recognized accreditation bodies? (§ 1.633)

E. When will FDA revoke recognition? (§ 1.634)

F. What if I want to voluntarily relinquish recognition or do not want to renew recognition? (§ 1.635)

G. How do I request reinstatement of recognition? (§ 1.636)

VIII. Comments on Accreditation of Third-Party Certification Bodies Under This Subpart

A. Who is eligible to seek accreditation? (§ 1.640)

B. What legal authority must a third-party certification body have to qualify for accreditation? (§ 1.641)

C. What competency and capacity must a third-party certification body have to qualify for accreditation? (§ 1.642)

D. What protections against conflicts of interest must a third-party certification body have to qualify for accreditation? (§ 1.643)

E. What quality assurance procedures must a third-party certification body have to qualify for accreditation? (§ 1.644)

F. What records procedures must a third-party certification body have to qualify for accreditation? (§ 1.645)

IX. Comments on Requirements for Third-Party Certification Bodies That Have Been Accredited Under This Subpart

A. How must an accredited third-party certification body ensure its audit agents are competent and objective? (§ 1.650)

B. How must an accredited third-party certification body conduct a food safety audit of an eligible entity? (§ 1.651)

C. What must an accredited third-party certification body include in food safety audit reports? (§ 1.652)

D. What must an accredited third-party certification body do when issuing food or facility certifications? (§ 1.653)

E. When must an accredited third-party certification body monitor an eligible entity that it has issued a food or facility certification? (§ 1.654)

F. How must an accredited third-party certification body monitor its own performance? (§ 1.655)

G. What reports and notifications must an accredited third-party certification body submit? (§ 1.656)

H. How must an accredited third-party certification body protect against conflicts of interest? (§ 1.657)

I. What records requirements must a third-party certification body that has been accredited meet? (§ 1.658)

X. Comments on Procedures for Accreditation of Third-Party Certification Bodies Under This Subpart

A. Where do I apply for accreditation or renewal of accreditation by a recognized accreditation body and what happens once the recognized accreditation body decides on my application? (§ 1.660)

B. What is the duration of accreditation by a recognized accreditation body? (§ 1.661)

C. How will FDA monitor accredited third-party certification bodies? (§ 1.662)

D. How do I request an FDA waiver or waiver extension for the 13-month limit for audit agents conducting regulatory audits? (§ 1.663)

E. When would FDA withdraw accreditation? (§ 1.664)

F. What if I want to voluntarily relinquish accreditation or do not want to renew accreditation? (§ 1.665)

G. How do I request reaccreditation? (§ 1.666)

XI. Comments on Additional Procedures for Direct Accreditation of Third-Party Certification Bodies Under This Subpart

A. How do I apply to FDA for direct accreditation or renewal of direct accreditation? (§ 1.670)

B. How will FDA review my application for direct accreditation or renewal of direct accreditation and what happens once FDA decides on my application? (§ 1.671)

C. What is the duration of direct accreditation? (§ 1.672)

XII. Comments on Requirements for Eligible Entities Under This Subpart

A. How and when will FDA monitor eligible entities? (§ 1.680)

B. How frequently must eligible entities be recertified? (§ 1.681)

XIII. Comments on General Requirements of This Subpart

A. How will FDA make information about recognized accreditation bodies and accredited third-party certification bodies available to the public? (§ 1.690)

B. How do I request reconsideration of a denial by FDA of an application or a waiver request? (§ 1.691)

C. How do I request internal agency review of a denial of an application or waiver request upon reconsideration? (§ 1.692)

D. How do I request a regulatory hearing on a revocation of recognition or withdrawal of accreditation? (§ 1.693)

E. Are electronic records created under this subpart subject to the electronic records requirements of part 11? (§ 1.694)

F. Are the records obtained by FDA under this subpart subject to public disclosure? (§ 1.695)

G. May importers use reports of regulatory audits by accredited certification bodies for purposes of subpart L of this part? (§ 1.698)

XIV. Editorial and Conforming Changes

XV. Executive Order 13175

XVI. Analysis of Economic Impact

XVII. Paperwork Reduction Act of 1995

XVIII. Analysis of Environmental Impact

XIX. Federalism

XX. References

Executive Summary

Purpose and Coverage of the Final Rule

This rule is part of FDA's implementation of FSMA, which intends to better protect public health by, among other things, adopting a modern, preventive, and risk-based approach to food safety regulation. In this document, we establish a program for accreditation of third-party certification bodies

1

to conduct food safety audits and issue certifications of foreign food facilities and foods for humans and animals for purposes of sections 801(q) and 806 of the FD&C Act. We are also codifying certain limited exemptions to mandatory import certification under 801(q) of the FD&C Act (21 U.S.C. 381).

1

As explained more fully in Response 1, in response to comments and for clarity, this final rule uses the term “third-party certification body” rather than either the term “third-party auditor” or the term, “third party auditor/certification body” (except that we will use the term “third-party auditor” in the definitions of “accredited third-party certification body” and “third-party certification body” in 21 CFR 1.600(c) and in the preamble discussion of those definitions in section III.A).

FSMA added section 808 to the FD&C Act (21 U.S.C. 384d), which directs FDA to establish a new program for accreditation of third-party certification bodies to conduct food safety audits and to certify that eligible foreign entities (including registered foreign food facilities) and food produced by such entities meet applicable FDA requirements for purposes of sections 801(q) and 806 of the FD&C Act. This rulemaking implements section 808 of the FD&C Act; we will recognize accreditation bodies to accredit third-party certification bodies, except for limited circumstances in which we may directly accredit third-party certification bodies.

FSMA specifies two uses for the food and facility certifications issued by accredited third-party certification bodies under this program. First, facility certifications will be used by importers to establish eligibility for VQIP under section 806 of the FD&C Act (21 U.S.C. 384b(a)). VQIP offers participating importers expedited review and entry of food that is part of VQIP. One condition of participation is importation of food from facilities audited and certified by third-party certification bodies accredited under this subpart. FDA issued draft guidance on VQIP on June 5, 2015 (80 FR 32136); the draft guidance may be accessed at

http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf

.

Second, section 801(q) of the FD&C Act gives FDA the authority to make a risk-based determination to require, as a condition of admissibility, that a food imported or offered for import into the United States be accompanied by a certification or other assurance that the food meets the applicable requirements of the FD&C Act. The authority to mandate import certification for food, based on risk, is one of the tools we can use to help prevent potentially harmful food from reaching U.S. consumers. When FDA has determined that a food import is subject to such certification under section 801(q) of the FD&C Act, FDA will require, as a condition of entry, a certification issued either by an accredited third-party certification body under this rule or by an agency or representative of the government of the country from which the food at issue originated, as designated by FDA.

In addition, facilities and importers may choose to use onsite audits conducted by third-party certification bodies accredited under the program set out in this rule in connection with meeting supplier verification requirements under FDA's final rules for Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food (final human preventive controls regulation) (80 FR55907, September 17, 2015); Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals (final animal preventive controls regulation) (80 FR 56169, September 17, 2015); and the Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals (published elsewhere in this edition of the

Federal Register

) (implementing sections 418 and 805 of the FD&C Act, respectively). Under those rules, in circumstances where an onsite audit is the appropriate supplier verification activity, such audit must be conducted by a “qualified auditor.” The definitions of “qualified auditor” in those rules make clear that an example of a potential qualified auditor includes, but is not limited to, an audit agent of a certification body that has been accredited in accordance with regulations in part 1, subpart M of this chapter (

i.e.,

this rule implementing section 808 of the FD&C Act).

Summary of Major Provisions of the Final Rule

This rule establishes the framework, procedures, and requirements for accreditation bodies and third-party certification bodies for purposes of section 808 of the FD&C Act. The rule sets requirements for the legal authority, competency, capacity, conflict of interest safeguards, quality assurance, and records procedures that accreditation bodies must demonstrate to be eligible for recognition. Accreditation bodies also must demonstrate capability to meet the FDA requirements that would apply upon recognition. Additionally, the rule establishes requirements for the legal authority, competency, capacity, conflict of interest safeguards, quality assurance, and records procedures that third-party certification bodies must demonstrate to be eligible for accreditation. Third-party certification bodies also must demonstrate capability to meet the applicable requirements of the rule that would apply upon accreditation.

Pursuant to FSMA section 307 (21 U.S.C. 384d), the rule requires accredited third-party certification

bodies to perform unannounced facility audits, to notify FDA upon discovering a condition that could cause or contribute to a serious risk to the public health, and to submit to FDA reports of regulatory audits conducted for certification purposes. The rule includes stringent requirements to prevent conflicts of interest from influencing the decisions of recognized accreditation bodies and accredited third-party certification bodies. The rule does not, however, establish the audit criteria that accredited third-party certification bodies will use in examining eligible entities for compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, because those criteria appear elsewhere in FDA regulations and the FD&C Act.

Costs and Benefits

Costs of the Third-Party final rule include compliance costs of accreditation bodies and certification bodies that choose to participate in our third-party program, and user fees imposed by FDA on accreditation bodies and certification bodies for application review and monitoring of program participants.

Table 1—Summary User Fee, Compliance, Undiscounted and Annualized Costs of the Third-Party (TP) Program per Participant

Eligible entity

Audited by

Certification bodies (CBs) currently

accredited under

other programs

CBs not accredited under any program

Total

SCENARIO 1

Number of section 801(q) Entities

10

65

75

Cost of Compliance with Program Requirements (TP Compliance Cost)

$694

$2,569

Section 801(q) Compliance Cost

$6,940

$166,985

$173,925

Number of section 806 Entities

145

971

1,116

TP Compliance Cost

$694

$2,569

Section 806 Compliance Cost

$100,630

$2,494,499

$2,595,129

Total TP Compliance Cost—Scenario 1

$2,769,054

SCENARIO 2

Number of section 801(q) Entities

10

65

75

TP Compliance Cost

$322

$2,197

Section 801(q) Compliance Cost

$3,220

$142,805

$146,025

Number of § 806 Entities

459

3,068

3,527

TP Compliance Cost

$322

$2,197

Section 806 Compliance Cost

$147,798

$6,740,396

$6,888,194

Total TP Compliance Cost—Scenario 2

$7,034,219

SCENARIO 3

Number of section 801(q) Entities

10

65

75

TP Compliance Cost

$227

$2,102

Section 801(q) Compliance Cost

$2,270

$136,630

$138,900

Number of section 806 Entities

801

5,359

6,160

TP Compliance Cost

$227

$2,102

Section 806 Compliance Cost

$181,827

$11,264,618

$11,446,445

Total TP Compliance Cost—Scenario 3

$11,585,345

The costs that accreditation bodies and certification bodies incur in complying with the regulation are necessarily less than the private benefits they accrue by becoming recognized or accredited, respectively. Through the third-party accreditation program more effective regulatory oversight is achieved. FDA will recoup resources in managing its third-party accreditation program through user fees that FDA intends to impose on participating accreditation bodies and third-party certification bodies.

I. Introduction and Background

A. FDA Food Safety Modernization Act

FSMA (Pub. L. 111-353), signed into law by President Obama on January 4, 2011, is intended to allow FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than relying primarily on reacting to problems after they occur. The law also provides new enforcement authorities to help achieve higher rates of compliance with risk-based, prevention-oriented safety standards and to better respond to and contain problems when they do occur. In addition, the law contains important new tools to better ensure the safety of imported foods and encourages partnerships with State, local, tribal, and territorial authorities and international collaborations with foreign regulatory counterparts. A top priority for FDA are those FSMA-required regulations that provide the framework for industry's implementation of preventive controls and enhance our ability to oversee their implementation for both domestic and imported food. To that end, we proposed the seven foundational rules listed in table 2 and

requested comments on all aspects of these proposed rules.

Table 2—Published Foundational Proposed Rules for Implementation of FSMA

Title

Abbreviation

Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food

2013 proposed human preventive controls regulation

78 FR 3646, January 16, 2013.

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption

2013 proposed produce safety regulation

78 FR 3504, January 16, 2013.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals

2013 proposed animal preventive controls regulation

78 FR 64736, October 29, 2013.

Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals

2013 proposed FSVP regulation

78 FR 45730, July 29, 2013.

Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications

2013 proposed third-party certification regulation (also referred to in this document as the proposed rule)

78 FR 45782, July 29, 2013.

Focused Mitigation Strategies To Protect Food Against Intentional Adulteration

2013 proposed intentional adulteration regulation

78 FR 78014, December 24, 2013.

Sanitary Transportation of Human and Animal Food

2014 proposed sanitary transportation regulation

79 FR 7006, February 5, 2014.

We also issued a supplemental notice of proposed rulemaking for the rules listed in table 3 and requested comments on specific issues identified in each supplemental notice of proposed rulemaking.

Table 3—Published Supplemental Notices of Proposed Rulemaking for the Foundational Rules for Implementation of FSMA

Title

Abbreviation

Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food

2014 supplemental human preventive controls notice

79 FR 58524, September 29, 2014.

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption

2014 supplemental produce safety notice

79 FR 58434, September 29, 2014.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals

2014 supplemental animal preventive controls notice

79 FR 58476, September 29, 2014.

FSVP for Importers of Food for Humans and Animals

2014 supplemental FSVP notice

79 FR 58574, September 29, 2014.

We finalized two of the foundational rulemakings listed in table 4 in September 2015.

Table 4—Published Foundational Final Rules for Implementation of FSMA

Title

Abbreviation

Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food

final human preventive controls regulation

80 FR 55908, September 17, 2015.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals

final animal preventive controls regulation

80 FR 56170, September 17, 2015.

As FDA finalizes these seven foundational rulemakings, we are putting in place a modern, risk-based framework for food safety that is based on the most recent science, that focuses efforts where the hazards are reasonably likely to occur, and that is flexible and practical given our current knowledge of food safety practices. To achieve this, FDA has engaged in a significant amount of outreach to the stakeholder community to find the right balance between flexibility and accountability in these regulations.

After FSMA was enacted in 2011, we have been involved in approximately 600 stakeholder engagements on FSMA and the proposed rules, including public meetings, webinars, listening sessions, farm tours, and extensive presentations and meetings with various stakeholder groups (Refs. 1, 2, 3). As a result of this stakeholder dialogue, FDA decided to issue the four supplemental notices of proposed rulemaking to share our current thinking on key issues and get additional stakeholder input on those issues. As we move forward into the next phase of FSMA implementation, we intend to continue this dialogue and collaboration with our stakeholders, through guidance, education, training, and assistance, to ensure that stakeholders understand and engage in their respective roles in food safety. FDA believes these seven foundational final rules, when implemented, will affect the paradigm shift toward prevention that was envisioned in FSMA and be a major step forward for food safety that will help protect consumers into the future.

B. Purpose of This Rulemaking

FSMA added section 808 to the FD&C Act which directs FDA to establish a new voluntary program for accreditation of third-party certification bodies to conduct food safety audits and to issue food and facility certifications to eligible foreign entities (including registered foreign food facilities) that meet our applicable requirements for purposes of sections 801(q) and 806 of the FD&C Act. This rulemaking implements section 808 of the FD&C Act; we will recognize accreditation bodies to accredit third-party certification bodies, except for limited circumstances in which we may directly accredit third-party certification bodies.

FSMA specifies two uses for the food and facility certifications issued by accredited third-party certification bodies under this program. First, facility certifications will be used by importers to establish eligibility for VQIP under section 806 of the FD&C Act. VQIP offers participating importers expedited review and importation for food from facilities audited and certified by third-party certification bodies accredited under this subpart. FDA issued draft guidance on VQIP on June 5, 2015 (80 FR 32136); the draft guidance may be accessed at

http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf

.

Second, section 801(q) of the FD&C Act gives FDA the authority to make a risk-based determination to require, as a condition of admissibility, that a food imported or offered for import into the United States be accompanied by a certification or other assurance that the food meets the applicable requirements of the FD&C Act. The authority to mandate import certification for food, based on risk, is one of the tools we can use to help prevent potentially harmful food from reaching U.S. consumers. When FDA has determined that a food import is subject to such certification under section 801(q) of the FD&C Act, FDA will require, as a condition of entry, a certification issued either by an accredited third-party certification body under this rule or by an agency or representative of the government of the country from which the food at issue originated, as designated by FDA.

This final rule will help FDA ensure the competence and independence of third-party certification bodies who are accredited to conduct foreign food safety audits to examine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, among other things. The document also will help ensure the validity and reliability of certifications offered to FDA for purposes of VQIP eligibility under section 806 of the FD&C Act and admissibility of an imported food subject to an FDA risk determination under section 801(q) of the FD&C Act.

The third-party certification program is part of FSMA's paradigm shift toward a modern, preventive, and risk-based approach to food safety regulation and new programs to facilitate global trade in safe food. Specifically, FSMA requires FDA to issue new preventive controls and produce safety standards that apply to domestic and foreign processors and producers. In addition, FSMA directs FDA to issue an FSVP regulation requiring importers to implement FSVPs that provide adequate assurances that their foreign suppliers produce food that is in compliance with processes and procedures, including risk-based preventive controls, that provide the same level of public health protection as those required under section 418 (concerning hazard analysis and preventive controls) or 419 (concerning produce safety) of the FD&C Act, as appropriate, and that is in compliance with sections 402 (concerning adulteration) and 403(w) (concerning misbranding regarding allergen labeling) of the FD&C Act. We emphasize that facilities and importers are not required to use third-party certification bodies accredited under this rule in meeting their supplier verification requirements under the final human or animal preventive controls or FSVP regulations. See section XIII.G.

By contrast, the third-party certification program established under section 808 of the FD&C Act focuses on food safety audits to certify that eligible foreign entities and the food produced by such entities meet applicable FDA requirements for purposes of sections 801(q) and 806 of the FD&C Act. Although importers must obtain facility certifications from accredited third-party certification bodies under this rule in order to be eligible for VQIP, we note that importers seeking to satisfy a requirement for certification as a condition of admissibility for an article of food under section 801(q) of the FD&C Act may offer a certification issued either by foreign governments designated by FDA to issue such certifications or by third-party certification bodies accredited under this rule.

Through FSMA we are transforming our role in the global food safety system, by building ever stronger partnerships with our foreign regulatory counterparts and by exploring opportunities to leverage private food safety activities to benefit of our system of public food safety assurances. We value the role that private audits can play in enhancing food safety when done properly, and we share common purpose with the food industry in ensuring the rigor and objectivity of those audits.

The final rule on accreditation of third-party certification bodies reflects the results of significant stakeholder engagement to help ensure that the rule achieves its public health goal, reflects industry best practices, and strikes the right balance between flexibility and accountability.

C. The Proposed Rule

FDA published a proposed rule for “Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications” (the proposed rule) on July 29, 2013. The proposed rule included eligibility requirements for accreditation bodies to qualify for recognition and requirements that accreditation bodies choosing to participate in the FDA program must meet, once recognized. We also proposed eligibility requirements for third-party certification bodies to qualify for accreditation and requirements that third-party certification bodies choosing to participate in the FDA program must meet, once accredited. We intended the proposed requirements to ensure the competency and independence of the accreditation bodies and third-party certification bodies participating in the program.

We also proposed procedures for recognition and accreditation, as well as requirements relating to monitoring and oversight of participating accreditation bodies and third-party certification bodies. These included procedures that we would follow when removing a third-party certification body or an accreditation body from the program. Further, we proposed requirements relating to auditing and certification of foreign eligible entities under the program, and for notifying us of conditions in an audited facility that could cause or contribute to a serious risk to the public health. In response to several requests, we extended the proposed rule comment period until January 27, 2014.

D. Public Comments

We received over 150 comments from accreditation bodies, certification bodies, members of the food industry, industry associations, foreign governments, State governments, public health organizations, public advocacy

groups, individual consumers, consumer groups, and others. Some submissions included signatures and statements from multiple individuals. Taken as a whole, the comments address virtually every provision of the proposed rule. In the remainder of this document, we describe the comments that are within the scope of this rulemaking, respond to them, and explain any revisions we made from the proposed rule.

A number of comments focus on the overarching issues of: (1) Alignment with voluntary consensus standards; (2) the use of private food safety schemes; (3) the relationship between the third-party certification program, foreign competent authorities, and FDA's international activities; and (4) the possible implications of the lack of qualified auditors on the third-party certification program. We address these comments generally below.

We received several comments on the overarching issue of the use of voluntary international consensus standards issued by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), including the following ISO/IEC standards: ISO/IEC 17000:2004 Conformity assessment—Vocabulary and general principles (ISO/IEC 17000:2004) (Ref. 4); ISO/IEC 17011:2004, Conformity assessment—General requirements for accreditation bodies accrediting conformity assessment bodies (ISO/IEC 17011:2004) (Ref. 5); ISO/IEC 17021:2011, Conformity assessment—Requirements for bodies providing audit and certification of management systems (ISO/IEC 17021:2011) (Ref. 6); ISO/IEC 17065:2012, Conformity assessment—Requirements for bodies certifying products, processes and services (ISO/IEC 17065:2012) (Ref. 7); and ISO/IEC 19011:2011, Guidelines for auditing management systems (ISO/IEC 19011:2011) (Ref. 8).

Some comments support the approach to ISO/IEC standards that we used when developing the proposed rule; some comments state that the process for developing these standards makes them unbiased. Other comments suggest we should place greater reliance on ISO/IEC standards, including some comments asserting that we should incorporate ISO/IEC standards by reference into the final rule. These comments encourage us to follow the example of a proposed rule issued by the Environmental Protection Agency and entitled, “Formaldehyde; Third-Party Certification Framework for the Formaldehyde Standards for Composite Wood Products” (78 FR 34795, June 10, 2013), which proposed to incorporate by reference certain international standards. These comments assert that by placing greater reliance on ISO standards, we could allow ISO's broader oversight program to complement FDA's management of these bodies.

Implementation of section 808 of the FD&C Act occurs against the backdrop of the broader Federal policies on consensus standards and conformity assessment under the National Technology Transfer and Advancement Act of 1995 (NTTAA) (Pub. L. 104-113). The NTTAA, together with the Office of Management and Budget (OMB) Circular A-119, revised February 10, 1998 (63 FR 8546, February 19, 1998), directs Federal Agencies to use voluntary consensus standards in lieu of government-unique standards except where inconsistent with law or otherwise impractical. OMB CircularA-119 states that the use of voluntary standards, whenever practicable and appropriate, is intended to eliminate the cost to government of developing its own standards and decrease the cost of goods procured and the burden of complying with Agency regulation; provide incentives and opportunities to establish standards that serve national needs; encourage long-term growth for U.S. enterprises and promote efficiency and economic competition through harmonization of standards; and further the policy of reliance upon the private sector to supply government needs for goods and services.

As directed by OMB in CircularA-119, the National Institute of Standards and Technology (NIST), in the

Federal Register

of August 10, 2000 (65 FR 48894), issued policy guidance on Federal conformity assessment activities (defined as activities concerned with determining directly or indirectly that requirements for products, services, systems, and organizations are fulfilled) (15 CFR 287.2). The Federal conformity assessment guidance is codified at 15 CFR part 287 and applies to all Federal Agencies that set policy for, manage, operate, or use conformity assessment activities or results, domestically and internationally (except for activities conducted pursuant to treaties) and is intended to eliminate unnecessary duplication and complexity in conformity assessment requirements. (We note that OMB has announced it is currently revising Circular A-119, and NIST is revising the Federal conformity assessment guidance.)

We agree with comments on the value of promoting international consistency and tapping into an existing framework of consensus standards that is familiar to industry, which may make it easier for accreditation bodies, third-party certification bodies, and eligible entities to comply with this rule. Therefore, we are revising the rule to allow for accreditation bodies and third-party certification bodies to use documentation of their conformance with ISO/IEC standards in meeting the program requirements under this rule, supplemented as necessary. We are not, however, incorporating these standards by reference into the rule as further discussed in our responses to comments in sections III. to XIII., except that we are not further responding to comments citing specific requirements of ISO/IEC Guide 65:1996, Conformity assessment—Requirements for bodies providing audit and certification of management systems (ISO/IEC Guide 65:1996) (Ref. 9) in sections III. to XIII., because that standard has been withdrawn and replaced by ISO/IEC 17065:2012 (Ref. 7) in September 2015. Comments referring to ISO/IEC 17020:2012, Conformity assessment—Requirements for the operation of various types of bodies performing inspection (ISO/IEC 17020:2012) (Ref. 10) are outside the scope of this rulemaking, because that standard relates to inspections and not the auditing and certification activities that will be performed under this rule. Therefore, we are not responding to comments citing to ISO/IEC 17020:2012, Conformity assessment—Requirements for the operation of various types of bodies performing inspection (ISO/IEC 17020:2012) (Ref. 10) in sections III. to XIII.

We also received several comments on the overarching issue of using private food safety schemes as audit criteria for regulatory audits conducted under the third-party certification program. Some comments suggest that FDA should rely on private food safety schemes, particularly those that have been benchmarked by the Global Food Safety Initiative (GFSI), as the audit criteria for regulatory audits of eligible entities under the third-party certification program. Other comments suggest that FDA should establish requirements for accreditation bodies and third-party certification bodies that are similar to those required by GFSI, such as GFSI requirements relating to accreditation under relevant ISO/IEC product certification or management system standards.

By way of background, a group of international retailers established GFSI in 2000 with the goal of reducing the need for duplicative third-party audits by benchmarking private food safety schemes against a harmonized set of

criteria for food safety and management systems (see 78 FR 45782 at 45788; July 29, 2013). Under current GFSI criteria, a food safety scheme must have a commitment with one or more accreditation bodies for certification bodies that operate in conformance with either the product certification standard, ISO/IEC Guide 65, or the management system standard, ISO/IEC 17021:2006 (supplemented by ISO/TS 22003). GFSI describes these standards as having similar requirements for how a certification body must operate—

e.g.,

in addressing issues of preventing conflict of interest, managing customer information, properly qualifying personnel, auditor calibration, and many other aspects involved with the certification process. However, as GFSI noted in a 2011 White Paper (Ref. 11), there is a distinct difference between the two. ISO 17021/ISO 22003 is not product specific. ISO/IEC Guide 65, on the other hand, is concerned with verifying that particular products or services meet specified requirements. The type and scope of GFSI benchmarked scheme selected, determines the accreditation standard which applies. The majority of GFSI recognized schemes fall under ISO/IEC Guide 65 accreditation requirements, whereas only two currently recognized schemes are management system schemes accredited to ISO 17021/ISO 22003.

Comments suggesting that we should rely on GFSI-benchmarked food safety schemes or other private food safety schemes as the criteria for certification under the third-party program are outside the scope of this rulemaking. This rule establishes the framework for the third-party certification program, and not the food safety standards that accredited third-party certification bodies will use to determine an eligible entity's compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. We are however responding to relevant comments that address audit quality and auditor competency, consistency, and capacity, including comments referencing GFSI's work in these areas.

Other overarching comments ask how the FSMA third-party certification program relates to the roles of foreign competent authorities and to FDA's international activities. Some comments assert that competent authorities should be allowed to participate in the third-party certification program purely by administrative procedures without a formal review process. Other comments suggest that government agencies with both regulatory and trade promotion missions face inherent conflicts of interest.

Some comments recommend that we should establish a different structure for accrediting third-party certification bodies that already have been approved by a foreign government accreditation body. Other comments suggest that FDA should reserve the role of accreditation body or third-party certification body for a national competent authority that requests it. The comments argue that the responsibility for monitoring the safety of food exports should remain with the national competent authorities in each country.

Some comments ask whether a national competent authority has a role in auditing and certification activities occurring in the country, including in countries where an FDA foreign office is located. Other comments ask whether the competent authority may perform other activities in the third-party certification program, such as authentication of audit information before it is submitted to FDA. Still other comments suggest that FDA require accredited third-party certification bodies to review correspondence between an audited eligible entity and the competent authorities in the country where the eligible entity is located.

Section 808 of the FD&C Act expressly provides for both public and private accredited third-party certification bodies. Public accreditation bodies and third-party certification bodies, as well as private accreditation bodies and third-party certification bodies that meet the eligibility requirements for recognition and accreditation under section 808 of the FD&C Act and this rule are equally eligible to participate in the third-party certification program. This includes government accreditation bodies and certification bodies in countries where FDA has a foreign office, as well as government agencies with the dual missions of food safety and trade promotion. We believe that both public and private third-party certification bodies and accreditation bodies are capable of exhibiting the competency, capacity, and impartiality necessary to meet the letter and spirit of the law and this regulation.

By becoming an accredited third-party certification body or a recognized accreditation body, a competent authority for food safety or a foreign accreditation body would establish a role in the third-party certification program. Only if competent authorities are accredited under this rule, may they issue food and facility certifications under section 808 of the FD&C Act. (We note, however, that FDA may require certifications from competent authorities under section 801(q) of the FD&C Act for foods that FDA determines meet the criteria set forth in that section (see 801(q)(3)(A) of the FD&C Act), regardless of whether the competent authorities are accredited.) We acknowledge that the third-party certification program that is the subject of this rule is narrowly tailored and only a small piece of the much larger modernized, prevention-oriented food safety system we are establishing under FSMA. Broader FSMA activities are outside the scope of this rulemaking, as are matters covered by FDA's information sharing arrangements with foreign competent authorities.

We received other comments on the overarching issue of how the third-party certification program fits into FDA's international activities. Some comments assert that, for countries with a systems recognition agreement with FDA, there should be no need for a (direct or indirect) role for FDA in monitoring accredited third-party certification bodies. Other comments encourage us to recognize their national food safety system as equivalent to that of the United States.

The systems recognition initiative is a food safety regulatory cooperation program that allows FDA to take into account the role of food safety systems of exporting countries in our risk-based decisionmaking. We are using systems recognition as a tool to determine when we can rely on the implementation of science-based food safety programs by foreign regulatory authorities and take action based on information provided by such authorities.

We note that a competent authority with whom FDA has a systems recognition agreement must apply for recognition to make accreditation decisions and apply for accreditation to issue certifications under section 808 of the FD&C Act. If the competent authority applies for recognition or direct accreditation by FDA (assuming that the statutory criteria have been met for FDA to begin direct accreditation), FDA's review will be informed by the data, experiences, and insights into the foreign system that FDA gained through the systems recognition review. Except as described above, systems recognition activities are outside the scope of this rulemaking, as are equivalency determinations.

We also received several overarching comments noting that the lack of qualified food safety auditors is a problem in many countries. Some comments suggest that we may face similar problems with the availability of accredited third-party certification

bodies in our program. The comments assert that we should prioritize the review of applications from foreign countries with significant volumes of exports to the United States because of the cost and inconvenience to foreign suppliers and the likely trade disruption that would result if the only accredited third-party certification bodies were located in other countries. Some comments predict that rapid expansion in the field of food safety auditing may result in shortcuts in auditing. Other comments contend that because of the limited availability of qualified auditors we should adjust the timeframes for accredited third-party certification bodies to submit information to FDA under the regulations. The comments specifically request that we lengthen the 45-day timeframe for submitting regulatory audit reports.

We acknowledge the concerns about cost, inconvenience, and disruption resulting from auditor capacity issues. We are encouraging broad program participation to minimize the likelihood that capacity issues might emerge, because certifications issued by accredited third-party certification bodies under this program are intended to facilitate trade. The certifications are used in meeting the eligibility requirements of VQIP for expedited entry of food under section 806 of the FD&C Act and in satisfying a condition of admissibility for a food subject an FDA determination under section 801(q) of the FD&C Act.

Revisions have been made to this rule made in response to comments, such as allowing accreditation bodies and third-party certification bodies to use documentation of their conformance with ISO/IEC standards in support of their applications. We also are modifying our “first in, first out” approach to processing applications, as comments request, to allow for prioritizing specific applications and requests based on program needs. We are unable to accommodate the request to lengthen the timeframe for submission of regulatory audit reports to FDA, because the 45-day deadline for submission is established in section 808(c)(3)(A) of the FD&C Act. Audit protocols and other requirements of the rule are designed to prevent audit agents (auditors) and third-party certification bodies from taking shortcuts that would jeopardize audit results.

Some comments addressed the Model Accreditation Standards that FDA is required to develop under section 808(b)(2) of the FD&C Act for use in qualifying third-party certification bodies for accreditation. Some of these comments suggest various criteria to be included in the model standards. Other comments suggest the proposed rule was ambiguous with respect to the form of, and manner by which, FDA will establish the Model Accreditation Standards.

While the substance of the Model Accreditation Standards is outside the scope of this rulemaking, we note that on July 24, 2015, FDA published a draft guidance on Model Accreditation Standards. The draft guidance can be accessed at:

http://www.fda.gov/Food/GuidanceRegulation/GuidancevDocumentsRegulatoryInformation/ucm455328.htm

. Additionally, a notice was published in the

Federal Register

(80 FR 44137, July 24, 2015) of the availability of the draft guidance and of the opening of a docket for public comments on the document. As explained in the draft guidance, section 808(b)(2) of the FD&C Act requires FDA to develop Model Accreditation Standards that recognized accreditation bodies shall use to qualify third-party certification bodies for accreditation, and in so doing, to look to existing standards for certification bodies (as of the date of enactment of FSMA) to avoid unnecessary duplication of efforts and costs. The draft guidance contains FDA recommendations on third-party certification body qualifications, including recommendations based on relevant provisions in the proposed rule. This final rule will serve as a framework for the Model Accreditation Standards final guidance, which will include more detailed recommendations on third-party certification body qualifications.

Some comments respond to our request for input on the question about the value of, and possible need for, FDA to establish a program for use of accredited third-party certification bodies to conduct domestic food safety audits (78 FR 45782 at 45823). We received comments on all sides, expressing various views. We are taking these comments under advisement at this time, as the focus of this final rule is on establishing and implementing the third-party certification program set forth in section 808 of the FD&C Act.

Other comments addressed the substance of VQIP, import certification, laboratory accreditation, and provisions in the proposed FSVP rule and/or other FMSA rules that are outside the scope of this rulemaking; accordingly we will not be responding to those comments here. Other comments that fall outside the scope of this rulemaking, and to which we will therefore not be responding, include comments on the value of a universal, mandatory food safety system; comments advocating for policies promoting locally grown produce; comments addressing the information technology infrastructure needs of the third-party certification program; comments suggesting the value of student interns to the food safety system; and comments on factors beyond the use of third-party audits that FDA should consider in setting inspection priorities.

We also received a few comments concerning the rulemaking process. Comments suggest that we devise a new process for regularly updating the rule; they state that FDA has cumbersome requirements for modifying rules. FDA's current rulemaking process is consistent with FDA's obligations under the Administrative Procedure Act (5 U.S.C. 551-559).

II. Legal Authority

Section 307 of FSMA, Accreditation of Third-Party Auditors, amends the FD&C Act to create a new provision, section 808, under the same name. Section 808(b)(1)(A) of the FD&C Act requires us to establish a system, within 2 years of the enactment of FSMA, for the recognition of accreditation bodies that accredit third-party certification bodies to conduct food safety audits and to issue certifications for eligible foreign food entities and their products for purposes of sections 801(q) and 806 of the FD&C Act.

Section 808(c)(5)(C) of the FD&C Act directs us to issue implementing regulations for section 808 of the FD&C Act. The regulations must require audits to be unannounced and must contain protections against conflicts of interest between accredited third-party certification bodies (and their audit agents) and the entities they audit or certify, including requirements on timing and public disclosure of fees and appropriate limits on financial affiliations (21 U.S.C. 384d(c)(5)(C)(i), (ii), and (iii)).

This final rule establishes regulations implementing section 808 of the FD&C Act. The authority for the requirements in this rule comes primarily from section 808 of the FD&C Act. However, FDA also derives authority for this final rule from other sections of the FD&C Act, including section 701(a) of the FD&C Act (21 U.S.C. 371(a)), which authorizes us to issue regulations for the efficient enforcement of the FD&C Act. The regulations in this final rule ensure the competency and independence of recognized accreditation bodies and of accredited third-party certification bodies, which will help ensure the validity and reliability of certifications and other information resulting from the food safety audits conducted by

accredited third-party certification bodies. These features of the final rule are essential to the operation of the third-party program. This rule also is consistent with section 404 of FSMA (21 U.S.C. 2252), which states that nothing in FSMA should be construed in a manner that is inconsistent with the agreement establishing the World Trade Organization or any other treaty or international agreement to which the United States is a party.

This rule establishes requirements for accreditation bodies and third-party certification bodies seeking recognition and accreditation, respectively. These requirements will help ensure that any accreditation bodies that we recognize, and any certification bodies that are accredited, are capable of meeting all of the requirements of this program. This includes requirements, for example, for legal authority and competency and capacity. It also includes provisions for the direct accreditation of third-party certification bodies by FDA in accordance with section 808(b)(1)(A)(ii) of the FD&C Act. This rule also establishes requirements for accreditation bodies that have been recognized, and third-party certification bodies that have been accredited. This includes requirements designed to decrease the potential for conflicts of interest in accordance with section 808(c)(5)(C)(ii) of the FD&C Act. Additionally, this rule establishes requirements for eligible entities that want to be certified under this program. This includes requirements for onsite audits by FDA for the purpose of monitoring in accordance with section 808(f)(3) of the FD&C Act. Finally, this rule establishes general requirements related to the operation of this program. These include requirements for requesting a regulatory hearing on revocation of recognition or withdrawal of accreditation.

Some of the requirements under this final rule are also established, in part, under the authority in sections 806 and 801(q) of the FD&C Act. Section 806 of the FD&C Act describes a voluntary program to provide for the expedited review and importation of food offered for importation from certified facilities (VQIP). Section 801(q) of the FD&C Act gives FDA authority to require certifications for imported food in certain situations. This final rule does not set up the framework for participation in the program described under section 806 of the FD&C Act, nor does it describe the circumstances under which FDA might require certification under section 801(q) of the FD&C Act. However, this rule does describe circumstances under which FDA might refuse to consider a certification issued under this program in determining the admissibility of an article of food for which the certification was offered under section 801(q) of the FD&C Act, or in determining eligibility for participation in VQIP under section 806 of the FD&C Act. Additionally, this rule creates limited exemptions from the certification requirements of section 801(q) of the FD&C Act for certain alcoholic beverages, including certain raw materials and ingredients that are used to manufacture/process alcoholic beverages. The exemptions are being promulgated consistent with section 116 of FSMA (21 U.S.C. 2206). Section 116(a) of FSMA states that, except as provided by certain listed sections in FSMA, nothing in FSMA, or the amendments made by FSMA, will be construed to apply to a facility that: (1) Under the Federal Alcohol Administration Act (27 U.S.C. 201

et seq.

) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001

et seq.

) is required to obtain a permit or to register with the Secretary of the Treasury as a condition of doing business in the United States and (2) under section 415 of the FD&C Act (21 U.S.C. 350d) is required to register as a facility because such facility is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages (with respect to the activities of such facility that relate to the manufacturing, processing, packing, or holding of alcoholic beverages). This rule also creates exemptions from the certification requirements of section 801(q) of the FD&C Act for products subject to the requirements of the U.S. Department of Agriculture (USDA) under the Federal Meat Inspection Act (FMIA) (21 U.S.C. 601

et seq.

), the Poultry Products Inspection Act (PPIA) (21 U.S.C. 451

et seq.

), or the Egg Products Inspection Act (EPIA) (21 U.S.C. 1031

et seq.

) at the time of importation. We conclude that this provision is consistent with section 403 of FSMA, entitled “Rule of Construction,” which states that nothing in FSMA shall be construed to alter or limit the jurisdiction of the Secretary of the Department of Agriculture.

III. Comments on What Definitions Apply to This Subpart (§ 1.600)

We proposed to codify definitions of several terms used in the third-party certification regulations. We received several comments on this section. As discussed in the following paragraphs, we have revised many of the proposed definitions in response to comments as well as on our own initiative. Where we disagree with comments or decline a suggested revision, we offer an explanation in response. Some definitions were finalized as proposed.

The definitions for terms used in the third-party certification regulations are codified in 21 CFR 1.600.

A. Definitions, Generally

(Comment 1) Several comments encourage us to more closely align the definitions in § 1.600 with international standards to promote consistency and common understanding of the rule. The comments explain that the terms and definitions used in section 808 of the FD&C Act and in the proposed rule convey a different meaning for accreditation bodies, certification bodies, and the standards community. To that end, some comments encourage us to avoid using the term “third-party auditor” synonymously with “certification body,” to be consistent with international standards, which use the term “certification body” (

e.g.,

ISO/IEC 17065:2012 (Ref.7).

Similarly, some comments indicate that, the language of the statute notwithstanding, it is not correct to use the term “third-party auditor” when describing the activities of a “third-party certification body.” The comments explain that auditors are individuals contracted or employed by certification bodies to conduct audits, and they urge us to clarify the rule by substituting “certification body” for “third-party auditor.”

(Response 1) We agree that alignment with the terminology used in international standards is preferable, wherever possible. Congress recognized the value of international standards in accreditation and certification, having instructed us in section 808(b)(2) of the FD&C Act to look to existing standards in developing our model accreditation standards to avoid unnecessary duplication of efforts and costs. We believe it is particularly useful to rely on definitions and terminology from international consensus standards when possible where, as here, the rule is establishing a voluntary program with an international focus. In addition, we agree that, notwithstanding the use of the term “third-party auditor” in the statute, the use of the term “third-party certification body” instead of the term “third-party auditor” provides some clarity for purposes of referring to bodies that employ or contract individuals to perform audits.

Therefore, in response to the comments suggesting the term “third-party auditor” is confusing and inconsistent with international standards, we are using the term “third-party certification body” in the

remainder of the preamble and in the codified of this final rule, except in the definitions of “Accredited third-party certification body” and “Third-party certification body” in § 1.600(c) and in the preamble discussion of those definitions.

On our own initiative, we are including the descriptor “third-party” before “certification body” throughout this final rule. We did not use that descriptor in the proposed rule when referring to a third-party auditor/certification body once accredited. We are doing so now in order that the term accurately reflects that, under this subpart, only third-party certification bodies are eligible for accreditation. We are making corresponding changes to the term “accredited auditor/certification body;” and in this final rule we will instead use the term, “accredited third-party certification body.”

Accordingly, we have revised the proposed definitions of “accreditation,” “accreditation body,” “accredited auditor/certification body,” “audit,” “audit agent,” “certification body,” “direct accreditation,” “eligible entity,” “facility certification,” “food certification,” “recognized accreditation body,” “relinquishment,” and “self-assessment,” to replace the term “third-party auditor” with the term “third-party certification body,” or “third-party certification bodies,” and to remove “auditor/” from in the term “third-party auditor/certification body” or “third-party auditors/certification bodies” that was used in the proposed rule.

On our own initiative, we added a sentence to the definition of “accredited third-party certification body” in § 1.600 of this final rule to explain that the term has the same meaning as “accredited third-party auditor” as defined in section 808(a)(4) of the FD&C Act. Similarly, we added language to the definition of “third-party certification body” in § 1.600 of this final rule explaining that the term has the same meaning as “third-party auditor” as defined in section 808(a)(3) of the FD&C Act.

(Comment 2) Some comments encourage us to make the definitions in this rule consistent with the definitions in other FSMA proposed rules, such as the 2013 proposed FSVP regulation, the 2013 proposed human preventive controls regulation, the 2013 proposed animal preventive controls regulation, and the 2012 proposed produce safety regulation, where feasible.

(Response 2) We agree with the comments on the overarching goal of alignment across regulations and accepted suggested revisions, where feasible and appropriate. However, it is not always possible to develop uniform definitions due to the distinct statutory requirements and the framework of each program. In such cases where it was not feasible or appropriate, we declined the suggested revisions from comments. We discuss such comments and our responses under each relevant term.

B. Assessment

We did not define “assessment” in the proposed rule.

(Comment 3) Some comments recommend adding a definition of “assessment” based on ISO/IEC 17011:2004 (Ref. 5), clause 3.7, which describes the process for evaluating certification bodies. The comments explain that defining such evaluations as “audits,” as we had proposed, is inconsistent with international standards. The comments suggest consulting with other ISO/IEC standards for relevant terminology.

(Response 3) We agree that the term “assessment” should be used, in part, to refer to the activity undertaken to assess the competency and capacity of a third-party certification body under the rule. We reviewed ISO/IEC 17011:2004 (Ref. 5) (clause 3.7 and NOTE) and ISO/IEC 17000:2004 (Ref. 4), ISO/IEC 17040:2005 Conformity assessment—General requirements for peer assessment of conformity assessment bodies and accreditation bodies (ISO/IEC 17040:2005) (Ref. 12), and an International Accreditation Forum (IAF) document entitled, “IAF Endorsed Normative Documents” (Ref. 13).

After considering the comments and reviewing the referenced documents, we developed a definition of “assessment” that describes, with respect to accreditation bodies, the activity undertaken by FDA to evaluate the competency and capacity of the accreditation body under the applicable requirements of this rule. With respect to certification bodies, “assessment” describes the activity undertaken by a recognized accreditation body (or, in the case of direct accreditation, FDA) to evaluate the competency and capacity of a certification body under the applicable requirements of this rule. We also made corresponding changes to the definition of “audit” from proposed § 1.600(c) by removing clauses (1) and (2).

C. Audit

We proposed a definition of “audit” describing the examination of accreditation bodies, third-party certification bodies, and eligible entities. We proposed to define an audit of an accreditation body as an examination by FDA of the accreditation body's authority, qualifications, resources, policies, procedures, and performance, as well as of its capability to meet the requirements of the proposed rule. We proposed to define an audit of a third-party certification body as an examination by a recognized accreditation body (or, by FDA, for direct accreditation) of the third-party certification body's authority, qualifications, resources, policies, procedures, and performance, as well as of its capability to meet the requirements of the proposed rule. We proposed to define an audit of an eligible entity as an examination by an accredited third-party certification body of the eligible entity to assess the entity, its facility, system(s), and food using audit criteria for consultative or regulatory audits, and, for consultative audits, also including an assessment of compliance with applicable industry standards and practices.

We received some comments on the proposed definition of “audit,” and the related definitions of “consultative audit” and “regulatory audit.” Comments specific to the definition of “consultative audit” are discussed in section III.E., and comments on the definition of “regulatory audit” are discussed in section III.L. As described in Response 3, we also removed clauses (1) and (2) from the proposed definition of “audit” because those evaluations are “assessments” as the term is defined in § 1.600(c).

On our own initiative, we are revising the definition of “audit” to clarify that an audit conducted under this subpart is not an inspection under section 704 of the FD&C Act (21 U.S.C. 374).

(Comment 4) Several comments encourage us to align our definition of audit with relevant international standards, and some comments request that we use the definition of “audit” from the Codex “Principles for Food Import and Export Inspection and Certification” (CAC/GL 20-1995) (Ref. 14), which defines “audit” as a “systematic and functionally independent examination to determine whether activities and related results comply with planned objectives.”

(Response 4) We agree with the general principle of creating consistency with international standards and have revised the definition of “audit” in § 1.600(c) accordingly. Rather than describing the determination of whether activities comply with “planned objectives” that appears in the Codex definition of “audit” (Ref. 14), we inserted a brief description of the objectives of consultative and regulatory audits from the definitions in section 808(a)(5) and (7) of the FD&C Act (

i.e.,

the examination of an eligible entity under this rule).

(Comment 5) Some comments encourage us to remove the proposed definition of “audit” in § 1.600(c) and substitute the FSVP definition of “audit” instead, to promote consistency and a common understanding of terminology.

(Response 5) We disagree. We believe that it is more important for the definition in this rule to reflect international standards that are generally well known to the parties subject to this rule than it is for the definition to mirror the definition in FSVP, which has different applicability. FSVP applies to importers; this rule applies to accreditation bodies, third-party certification bodies, and eligible entities. Therefore, we are rejecting the suggestion to use the FSVP definition of “audit” as the definition of “audit” in § 1.600(c).

(Comment 6) We received some comments on the definition of “audit” regarding its relationship to the related definitions of “consultative audit” and “regulatory audit” in § 1.600(c). Some comments recommend that we revise the definition of “audit” to mean only regulatory audits, and not consultative audits, asserting that is how the word “audit” is used in the statute. These comments contend that the statute must be interpreted in light of the fact that section 808 of the FD&C Act is directed to food and facility certifications, which are only accomplished through regulatory audits. Other comments ask us to clarify that the services of an accredited third-party certification body that fall short of the definition of an “audit” (

e.g.,

informal consulting, continuous improvement programs, and limited purpose audits) under this rule, are not subject to the requirements of the rule.

(Response 6) We decline the suggestion to interpret section 808 of the FD&C Act in a manner that would equate “audit” with “regulatory audit.” Section 808 of the FD&C Act defines two types of audits used under the program, consultative audits and regulatory audits, and contains requirements relating to each. (See,

e.g.,

section 808(a)(5), (7), and (c)(3)(A) of the FD&C Act). In addition, section 808(c)(4)(B) of the FD&C Act expressly allows an accredited third-party certification body or an audit agent of such auditor to perform consultative and regulatory audits of eligible entities.

To the extent that other comments suggest creating a list of exceptions from the definition of “audit” in the codified for this rule, we decline to do so. To the extent that these comments were seeking clarification of the definition of “consultative audit” in § 1.600(c), and what types of activities might fall outside of that definition as well as outside of this program, please see the discussion in Response 9 in section III.E.

(Comment 7) Some comments express confusion about the criteria that accredited third-party certification bodies will be using in conducting audits under subpart M and ask us to more clearly describe the “applicable requirements” against which compliance will be evaluated. Some comments are concerned that eligible entities might be audited against requirements that do not apply to their operations. For example, some comments note that firms subject to the final animal preventive controls regulation should not be assessed for compliance with the allergen cross contamination requirements of the final human preventive controls regulation. Other comments ask us to clarify whether the “applicable requirements” are limited to requirements that appear in the FD&C Act or FDA regulations, or both.

(Response 7) During regulatory and consultative audits, accredited third-party certification bodies will examine compliance with applicable food safety requirements of the FD&C Act and FDA regulations within the scope of the audit. In consultative audits, the third-party certification bodies also may be conducting an examination to determine conformance with applicable industry standards and practices.

The applicable requirements that accredited third-party certification bodies and their audit agents will use relate to the food safety standards under the FD&C Act, such as the adulterated food provisions in section 402 of the FD&C Act and the provisions on the misbranding of food allergens in section 403(w) of the FD&C Act. The applicable requirements of the FD&C Act and FDA regulations would depend on the type of eligible entity being audited. To use the example given by one of the comments, an eligible entity that is subject to the requirements of the final animal preventive controls regulation, but not the final human preventive controls regulation, would not be subject to an audit examining its practices relating to cross-contamination by food allergens under the final human preventive controls regulation because those are not “applicable food safety requirements” for such an entity.

To help clarify this rule for eligible entities, third-party certification bodies, and accreditation bodies who may be interested in participating in the program and who may not yet be familiar with U.S. laws and regulations, we are using the phrase “applicable food safety requirements of the FD&C Act and FDA regulations” in place of the phrase “applicable requirements” in the definition of “audit” in § 1.600(c) and elsewhere throughout the rule where we are discussing the requirements that will be used in auditing eligible entities.

2

2

Although we have elected to cite to both the FD&C Act and FDA regulations in this definition, we otherwise will follow the conventional practice of using the words “applicable requirements” to refer the applicable requirements of the FD&C Act and FDA regulations.

D. Audit Agent

We proposed to define an “audit agent” as an individual who is an employee or other agent of an accredited third-party certification body who, although not individually accredited, is qualified to conduct food safety audits on behalf of an accredited third-party certification body. Under the proposed rule we also defined an audit agent to include a contractor of the accredited third-party certification body.

(Comment 8) Some comments express concern about our proposal to allow a contractor of an accredited third-party certification body to serve as an audit agent, asserting that “[w]ith each step that is further removed in this process, institutional control is lost exponentially.” The comments point out that a subcontractor conducted the audit and gave a passing audit score to a cantaloupe farm and packing facility that used “improper and unsafe processing equipment” and subsequently was linked to a deadly outbreak caused by

Listeria monocytogenes

. Other comments mentioning the incident cite to an article in Bloomberg News explaining that auditors often outsource to independent contractors over whom they do not have direct management control (Ref. 15). Still other comments offer the cantaloupe outbreak as an example of why auditors must be competent and accountable for their activities.

(Response 8) We understand that third-party certification bodies currently work with individual auditors under many different types of arrangements. We acknowledge concerns raised by comments about recent outbreaks at some domestic facilities that had received satisfactory scores in food safety audits. Further, we agree with the comments on the importance of an accredited third-party certification body exercising adequate control over an audit agent conducting audits on its

behalf. We believe that principle is equally true whether the audit agent is an employee or a contract auditor.

International standards, such as ISO/IEC 17021:2011 (Ref. 6), specifically allow accredited third-party certification bodies to use contractors to perform audits if certain conditions are met. Among other conditions, contract auditors must meet the same level of qualifications (

e.g.,

knowledge, skills, and experience) and the same requirements for impartiality and objectivity as do the auditors the third-party certification body employs. The third-party certification body must exercise adequate control and oversight over a contractor such that the third-party certification body accepts the result of the contractor's audit as its own.

When we proposed to define “audit agent” to include a contractor, we were contemplating arrangements such as those described in ISO/IEC 17021:2011 (Ref. 6) that involve a direct relationship between the accredited third-party certification body and its auditors. We are revising the definition of “audit agent” to clarify that we are excluding subcontractors and other types of outsourcing arrangements; we have concluded that such arrangements fail to provide the degree of control and oversight necessary for an accredited third-party certification body to ensure that its audit agents are competent and objective. An accredited third-party certification body exercises direct supervision over the activities of its employees, and has a direct relationship with a contractor; but the relationship between the third-party certification body and a subcontractor or other type of outsourced staff is attenuated—the third-party certification body may not even choose such persons and may not have any direct authority over them. We do not believe such diminished oversight is appropriate, given the important role of audit agents in this program.

By revising the definition of “audit agent” we are not preventing an accredited third-party certification body from subcontracting for services in areas other than the conduct of audits. For example, an accredited third-party certification body may use subcontractors or other outsourcing arrangements to deliver annual training to its audit agents under § 1.650 or may use subcontractors or other outsourcing arrangements to investigate and decide on appeals of adverse regulatory audit results under § 1.651. However, we are limiting the role of “audit agent” to employees and contractors of the accredited third-party certification body.

E. Consultative Audit

We proposed to define a “consultative audit” as an audit of an eligible entity: (1) To determine whether such entity is in compliance with applicable requirements of the FD&C Act and industry standards and practices and (2) the results of which are for internal purposes only and cannot be used to determine eligibility for a food or facility certification issued under this subpart or in meeting the requirements for an onsite audit of a foreign supplier under subpart L of this part.

(Comment 9) We received several comments on the definition of “consultative audit.” Many comments express concern that the definition of “consultative audit” is overly broad and that some of the requirements that would apply to consultative audits under the proposed rule might create a disincentive to using accredited third-party certification bodies. Some comments urge FDA to remove all requirements associated with consultative audits from the rule. Other comments identify two requirements of particular concern: (1) Proposed § 1.656, requiring an accredited third-party certification body conducting a consultative audit or regulatory audit under the rule to notify FDA immediately upon discovering a condition that could cause or contribute to a serious risk to public health (the notification requirement) and (2) proposed § 1.652, requiring an accredited third-party certification body to provide FDA access to a consultative audit report when the criteria for records access under section 414 of the FD&C Act (21 U.S.C. 350c) are met (the records access requirement). The comments explain that many firms use certification bodies (and/or their consulting divisions) to help establish, maintain, and improve their food safety practices. For example, some firms use certification bodies (and/or their consulting divisions) to help in identifying root causes and remediating food safety problems. Comments also note that certification bodies (and/or their consulting divisions) provide informal counseling, perform preliminary evaluations, limited purpose audits, and activities in support of firms' continuous improvement programs.

Comments express concern that if these types of activities are subject to notification, records access, and other requirements of the rule, firms located outside the United States might not use accredited third-party certification bodies, instead choosing unaccredited third-party certification bodies to avoid the requirements of this rule. The comments assert that unaccredited third-party certification bodies are less likely to have qualified auditors and their independence and objectivity is less certain, than third-party certification bodies that have been evaluated and issued accreditation.

Comments also argue that the definition of “consultative audit,” which states that the results of such an audit are “for internal purposes only,” is inconsistent with the requirements for notification and records access that would apply to consultative audits under the proposed rule. Other comments ask us to clarify that audits conducted for external purposes—for example, an audit for purposes of compliance with FSVP—do not satisfy the definition of a consultative audit because consultative audits are for internal purposes only.

Some comments suggest that the proposed definition of “consultative audit,” taken together with the proposed definitions of “food safety audit” and “regulatory audit,” could preclude third-party certification bodies from conducting any audits that are outside the scope of subpart M, once accredited. Based on that interpretation, the comments predict that few if any third-party certification bodies would want to participate in the program.

Many of the comments that express concern about disincentives also suggest that Congress intended the third-party program to be much narrower than our proposed definition of “consultative audit” would suggest. These comments suggest that the FSMA third-party certification program was intended to be focused on regulatory audits and the issuance of certifications to be used for two limited purposes:

i.e.,

in establishing an importer's eligibility for VQIP and in satisfying a condition of admissibility for a food subject to an FDA safety determination under section 801(q) of the FD&C Act. These comments argue further that Congress inserted the term “consultative audit” in the statute to be used only in reference to the conflicts of interest provisions in section 808(c)(4)(C) and (c)(5) of the FD&C Act; therefore, a broad interpretation of “consultative audit” is inconsistent with Congressional intent. The comments urge us to construe the term “consultative audit” as narrowly as possible.

(Response 9) We recognize that food firms use accredited third-party certification bodies (and their consulting divisions) in various

capacities that serve the ultimate goal of improving food safety. We do not want, nor do we believe Congress intended, for our third-party certification program to create disincentives for food firms seeking to use accredited third-party certification bodies for various purposes to improve food safety practices in their operations. Nevertheless, we decline the request to remove all requirements relating to consultative audits from this final rule. Section 808(c)(5)(C) of the FD&C Act directs us to issue implementing regulations for section 808 of the FD&C Act, which includes some specific provisions relating to consultative audits (

e.g.,

section 808(c)(3)(A) and (C) on consultative audit reports and section 808 (c)(4)(C) of the FD&C Act on audit agents performing regulatory audits of eligible entities of which they performed consultative or regulatory audits within the preceding 13 months). We have, however, revised the definition of “consultative audit” as explained below and have made other revisions to the rule to clarify the scope of such audits and help mitigate possible disincentives to conduct consultative audits, while fulfilling the letter and spirit of the law.

With regard to the comments expressing concerns about an overly broad interpretation of “consultative audit,” we remind readers that the statute endows both regulatory and consultative audits with certain characteristics. For example, section 808(a)(6) of the FD&C Act indicates that an eligible entity must choose to be audited by an accredited third-party certification body, and section 808(c)(5)(C)(i) of the FD&C Act states that audits under this program must be unannounced. We understand these provisions to mean that, at the time the audit services are arranged, an eligible entity must specifically request from an accredited third-party certification body a food safety audit under this rule—that is the only way the accredited third-party certification body would know that the eligible entity is requesting an unannounced subpart M audit to determine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. Further, the eligible entity would need to specify whether it is seeking a regulatory or consultative audit. (In addition to determining whether the eligible entity is in compliance with the food safety requirements of the FD&C Act, consultative audits under section 808 of the FD&C Act also determine whether the eligible entity is in compliance with applicable industry standards and practices). Audits that fall outside the purview of this rule—for example, audits that are conducted by third-party certification bodies that are not accredited under this program, audits that determine compliance with standards other than the food safety requirements of the FD&C Act and FDA regulations (

e.g.,

audits that determine compliance with private standards), audits that are announced, and audits conducted solely for the purposes of supplier verification under the final human or animal preventive controls regulations or the final FSVP regulations—are not covered by, or subject to, the requirements of this rule.

It is impossible to describe or predict all of the audit scenarios that may occur. We emphasize that an accredited third-party certification body can continue to offer auditing and certification services that are outside the scope of this rule, such as on-site supplier verification audits under the final human or animal food preventive controls regulations or the final FSVP regulation. Such audits would not be subject to the requirements of this rule, including the reporting and notification requirements.

In response to comments, we revised the proposed definition of “consultative audit” to clarify that it is an audit conducted in preparation for a regulatory audit under the third-party certification program. A consultative audit would thus be a pre-examination or pre-assessment type of activity imbued with certain characteristics. We further clarify the characteristics of a consultative audit, as well as of a regulatory audit (the results of which can form the basis for issuance of certification under the rule), in the definition of “food safety audit” discussed in section III.J.

F. Eligible Entity

We proposed to define an “eligible entity” as a foreign entity that chooses to be subject to a food safety audit by an accredited third-party certification body. We further proposed that eligible entities include foreign facilities subject to the registration requirements in FDA regulations.

(Comment 10) We received several comments on the definition of “eligible entity.” Some comments request that we provide examples of specific types of entities that satisfy the definition. Some comments offer examples of “eligible entities,” including orchards or farms, packing houses, processing plants, and storage facilities. Other comments suggest we add “and foreign farms” to the end of the definition, to clarify that such entities are eligible to receive audits under subpart M. Some comments encourage us to adjust the definition of “eligible entity” to make it mandatory for foreign food facilities to undergo food safety audits by accredited third-party certification bodies.

(Response 10) The proposed definition of “eligible entity” was based on the statutory definition, which includes facilities subject to the registration requirements in section 415 of the FD&C Act that choose to be audited under the program. At our own initiative we are revising the definition of “eligible entity” in the codified to more accurately track the statute, and we decline the suggestion to add specific examples, such as orchards or farms, that are not included in the statutory definition of “eligible entity.” However, as explained in Response 12 we are revising the definition of “facility” in § 1.600(c) to clarify that entities that grow, harvest, or raise animals for food for consumption in the United States are facilities that are eligible for auditing and certification under this subpart.

We disagree with the comment suggesting that we should make audits under this program mandatory for all foreign food firms by modifying the definition of “eligible entity.” The statute clearly indicates that participation in this program is intended to be voluntary, and only entities that choose to be audited under the program are subject to its requirements (see section 808(a)(6) of the FD&C Act).

(Comment 11) In the proposed rule, we specifically asked for comment on whether to allow for food or facility certification to be issued to a producer group, offering as an example the criteria for groups under the National Organic Program (NOP)—

i.e.,

having multiple sites operating under a single management system and whose farms are “uniform in most ways.” Several comments responded to this inquiry in relation to the definition of “eligible entity.”

Comments in support of certification of a group (

e.g.,

a cooperative being audited as a single eligible entity) note that some producers are very small and might find it difficult on their own to obtain third-party certification, but taken as a group the task would likely be more manageable. Other comments note that treating multiples sites with a single management system as a single eligible entity could be particularly helpful in sectors or regions where there is a scarcity of accredited third-party certification bodies. Some comments argue in support of groups functioning as a single eligible entity as long as the central management system functions effectively, providing oversight to the

members. Comments also note that some multisite sampling protocols have been developed by international organizations, such as ISO.

Other comments encourage us to ensure that cooperatives are subject to this rule, so that all the links in a foreign supply chain are appropriately inspected, and so that they are subject to any applicable regulations before their product is exported to the United States.

Comments not in support of cooperatives being classified as eligible entities note that food safety practices and conditions are site-specific and can vary significantly even if the individual farms are located in the same geographic area (for example, due to soil composition, agricultural water runoff, or the manner in which the land was used in the past). They also note that organic production standards and scientifically-based food safety standards are not the same, so what works for the NOP may not be appropriate here

Some comments encourage us to provide guidance on the acceptable parameters of a cooperative. Some comments encourage us to consider guidance available from other sources beyond the NOP, such as the International Federation of Organic Agriculture Movements.

(Response 11) We decline to revise the definition of eligible entities to include a group. We acknowledge that some very small producers might be daunted by the prospect of working individually with an accredited third-party certification body, and there would be obvious economies in banding together with other very small producers to gain certification. We also acknowledge that some sets of producers do currently function as a unit under a centralized management system, and that group certification may make it easier for entities to access accredited third-party certification bodies in areas or regions where they may be scarce. Nevertheless, after reviewing the NOP, the International Federation of Organic Agricultural Movements, the Canada Organic Office Operation Manual, the USDA Agricultural Marketing Service pilot program on group certification, and other recommended sources, we conclude that it would not be appropriate to allow groups to be certified under this program. Group certification raises a myriad of complicated issues such as establishing who may act as a group, determining the requisites of a central management system, and delineating the minimum requirements for accredited third-party certification body audits of a group.

With regard to the comments contending that certifications from individual eligible entities that might otherwise act as a group would create redundant and unnecessary paperwork for FDA, we will take that sort of information into account as we gain experience with the program. Finally, with regard to the comments encouraging us to define “eligible entity” to include groups to ensure that all their members are examined for compliance with applicable food safety regulations before their food is exported to the United States, we note that this rule does not create audit obligations for all foreign suppliers or for all importers. The third-party certification program created by this rule is a voluntary program for eligible entities who wish to participate.

G. Facility

We proposed to define “facility” as any structure, or structures of an eligible entity under one ownership at one general physical location, or, in the case of a mobile facility, traveling to multiple locations, which manufactures/processes, packs, or holds food for consumption in the United States. The definition went on to state that: (1) Transport vehicles are not facilities if they hold food only in the usual course of business as carriers; (2) a facility may consist of one or more contiguous structures, and a single building may house more than one distinct facility if the facilities are under separate ownership; (3) the private residence of an individual is not a facility; and (4) non-bottled water drinking water collection and distribution establishments and their structures are not facilities.

On our own initiative, we are clarifying that facilities for the purposes of this subpart are not limited to facilities required to be registered under Subpart H.

(Comment 12) Some comments encourage us to align the proposed definition of “facility” to the definition of “facility” in the human and animal preventive controls, produce safety, and FSVP regulations, to promote consistency and common understanding of the rules.

(Response 12) As previously noted, we agree with the comments on the importance of consistency across regulations, where feasible and appropriate. We reviewed the definitions of “facility” in the final FSVP and final human preventive controls regulations, and found those definitions to be too narrow in light of the purpose of this rule to establish a voluntary program for certification of foods and facilities and the broad definition of “eligible entity” in section 808(a)(6) of the FD&C Act. Of our own initiative, in order to preserve the option for broad participation in the third-party program, we are expressly including in the definition of “facility” those entities that grow, harvest, or raise animals for food for consumption in the United States.

H. Facility Certification and Food Certification

We proposed to define “facility certification” as an attestation, issued for purposes of section 806 of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish that a facility meets the applicable requirements of the FD&C Act. We proposed to define “food certification” as an attestation, issued for purposes of section 801(q) of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish that a food meets the applicable requirements of the FD&C Act.

(Comment 13) We received some comments on the definitions of “facility certification” and “food certification.” Some of these comments raise group certification issues which we address above, in connection with the definition of “foreign cooperative.” Some comments state that “food certification” is improper terminology, because it implies a product certification model, whereas audits of eligible entities—particularly in the produce sector—generally assess processes and/or management systems.

(Response 13) The term “food certification” appears in the statute and is specifically discussed in the statute as a type of certification that may be used in meeting a condition of admissibility under section 801(q) of the FD&C Act. Under section 808(c)(2)(C) of the FD&C Act, food certifications may only issue upon conduct of a regulatory audit. In light of the statutory language, we decline to revise the term “food certification” in response to the comments on this rule.

We also note that section 801(q)(1) of the FD&C Act allows for FDA to accept “a listing of certified facilities that manufacture, process, pack, or hold food, or other assurances deemed appropriate by FDA” to satisfy the condition of admissibility. Of our own initiative, in light of this statutory language, we are clarifying in the definition of “facility certification” that

a facility certification may be issued for purposes of 801(q) of the FD&C Act.

I. Food

In proposed § 1.600(b), we stated unless otherwise defined in § 1.600(c) of the proposed rule, definitions of terms in section 201 of the FD&C Act would apply to terms used in this subpart. Section 201 of the FD&C Act defines “food” as “(1) articles used for food or drink for man or other animals, (2) chewing gum, and (3) articles used for components of any such article.” Proposed § 1.600(c) did not define the term “food.”

(Comment 14) Some comments request that we define “food” consistent with how it was defined in the FSVP proposed rule for consistency and to indicate that producers of food contact substances are eligible entities.

(Response 14) The proposed definition of “food” under § 1.600 would include pesticides when they meet the definition of “food” under section 201 of the FD&C Act. By contrast, the FSVP rule's proposed definition of food explicitly does not include pesticides, as defined in 7 U.S.C. 136(u), consistent with the definition of “food” used in the rulemaking on the Prior Notice of Imported Food Under the Public Health Security and Bioterrorism Preparedness Act of 2002 (prior notice rule). FDA received comments during that rulemaking questioning the applicability of the rule to pesticides, so FDA clarified that “food” for the purposes of that rule did not include pesticides.

The final FSVP regulation, which is publishing elsewhere in this issue of the

Federal Register

, retains the exclusion of pesticides from the definition of “food.”

In response to comments suggesting revision of the definition of “food” in this rule to be consistent with the final FSVP regulation, we considered the purposes that certifications serve under this program and the nature of comments we received on the third-party proposed rule, including general comments requesting alignment across the FSMA rules and comments specifically requesting that we use the FSVP definition of “food.” Certifications issued by accredited third-party certification bodies may be used in establishing an importer's eligibility to participate in VQIP and in satisfying a condition of admissibility for an imported food that we determine poses a safety risk under section 801(q) of the FD&C Act.

While certifications may be useful in addressing pesticide contamination of food (

e.g.,

pesticide levels in food that exceed established tolerances), we have not identified a need for certifications to address pesticides as articles of food, nor do we anticipate a role for food safety audits in pesticide manufacturing facilities. Accordingly, we are revising the final rule by adding to § 1.600(c) a definition of “food” that excludes pesticides.

We also agree with the comment that producers of food contact substances could be eligible entities under this rule and that food contact substances should be considered food for the purposes of this rule. Third-party food safety audits and certifications for food contact substances could potentially be useful given the possibility of migration of harmful food contact substances into food or contamination of food contact materials that directly contact food. Accordingly, we are revising the proposed definition of “food” to exclude pesticides and retain “food contact substances” in the definition of “food” in this final rule, consistent with the definition of “food” in the final FSVP regulation.

J. Food Safety Audit

We proposed to define “food safety audit” as a regulatory audit or a consultative audit.

(Comment 15) We received a few comments on the definition of “food safety audit.” Some comments request that we remove consultative audits from the definition of “food safety audit,” asserting that consultative audits should not be subject to the reporting and notification requirements associated with “food safety audits.” Other comments say we should replace the term “food safety audit” with “regulatory audit,” as a matter of statutory construction and sound policy. Finally, some comments suggest that we delete the definition of “food safety audit” altogether.

(Response 15) We are retaining the definition of “food safety audit” as a useful definition to describe regulatory and consultative audits that fall under the requirements of this rule. As described in Response 9, we have revised the definition of “consultative audit” to clarify that it is an audit conducted in preparation for a regulatory audit under the third-party certification program. Although an audit meeting that definition would be subject to certain reporting and notification requirements, there are many types of audits/arrangements that would not fall within the definition of “consultative audit” or “regulatory audit,” and would therefore not be subject to the requirements of this rule, including the reporting and notification requirements. Therefore, including consultative audits in the definition of “food safety audit” will not prevent eligible entities from using accredited third-party certification bodies for auditing arrangements that fall outside of the scope of this rule and do not trigger the requirements of this rule. To further address comments' concerns, we are modifying the definition of “food safety audit” to provide clarification regarding what types of audits/activities would fall outside of the scope of this rule. Specifically, we clarify that a food safety audit must be declared by an eligible entity at the time of audit planning and must be conducted on an unannounced basis consistent with sections 808(b)(6) and 808(c)(5)(C) of the FD&C Act.

K. Foreign Cooperative

We proposed to define “foreign cooperative” as an entity that aggregates food from growers or processors that is intended for export to the United States.

On our own initiative, we are replacing the phrase “entity that aggregates” with “autonomous association of persons, identified as members, who are united through a jointly owned enterprise to aggregate” for clarification purposes.

(Comment 16) Some comments suggest that we add a definition for “consolidator.” The comments contrast consolidators with cooperatives and argue that consolidators act essentially as brokers that purchase products from several sources and then export the total set to the United States. According to these comments, consolidators do not own or manage the individual sites and generally do not have control over or even knowledge of the processing procedures.

(Response 16) We agree with the comment that an entity without a single management system that exercises control over the manner in which individual sites meet the applicable food safety requirements of the FD&C Act and FDA regulations would not be an eligible entity. However, we disagree that adding a definition of “consolidator” would be helpful because whether an entity is a “consolidator” has no bearing on the requirements of this rule.

(Comment 17) Some comments point out that while the proposed rule indicates a foreign cooperative could be an accreditation body or a third-party certification body, in their countries the government is the accreditation body. Also, in some places the government authorizes certain parties to conduct audit activities and those parties are under the control and supervision of the

government. Accordingly, the comments suggest that we indicate in which countries and in which cases a foreign cooperative could be an accreditation body or a third-party certification body. Other comments recommend more detail on how cooperatives are defined, and how they would conform to FDA requirements for third-party certification bodies.

(Response 17) We currently are not in a position to be able to determine which countries or which foreign cooperatives may be adequately qualified to become accredited under the third-party certification program. We note that section 808 of the FD&C Act expressly allows foreign cooperatives to serve as accredited third-party certification bodies if they are adequately qualified and independent of the eligible entities they audit or certify under the third-party certification program. Therefore, we are not categorically excluding foreign cooperatives from the third-party certification program, nor are we making any categorical decisions on whether governmental accreditation bodies have conflicts that would preclude them from accrediting such foreign cooperatives under the program.

L. Regulatory Audit

We proposed to define a “regulatory audit” as an audit of an eligible entity to determine whether such entity is in compliance with the provisions of the FD&C Act and the results of which are used in determining eligibility for food certification under section 801(q) of the FD&C Act or facility certification under section 806 of the FD&C Act, and may be used by an importer in meeting the requirements for an onsite audit of a foreign supplier under the FSVP program.

(Comment 18) Some comments request that we clarify the definition of “regulatory audit.”

(Response 18) The comments requesting clarification failed to mention specific characteristics in the definition needing clarification and did not offer suggestions for clarification. Therefore, we decline to modify the definition based on these comments. However, on our own initiative we have revised the definition of “regulatory audit” by removing the clause “, and may be used by an importer in meeting the requirements for an onsite audit of a foreign supplier under subpart L of this part” that does not appear in the statute. We did this in part to avoid confusion. We emphasize that an audit conducted for the purposes of FSVP would not need to be conducted by a third-party certification body under this subpart. See section XIII.G. Nor are facilities required to use third-party certification bodies accredited under this rule in meeting their supplier verification requirements under the final human or animal preventive controls regulations. On our own initiative, we are revising the definition of “regulatory audit” to clarify that the results of a regulatory audit may be used to determine eligibility for any certifications that may be used for purposes of section 801(q) or section 806 of the FD&C Act.

M. Self-Assessment

We proposed to define “self-assessment” as a systematic assessment conducted by an accreditation body or by a third-party certification body to determine whether it meets the applicable requirements of this subpart.

We received no adverse comments about our proposed definition. However, on our own initiative, we are revising the definition of “self-assessment” to improve clarity and to specify what is required of a recognized accreditation body and an accredited third-party certification body when performing these evaluations.

N. Third-Party Auditor

We proposed to define a “third-party auditor” as a foreign government, agency of a foreign government, foreign cooperative, or any other third-party that is eligible to be considered for accreditation to conduct food safety audits and to certify that eligible entities meet the applicable requirements of the FD&C Act. We further proposed that a third-party auditor may be a single individual or an organization and may use audit agents to conduct food safety audits. Finally, we proposed that “third-party auditor” has the same meaning as “certification body” as that term was defined in the proposed rule.

(Comment 19) As described in Comment 1, we received several comments urging us to align our definitions and terminology with international standards. Some comments state that the term “third-party auditor,” the language of the statute notwithstanding, is not correct terminology to use interchangeably with “third-party certification body.”

(Response 19) As discussed previously, we agree that it is beneficial to use terminology in this rule that is consistent with terminology used in international standards when feasible and appropriate. Therefore, we are deleting the definition of “third-party auditor” in the final rule and will use the term “third-party certification body” in this rule except that we will use the term “third-party auditor” in the definitions of “Accredited third-party certification body” and “Third-party certification body” in § 1.600(c) and in the preamble discussion of those definitions in section III.A. We are clarifying in the definition of “third-party certification body” in § 1.600(c) that the term has the same meaning as “third-party auditor” as defined in section 808(a)(3) of the FD&C Act.

IV. Comments on Who Is Subject to This Subpart (§ 1.601)

We proposed in § 1.601 that this rule would apply to those accreditation bodies, third-party certification bodies, and eligible entities that seek to participate in this voluntary third-party certification program. We proposed two limited exemptions from section 801(q) of the FD&C Act: One related to alcoholic beverages from an eligible entity that is a facility that meets certain conditions, and another related to certain food constituting not more than 5 percent of the overall sales of a facility meeting the conditions of the first exemption.

A. Limiting the Scope of the Rule to Regulatory Audits and Certifications

Under proposed § 1.601(b), we proposed that subpart M would apply to third-party certification bodies seeking accreditation to conduct food safety audits and issue certifications for purposes of sections 801(q) and 806 of the FD&C Act.

(Comment 20) Some comments suggest we modify the language in § 1.601(b) regarding third-party certification bodies seeking accreditation to clarify that requirements of the rule apply only to imported foods that are subject to a condition of admissibility under section 801(q) of the FD&C Act and imported foods offered by an importer seeking to establish eligibility to participate in VQIP. In this view, the requirements of the rule (

e.g.,

the notification requirements) should not apply to audits other than regulatory audits that are conducted for certification purposes.

(Response 20) We decline to make the suggested revisions to § 1.601(b) because § 1.601(b)(2) already describes the two types of certifications that may be issued by accredited third-party certification bodies under the final rule and the types of audits that they would conduct under this program (

i.e.,

food safety audits, which include both consultative and regulatory audits). Audits conducted by third-party certification bodies that are outside of the scope of this program, and eligible entities receiving audits outside of the scope of this program, would not be

subject to the requirements of this final rule. With respect to the suggestion that the final rule should apply only to regulatory audits, and therefore not to consultative audits, we note, as previously discussed, that section 808 of the FD&C Act specifically defines “consultative audit” and contains requirements for the conduct of both regulatory and consultative audits (see,

e.g.,

section 808(a)(5) and (c)(4)(B) of the FD&C Act). Therefore, this final rule establishes requirements for consultative audits that are consistent with the provisions on consultative audits in the statute.

B. Exemption for Alcoholic Beverages

Under proposed § 1.601(d), we proposed to exempt from the certification requirements under section 801(q) of the FD&C Act alcoholic beverages that are imported from an eligible entity that is a facility that meets the following two conditions:

• Under the Federal Alcohol Administration Act or chapter 51 of subtitle E of the Internal Revenue Code of 1986, the facility is a foreign facility of a type that, if it were a domestic facility, would require obtaining a permit from, registering with, or obtaining approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States; and

• Under section 415 of the Federal Food, Drug, and Cosmetic Act, the facility is required to register as a facility because it is engaged in manufacturing/processing one or more alcoholic beverages.

We also proposed that the certification requirements under section 801(q) of the FD&C Act would not apply to food other than alcoholic beverages that is imported from a facility described in § 1.601(d)(1) provided that such food:

(i) Is in prepackaged form that prevents any direct human contact with such food; and

(ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury.

We tentatively concluded that these provisions were consistent with the provisions on alcohol-related facilities in section 116 of FSMA.

(Comment 21) Some comments support the proposed exemption of imported beverage alcohol products, but encourage us to clarify and amplify the exemption to cover the raw materials and ingredients (

e.g.,

grapes, grains, hops, flavors) used to produce alcoholic beverages. The comments assert that the requested exemption would provide for consistency between domestic and foreign facilities and would be consistent with Congressional intent regarding section 116 of FSMA. The comments assert that the expanded exemption would be consistent with the regulations on preventive controls for human food. The comments urge us to consult their comments on the FSVP proposed rule.

(Response 21) As requested, we consulted comments submitted on proposed § 1.501(e) in the FSVP proposed rule, requesting an exemption from the FSVP requirements for the importation of the raw materials and ingredients (

e.g.,

grapes, grains, hops, flavors) used to produce alcoholic beverages, and asserting that such an exemption would be consistent with Congressional intent regarding section 116 of FSMA.

We considered the comments' request in light of the risk-based public health principles generally underlying FSMA and have concluded that Congress did not intend for FSMA's core requirements to apply to the manufacture/processing, packing, and holding of alcoholic beverages. Congress may have made such a conclusion in light of the potential antimicrobial function of the alcohol content in such beverages and the concurrent regulation of alcoholic beverage-related facilities by both FDA and the Alcohol and Tobacco Tax and Trade Bureau. In light of this context, we have concluded that section 116 of FSMA should be interpreted to mean that the manufacturing, processing, packing, or holding of alcoholic beverages at most alcohol-related facilities should not be subject to this rule.

We believe the same rationale supports the comments' request. Accordingly, and consistent with the final FSVP regulation, we are expanding the exemption from certification under section 801(q) of the FD&C Act in § 1.601(d) to cover raw materials or other ingredients that are used to manufacture/process, pack or hold alcoholic beverages by an importer required to be registered under section 415 of the FD&C Act, when such facilities are exempt from the preventive controls regulations under 21 CFR 117.5(i).

Also in this final rule, we are replacing the term “food other than alcoholic beverages,” to describe the applicability of the exemption, with the term “food that is not an alcoholic beverage.”

C. USDA Regulated Products

(Comment 22) Some comments suggest we explicitly exempt products under USDA jurisdiction from the requirements of this rule.

(Response 22) We agree that an exemption to 801(q) is appropriate with respect to meat, poultry, and egg products regulated by USDA at the time of importation. The final rule adds a new § 1.601(d)(2) which states that any certification under 801(q) does not apply to meat, poultry, and egg products that at the time of importation are subject to the requirements of the USDA under FMIA (21 U.S.C. 601

et seq.

), PPIA (21 U.S.C. 451

et seq.

), or EPIA (21 U.S.C. 1031

et seq.

). We conclude that this provision is consistent with section 403 of FSMA, entitled “Rule of Construction,” which states that nothing in FSMA shall be construed to alter or limit the jurisdiction of the Secretary of the Department of Agriculture. For many decades, USDA has exercised authority and responsibility over the import of such meat, poultry, and egg products, and has detailed regulations and procedures implementing this authority. In light of USDA's role with respect to the importation of these products, and also in light of section 403 of FSMA, we believe that Congress did not intend for an FDA determination under section 801(q) of the FD&C Act to apply to meat, poultry, and egg products that at the time of importation are subject to USDA requirements under the MPIA, PPIA, and EPIA, respectively. We therefore conclude that final § 1.601(d)(2) is consistent with Congress's intent in promulgating section 403 of FSMA.

With respect to the third-party program, we note that the program establishes a voluntary system of certification by accredited third-party certification bodies that food and facilities meet applicable requirements of the FD&C Act and FDA regulations. Certifications issued under this program will not be used to facilitate entry of meat, poultry, and egg products that are regulated by USDA at the time of importation, as defined above.

V. Comments on Recognition of Accreditation Bodies Under This Subpart

A. Who is eligible to seek recognition? (§ 1.610)

Proposed § 1.610 states that an accreditation body would be eligible for recognition if it could demonstrate that it meets the requirements related to legal authority, competency, capacity, conflicts of interest, quality assurance, and records in §§ 1.611 through 1.615. In our discussion of this section in the preamble of the proposed rule we stated our tentative conclusions that key

elements of ISO/IEC 17011:2004 (Ref. 5) would form a basis for our requirements, and that documented conformance to that standard would be relevant in demonstrating that an accreditation body is qualified for recognition.

(Comment 23) Some comments recommend that we require accreditation bodies to be signatories to IAF multilateral recognition agreements (IAF-MLAs) (which requires signatories, among other things, to conform to ISO/IEC 17011:2004) as a condition of recognition, and some contend it should be the sole criterion. Comments in favor of including signatory status as a requirement note that the process of becoming a signatory involves a thorough peer-review process, which helps ensure quality outcomes (

e.g.,

signatories have to demonstrate conformance to ISO/IEC 17011:2004 as part of the peer review process). Comments note other aspects of IAF-MLA signatory status that would be beneficial to the program, such as periodic reevaluation by peer signatories to ensure continued compliance. These comments argue that when a foreign government is the accreditation body, it may be difficult for FDA to regulate a peer agency, so reliance on IAF-MLA signatory status would be helpful, in part because it would give an independent organization (IAF) a role in managing the accreditation body.

Some comments discourage us from requiring IAF-MLA signatory status as a condition of recognition. Some comments suggest that we consider signatory status as a factor in favor of recognition, noting many of the same advantages touted by proponents of requiring signatory status, but suggest that we not make IAF-MLA signatory status a condition of program participation.

Other comments explain that it would be premature to make IAF signatory status the sole requirement. The comments note that at the time of these comments the IAF-MLA does not yet include subscopes for specific food safety standards or schemes. Still other comments recommend that FDA study the issues surrounding signatory status further before making it a requirement, pointing out that some countries may not have signatory IAF-MLA members representing them.

Some comments cite to third-party food safety audit programs administered by other governments, noting those programs do not require IAF-MLA status as a condition for program participation. These comments argue that it is more important to require conformance to ISO/IEC 17011:2004.

(Response 23) The comments uniformly agree on the value of an accreditation body's conformance to ISO/IEC 17011:2004 in establishing its qualifications for recognition. As discussed in section I.D., we agree that an accreditation body may use its documented conformance to ISO/IEC 17011:2004 to support its eligibility for recognition under this rule, supplemented as necessary (for example, to demonstrate capability to meet FDA requirements for reporting and notification under § 1.623, if recognized). We also agree that additional documentation relating to IAF-MLA signatory status may be useful in supporting an accreditation body's application for recognition under this program. However, we disagree with comments suggesting that we require IAF-MLA signatory status as the sole criterion or one of several criteria for recognition to accredit third-party certification bodies to conduct food safety audits and to certify that eligible entities meet the applicable food safety requirements of the FD&C Act and FDA regulations at this time. We currently lack (and the comments did not provide) adequate information to conclude that IAF-MLA signatory status should be the sole factual basis or one of several criteria for determining whether an accreditation body can fulfill the roles and responsibilities of a recognized accreditation body under this subpart. Further, we also want to allow accreditation bodies that are not signatories to participate in the program if they meet the statutory and regulatory criteria.

(Comment 24) As explained in section I.D., several comments support FDA's reliance on ISO/IEC 17011:2004 (Ref. 5) in developing the proposed rule. Other comments suggest FDA should place greater reliance on ISO/IEC 17011:2004 (Ref. 5), including some comments recommending that we incorporate the standard by reference into the rule.

(Response 24) We agree with comments on the value of promoting international consistency and tapping into an existing framework that is familiar to accreditation bodies, third-party certification bodies, and the food industry. Accordingly, in § 1.610 we are adding new language to state that an accreditation body may use documentation of conformance with ISO/IEC 17011:2004 (Ref. 5), supplemented as necessary, to demonstrate that it is eligible for recognition. This new language may make it easier for accreditation bodies that already conform to ISO/IEC 17011:2004 (Ref. 5) to apply for the program. We are also making conforming changes to §§ 1.622(d) and 1.623(b), 1.640(a), and 1.655(e).

We decline to incorporate ISO/IEC 17011:2004 (Ref. 5) by reference as the sole criterion or one of several criteria for recognition, because the standard contains some provisions that are inconsistent with section 808 of the FD&C Act or impractical for use in our program. For example, ISO/IEC 17011:2004 (Ref. 5), clause 4.3.7, allows an accreditation body to have “related bodies” that provide conformity assessment services (

e.g.,

auditing and certification) in areas the accreditation body accredits. (A “related body” is linked to the accreditation body by common ownership or contractual arrangement, under clause 4.3.7 NOTE 1.) The only safeguards that a related body is expressly required to meet are as follows: (1) It must have different top management than the accreditation body's top management; (2) different personnel from those involved in the accreditation decisionmaking processes; (3) no possibility to influence the outcome of an assessment for accreditation; and (4) distinctly different names, logos, and symbols. While clause 4.3.7 of ISO/IEC 17011 (Ref. 5) speaks to issues of common management and control of the accreditation body and its related body, the standard does not expressly prohibit the accreditation body from accrediting its related body with which it shares common ownership or financial interests. For example, an accreditation body that provides financial support (directly or indirectly) to a related body could be viewed as lacking the impartiality necessary to make an objective decision about whether the related body it supports is appropriately qualified. The impartiality provisions in ISO/IEC 17011:2004 (Ref. 5) are impractical for our purposes because they fail to address the range of possible conflicts associated with shared financial interests and ownership between a recognized accreditation body and a “related” third-party certification body under this rule. To help ensure the credibility of our program, § 1.624 requires a recognized accreditation body to implement a program to ensure that the accreditation body and its officers, employees, and other agents involved in accreditation activities do not own or have a financial interest in a third-party certification body seeking its accreditation. Accordingly, it would be inappropriate for us to rely on the conflict of interest safeguards contained in ISO/IEC

17011:2004 (Ref. 5), in the third-party certification program we are establishing.

For the foregoing reasons, we decline the suggestion to incorporate ISO/IEC 17011:2004 (Ref. 5) by reference into this rule.

(Comment 25) Several comments express concern about our proposal to allow both public and private accreditation bodies to seek recognition. Some comments discourage us from allowing private entities to be accreditation bodies because of the concern that allowing for private accreditation bodies may cause conflicts of interest. Similarly, some comments contend that accreditation bodies must uphold public confidence and perform their duties objectively, which is the purview of governmental entities.

Other comments take a contrary view, suggesting that some government agencies have missions that may undermine the objectivity and independence required of a recognized accreditation body. Some comments encourage us to consider which government agency/ministry in a given country may be eligible for recognition, and to solicit input from stakeholders as to which agencies/ministries are best positioned to perform this function.

Still other comments assert that private and government entities are sufficiently different such that we should establish different conflict of interest provisions and requirements for each.

(Response 25) Comments on both sides of this issue express concern that any accreditation body we recognize must be independent and objective in the performance of its duties. We share that concern. However, none of the comments offered substantiation that would lead us to bar public or private accreditation bodies, as a class, from seeking recognition because of conflicts of interest inherent in the class.

Section 808 of the FD&C Act defines an “accreditation body” as an authority that accredits third-party certification bodies and makes no distinction between public and private accreditation bodies. We have concluded that both public and private accreditation bodies are potentially capable of exhibiting the impartiality necessary for recognition under this rule. Therefore in light of the broad definition of “accreditation body” and to maximize the opportunities for qualified accreditation bodies to participate in the program, FDA does not consider it to be appropriate to limit the program to only certain types of accreditation bodies.

With respect to the comments that suggest we apply different conflict of interest requirements to different types of accreditation bodies, none of these comments offered an adequate explanation to justify different requirements for public and private accreditation bodies. Again, we note that section 808 of the FD&C Act does not make distinctions for different types of accreditation bodies.

(Comment 26) Some comments request that we provide additional explanation regarding how an accreditation body that does not have experience accrediting third-party certification bodies for food safety scopes would become eligible for recognition under this program.

(Response 26) An accreditation body of the type described in the comments' hypothetical might face practical difficulties in providing adequate substantiation demonstrating that it meets the requirements described in § 1.610. However, we will consider each application on its own merits and do not foreclose the possibility for such an accreditation body to make the showing necessary to be granted recognition under this rule.

B. What legal authority must an accreditation body have to qualify for recognition? (§ 1.611)

We proposed to require an accreditation body seeking recognition to demonstrate that it has adequate legal authority (as a governmental entity or through contractual rights) to assess a third-party certification body for accreditation, including authority to review records and conduct performance assessments (

e.g.,

authority to witness the performance of a statistically significant number of employees and other agents conducting assessments). We proposed to require that the accreditation body have adequate authority to remove or modify an accreditation status, once granted. We also proposed to require the accreditation body to demonstrate that it would be capable of exercising the legal authority necessary to meet the program requirements, if we granted recognition.

On our own initiative, in § 1.611(a)(2) we replaced, “personnel and other agents,” with, “audit agents, or the third-party certification body in the case of a third-party certification body that is an individual” for clarity and consistency with section 808(a)(4) of the FD&C Act. We have also made corresponding changes throughout this subpart.

(Comment 27) Some comments provide support for this provision, and others encourage us to ensure that a private accreditation body seeking recognition could have adequate legal authority to operate.

(Response 27) We agree with the comment urging us to ensure that a private accreditation body could have the necessary authority to act as a recognized accreditation body under this rule. As noted previously, we see no inherent reason why private entities could not theoretically meet the eligibility requirements for accreditation bodies under this rule. Therefore, we are revising § 1.611(a) and (b) to clarify that an accreditation body can be a legal entity with contractual rights. By the words “legal entity,” we mean that the accreditation body must be duly authorized to operate as an accreditation body by governmental authorities responsible for such authorizations in any country or countries in which the accreditation body seeks to perform accreditation of third-party certification bodies under this rule.

(Comment 28) Some comments ask us to clarify what we mean by “statistically significant” as used in § 1.611(a)(2) and elsewhere in the proposed rule to provide adequate confidence in the results of an analysis of the sample. The comments encourage us to abandon the phrase “statistically significant” in favor of the language of ISO/IEC 17011:2004 (Ref. 5), which requires an accreditation body to witness the performance of a representative number of third-party certification body staff.

(Response 28) We understand from the comments that a body of knowledge and experience has developed among accreditation bodies conforming to ISO/IEC 17011: 2004 (Ref. 5) on the meaning of “representative” numbers of observations and that no similar body of knowledge or experience exists on the meaning of “statistically significant” numbers of observations in this context. Accordingly, we are revising § 1.611 to require observations of a “representative sample” of audit agents and food safety audits. We are making similar revisions to other sections of the rule that require onsite observations.

For purposes of an accreditation body's observations of a third-party certification body under this rule, what constitutes a “representative sample” will be decided on a case-by-case basis, depending on various factors. These factors include the scope of accreditation, whether the third-party certification body is an individual who will conduct audits and make certification decisions, or whether the third-party certification body uses agents to conduct audits and, if so, whether such agents are centrally managed, conducting similar types of

audits, under a single set of operating procedures or whether the agents are managed from various locations, perform different types of audits, or follow different procedures such that these various locations, activities, or practices must be observed to ensure that the sample is sufficiently representative. A representative sample also must provide adequate confidence in the results of an analysis of the sample.

C. What competency and capacity must an accreditation body have to qualify for recognition? (§ 1.612)

We proposed to require an accreditation body seeking recognition to demonstrate that it has the resources required to adequately implement its accreditation program, including adequate numbers of qualified employees and other agents, adequate financial resources for its operations, and the capability to meet the resource demands of a recognized accreditation body, in the event the accreditation body is recognized.

(Comment 29) We received some comments on this provision, which also support the proposed rule's requirement that accreditation bodies demonstrate their competence and capacity based on the requirements of ISO/IEC 17011:2004 (Ref. 5). However, these comments disagree with our statement in the preamble that liability coverage requirements should not apply to this rule. The comments argue that we should include a requirement for accreditation bodies to carry liability coverage, noting that it is one of the requirements in ISO/IEC 17011:2004 (Ref. 5) and describing it as especially important because of the risks associated with food safety.

(Response 29) We agree with the comments that liability insurance may be useful in demonstrating the adequacy of an accreditation body's resources, for example, under ISO/IEC 17011:2004 (Ref. 5); however, FDA lacks experience in evaluating the adequacy of liability coverage for accreditation activities and we do not believe it would be appropriate for FDA to make recognition decisions primarily on this basis. We believe an accreditation body can demonstrate that it is adequately resourced in a number of different ways, including providing documentation of liability coverage as part of the information submitted to help to demonstrate that accreditation body is adequately resourced.

D. What protections against conflict of interest must an accreditation body have to qualify for recognition? (§ 1.613)

Proposed § 1.613 requires accreditation bodies to demonstrate that they have written measures to protect against conflicts of interest with third-party certification bodies and the capability to meet the rule's other conflict of interest requirements.

On our own initiative, we are clarifying that the scope of conflict of interest provisions in § 1.613(a) is limited to individuals involved in accreditation, auditing, and certification activities and not, for example, employees involved in purely administrative functions, such as payroll, or in positions that support administrative functions, such as computer technicians. Therefore, § 1.613(a) of this rule applies to interests between the officers, employees, and other agents of the accreditation body that are involved in accreditation activities and the officers, employees, and other agents of the third-party certification body involved in auditing and certification activities. We are making corresponding changes in the subsequent provisions for recognized accreditation bodies under § 1.624(a).

(Comment 30) Some comments take issue with our decision not to include the requirements of clause 4.3.2 of ISO/IEC 17011:2004 (Ref. 5), which requires the accreditation body to have documented and implemented a structure relating to conflicts of interest that provides for effective involvement by interested parties with balanced representation ensured.

(Response 30) We decline to require that recognized accreditation bodies establish and implement a structure for involving interested parties in matters relating to the conflict of interest requirements for recognized accreditation bodies. It would be administratively burdensome for FDA to establish a mechanism for monitoring the activities of interested parties that the accreditation body elects to involve to comply with such requirements. In our third-party certification program, impartiality will be protected by the conflict of interest provisions for accreditation bodies in § 1.624, the appeals provisions in § 1.620(d), and FDA's oversight activities.

E. What quality assurance procedures must an accreditation body have to qualify for recognition? (§ 1.614)

Proposed § 1.614 requires accreditation bodies to implement a written quality assurance program and have the capability to meet the rule's other quality assurance requirements.

(Comment 31) Some comments encourage FDA to more closely align § 1.614 with established international standards on quality assurance programs. Some ask us to rely on the relevant provisions in ISO/IEC 17011:2004 (Ref. 5) in particular.

(Response 31) We agree with the comments and as described in section I.D., we are revising § 1.610 to allow accreditation bodies to use their demonstrated conformance to ISO/IEC 17011:2004 (Ref. 5), supplemented as necessary, in meeting the requirements for recognition.

(Comment 32) Some comments ask us to clarify the language in § 1.614(a)(1) and (2) regarding food safety problems and corrective actions.

(Response 32) We agree and have revised § 1.614(a)(1) and (2) to clarify that an accreditation body must demonstrate that it has procedures to identify deficiencies and procedures to execute corrective actions for such deficiencies, using language that better aligns with international standards (see,

e.g.,

clause 5.5 in ISO/IEC 17011:2004 (Ref. 5)).

F. What records procedures must an accreditation body have to qualify for recognition? (§ 1.615)

Proposed § 1.615 would require accreditation bodies seeking recognition to demonstrate that they have developed and implemented adequate written procedures for establishing, controlling, and retaining records and to demonstrate the capability to meet the program's records, reporting, and notification requirements, if recognized.

(Comment 33) Some comments voice general concerns about confidentiality. Others state their concern with how confidentiality of third-party certification body records would be preserved when third-party certification bodies must share information with recognized accreditation bodies and FDA. Noting that such information can be sensitive in nature and sometimes includes confidential business information, these comments urge us to place certain limits—

i.e.,

only information related to food safety would be collected during audits of third-party certification bodies and such information would be shared only with the recognized accreditation body and FDA. Some comments suggest FDA require strict protective measures for information handled by third-party certification bodies and accreditation bodies, because the release of an eligible entity's confidential business information could have detrimental

effects on U.S. businesses and their foreign suppliers. These comments suggest the use of confidentiality protections such as “confidential disclosure agreements” so that the audit climate remains conducive to robust scrutiny and open dialogue.

Some comments also express concern with the proposed use of electronic records, because of the opportunity for sensitive electronic information to be compromised. Such comments recommend that the final rule include requirements for both third-party certification bodies and accreditation bodies to ensure that electronic records remain secure in transit and during storage.

(Response 33) We decline the suggestions to require confidential disclosure agreements between recognized accreditation bodies and third-party certification bodies under our program and to establish data protection requirements for electronic records and communications of recognized accreditation bodies and accredited third-party certification bodies. We understand that many accreditation bodies and third-party certification bodies have contractual agreements regarding confidentiality and disclosure by those parties. We expect accreditation bodies that become recognized under our program may elect to establish contracts that incorporate language on information sharing with FDA for third-party certification bodies seeking accreditation under this program. For such accreditation bodies, how they choose to accomplish this—

e.g.,

whether by establishing a separate confidentiality agreement or through revision of current contract language or creation of a new contract addendum—is a decision best made by the parties to those contracts. Accreditation bodies and third-party certification bodies will have common interests in safeguarding the electronic records they store and transmit to each other; therefore, we have no reason to believe that any separate agreements will lack adequate protections for confidentiality of information, including information stored and shared among the parties electronically.

This rule focuses on confidentiality and disclosure with respect to information shared with FDA. As explained in section XIII.F., FDA will protect the confidentiality of information accessed by or submitted to the Agency in accordance with § 1.695 of this subpart. With respect to the storage of electronic records and electronic transmission of information by FDA, we note that we are working the FDA IT security professionals in establishing the electronic portal for the third-party certification program to apply adequate and appropriate controls to ensure the confidentiality and integrity of data submitted to FDA through the portal.

(Comment 34) In the proposed rule preamble discussion of this section we stated that, “[a]ccreditation bodies applying for recognition must demonstrate their capacity, if recognized, to grant us access to confidential information, including information contained in records, without prior written consent of the third-party certification body involved. Having access to records relating to accreditation activities (including confidential information) under this subpart is necessary to ensure the rigor, credibility, and independence of the program.” Some comments take issue with this point, arguing that accreditation bodies would not be able to grant such access—they would only be able to grant access to confidential information

with

prior written consent. That is, the accreditation body would first need to make arrangements for FDA access to confidential records with the third-party certification bodies it accredits and the eligible entities certified by those third-party certification bodies. Comments that express doubt about private sector foreign accreditation bodies actually granting FDA access to confidential records contend that such access is particularly unlikely without the prior written consent of the third-party certification body whose records are sought.

(Response 34) We agree with the comments that the contracts accreditation bodies currently use with their third-party certification body clients do not contemplate the program we are establishing. As comments suggest, we would expect that confidentiality provisions in standard contracts would need to be revised such that, in signing a contract for accreditation under the FDA program, the third-party certification body would be giving the accreditation body its prior consent to perform any reporting or notification necessary for the recognized accreditation body to fulfill its obligations under the rule. Indeed, we expect that accreditation bodies seeking recognition will demonstrate their ability to comply with the reporting and notification provisions of this rule by providing us examples of standard contract language that has been suitably revised as comments describe.

VI. Comments on Requirements for Recognized Accreditation Bodies Under This Subpart

A. How must a recognized accreditation body evaluate third-party certification bodies seeking accreditation? (§ 1.620)

Proposed § 1.620 would establish the criteria and procedures that a recognized accreditation body must use in assessing third-party certification bodies for accreditation. Paragraph (a) broadly addresses the different requirements for foreign governments and foreign cooperatives or other third parties. Paragraph (b) requires the accreditation body to require third-party certification bodies to satisfy the rule's reporting and notification requirements. Paragraph (c) requires the accreditation body to maintain certain records, such as those related to withdrawal or suspension of a third-party certification body. Paragraph (d) requires an accreditation body to have written procedures for handling appeals from third-party certification bodies, and requires certain minimal appeal procedures.

On our own initiative, we are revising § 1.620(a)(2) and (3) to apply to accredited third-party certification bodies that are comprised of a single individual, as applicable. We are also removing, “and any requirements specified in FDA model accreditation standards regarding qualifications for accreditation, including legal authority, competency, capacity, conflicts of interest, quality assurance, and records” to follow good guidance practice. We are making corresponding changes to §§ 1.620(a)(1), 1.640(b), and 1.640(c). We are also revising § 1.620(c) to specify that recognized accreditation bodies must also include the date of the action in their records relating to any denial of accreditation or the withdrawal, suspension, or reduction in scope of accreditation of a third-party certification body. In addition, we are revising § 1.620(d) to clarify that the recognized accreditation body must notify any third-party certification body of an adverse decision associated with its accreditation under the subpart, including denial of accreditation or the withdrawal, suspension, or reduction in the scope of its accreditation.

(Comment 35) In paragraph (a)(3) of this proposed section we stated that a recognized accreditation body must observe “a statistically significant number of onsite audits” conducted by the third-party certification body seeking accreditation. Some comments request clarification of what we meant by “statistically significant,” so that accreditation bodies would know what

would be an adequate number of audits to observe to provide adequate confidence in the results of an analysis of such observations. The comments suggest that we should explain the criteria for determining the number of witness audits to be conducted under proposed § 1.620 and ask whether site-specific issues such as geographic factors should be considered. Other comments encourage us to abandon the phrase “statistically significant” in favor of the language of ISO/IEC 17011:2004 (Ref. 5), which requires an accreditation body to witness the performance of a representative number of third-party certification body staff.

(Response 35) We have removed the phrase “statistically significant” in § 1.620(a)(3) and inserted the phrase “representative sample.” We explain in Response 28 that comments presented compelling arguments that a significant body of knowledge and experience has developed around the meaning of a “representative” number of observations under ISO/IEC 17011:2004 (Ref. 5) to achieve an adequate level of confidence in the results. We have revised § 1.620(a)(3) accordingly. Site-specific issues may be relevant in determining the representative number of witness assessments to conduct, for example, where audit agents are located in remote offices or where food safety audits are managed by remote offices. The accrediting body, either a recognized accreditation body or FDA in the case of direct accreditation, will be best positioned to determine whether geographic issues are relevant for purposes of § 1.620(a)(3).

(Comment 36) Some comments ask us to revise § 1.620(d)(2) to clarify that the individuals used to hear appeals of adverse decisions by a recognized accreditation body could be individuals external to the accreditation body.

(Response 36) We agree with the comments and have revised this provision to clarify that individuals used to hear appeals may be external to the accreditation body, as well as a similar provision applying to appeals by eligible entities of adverse decisions by an accredited third-party certification body. We have also revised this provision to use language similar to language that is used in § 16.42(b), which describes the characteristics of a presiding officer that may be used for FDA regulatory hearings.

(Comment 37) In the preamble to the proposed rule we stated that we were not proposing to review the decisions of recognized accreditation bodies nor were we proposing to hear appeals from third-party certification bodies aggrieved by an accreditation body's decision(s). We sought comment on these matters. In response, some comments state their understanding that FDA would retain the authority to challenge a recognized accreditation body's decisions, because we have authority over the entire program.

(Response 37) We agree with comments that our oversight extends to any accreditation body or third-party certification body participating in the program, including the authority to withdraw accreditation from a third-party certification body even if the accreditation was granted by a recognized accreditation body. However, FDA does not intend to serve as an appellate body for aggrieved third-party certification bodies, as this would be unworkable and unnecessary. Withdrawing the accreditation of a third-party certification body to remove it from our program is quite different than, for example, overturning an accreditation body's decision to deny accreditation to a third-party certification body in the first place. Our program is designed to ensure the competency and independence of accreditation bodies. As part of this program, FDA will be recognizing accreditation bodies to make accreditation decisions based on a determination that the accreditation body is qualified to do so. FDA involvement in accreditation decisions would defeat the purpose of the program. Additionally, FDA retains the authority to revoke the recognition of accreditation bodies for good cause under § 1.634(a)(4) for failure to comply with this rule. For all of these reasons, FDA declines to codify a process to review appeals challenging recognized accreditation body decisions under this program.

(Comment 38) Several comments encourage us to expand on the requirement to use “independent” person(s) to hear an appeal of an adverse accreditation body decision. Some comments suggest that we clarify that an independent person is one who was not involved in the decision that is the subject of the appeal. A few comments suggest we further require the accreditation body to use person(s) who are external to the organization.

(Response 38) We agree with the suggestions to clarify § 1.620(d)(2) and are revising it to align with the impartiality provisions in 21 CFR part 16, which contains the regulations for regulatory hearings that we will generally apply under § 1.693 to an appeal of a revocation or withdrawal. Under the part 16 regulations, the person presiding over the hearing must be free from bias or prejudice and must not have participated in the action that is the subject of the hearing or be subordinate to a person who participated in the action. We believe that the credibility of the third-party certification program will be enhanced by requiring recognized accreditation bodies to afford similar protections when considering appeals by certification bodies under this rule. While we decline the suggestion to require the use of external parties in deciding appeals, we note that a recognized accreditation body has flexibility to use an external party under § 1.620(d)(2).

B. How must a recognized accreditation body monitor the performance of third-party certification bodies it accredited? (§ 1.621)

We proposed to require a recognized accreditation body to conduct an annual evaluation of each of its accredited certification bodies that includes a review of the certification body's self-assessments, its regulatory audit reports, notifications to FDA, and any other information reasonably available. We requested comment on whether the information we proposed to require would provide a solid basis for an evaluation. We asked stakeholders whether we should include a requirement in § 1.621 for onsite monitoring of accredited certification bodies and, if so, whether we should require the accreditation body to observe or visit the certification body's headquarters.

(Comment 39) We received several comments on the annual assessment requirements of proposed § 1.621. Some comments agree with the requirement for an annual assessment. Some comments mention a Government Accountability Office (GAO) report entitled, “FDA Can Better Oversee Food Imports by Assessing and Leveraging Other Countries' Oversight Resources” (GAO 12-933) and dated September 2012, which notes ongoing challenges with ensuring the competency of third parties to consistently apply standards and argues that annual assessments would improve certification body reliability and competency. Some of these comments state they would even support more frequent certification body evaluations.

In contrast, some comments argue that annual assessments would be burdensome. Comments variously focus on the burden on accreditation bodies, certification bodies, and eligible entities. Some comments disapprove of the cumulative burden of all the assessments (

e.g.,

self-assessments and monitoring assessments) required

throughout the rule. Some comments suggest biennial assessments, and note that such a requirement would be consistent with ISO/IEC 17011:2004 (Ref. 5). Still others argue that when the accreditation body or certification body is a government entity we should allow for flexibility around the timing of assessments.

(Response 39) We agree with comments that express the view that annual assessments of certification bodies will help build confidence in the third-party certification program. Annual assessments will help accreditation bodies ensure certification bodies' continued compliance with the program requirements and quickly identify and address any deficiencies with a certification body before a situation escalates.

We also acknowledge the concerns about the efforts needed to comply with the monitoring and self-assessment requirements of the rule. Section 1.621 is part of a set of proposed monitoring and self-assessment requirements intended to work together in helping to ensure that the recognized accreditation bodies and accredited third-party certification bodies maintain compliance with the rule's requirements. The certification body self-assessment in § 1.655 is intended to serve, in part, as information for use in the accreditation body monitoring in § 1.621, the results of which we intend the accreditation body to use in its self-assessment under § 1.622. We do not intend for the assessments to require duplicative efforts, with each section requiring a discrete set of activities with no opportunity to use the results of one set of activities when performing another. As explained in the preamble to the proposed rule, the accreditation body assessments of certification bodies will not only help ensure that the certification bodies continue to comply with our requirements, but also can help the accreditation body identify trends and any deficiencies in its own performance. The proposed monitoring and self-assessment activities are an essential part of the program's safety net.

With respect to § 1.621, in particular, we believe this section will be far less burdensome in practice than some of the comments anticipate, because of the convergence between the ISO/IEC standards and this rule. The activities required by § 1.621 are similar in substance to surveillance activities under ISO/IEC 17011:2004 (Ref. 5), which includes review of audit reports, results of internal quality control, and management review records identified in clause 3.18 NOTE, and thus are likely to be activities many accreditation bodies already perform. In light of the foregoing, we have concluded that requiring accreditation bodies to perform annual evaluations of each certification body they accredit under the program is not unduly burdensome. We disagree with comments suggesting that monitoring should be more frequent than once a year, because requiring assessments to be performed and reported twice eac

This text is long and has been trimmed here. Open the source document for the complete record.