# Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2015-28160

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** November 27, 2015
- **Citation:** 80 FR 74570

## Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 1, 11, and 16
[Docket No. FDA-2011-N-0146]
RIN 0910-AG66
Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Final rule.

SUMMARY:

The Food and Drug Administration (FDA or we) is adopting regulations to provide for accreditation of third-party certification bodies to conduct food safety audits of foreign food entities, including registered foreign food facilities, and to issue food and facility certifications, under the FDA Food Safety Modernization Act (FSMA). These certifications will be required for participation in the voluntary qualified importer program (VQIP) established under the Federal Food, Drug, and Cosmetic Act (FD&C Act). In addition, when the Agency has determined that an imported food is subject to certification under FSMA, the Agency may require a certification under this rule as a condition for admitting the food into the United States. FDA also expects that these regulations will increase efficiency by reducing the number of redundant food safety audits.

DATES:

This rule is effective January 26, 2016.

FOR FURTHER INFORMATION CONTACT:

Charlotte A. Christin, Office of Foods and Veterinary Medicine, Food and Drug Administration, 10903 New Hampshire Ave., Silver Spring, MD 20993, 301-796-7526.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary

I. Introduction and Background

A. FDA Food Safety Modernization Act

B. Purpose of This Rulemaking

C. The Proposed Rule

D. Public Comments

II. Legal Authority

III. Comments on What Definitions Apply to This Subpart (§ 1.600)

A. Definitions, Generally

B. Assessment

C. Audit

D. Audit Agent

E. Consultative Audit

F. Eligible Entity

G. Facility

H. Facility Certification and Food Certification

I. Food

J. Food Safety Audit

K. Foreign Cooperative

L. Regulatory Audit

M. Self-Assessment

N. Third-Party Auditor

IV. Comments on Who Is Subject to This Subpart (§ 1.601)

A. Limiting the Scope of the Rule to Regulatory Audits and Certifications

B. Exemption for Alcoholic Beverages

C. USDA Regulated Products

V. Comments on Recognition of Accreditation Bodies Under This Subpart

A. Who is eligible to seek recognition? (§ 1.610)

B. What legal authority must an accreditation body have to qualify for recognition? (§ 1.611)

C. What competency and capacity must an accreditation body have to qualify for recognition? (§ 1.612)

D. What protections against conflicts of interest must an accreditation body have to qualify for recognition? (§ 1.613)

E. What quality assurance procedures must an accreditation body have to qualify for recognition? (§ 1.614)

F. What records procedures must an accreditation body have to qualify for recognition? (§ 1.615)

VI. Comments on Requirements for Accreditation Bodies That Have Been Recognized Under This Subpart

A. How must a recognized accreditation body evaluate third-party certification bodies seeking accreditation? (§ 1.620)

B. How must a recognized accreditation body monitor the performance of third-party certification bodies it accredited? (§ 1.621)

C. How must a recognized accreditation body monitor its own performance? (§ 1.622)

D. What reports and notifications must a recognized accreditation body submit to FDA? (§ 1.623)

E. How must a recognized accreditation body protect against conflicts of interest? (§ 1.624)

F. What records requirements must an accreditation body that has been recognized meet? (§ 1.625)

VII. Comments on Procedures for Recognition of Accreditation Bodies Under This Subpart

A. How do I apply to FDA for recognition or renewal of recognition? (§ 1.630)

B. How will FDA review my application for recognition or for renewal of recognition and what happens once FDA decides on my application? (§ 1.631)

C. What is the duration of recognition? (§ 1.632)

D. How will FDA monitor recognized accreditation bodies? (§ 1.633)

E. When will FDA revoke recognition? (§ 1.634)

F. What if I want to voluntarily relinquish recognition or do not want to renew recognition? (§ 1.635)

G. How do I request reinstatement of recognition? (§ 1.636)

VIII. Comments on Accreditation of Third-Party Certification Bodies Under This Subpart

A. Who is eligible to seek accreditation? (§ 1.640)

B. What legal authority must a third-party certification body have to qualify for accreditation? (§ 1.641)

C. What competency and capacity must a third-party certification body have to qualify for accreditation? (§ 1.642)

D. What protections against conflicts of interest must a third-party certification body have to qualify for accreditation? (§ 1.643)

E. What quality assurance procedures must a third-party certification body have to qualify for accreditation? (§ 1.644)

F. What records procedures must a third-party certification body have to qualify for accreditation? (§ 1.645)

IX. Comments on Requirements for Third-Party Certification Bodies That Have Been Accredited Under This Subpart

A. How must an accredited third-party certification body ensure its audit agents are competent and objective? (§ 1.650)

B. How must an accredited third-party certification body conduct a food safety audit of an eligible entity? (§ 1.651)

C. What must an accredited third-party certification body include in food safety audit reports? (§ 1.652)

D. What must an accredited third-party certification body do when issuing food or facility certifications? (§ 1.653)

E. When must an accredited third-party certification body monitor an eligible entity that it has issued a food or facility certification? (§ 1.654)

F. How must an accredited third-party certification body monitor its own performance? (§ 1.655)

G. What reports and notifications must an accredited third-party certification body submit? (§ 1.656)

H. How must an accredited third-party certification body protect against conflicts of interest? (§ 1.657)

I. What records requirements must a third-party certification body that has been accredited meet? (§ 1.658)

X. Comments on Procedures for Accreditation of Third-Party Certification Bodies Under This Subpart

A. Where do I apply for accreditation or renewal of accreditation by a recognized accreditation body and what happens once the recognized accreditation body decides on my application? (§ 1.660)

B. What is the duration of accreditation by a recognized accreditation body? (§ 1.661)

C. How will FDA monitor accredited third-party certification bodies? (§ 1.662)

D. How do I request an FDA waiver or waiver extension for the 13-month limit for audit agents conducting regulatory audits? (§ 1.663)

E. When would FDA withdraw accreditation? (§ 1.664)

F. What if I want to voluntarily relinquish accreditation or do not want to renew accreditation? (§ 1.665)

G. How do I request reaccreditation? (§ 1.666)

XI. Comments on Additional Procedures for Direct Accreditation of Third-Party Certification Bodies Under This Subpart

A. How do I apply to FDA for direct accreditation or renewal of direct accreditation? (§ 1.670)

B. How will FDA review my application for direct accreditation or renewal of direct accreditation and what happens once FDA decides on my application? (§ 1.671)

C. What is the duration of direct accreditation? (§ 1.672)

XII. Comments on Requirements for Eligible Entities Under This Subpart

A. How and when will FDA monitor eligible entities? (§ 1.680)

B. How frequently must eligible entities be recertified? (§ 1.681)

XIII. Comments on General Requirements of This Subpart

A. How will FDA make information about recognized accreditation bodies and accredited third-party certification bodies available to the public? (§ 1.690)

B. How do I request reconsideration of a denial by FDA of an application or a waiver request? (§ 1.691)

C. How do I request internal agency review of a denial of an application or waiver request upon reconsideration? (§ 1.692)

D. How do I request a regulatory hearing on a revocation of recognition or withdrawal of accreditation? (§ 1.693)

E. Are electronic records created under this subpart subject to the electronic records requirements of part 11? (§ 1.694)

F. Are the records obtained by FDA under this subpart subject to public disclosure? (§ 1.695)

G. May importers use reports of regulatory audits by accredited certification bodies for purposes of subpart L of this part? (§ 1.698)

XIV. Editorial and Conforming Changes

XV. Executive Order 13175

XVI. Analysis of Economic Impact

XVII. Paperwork Reduction Act of 1995

XVIII. Analysis of Environmental Impact

XIX. Federalism

XX. References

Executive Summary

Purpose and Coverage of the Final Rule

This rule is part of FDA's implementation of FSMA, which intends to better protect public health by, among other things, adopting a modern, preventive, and risk-based approach to food safety regulation. In this document, we establish a program for accreditation of third-party certification bodies
1

to conduct food safety audits and issue certifications of foreign food facilities and foods for humans and animals for purposes of sections 801(q) and 806 of the FD&C Act. We are also codifying certain limited exemptions to mandatory import certification under 801(q) of the FD&C Act (21 U.S.C. 381).

1
As explained more fully in Response 1, in response to comments and for clarity, this final rule uses the term “third-party certification body” rather than either the term “third-party auditor” or the term, “third party auditor/certification body” (except that we will use the term “third-party auditor” in the definitions of “accredited third-party certification body” and “third-party certification body” in 21 CFR 1.600(c) and in the preamble discussion of those definitions in section III.A).

FSMA added section 808 to the FD&C Act (21 U.S.C. 384d), which directs FDA to establish a new program for accreditation of third-party certification bodies to conduct food safety audits and to certify that eligible foreign entities (including registered foreign food facilities) and food produced by such entities meet applicable FDA requirements for purposes of sections 801(q) and 806 of the FD&C Act. This rulemaking implements section 808 of the FD&C Act; we will recognize accreditation bodies to accredit third-party certification bodies, except for limited circumstances in which we may directly accredit third-party certification bodies.

FSMA specifies two uses for the food and facility certifications issued by accredited third-party certification bodies under this program. First, facility certifications will be used by importers to establish eligibility for VQIP under section 806 of the FD&C Act (21 U.S.C. 384b(a)). VQIP offers participating importers expedited review and entry of food that is part of VQIP. One condition of participation is importation of food from facilities audited and certified by third-party certification bodies accredited under this subpart. FDA issued draft guidance on VQIP on June 5, 2015 (80 FR 32136); the draft guidance may be accessed at
http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf
.

Second, section 801(q) of the FD&C Act gives FDA the authority to make a risk-based determination to require, as a condition of admissibility, that a food imported or offered for import into the United States be accompanied by a certification or other assurance that the food meets the applicable requirements of the FD&C Act. The authority to mandate import certification for food, based on risk, is one of the tools we can use to help prevent potentially harmful food from reaching U.S. consumers. When FDA has determined that a food import is subject to such certification under section 801(q) of the FD&C Act, FDA will require, as a condition of entry, a certification issued either by an accredited third-party certification body under this rule or by an agency or representative of the government of the country from which the food at issue originated, as designated by FDA.

In addition, facilities and importers may choose to use onsite audits conducted by third-party certification bodies accredited under the program set out in this rule in connection with meeting supplier verification requirements under FDA's final rules for Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food (final human preventive controls regulation) (80 FR55907, September 17, 2015); Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals (final animal preventive controls regulation) (80 FR 56169, September 17, 2015); and the Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals (published elsewhere in this edition of the
Federal Register
) (implementing sections 418 and 805 of the FD&C Act, respectively). Under those rules, in circumstances where an onsite audit is the appropriate supplier verification activity, such audit must be conducted by a “qualified auditor.” The definitions of “qualified auditor” in those rules make clear that an example of a potential qualified auditor includes, but is not limited to, an audit agent of a certification body that has been accredited in accordance with regulations in part 1, subpart M of this chapter (
i.e.,
this rule implementing section 808 of the FD&C Act).

Summary of Major Provisions of the Final Rule

This rule establishes the framework, procedures, and requirements for accreditation bodies and third-party certification bodies for purposes of section 808 of the FD&C Act. The rule sets requirements for the legal authority, competency, capacity, conflict of interest safeguards, quality assurance, and records procedures that accreditation bodies must demonstrate to be eligible for recognition. Accreditation bodies also must demonstrate capability to meet the FDA requirements that would apply upon recognition. Additionally, the rule establishes requirements for the legal authority, competency, capacity, conflict of interest safeguards, quality assurance, and records procedures that third-party certification bodies must demonstrate to be eligible for accreditation. Third-party certification bodies also must demonstrate capability to meet the applicable requirements of the rule that would apply upon accreditation.

Pursuant to FSMA section 307 (21 U.S.C. 384d), the rule requires accredited third-party certification

bodies to perform unannounced facility audits, to notify FDA upon discovering a condition that could cause or contribute to a serious risk to the public health, and to submit to FDA reports of regulatory audits conducted for certification purposes. The rule includes stringent requirements to prevent conflicts of interest from influencing the decisions of recognized accreditation bodies and accredited third-party certification bodies. The rule does not, however, establish the audit criteria that accredited third-party certification bodies will use in examining eligible entities for compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, because those criteria appear elsewhere in FDA regulations and the FD&C Act.

Costs and Benefits

Costs of the Third-Party final rule include compliance costs of accreditation bodies and certification bodies that choose to participate in our third-party program, and user fees imposed by FDA on accreditation bodies and certification bodies for application review and monitoring of program participants.

Table 1—Summary User Fee, Compliance, Undiscounted and Annualized Costs of the Third-Party (TP) Program per Participant

Eligible entity
Audited by

Certification bodies (CBs) currently
accredited under
other programs

CBs not accredited under any program
Total

SCENARIO 1

Number of section 801(q) Entities
10
65
75

Cost of Compliance with Program Requirements (TP Compliance Cost)
$694
$2,569

Section 801(q) Compliance Cost
$6,940
$166,985
$173,925

Number of section 806 Entities
145
971
1,116

TP Compliance Cost
$694
$2,569

Section 806 Compliance Cost
$100,630
$2,494,499
$2,595,129

Total TP Compliance Cost—Scenario 1

$2,769,054

SCENARIO 2

Number of section 801(q) Entities
10
65
75

TP Compliance Cost
$322
$2,197

Section 801(q) Compliance Cost
$3,220
$142,805
$146,025

Number of § 806 Entities
459
3,068
3,527

TP Compliance Cost
$322
$2,197

Section 806 Compliance Cost
$147,798
$6,740,396
$6,888,194

Total TP Compliance Cost—Scenario 2

$7,034,219

SCENARIO 3

Number of section 801(q) Entities
10
65
75

TP Compliance Cost
$227
$2,102

Section 801(q) Compliance Cost
$2,270
$136,630
$138,900

Number of section 806 Entities
801
5,359
6,160

TP Compliance Cost
$227
$2,102

Section 806 Compliance Cost
$181,827
$11,264,618
$11,446,445

Total TP Compliance Cost—Scenario 3

$11,585,345

The costs that accreditation bodies and certification bodies incur in complying with the regulation are necessarily less than the private benefits they accrue by becoming recognized or accredited, respectively. Through the third-party accreditation program more effective regulatory oversight is achieved. FDA will recoup resources in managing its third-party accreditation program through user fees that FDA intends to impose on participating accreditation bodies and third-party certification bodies.

I. Introduction and Background

A. FDA Food Safety Modernization Act

FSMA (Pub. L. 111-353), signed into law by President Obama on January 4, 2011, is intended to allow FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than relying primarily on reacting to problems after they occur. The law also provides new enforcement authorities to help achieve higher rates of compliance with risk-based, prevention-oriented safety standards and to better respond to and contain problems when they do occur. In addition, the law contains important new tools to better ensure the safety of imported foods and encourages partnerships with State, local, tribal, and territorial authorities and international collaborations with foreign regulatory counterparts. A top priority for FDA are those FSMA-required regulations that provide the framework for industry's implementation of preventive controls and enhance our ability to oversee their implementation for both domestic and imported food. To that end, we proposed the seven foundational rules listed in table 2 and

requested comments on all aspects of these proposed rules.

Table 2—Published Foundational Proposed Rules for Implementation of FSMA

Title
Abbreviation
Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food
2013 proposed human preventive controls regulation
78 FR 3646, January 16, 2013.

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption
2013 proposed produce safety regulation
78 FR 3504, January 16, 2013.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals
2013 proposed animal preventive controls regulation
78 FR 64736, October 29, 2013.

Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals
2013 proposed FSVP regulation
78 FR 45730, July 29, 2013.

Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications
2013 proposed third-party certification regulation (also referred to in this document as the proposed rule)
78 FR 45782, July 29, 2013.

Focused Mitigation Strategies To Protect Food Against Intentional Adulteration
2013 proposed intentional adulteration regulation
78 FR 78014, December 24, 2013.

Sanitary Transportation of Human and Animal Food
2014 proposed sanitary transportation regulation
79 FR 7006, February 5, 2014.

We also issued a supplemental notice of proposed rulemaking for the rules listed in table 3 and requested comments on specific issues identified in each supplemental notice of proposed rulemaking.

Table 3—Published Supplemental Notices of Proposed Rulemaking for the Foundational Rules for Implementation of FSMA

Title
Abbreviation
Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food
2014 supplemental human preventive controls notice
79 FR 58524, September 29, 2014.

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption
2014 supplemental produce safety notice
79 FR 58434, September 29, 2014.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals
2014 supplemental animal preventive controls notice
79 FR 58476, September 29, 2014.

FSVP for Importers of Food for Humans and Animals
2014 supplemental FSVP notice
79 FR 58574, September 29, 2014.

We finalized two of the foundational rulemakings listed in table 4 in September 2015.

Table 4—Published Foundational Final Rules for Implementation of FSMA

Title
Abbreviation
Publication

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food
final human preventive controls regulation
80 FR 55908, September 17, 2015.

Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals
final animal preventive controls regulation
80 FR 56170, September 17, 2015.

As FDA finalizes these seven foundational rulemakings, we are putting in place a modern, risk-based framework for food safety that is based on the most recent science, that focuses efforts where the hazards are reasonably likely to occur, and that is flexible and practical given our current knowledge of food safety practices. To achieve this, FDA has engaged in a significant amount of outreach to the stakeholder community to find the right balance between flexibility and accountability in these regulations.

After FSMA was enacted in 2011, we have been involved in approximately 600 stakeholder engagements on FSMA and the proposed rules, including public meetings, webinars, listening sessions, farm tours, and extensive presentations and meetings with various stakeholder groups (Refs. 1, 2, 3). As a result of this stakeholder dialogue, FDA decided to issue the four supplemental notices of proposed rulemaking to share our current thinking on key issues and get additional stakeholder input on those issues. As we move forward into the next phase of FSMA implementation, we intend to continue this dialogue and collaboration with our stakeholders, through guidance, education, training, and assistance, to ensure that stakeholders understand and engage in their respective roles in food safety. FDA believes these seven foundational final rules, when implemented, will affect the paradigm shift toward prevention that was envisioned in FSMA and be a major step forward for food safety that will help protect consumers into the future.

B. Purpose of This Rulemaking

FSMA added section 808 to the FD&C Act which directs FDA to establish a new voluntary program for accreditation of third-party certification bodies to conduct food safety audits and to issue food and facility certifications to eligible foreign entities (including registered foreign food facilities) that meet our applicable requirements for purposes of sections 801(q) and 806 of the FD&C Act. This rulemaking implements section 808 of the FD&C Act; we will recognize accreditation bodies to accredit third-party certification bodies, except for limited circumstances in which we may directly accredit third-party certification bodies.

FSMA specifies two uses for the food and facility certifications issued by accredited third-party certification bodies under this program. First, facility certifications will be used by importers to establish eligibility for VQIP under section 806 of the FD&C Act. VQIP offers participating importers expedited review and importation for food from facilities audited and certified by third-party certification bodies accredited under this subpart. FDA issued draft guidance on VQIP on June 5, 2015 (80 FR 32136); the draft guidance may be accessed at
http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf
.

Second, section 801(q) of the FD&C Act gives FDA the authority to make a risk-based determination to require, as a condition of admissibility, that a food imported or offered for import into the United States be accompanied by a certification or other assurance that the food meets the applicable requirements of the FD&C Act. The authority to mandate import certification for food, based on risk, is one of the tools we can use to help prevent potentially harmful food from reaching U.S. consumers. When FDA has determined that a food import is subject to such certification under section 801(q) of the FD&C Act, FDA will require, as a condition of entry, a certification issued either by an accredited third-party certification body under this rule or by an agency or representative of the government of the country from which the food at issue originated, as designated by FDA.

This final rule will help FDA ensure the competence and independence of third-party certification bodies who are accredited to conduct foreign food safety audits to examine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, among other things. The document also will help ensure the validity and reliability of certifications offered to FDA for purposes of VQIP eligibility under section 806 of the FD&C Act and admissibility of an imported food subject to an FDA risk determination under section 801(q) of the FD&C Act.

The third-party certification program is part of FSMA's paradigm shift toward a modern, preventive, and risk-based approach to food safety regulation and new programs to facilitate global trade in safe food. Specifically, FSMA requires FDA to issue new preventive controls and produce safety standards that apply to domestic and foreign processors and producers. In addition, FSMA directs FDA to issue an FSVP regulation requiring importers to implement FSVPs that provide adequate assurances that their foreign suppliers produce food that is in compliance with processes and procedures, including risk-based preventive controls, that provide the same level of public health protection as those required under section 418 (concerning hazard analysis and preventive controls) or 419 (concerning produce safety) of the FD&C Act, as appropriate, and that is in compliance with sections 402 (concerning adulteration) and 403(w) (concerning misbranding regarding allergen labeling) of the FD&C Act. We emphasize that facilities and importers are not required to use third-party certification bodies accredited under this rule in meeting their supplier verification requirements under the final human or animal preventive controls or FSVP regulations. See section XIII.G.

By contrast, the third-party certification program established under section 808 of the FD&C Act focuses on food safety audits to certify that eligible foreign entities and the food produced by such entities meet applicable FDA requirements for purposes of sections 801(q) and 806 of the FD&C Act. Although importers must obtain facility certifications from accredited third-party certification bodies under this rule in order to be eligible for VQIP, we note that importers seeking to satisfy a requirement for certification as a condition of admissibility for an article of food under section 801(q) of the FD&C Act may offer a certification issued either by foreign governments designated by FDA to issue such certifications or by third-party certification bodies accredited under this rule.

Through FSMA we are transforming our role in the global food safety system, by building ever stronger partnerships with our foreign regulatory counterparts and by exploring opportunities to leverage private food safety activities to benefit of our system of public food safety assurances. We value the role that private audits can play in enhancing food safety when done properly, and we share common purpose with the food industry in ensuring the rigor and objectivity of those audits.

The final rule on accreditation of third-party certification bodies reflects the results of significant stakeholder engagement to help ensure that the rule achieves its public health goal, reflects industry best practices, and strikes the right balance between flexibility and accountability.

C. The Proposed Rule

FDA published a proposed rule for “Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications” (the proposed rule) on July 29, 2013. The proposed rule included eligibility requirements for accreditation bodies to qualify for recognition and requirements that accreditation bodies choosing to participate in the FDA program must meet, once recognized. We also proposed eligibility requirements for third-party certification bodies to qualify for accreditation and requirements that third-party certification bodies choosing to participate in the FDA program must meet, once accredited. We intended the proposed requirements to ensure the competency and independence of the accreditation bodies and third-party certification bodies participating in the program.

We also proposed procedures for recognition and accreditation, as well as requirements relating to monitoring and oversight of participating accreditation bodies and third-party certification bodies. These included procedures that we would follow when removing a third-party certification body or an accreditation body from the program. Further, we proposed requirements relating to auditing and certification of foreign eligible entities under the program, and for notifying us of conditions in an audited facility that could cause or contribute to a serious risk to the public health. In response to several requests, we extended the proposed rule comment period until January 27, 2014.

D. Public Comments

We received over 150 comments from accreditation bodies, certification bodies, members of the food industry, industry associations, foreign governments, State governments, public health organizations, public advocacy

groups, individual consumers, consumer groups, and others. Some submissions included signatures and statements from multiple individuals. Taken as a whole, the comments address virtually every provision of the proposed rule. In the remainder of this document, we describe the comments that are within the scope of this rulemaking, respond to them, and explain any revisions we made from the proposed rule.

A number of comments focus on the overarching issues of: (1) Alignment with voluntary consensus standards; (2) the use of private food safety schemes; (3) the relationship between the third-party certification program, foreign competent authorities, and FDA's international activities; and (4) the possible implications of the lack of qualified auditors on the third-party certification program. We address these comments generally below.

We received several comments on the overarching issue of the use of voluntary international consensus standards issued by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), including the following ISO/IEC standards: ISO/IEC 17000:2004 Conformity assessment—Vocabulary and general principles (ISO/IEC 17000:2004) (Ref. 4); ISO/IEC 17011:2004, Conformity assessment—General requirements for accreditation bodies accrediting conformity assessment bodies (ISO/IEC 17011:2004) (Ref. 5); ISO/IEC 17021:2011, Conformity assessment—Requirements for bodies providing audit and certification of management systems (ISO/IEC 17021:2011) (Ref. 6); ISO/IEC 17065:2012, Conformity assessment—Requirements for bodies certifying products, processes and services (ISO/IEC 17065:2012) (Ref. 7); and ISO/IEC 19011:2011, Guidelines for auditing management systems (ISO/IEC 19011:2011) (Ref. 8).

Some comments support the approach to ISO/IEC standards that we used when developing the proposed rule; some comments state that the process for developing these standards makes them unbiased. Other comments suggest we should place greater reliance on ISO/IEC standards, including some comments asserting that we should incorporate ISO/IEC standards by reference into the final rule. These comments encourage us to follow the example of a proposed rule issued by the Environmental Protection Agency and entitled, “Formaldehyde; Third-Party Certification Framework for the Formaldehyde Standards for Composite Wood Products” (78 FR 34795, June 10, 2013), which proposed to incorporate by reference certain international standards. These comments assert that by placing greater reliance on ISO standards, we could allow ISO's broader oversight program to complement FDA's management of these bodies.

Implementation of section 808 of the FD&C Act occurs against the backdrop of the broader Federal policies on consensus standards and conformity assessment under the National Technology Transfer and Advancement Act of 1995 (NTTAA) (Pub. L. 104-113). The NTTAA, together with the Office of Management and Budget (OMB) Circular A-119, revised February 10, 1998 (63 FR 8546, February 19, 1998), directs Federal Agencies to use voluntary consensus standards in lieu of government-unique standards except where inconsistent with law or otherwise impractical. OMB CircularA-119 states that the use of voluntary standards, whenever practicable and appropriate, is intended to eliminate the cost to government of developing its own standards and decrease the cost of goods procured and the burden of complying with Agency regulation; provide incentives and opportunities to establish standards that serve national needs; encourage long-term growth for U.S. enterprises and promote efficiency and economic competition through harmonization of standards; and further the policy of reliance upon the private sector to supply government needs for goods and services.

As directed by OMB in CircularA-119, the National Institute of Standards and Technology (NIST), in the
Federal Register
of August 10, 2000 (65 FR 48894), issued policy guidance on Federal conformity assessment activities (defined as activities concerned with determining directly or indirectly that requirements for products, services, systems, and organizations are fulfilled) (15 CFR 287.2). The Federal conformity assessment guidance is codified at 15 CFR part 287 and applies to all Federal Agencies that set policy for, manage, operate, or use conformity assessment activities or results, domestically and internationally (except for activities conducted pursuant to treaties) and is intended to eliminate unnecessary duplication and complexity in conformity assessment requirements. (We note that OMB has announced it is currently revising Circular A-119, and NIST is revising the Federal conformity assessment guidance.)

We agree with comments on the value of promoting international consistency and tapping into an existing framework of consensus standards that is familiar to industry, which may make it easier for accreditation bodies, third-party certification bodies, and eligible entities to comply with this rule. Therefore, we are revising the rule to allow for accreditation bodies and third-party certification bodies to use documentation of their conformance with ISO/IEC standards in meeting the program requirements under this rule, supplemented as necessary. We are not, however, incorporating these standards by reference into the rule as further discussed in our responses to comments in sections III. to XIII., except that we are not further responding to comments citing specific requirements of ISO/IEC Guide 65:1996, Conformity assessment—Requirements for bodies providing audit and certification of management systems (ISO/IEC Guide 65:1996) (Ref. 9) in sections III. to XIII., because that standard has been withdrawn and replaced by ISO/IEC 17065:2012 (Ref. 7) in September 2015. Comments referring to ISO/IEC 17020:2012, Conformity assessment—Requirements for the operation of various types of bodies performing inspection (ISO/IEC 17020:2012) (Ref. 10) are outside the scope of this rulemaking, because that standard relates to inspections and not the auditing and certification activities that will be performed under this rule. Therefore, we are not responding to comments citing to ISO/IEC 17020:2012, Conformity assessment—Requirements for the operation of various types of bodies performing inspection (ISO/IEC 17020:2012) (Ref. 10) in sections III. to XIII.

We also received several comments on the overarching issue of using private food safety schemes as audit criteria for regulatory audits conducted under the third-party certification program. Some comments suggest that FDA should rely on private food safety schemes, particularly those that have been benchmarked by the Global Food Safety Initiative (GFSI), as the audit criteria for regulatory audits of eligible entities under the third-party certification program. Other comments suggest that FDA should establish requirements for accreditation bodies and third-party certification bodies that are similar to those required by GFSI, such as GFSI requirements relating to accreditation under relevant ISO/IEC product certification or management system standards.

By way of background, a group of international retailers established GFSI in 2000 with the goal of reducing the need for duplicative third-party audits by benchmarking private food safety schemes against a harmonized set of

criteria for food safety and management systems (see 78 FR 45782 at 45788; July 29, 2013). Under current GFSI criteria, a food safety scheme must have a commitment with one or more accreditation bodies for certification bodies that operate in conformance with either the product certification standard, ISO/IEC Guide 65, or the management system standard, ISO/IEC 17021:2006 (supplemented by ISO/TS 22003). GFSI describes these standards as having similar requirements for how a certification body must operate—
e.g.,
in addressing issues of preventing conflict of interest, managing customer information, properly qualifying personnel, auditor calibration, and many other aspects involved with the certification process. However, as GFSI noted in a 2011 White Paper (Ref. 11), there is a distinct difference between the two. ISO 17021/ISO 22003 is not product specific. ISO/IEC Guide 65, on the other hand, is concerned with verifying that particular products or services meet specified requirements. The type and scope of GFSI benchmarked scheme selected, determines the accreditation standard which applies. The majority of GFSI recognized schemes fall under ISO/IEC Guide 65 accreditation requirements, whereas only two currently recognized schemes are management system schemes accredited to ISO 17021/ISO 22003.

Comments suggesting that we should rely on GFSI-benchmarked food safety schemes or other private food safety schemes as the criteria for certification under the third-party program are outside the scope of this rulemaking. This rule establishes the framework for the third-party certification program, and not the food safety standards that accredited third-party certification bodies will use to determine an eligible entity's compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. We are however responding to relevant comments that address audit quality and auditor competency, consistency, and capacity, including comments referencing GFSI's work in these areas.

Other overarching comments ask how the FSMA third-party certification program relates to the roles of foreign competent authorities and to FDA's international activities. Some comments assert that competent authorities should be allowed to participate in the third-party certification program purely by administrative procedures without a formal review process. Other comments suggest that government agencies with both regulatory and trade promotion missions face inherent conflicts of interest.

Some comments recommend that we should establish a different structure for accrediting third-party certification bodies that already have been approved by a foreign government accreditation body. Other comments suggest that FDA should reserve the role of accreditation body or third-party certification body for a national competent authority that requests it. The comments argue that the responsibility for monitoring the safety of food exports should remain with the national competent authorities in each country.

Some comments ask whether a national competent authority has a role in auditing and certification activities occurring in the country, including in countries where an FDA foreign office is located. Other comments ask whether the competent authority may perform other activities in the third-party certification program, such as authentication of audit information before it is submitted to FDA. Still other comments suggest that FDA require accredited third-party certification bodies to review correspondence between an audited eligible entity and the competent authorities in the country where the eligible entity is located.

Section 808 of the FD&C Act expressly provides for both public and private accredited third-party certification bodies. Public accreditation bodies and third-party certification bodies, as well as private accreditation bodies and third-party certification bodies that meet the eligibility requirements for recognition and accreditation under section 808 of the FD&C Act and this rule are equally eligible to participate in the third-party certification program. This includes government accreditation bodies and certification bodies in countries where FDA has a foreign office, as well as government agencies with the dual missions of food safety and trade promotion. We believe that both public and private third-party certification bodies and accreditation bodies are capable of exhibiting the competency, capacity, and impartiality necessary to meet the letter and spirit of the law and this regulation.

By becoming an accredited third-party certification body or a recognized accreditation body, a competent authority for food safety or a foreign accreditation body would establish a role in the third-party certification program. Only if competent authorities are accredited under this rule, may they issue food and facility certifications under section 808 of the FD&C Act. (We note, however, that FDA may require certifications from competent authorities under section 801(q) of the FD&C Act for foods that FDA determines meet the criteria set forth in that section (see 801(q)(3)(A) of the FD&C Act), regardless of whether the competent authorities are accredited.) We acknowledge that the third-party certification program that is the subject of this rule is narrowly tailored and only a small piece of the much larger modernized, prevention-oriented food safety system we are establishing under FSMA. Broader FSMA activities are outside the scope of this rulemaking, as are matters covered by FDA's information sharing arrangements with foreign competent authorities.

We received other comments on the overarching issue of how the third-party certification program fits into FDA's international activities. Some comments assert that, for countries with a systems recognition agreement with FDA, there should be no need for a (direct or indirect) role for FDA in monitoring accredited third-party certification bodies. Other comments encourage us to recognize their national food safety system as equivalent to that of the United States.

The systems recognition initiative is a food safety regulatory cooperation program that allows FDA to take into account the role of food safety systems of exporting countries in our risk-based decisionmaking. We are using systems recognition as a tool to determine when we can rely on the implementation of science-based food safety programs by foreign regulatory authorities and take action based on information provided by such authorities.

We note that a competent authority with whom FDA has a systems recognition agreement must apply for recognition to make accreditation decisions and apply for accreditation to issue certifications under section 808 of the FD&C Act. If the competent authority applies for recognition or direct accreditation by FDA (assuming that the statutory criteria have been met for FDA to begin direct accreditation), FDA's review will be informed by the data, experiences, and insights into the foreign system that FDA gained through the systems recognition review. Except as described above, systems recognition activities are outside the scope of this rulemaking, as are equivalency determinations.

We also received several overarching comments noting that the lack of qualified food safety auditors is a problem in many countries. Some comments suggest that we may face similar problems with the availability of accredited third-party certification

bodies in our program. The comments assert that we should prioritize the review of applications from foreign countries with significant volumes of exports to the United States because of the cost and inconvenience to foreign suppliers and the likely trade disruption that would result if the only accredited third-party certification bodies were located in other countries. Some comments predict that rapid expansion in the field of food safety auditing may result in shortcuts in auditing. Other comments contend that because of the limited availability of qualified auditors we should adjust the timeframes for accredited third-party certification bodies to submit information to FDA under the regulations. The comments specifically request that we lengthen the 45-day timeframe for submitting regulatory audit reports.

We acknowledge the concerns about cost, inconvenience, and disruption resulting from auditor capacity issues. We are encouraging broad program participation to minimize the likelihood that capacity issues might emerge, because certifications issued by accredited third-party certification bodies under this program are intended to facilitate trade. The certifications are used in meeting the eligibility requirements of VQIP for expedited entry of food under section 806 of the FD&C Act and in satisfying a condition of admissibility for a food subject an FDA determination under section 801(q) of the FD&C Act.

Revisions have been made to this rule made in response to comments, such as allowing accreditation bodies and third-party certification bodies to use documentation of their conformance with ISO/IEC standards in support of their applications. We also are modifying our “first in, first out” approach to processing applications, as comments request, to allow for prioritizing specific applications and requests based on program needs. We are unable to accommodate the request to lengthen the timeframe for submission of regulatory audit reports to FDA, because the 45-day deadline for submission is established in section 808(c)(3)(A) of the FD&C Act. Audit protocols and other requirements of the rule are designed to prevent audit agents (auditors) and third-party certification bodies from taking shortcuts that would jeopardize audit results.

Some comments addressed the Model Accreditation Standards that FDA is required to develop under section 808(b)(2) of the FD&C Act for use in qualifying third-party certification bodies for accreditation. Some of these comments suggest various criteria to be included in the model standards. Other comments suggest the proposed rule was ambiguous with respect to the form of, and manner by which, FDA will establish the Model Accreditation Standards.

While the substance of the Model Accreditation Standards is outside the scope of this rulemaking, we note that on July 24, 2015, FDA published a draft guidance on Model Accreditation Standards. The draft guidance can be accessed at:
http://www.fda.gov/Food/GuidanceRegulation/GuidancevDocumentsRegulatoryInformation/ucm455328.htm
. Additionally, a notice was published in the
Federal Register
(80 FR 44137, July 24, 2015) of the availability of the draft guidance and of the opening of a docket for public comments on the document. As explained in the draft guidance, section 808(b)(2) of the FD&C Act requires FDA to develop Model Accreditation Standards that recognized accreditation bodies shall use to qualify third-party certification bodies for accreditation, and in so doing, to look to existing standards for certification bodies (as of the date of enactment of FSMA) to avoid unnecessary duplication of efforts and costs. The draft guidance contains FDA recommendations on third-party certification body qualifications, including recommendations based on relevant provisions in the proposed rule. This final rule will serve as a framework for the Model Accreditation Standards final guidance, which will include more detailed recommendations on third-party certification body qualifications.

Some comments respond to our request for input on the question about the value of, and possible need for, FDA to establish a program for use of accredited third-party certification bodies to conduct domestic food safety audits (78 FR 45782 at 45823). We received comments on all sides, expressing various views. We are taking these comments under advisement at this time, as the focus of this final rule is on establishing and implementing the third-party certification program set forth in section 808 of the FD&C Act.

Other comments addressed the substance of VQIP, import certification, laboratory accreditation, and provisions in the proposed FSVP rule and/or other FMSA rules that are outside the scope of this rulemaking; accordingly we will not be responding to those comments here. Other comments that fall outside the scope of this rulemaking, and to which we will therefore not be responding, include comments on the value of a universal, mandatory food safety system; comments advocating for policies promoting locally grown produce; comments addressing the information technology infrastructure needs of the third-party certification program; comments suggesting the value of student interns to the food safety system; and comments on factors beyond the use of third-party audits that FDA should consider in setting inspection priorities.

We also received a few comments concerning the rulemaking process. Comments suggest that we devise a new process for regularly updating the rule; they state that FDA has cumbersome requirements for modifying rules. FDA's current rulemaking process is consistent with FDA's obligations under the Administrative Procedure Act (5 U.S.C. 551-559).

II. Legal Authority

Section 307 of FSMA, Accreditation of Third-Party Auditors, amends the FD&C Act to create a new provision, section 808, under the same name. Section 808(b)(1)(A) of the FD&C Act requires us to establish a system, within 2 years of the enactment of FSMA, for the recognition of accreditation bodies that accredit third-party certification bodies to conduct food safety audits and to issue certifications for eligible foreign food entities and their products for purposes of sections 801(q) and 806 of the FD&C Act.

Section 808(c)(5)(C) of the FD&C Act directs us to issue implementing regulations for section 808 of the FD&C Act. The regulations must require audits to be unannounced and must contain protections against conflicts of interest between accredited third-party certification bodies (and their audit agents) and the entities they audit or certify, including requirements on timing and public disclosure of fees and appropriate limits on financial affiliations (21 U.S.C. 384d(c)(5)(C)(i), (ii), and (iii)).

This final rule establishes regulations implementing section 808 of the FD&C Act. The authority for the requirements in this rule comes primarily from section 808 of the FD&C Act. However, FDA also derives authority for this final rule from other sections of the FD&C Act, including section 701(a) of the FD&C Act (21 U.S.C. 371(a)), which authorizes us to issue regulations for the efficient enforcement of the FD&C Act. The regulations in this final rule ensure the competency and independence of recognized accreditation bodies and of accredited third-party certification bodies, which will help ensure the validity and reliability of certifications and other information resulting from the food safety audits conducted by

accredited third-party certification bodies. These features of the final rule are essential to the operation of the third-party program. This rule also is consistent with section 404 of FSMA (21 U.S.C. 2252), which states that nothing in FSMA should be construed in a manner that is inconsistent with the agreement establishing the World Trade Organization or any other treaty or international agreement to which the United States is a party.

This rule establishes requirements for accreditation bodies and third-party certification bodies seeking recognition and accreditation, respectively. These requirements will help ensure that any accreditation bodies that we recognize, and any certification bodies that are accredited, are capable of meeting all of the requirements of this program. This includes requirements, for example, for legal authority and competency and capacity. It also includes provisions for the direct accreditation of third-party certification bodies by FDA in accordance with section 808(b)(1)(A)(ii) of the FD&C Act. This rule also establishes requirements for accreditation bodies that have been recognized, and third-party certification bodies that have been accredited. This includes requirements designed to decrease the potential for conflicts of interest in accordance with section 808(c)(5)(C)(ii) of the FD&C Act. Additionally, this rule establishes requirements for eligible entities that want to be certified under this program. This includes requirements for onsite audits by FDA for the purpose of monitoring in accordance with section 808(f)(3) of the FD&C Act. Finally, this rule establishes general requirements related to the operation of this program. These include requirements for requesting a regulatory hearing on revocation of recognition or withdrawal of accreditation.

Some of the requirements under this final rule are also established, in part, under the authority in sections 806 and 801(q) of the FD&C Act. Section 806 of the FD&C Act describes a voluntary program to provide for the expedited review and importation of food offered for importation from certified facilities (VQIP). Section 801(q) of the FD&C Act gives FDA authority to require certifications for imported food in certain situations. This final rule does not set up the framework for participation in the program described under section 806 of the FD&C Act, nor does it describe the circumstances under which FDA might require certification under section 801(q) of the FD&C Act. However, this rule does describe circumstances under which FDA might refuse to consider a certification issued under this program in determining the admissibility of an article of food for which the certification was offered under section 801(q) of the FD&C Act, or in determining eligibility for participation in VQIP under section 806 of the FD&C Act. Additionally, this rule creates limited exemptions from the certification requirements of section 801(q) of the FD&C Act for certain alcoholic beverages, including certain raw materials and ingredients that are used to manufacture/process alcoholic beverages. The exemptions are being promulgated consistent with section 116 of FSMA (21 U.S.C. 2206). Section 116(a) of FSMA states that, except as provided by certain listed sections in FSMA, nothing in FSMA, or the amendments made by FSMA, will be construed to apply to a facility that: (1) Under the Federal Alcohol Administration Act (27 U.S.C. 201
et seq.
) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001
et seq.
) is required to obtain a permit or to register with the Secretary of the Treasury as a condition of doing business in the United States and (2) under section 415 of the FD&C Act (21 U.S.C. 350d) is required to register as a facility because such facility is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages (with respect to the activities of such facility that relate to the manufacturing, processing, packing, or holding of alcoholic beverages). This rule also creates exemptions from the certification requirements of section 801(q) of the FD&C Act for products subject to the requirements of the U.S. Department of Agriculture (USDA) under the Federal Meat Inspection Act (FMIA) (21 U.S.C. 601
et seq.
), the Poultry Products Inspection Act (PPIA) (21 U.S.C. 451
et seq.
), or the Egg Products Inspection Act (EPIA) (21 U.S.C. 1031
et seq.
) at the time of importation. We conclude that this provision is consistent with section 403 of FSMA, entitled “Rule of Construction,” which states that nothing in FSMA shall be construed to alter or limit the jurisdiction of the Secretary of the Department of Agriculture.

III. Comments on What Definitions Apply to This Subpart (§ 1.600)

We proposed to codify definitions of several terms used in the third-party certification regulations. We received several comments on this section. As discussed in the following paragraphs, we have revised many of the proposed definitions in response to comments as well as on our own initiative. Where we disagree with comments or decline a suggested revision, we offer an explanation in response. Some definitions were finalized as proposed.

The definitions for terms used in the third-party certification regulations are codified in 21 CFR 1.600.

A. Definitions, Generally

(Comment 1) Several comments encourage us to more closely align the definitions in § 1.600 with international standards to promote consistency and common understanding of the rule. The comments explain that the terms and definitions used in section 808 of the FD&C Act and in the proposed rule convey a different meaning for accreditation bodies, certification bodies, and the standards community. To that end, some comments encourage us to avoid using the term “third-party auditor” synonymously with “certification body,” to be consistent with international standards, which use the term “certification body” (
e.g.,
ISO/IEC 17065:2012 (Ref.7).

Similarly, some comments indicate that, the language of the statute notwithstanding, it is not correct to use the term “third-party auditor” when describing the activities of a “third-party certification body.” The comments explain that auditors are individuals contracted or employed by certification bodies to conduct audits, and they urge us to clarify the rule by substituting “certification body” for “third-party auditor.”

(Response 1) We agree that alignment with the terminology used in international standards is preferable, wherever possible. Congress recognized the value of international standards in accreditation and certification, having instructed us in section 808(b)(2) of the FD&C Act to look to existing standards in developing our model accreditation standards to avoid unnecessary duplication of efforts and costs. We believe it is particularly useful to rely on definitions and terminology from international consensus standards when possible where, as here, the rule is establishing a voluntary program with an international focus. In addition, we agree that, notwithstanding the use of the term “third-party auditor” in the statute, the use of the term “third-party certification body” instead of the term “third-party auditor” provides some clarity for purposes of referring to bodies that employ or contract individuals to perform audits.

Therefore, in response to the comments suggesting the term “third-party auditor” is confusing and inconsistent with international standards, we are using the term “third-party certification body” in the

remainder of the preamble and in the codified of this final rule, except in the definitions of “Accredited third-party certification body” and “Third-party certification body” in § 1.600(c) and in the preamble discussion of those definitions.

On our own initiative, we are including the descriptor “third-party” before “certification body” throughout this final rule. We did not use that descriptor in the proposed rule when referring to a third-party auditor/certification body once accredited. We are doing so now in order that the term accurately reflects that, under this subpart, only third-party certification bodies are eligible for accreditation. We are making corresponding changes to the term “accredited auditor/certification body;” and in this final rule we will instead use the term, “accredited third-party certification body.”

Accordingly, we have revised the proposed definitions of “accreditation,” “accreditation body,” “accredited auditor/certification body,” “audit,” “audit agent,” “certification body,” “direct accreditation,” “eligible entity,” “facility certification,” “food certification,” “recognized accreditation body,” “relinquishment,” and “self-assessment,” to replace the term “third-party auditor” with the term “third-party certification body,” or “third-party certification bodies,” and to remove “auditor/” from in the term “third-party auditor/certification body” or “third-party auditors/certification bodies” that was used in the proposed rule.

On our own initiative, we added a sentence to the definition of “accredited third-party certification body” in § 1.600 of this final rule to explain that the term has the same meaning as “accredited third-party auditor” as defined in section 808(a)(4) of the FD&C Act. Similarly, we added language to the definition of “third-party certification body” in § 1.600 of this final rule explaining that the term has the same meaning as “third-party auditor” as defined in section 808(a)(3) of the FD&C Act.

(Comment 2) Some comments encourage us to make the definitions in this rule consistent with the definitions in other FSMA proposed rules, such as the 2013 proposed FSVP regulation, the 2013 proposed human preventive controls regulation, the 2013 proposed animal preventive controls regulation, and the 2012 proposed produce safety regulation, where feasible.

(Response 2) We agree with the comments on the overarching goal of alignment across regulations and accepted suggested revisions, where feasible and appropriate. However, it is not always possible to develop uniform definitions due to the distinct statutory requirements and the framework of each program. In such cases where it was not feasible or appropriate, we declined the suggested revisions from comments. We discuss such comments and our responses under each relevant term.

B. Assessment

We did not define “assessment” in the proposed rule.

(Comment 3) Some comments recommend adding a definition of “assessment” based on ISO/IEC 17011:2004 (Ref. 5), clause 3.7, which describes the process for evaluating certification bodies. The comments explain that defining such evaluations as “audits,” as we had proposed, is inconsistent with international standards. The comments suggest consulting with other ISO/IEC standards for relevant terminology.

(Response 3) We agree that the term “assessment” should be used, in part, to refer to the activity undertaken to assess the competency and capacity of a third-party certification body under the rule. We reviewed ISO/IEC 17011:2004 (Ref. 5) (clause 3.7 and NOTE) and ISO/IEC 17000:2004 (Ref. 4), ISO/IEC 17040:2005 Conformity assessment—General requirements for peer assessment of conformity assessment bodies and accreditation bodies (ISO/IEC 17040:2005) (Ref. 12), and an International Accreditation Forum (IAF) document entitled, “IAF Endorsed Normative Documents” (Ref. 13).

After considering the comments and reviewing the referenced documents, we developed a definition of “assessment” that describes, with respect to accreditation bodies, the activity undertaken by FDA to evaluate the competency and capacity of the accreditation body under the applicable requirements of this rule. With respect to certification bodies, “assessment” describes the activity undertaken by a recognized accreditation body (or, in the case of direct accreditation, FDA) to evaluate the competency and capacity of a certification body under the applicable requirements of this rule. We also made corresponding changes to the definition of “audit” from proposed § 1.600(c) by removing clauses (1) and (2).

C. Audit

We proposed a definition of “audit” describing the examination of accreditation bodies, third-party certification bodies, and eligible entities. We proposed to define an audit of an accreditation body as an examination by FDA of the accreditation body's authority, qualifications, resources, policies, procedures, and performance, as well as of its capability to meet the requirements of the proposed rule. We proposed to define an audit of a third-party certification body as an examination by a recognized accreditation body (or, by FDA, for direct accreditation) of the third-party certification body's authority, qualifications, resources, policies, procedures, and performance, as well as of its capability to meet the requirements of the proposed rule. We proposed to define an audit of an eligible entity as an examination by an accredited third-party certification body of the eligible entity to assess the entity, its facility, system(s), and food using audit criteria for consultative or regulatory audits, and, for consultative audits, also including an assessment of compliance with applicable industry standards and practices.

We received some comments on the proposed definition of “audit,” and the related definitions of “consultative audit” and “regulatory audit.” Comments specific to the definition of “consultative audit” are discussed in section III.E., and comments on the definition of “regulatory audit” are discussed in section III.L. As described in Response 3, we also removed clauses (1) and (2) from the proposed definition of “audit” because those evaluations are “assessments” as the term is defined in § 1.600(c).

On our own initiative, we are revising the definition of “audit” to clarify that an audit conducted under this subpart is not an inspection under section 704 of the FD&C Act (21 U.S.C. 374).

(Comment 4) Several comments encourage us to align our definition of audit with relevant international standards, and some comments request that we use the definition of “audit” from the Codex “Principles for Food Import and Export Inspection and Certification” (CAC/GL 20-1995) (Ref. 14), which defines “audit” as a “systematic and functionally independent examination to determine whether activities and related results comply with planned objectives.”

(Response 4) We agree with the general principle of creating consistency with international standards and have revised the definition of “audit” in § 1.600(c) accordingly. Rather than describing the determination of whether activities comply with “planned objectives” that appears in the Codex definition of “audit” (Ref. 14), we inserted a brief description of the objectives of consultative and regulatory audits from the definitions in section 808(a)(5) and (7) of the FD&C Act (
i.e.,

the examination of an eligible entity under this rule).

(Comment 5) Some comments encourage us to remove the proposed definition of “audit” in § 1.600(c) and substitute the FSVP definition of “audit” instead, to promote consistency and a common understanding of terminology.

(Response 5) We disagree. We believe that it is more important for the definition in this rule to reflect international standards that are generally well known to the parties subject to this rule than it is for the definition to mirror the definition in FSVP, which has different applicability. FSVP applies to importers; this rule applies to accreditation bodies, third-party certification bodies, and eligible entities. Therefore, we are rejecting the suggestion to use the FSVP definition of “audit” as the definition of “audit” in § 1.600(c).

(Comment 6) We received some comments on the definition of “audit” regarding its relationship to the related definitions of “consultative audit” and “regulatory audit” in § 1.600(c). Some comments recommend that we revise the definition of “audit” to mean only regulatory audits, and not consultative audits, asserting that is how the word “audit” is used in the statute. These comments contend that the statute must be interpreted in light of the fact that section 808 of the FD&C Act is directed to food and facility certifications, which are only accomplished through regulatory audits. Other comments ask us to clarify that the services of an accredited third-party certification body that fall short of the definition of an “audit” (
e.g.,
informal consulting, continuous improvement programs, and limited purpose audits) under this rule, are not subject to the requirements of the rule.

(Response 6) We decline the suggestion to interpret section 808 of the FD&C Act in a manner that would equate “audit” with “regulatory audit.” Section 808 of the FD&C Act defines two types of audits used under the program, consultative audits and regulatory audits, and contains requirements relating to each. (See,
e.g.,
section 808(a)(5), (7), and (c)(3)(A) of the FD&C Act). In addition, section 808(c)(4)(B) of the FD&C Act expressly allows an accredited third-party certification body or an audit agent of such auditor to perform consultative and regulatory audits of eligible entities.

To the extent that other comments suggest creating a list of exceptions from the definition of “audit” in the codified for this rule, we decline to do so. To the extent that these comments were seeking clarification of the definition of “consultative audit” in § 1.600(c), and what types of activities might fall outside of that definition as well as outside of this program, please see the discussion in Response 9 in section III.E.

(Comment 7) Some comments express confusion about the criteria that accredited third-party certification bodies will be using in conducting audits under subpart M and ask us to more clearly describe the “applicable requirements” against which compliance will be evaluated. Some comments are concerned that eligible entities might be audited against requirements that do not apply to their operations. For example, some comments note that firms subject to the final animal preventive controls regulation should not be assessed for compliance with the allergen cross contamination requirements of the final human preventive controls regulation. Other comments ask us to clarify whether the “applicable requirements” are limited to requirements that appear in the FD&C Act or FDA regulations, or both.

(Response 7) During regulatory and consultative audits, accredited third-party certification bodies will examine compliance with applicable food safety requirements of the FD&C Act and FDA regulations within the scope of the audit. In consultative audits, the third-party certification bodies also may be conducting an examination to determine conformance with applicable industry standards and practices.

The applicable requirements that accredited third-party certification bodies and their audit agents will use relate to the food safety standards under the FD&C Act, such as the adulterated food provisions in section 402 of the FD&C Act and the provisions on the misbranding of food allergens in section 403(w) of the FD&C Act. The applicable requirements of the FD&C Act and FDA regulations would depend on the type of eligible entity being audited. To use the example given by one of the comments, an eligible entity that is subject to the requirements of the final animal preventive controls regulation, but not the final human preventive controls regulation, would not be subject to an audit examining its practices relating to cross-contamination by food allergens under the final human preventive controls regulation because those are not “applicable food safety requirements” for such an entity.

To help clarify this rule for eligible entities, third-party certification bodies, and accreditation bodies who may be interested in participating in the program and who may not yet be familiar with U.S. laws and regulations, we are using the phrase “applicable food safety requirements of the FD&C Act and FDA regulations” in place of the phrase “applicable requirements” in the definition of “audit” in § 1.600(c) and elsewhere throughout the rule where we are discussing the requirements that will be used in auditing eligible entities.
2

2
Although we have elected to cite to both the FD&C Act and FDA regulations in this definition, we otherwise will follow the conventional practice of using the words “applicable requirements” to refer the applicable requirements of the FD&C Act and FDA regulations.

D. Audit Agent

We proposed to define an “audit agent” as an individual who is an employee or other agent of an accredited third-party certification body who, although not individually accredited, is qualified to conduct food safety audits on behalf of an accredited third-party certification body. Under the proposed rule we also defined an audit agent to include a contractor of the accredited third-party certification body.

(Comment 8) Some comments express concern about our proposal to allow a contractor of an accredited third-party certification body to serve as an audit agent, asserting that “[w]ith each step that is further removed in this process, institutional control is lost exponentially.” The comments point out that a subcontractor conducted the audit and gave a passing audit score to a cantaloupe farm and packing facility that used “improper and unsafe processing equipment” and subsequently was linked to a deadly outbreak caused by
Listeria monocytogenes
. Other comments mentioning the incident cite to an article in Bloomberg News explaining that auditors often outsource to independent contractors over whom they do not have direct management control (Ref. 15). Still other comments offer the cantaloupe outbreak as an example of why auditors must be competent and accountable for their activities.

(Response 8) We understand that third-party certification bodies currently work with individual auditors under many different types of arrangements. We acknowledge concerns raised by comments about recent outbreaks at some domestic facilities that had received satisfactory scores in food safety audits. Further, we agree with the comments on the importance of an accredited third-party certification body exercising adequate control over an audit agent conducting audits on its

behalf. We believe that principle is equally true whether the audit agent is an employee or a contract auditor.

International standards, such as ISO/IEC 17021:2011 (Ref. 6), specifically allow accredited third-party certification bodies to use contractors to perform audits if certain conditions are met. Among other conditions, contract auditors must meet the same level of qualifications (
e.g.,
knowledge, skills, and experience) and the same requirements for impartiality and objectivity as do the auditors the third-party certification body employs. The third-party certification body must exercise adequate control and oversight over a contractor such that the third-party certification body accepts the result of the contractor's audit as its own.

When we proposed to define “audit agent” to include a contractor, we were contemplating arrangements such as those described in ISO/IEC 17021:2011 (Ref. 6) that involve a direct relationship between the accredited third-party certification body and its auditors. We are revising the definition of “audit agent” to clarify that we are excluding subcontractors and other types of outsourcing arrangements; we have concluded that such arrangements fail to provide the degree of control and oversight necessary for an accredited third-party certification body to ensure that its audit agents are competent and objective. An accredited third-party certification body exercises direct supervision over the activities of its employees, and has a direct relationship with a contractor; but the relationship between the third-party certification body and a subcontractor or other type of outsourced staff is attenuated—the third-party certification body may not even choose such persons and may not have any direct authority over them. We do not believe such diminished oversight is appropriate, given the important role of audit agents in this program.

By revising the definition of “audit agent” we are not preventing an accredited third-party certification body from subcontracting for services in areas other than the conduct of audits. For example, an accredited third-party certification body may use subcontractors or other outsourcing arrangements to deliver annual training to its audit agents under § 1.650 or may use subcontractors or other outsourcing arrangements to investigate and decide on appeals of adverse regulatory audit results under § 1.651. However, we are limiting the role of “audit agent” to employees and contractors of the accredited third-party certification body.

E. Consultative Audit

We proposed to define a “consultative audit” as an audit of an eligible entity: (1) To determine whether such entity is in compliance with applicable requirements of the FD&C Act and industry standards and practices and (2) the results of which are for internal purposes only and cannot be used to determine eligibility for a food or facility certification issued under this subpart or in meeting the requirements for an onsite audit of a foreign supplier under subpart L of this part.

(Comment 9) We received several comments on the definition of “consultative audit.” Many comments express concern that the definition of “consultative audit” is overly broad and that some of the requirements that would apply to consultative audits under the proposed rule might create a disincentive to using accredited third-party certification bodies. Some comments urge FDA to remove all requirements associated with consultative audits from the rule. Other comments identify two requirements of particular concern: (1) Proposed § 1.656, requiring an accredited third-party certification body conducting a consultative audit or regulatory audit under the rule to notify FDA immediately upon discovering a condition that could cause or contribute to a serious risk to public health (the notification requirement) and (2) proposed § 1.652, requiring an accredited third-party certification body to provide FDA access to a consultative audit report when the criteria for records access under section 414 of the FD&C Act (21 U.S.C. 350c) are met (the records access requirement). The comments explain that many firms use certification bodies (and/or their consulting divisions) to help establish, maintain, and improve their food safety practices. For example, some firms use certification bodies (and/or their consulting divisions) to help in identifying root causes and remediating food safety problems. Comments also note that certification bodies (and/or their consulting divisions) provide informal counseling, perform preliminary evaluations, limited purpose audits, and activities in support of firms' continuous improvement programs.

Comments express concern that if these types of activities are subject to notification, records access, and other requirements of the rule, firms located outside the United States might not use accredited third-party certification bodies, instead choosing unaccredited third-party certification bodies to avoid the requirements of this rule. The comments assert that unaccredited third-party certification bodies are less likely to have qualified auditors and their independence and objectivity is less certain, than third-party certification bodies that have been evaluated and issued accreditation.

Comments also argue that the definition of “consultative audit,” which states that the results of such an audit are “for internal purposes only,” is inconsistent with the requirements for notification and records access that would apply to consultative audits under the proposed rule. Other comments ask us to clarify that audits conducted for external purposes—for example, an audit for purposes of compliance with FSVP—do not satisfy the definition of a consultative audit because consultative audits are for internal purposes only.

Some comments suggest that the proposed definition of “consultative audit,” taken together with the proposed definitions of “food safety audit” and “regulatory audit,” could preclude third-party certification bodies from conducting any audits that are outside the scope of subpart M, once accredited. Based on that interpretation, the comments predict that few if any third-party certification bodies would want to participate in the program.

Many of the comments that express concern about disincentives also suggest that Congress intended the third-party program to be much narrower than our proposed definition of “consultative audit” would suggest. These comments suggest that the FSMA third-party certification program was intended to be focused on regulatory audits and the issuance of certifications to be used for two limited purposes:
i.e.,
in establishing an importer's eligibility for VQIP and in satisfying a condition of admissibility for a food subject to an FDA safety determination under section 801(q) of the FD&C Act. These comments argue further that Congress inserted the term “consultative audit” in the statute to be used only in reference to the conflicts of interest provisions in section 808(c)(4)(C) and (c)(5) of the FD&C Act; therefore, a broad interpretation of “consultative audit” is inconsistent with Congressional intent. The comments urge us to construe the term “consultative audit” as narrowly as possible.

(Response 9) We recognize that food firms use accredited third-party certification bodies (and their consulting divisions) in various

capacities that serve the ultimate goal of improving food safety. We do not want, nor do we believe Congress intended, for our third-party certification program to create disincentives for food firms seeking to use accredited third-party certification bodies for various purposes to improve food safety practices in their operations. Nevertheless, we decline the request to remove all requirements relating to consultative audits from this final rule. Section 808(c)(5)(C) of the FD&C Act directs us to issue implementing regulations for section 808 of the FD&C Act, which includes some specific provisions relating to consultative audits (
e.g.,
section 808(c)(3)(A) and (C) on consultative audit reports and section 808 (c)(4)(C) of the FD&C Act on audit agents performing regulatory audits of eligible entities of which they performed consultative or regulatory audits within the preceding 13 months). We have, however, revised the definition of “consultative audit” as explained below and have made other revisions to the rule to clarify the scope of such audits and help mitigate possible disincentives to conduct consultative audits, while fulfilling the letter and spirit of the law.

With regard to the comments expressing concerns about an overly broad interpretation of “consultative audit,” we remind readers that the statute endows both regulatory and consultative audits with certain characteristics. For example, section 808(a)(6) of the FD&C Act indicates that an eligible entity must choose to be audited by an accredited third-party certification body, and section 808(c)(5)(C)(i) of the FD&C Act states that audits under this program must be unannounced. We understand these provisions to mean that, at the time the audit services are arranged, an eligible entity must specifically request from an accredited third-party certification body a food safety audit under this rule—that is the only way the accredited third-party certification body would know that the eligible entity is requesting an unannounced subpart M audit to determine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. Further, the eligible entity would need to specify whether it is seeking a regulatory or consultative audit. (In addition to determining whether the eligible entity is in compliance with the food safety requirements of the FD&C Act, consultative audits under section 808 of the FD&C Act also determine whether the eligible entity is in compliance with applicable industry standards and practices). Audits that fall outside the purview of this rule—for example, audits that are conducted by third-party certification bodies that are not accredited under this program, audits that determine compliance with standards other than the food safety requirements of the FD&C Act and FDA regulations (
e.g.,
audits that determine compliance with private standards), audits that are announced, and audits conducted solely for the purposes of supplier verification under the final human or animal preventive controls regulations or the final FSVP regulations—are not covered by, or subject to, the requirements of this rule.

It is impossible to describe or predict all of the audit scenarios that may occur. We emphasize that an accredited third-party certification body can continue to offer auditing and certification services that are outside the scope of this rule, such as on-site supplier verification audits under the final human or animal food preventive controls regulations or the final FSVP regulation. Such audits would not be subject to the requirements of this rule, including the reporting and notification requirements.

In response to comments, we revised the proposed definition of “consultative audit” to clarify that it is an audit conducted in preparation for a regulatory audit under the third-party certification program. A consultative audit would thus be a pre-examination or pre-assessment type of activity imbued with certain characteristics. We further clarify the characteristics of a consultative audit, as well as of a regulatory audit (the results of which can form the basis for issuance of certification under the rule), in the definition of “food safety audit” discussed in section III.J.

F. Eligible Entity

We proposed to define an “eligible entity” as a foreign entity that chooses to be subject to a food safety audit by an accredited third-party certification body. We further proposed that eligible entities include foreign facilities subject to the registration requirements in FDA regulations.

(Comment 10) We received several comments on the definition of “eligible entity.” Some comments request that we provide examples of specific types of entities that satisfy the definition. Some comments offer examples of “eligible entities,” including orchards or farms, packing houses, processing plants, and storage facilities. Other comments suggest we add “and foreign farms” to the end of the definition, to clarify that such entities are eligible to receive audits under subpart M. Some comments encourage us to adjust the definition of “eligible entity” to make it mandatory for foreign food facilities to undergo food safety audits by accredited third-party certification bodies.

(Response 10) The proposed definition of “eligible entity” was based on the statutory definition, which includes facilities subject to the registration requirements in section 415 of the FD&C Act that choose to be audited under the program. At our own initiative we are revising the definition of “eligible entity” in the codified to more accurately track the statute, and we decline the suggestion to add specific examples, such as orchards or farms, that are not included in the statutory definition of “eligible entity.” However, as explained in Response 12 we are revising the definition of “facility” in § 1.600(c) to clarify that entities that grow, harvest, or raise animals for food for consumption in the United States are facilities that are eligible for auditing and certification under this subpart.

We disagree with the comment suggesting that we should make audits under this program mandatory for all foreign food firms by modifying the definition of “eligible entity.” The statute clearly indicates that participation in this program is intended to be voluntary, and only entities that choose to be audited under the program are subject to its requirements (see section 808(a)(6) of the FD&C Act).

(Comment 11) In the proposed rule, we specifically asked for comment on whether to allow for food or facility certification to be issued to a producer group, offering as an example the criteria for groups under the National Organic Program (NOP)—
i.e.,
having multiple sites operating under a single management system and whose farms are “uniform in most ways.” Several comments responded to this inquiry in relation to the definition of “eligible entity.”

Comments in support of certification of a group (
e.g.,
a cooperative being audited as a single eligible entity) note that some producers are very small and might find it difficult on their own to obtain third-party certification, but taken as a group the task would likely be more manageable. Other comments note that treating multiples sites with a single management system as a single eligible entity could be particularly helpful in sectors or regions where there is a scarcity of accredited third-party certification bodies. Some comments argue in support of groups functioning as a single eligible entity as long as the central management system functions effectively, providing oversight to the

members. Comments also note that some multisite sampling protocols have been developed by international organizations, such as ISO.

Other comments encourage us to ensure that cooperatives are subject to this rule, so that all the links in a foreign supply chain are appropriately inspected, and so that they are subject to any applicable regulations before their product is exported to the United States.

Comments not in support of cooperatives being classified as eligible entities note that food safety practices and conditions are site-specific and can vary significantly even if the individual farms are located in the same geographic area (for example, due to soil composition, agricultural water runoff, or the manner in which the land was used in the past). They also note that organic production standards and scientifically-based food safety standards are not the same, so what works for the NOP may not be appropriate here

Some comments encourage us to provide guidance on the acceptable parameters of a cooperative. Some comments encourage us to consider guidance available from other sources beyond the NOP, such as the International Federation of Organic Agriculture Movements.

(Response 11) We decline to revise the definition of eligible entities to include a group. We acknowledge that some very small producers might be daunted by the prospect of working individually with an accredited third-party certification body, and there would be obvious economies in banding together with other very small producers to gain certification. We also acknowledge that some sets of producers do currently function as a unit under a centralized management system, and that group certification may make it easier for entities to access accredited third-party certification bodies in areas or regions where they may be scarce. Nevertheless, after reviewing the NOP, the International Federation of Organic Agricultural Movements, the Canada Organic Office Operation Manual, the USDA Agricultural Marketing Service pilot program on group certification, and other recommended sources, we conclude that it would not be appropriate to allow groups to be certified under this program. Group certification raises a myriad of complicated issues such as establishing who may act as a group, determining the requisites of a central management system, and delineating the minimum requirements for accredited third-party certification body audits of a group.

With regard to the comments contending that certifications from individual eligible entities that might otherwise act as a group would create redundant and unnecessary paperwork for FDA, we will take that sort of information into account as we gain experience with the program. Finally, with regard to the comments encouraging us to define “eligible entity” to include groups to ensure that all their members are examined for compliance with applicable food safety regulations before their food is exported to the United States, we note that this rule does not create audit obligations for all foreign suppliers or for all importers. The third-party certification program created by this rule is a voluntary program for eligible entities who wish to participate.

G. Facility

We proposed to define “facility” as any structure, or structures of an eligible entity under one ownership at one general physical location, or, in the case of a mobile facility, traveling to multiple locations, which manufactures/processes, packs, or holds food for consumption in the United States. The definition went on to state that: (1) Transport vehicles are not facilities if they hold food only in the usual course of business as carriers; (2) a facility may consist of one or more contiguous structures, and a single building may house more than one distinct facility if the facilities are under separate ownership; (3) the private residence of an individual is not a facility; and (4) non-bottled water drinking water collection and distribution establishments and their structures are not facilities.

On our own initiative, we are clarifying that facilities for the purposes of this subpart are not limited to facilities required to be registered under Subpart H.

(Comment 12) Some comments encourage us to align the proposed definition of “facility” to the definition of “facility” in the human and animal preventive controls, produce safety, and FSVP regulations, to promote consistency and common understanding of the rules.

(Response 12) As previously noted, we agree with the comments on the importance of consistency across regulations, where feasible and appropriate. We reviewed the definitions of “facility” in the final FSVP and final human preventive controls regulations, and found those definitions to be too narrow in light of the purpose of this rule to establish a voluntary program for certification of foods and facilities and the broad definition of “eligible entity” in section 808(a)(6) of the FD&C Act. Of our own initiative, in order to preserve the option for broad participation in the third-party program, we are expressly including in the definition of “facility” those entities that grow, harvest, or raise animals for food for consumption in the United States.

H. Facility Certification and Food Certification

We proposed to define “facility certification” as an attestation, issued for purposes of section 806 of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish that a facility meets the applicable requirements of the FD&C Act. We proposed to define “food certification” as an attestation, issued for purposes of section 801(q) of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish that a food meets the applicable requirements of the FD&C Act.

(Comment 13) We received some comments on the definitions of “facility certification” and “food certification.” Some of these comments raise group certification issues which we address above, in connection with the definition of “foreign cooperative.” Some comments state that “food certification” is improper terminology, because it implies a product certification model, whereas audits of eligible entities—particularly in the produce sector—generally assess processes and/or management systems.

(Response 13) The term “food certification” appears in the statute and is specifically discussed in the statute as a type of certification that may be used in meeting a condition of admissibility under section 801(q) of the FD&C Act. Under section 808(c)(2)(C) of the FD&C Act, food certifications may only issue upon conduct of a regulatory audit. In light of the statutory language, we decline to revise the term “food certification” in response to the comments on this rule.

We also note that section 801(q)(1) of the FD&C Act allows for FDA to accept “a listing of certified facilities that manufacture, process, pack, or hold food, or other assurances deemed appropriate by FDA” to satisfy the condition of admissibility. Of our own initiative, in light of this statutory language, we are clarifying in the definition of “facility certification” that

a facility certification may be issued for purposes of 801(q) of the FD&C Act.

I. Food

In proposed § 1.600(b), we stated unless otherwise defined in § 1.600(c) of the proposed rule, definitions of terms in section 201 of the FD&C Act would apply to terms used in this subpart. Section 201 of the FD&C Act defines “food” as “(1) articles used for food or drink for man or other animals, (2) chewing gum, and (3) articles used for components of any such article.” Proposed § 1.600(c) did not define the term “food.”

(Comment 14) Some comments request that we define “food” consistent with how it was defined in the FSVP proposed rule for consistency and to indicate that producers of food contact substances are eligible entities.

(Response 14) The proposed definition of “food” under § 1.600 would include pesticides when they meet the definition of “food” under section 201 of the FD&C Act. By contrast, the FSVP rule's proposed definition of food explicitly does not include pesticides, as defined in 7 U.S.C. 136(u), consistent with the definition of “food” used in the rulemaking on the Prior Notice of Imported Food Under the Public Health Security and Bioterrorism Preparedness Act of 2002 (prior notice rule). FDA received comments during that rulemaking questioning the applicability of the rule to pesticides, so FDA clarified that “food” for the purposes of that rule did not include pesticides.

The final FSVP regulation, which is publishing elsewhere in this issue of the
Federal Register
, retains the exclusion of pesticides from the definition of “food.”

In response to comments suggesting revision of the definition of “food” in this rule to be consistent with the final FSVP regulation, we considered the purposes that certifications serve under this program and the nature of comments we received on the third-party proposed rule, including general comments requesting alignment across the FSMA rules and comments specifically requesting that we use the FSVP definition of “food.” Certifications issued by accredited third-party certification bodies may be used in establishing an importer's eligibility to participate in VQIP and in satisfying a condition of admissibility for an imported food that we determine poses a safety risk under section 801(q) of the FD&C Act.

While certifications may be useful in addressing pesticide contamination of food (
e.g.,
pesticide levels in food that exceed established tolerances), we have not identified a need for certifications to address pesticides as articles of food, nor do we anticipate a role for food safety audits in pesticide manufacturing facilities. Accordingly, we are revising the final rule by adding to § 1.600(c) a definition of “food” that excludes pesticides.

We also agree with the comment that producers of food contact substances could be eligible entities under this rule and that food contact substances should be considered food for the purposes of this rule. Third-party food safety audits and certifications for food contact substances could potentially be useful given the possibility of migration of harmful food contact substances into food or contamination of food contact materials that directly contact food. Accordingly, we are revising the proposed definition of “food” to exclude pesticides and retain “food contact substances” in the definition of “food” in this final rule, consistent with the definition of “food” in the final FSVP regulation.

J. Food Safety Audit

We proposed to define “food safety audit” as a regulatory audit or a consultative audit.

(Comment 15) We received a few comments on the definition of “food safety audit.” Some comments request that we remove consultative audits from the definition of “food safety audit,” asserting that consultative audits should not be subject to the reporting and notification requirements associated with “food safety audits.” Other comments say we should replace the term “food safety audit” with “regulatory audit,” as a matter of statutory construction and sound policy. Finally, some comments suggest that we delete the definition of “food safety audit” altogether.

(Response 15) We are retaining the definition of “food safety audit” as a useful definition to describe regulatory and consultative audits that fall under the requirements of this rule. As described in Response 9, we have revised the definition of “consultative audit” to clarify that it is an audit conducted in preparation for a regulatory audit under the third-party certification program. Although an audit meeting that definition would be subject to certain reporting and notification requirements, there are many types of audits/arrangements that would not fall within the definition of “consultative audit” or “regulatory audit,” and would therefore not be subject to the requirements of this rule, including the reporting and notification requirements. Therefore, including consultative audits in the definition of “food safety audit” will not prevent eligible entities from using accredited third-party certification bodies for auditing arrangements that fall outside of the scope of this rule and do not trigger the requirements of this rule. To further address comments' concerns, we are modifying the definition of “food safety audit” to provide clarification regarding what types of audits/activities would fall outside of the scope of this rule. Specifically, we clarify that a food safety audit must be declared by an eligible entity at the time of audit planning and must be conducted on an unannounced basis consistent with sections 808(b)(6) and 808(c)(5)(C) of the FD&C Act.

K. Foreign Cooperative

We proposed to define “foreign cooperative” as an entity that aggregates food from growers or processors that is intended for export to the United States.

On our own initiative, we are replacing the phrase “entity that aggregates” with “autonomous association of persons, identified as members, who are united through a jointly owned enterprise to aggregate” for clarification purposes.

(Comment 16) Some comments suggest that we add a definition for “consolidator.” The comments contrast consolidators with cooperatives and argue that consolidators act essentially as brokers that purchase products from several sources and then export the total set to the United States. According to these comments, consolidators do not own or manage the individual sites and generally do not have control over or even knowledge of the processing procedures.

(Response 16) We agree with the comment that an entity without a single management system that exercises control over the manner in which individual sites meet the applicable food safety requirements of the FD&C Act and FDA regulations would not be an eligible entity. However, we disagree that adding a definition of “consolidator” would be helpful because whether an entity is a “consolidator” has no bearing on the requirements of this rule.

(Comment 17) Some comments point out that while the proposed rule indicates a foreign cooperative could be an accreditation body or a third-party certification body, in their countries the government is the accreditation body. Also, in some places the government authorizes certain parties to conduct audit activities and those parties are under the control and supervision of the

government. Accordingly, the comments suggest that we indicate in which countries and in which cases a foreign cooperative could be an accreditation body or a third-party certification body. Other comments recommend more detail on how cooperatives are defined, and how they would conform to FDA requirements for third-party certification bodies.

(Response 17) We currently are not in a position to be able to determine which countries or which foreign cooperatives may be adequately qualified to become accredited under the third-party certification program. We note that section 808 of the FD&C Act expressly allows foreign cooperatives to serve as accredited third-party certification bodies if they are adequately qualified and independent of the eligible entities they audit or certify under the third-party certification program. Therefore, we are not categorically excluding foreign cooperatives from the third-party certification program, nor are we making any categorical decisions on whether governmental accreditation bodies have conflicts that would preclude them from accrediting such foreign cooperatives under the program.

L. Regulatory Audit

We proposed to define a “regulatory audit” as an audit of an eligible entity to determine whether such entity is in compliance with the provisions of the FD&C Act and the results of which are used in determining eligibility for food certification under section 801(q) of the FD&C Act or facility certification under section 806 of the FD&C Act, and may be used by an importer in meeting the requirements for an onsite audit of a foreign supplier under the FSVP program.

(Comment 18) Some comments request that we clarify the definition of “regulatory audit.”

(Response 18) The comments requesting clarification failed to mention specific characteristics in the definition needing clarification and did not offer suggestions for clarification. Therefore, we decline to modify the definition based on these comments. However, on our own initiative we have revised the definition of “regulatory audit” by removing the clause “, and may be used by an importer in meeting the requirements for an onsite audit of a foreign supplier under subpart L of this part” that does not appear in the statute. We did this in part to avoid confusion. We emphasize that an audit conducted for the purposes of FSVP would not need to be conducted by a third-party certification body under this subpart. See section XIII.G. Nor are facilities required to use third-party certification bodies accredited under this rule in meeting their supplier verification requirements under the final human or animal preventive controls regulations. On our own initiative, we are revising the definition of “regulatory audit” to clarify that the results of a regulatory audit may be used to determine eligibility for any certifications that may be used for purposes of section 801(q) or section 806 of the FD&C Act.

M. Self-Assessment

We proposed to define “self-assessment” as a systematic assessment conducted by an accreditation body or by a third-party certification body to determine whether it meets the applicable requirements of this subpart.

We received no adverse comments about our proposed definition. However, on our own initiative, we are revising the definition of “self-assessment” to improve clarity and to specify what is required of a recognized accreditation body and an accredited third-party certification body when performing these evaluations.

N. Third-Party Auditor

We proposed to define a “third-party auditor” as a foreign government, agency of a foreign government, foreign cooperative, or any other third-party that is eligible to be considered for accreditation to conduct food safety audits and to certify that eligible entities meet the applicable requirements of the FD&C Act. We further proposed that a third-party auditor may be a single individual or an organization and may use audit agents to conduct food safety audits. Finally, we proposed that “third-party auditor” has the same meaning as “certification body” as that term was defined in the proposed rule.

(Comment 19) As described in Comment 1, we received several comments urging us to align our definitions and terminology with international standards. Some comments state that the term “third-party auditor,” the language of the statute notwithstanding, is not correct terminology to use interchangeably with “third-party certification body.”

(Response 19) As discussed previously, we agree that it is beneficial to use terminology in this rule that is consistent with terminology used in international standards when feasible and appropriate. Therefore, we are deleting the definition of “third-party auditor” in the final rule and will use the term “third-party certification body” in this rule except that we will use the term “third-party auditor” in the definitions of “Accredited third-party certification body” and “Third-party certification body” in § 1.600(c) and in the preamble discussion of those definitions in section III.A. We are clarifying in the definition of “third-party certification body” in § 1.600(c) that the term has the same meaning as “third-party auditor” as defined in section 808(a)(3) of the FD&C Act.

IV. Comments on Who Is Subject to This Subpart (§ 1.601)

We proposed in § 1.601 that this rule would apply to those accreditation bodies, third-party certification bodies, and eligible entities that seek to participate in this voluntary third-party certification program. We proposed two limited exemptions from section 801(q) of the FD&C Act: One related to alcoholic beverages from an eligible entity that is a facility that meets certain conditions, and another related to certain food constituting not more than 5 percent of the overall sales of a facility meeting the conditions of the first exemption.

A. Limiting the Scope of the Rule to Regulatory Audits and Certifications

Under proposed § 1.601(b), we proposed that subpart M would apply to third-party certification bodies seeking accreditation to conduct food safety audits and issue certifications for purposes of sections 801(q) and 806 of the FD&C Act.

(Comment 20) Some comments suggest we modify the language in § 1.601(b) regarding third-party certification bodies seeking accreditation to clarify that requirements of the rule apply only to imported foods that are subject to a condition of admissibility under section 801(q) of the FD&C Act and imported foods offered by an importer seeking to establish eligibility to participate in VQIP. In this view, the requirements of the rule (
e.g.,
the notification requirements) should not apply to audits other than regulatory audits that are conducted for certification purposes.

(Response 20) We decline to make the suggested revisions to § 1.601(b) because § 1.601(b)(2) already describes the two types of certifications that may be issued by accredited third-party certification bodies under the final rule and the types of audits that they would conduct under this program (
i.e.,
food safety audits, which include both consultative and regulatory audits). Audits conducted by third-party certification bodies that are outside of the scope of this program, and eligible entities receiving audits outside of the scope of this program, would not be

subject to the requirements of this final rule. With respect to the suggestion that the final rule should apply only to regulatory audits, and therefore not to consultative audits, we note, as previously discussed, that section 808 of the FD&C Act specifically defines “consultative audit” and contains requirements for the conduct of both regulatory and consultative audits (see,
e.g.,
section 808(a)(5) and (c)(4)(B) of the FD&C Act). Therefore, this final rule establishes requirements for consultative audits that are consistent with the provisions on consultative audits in the statute.

B. Exemption for Alcoholic Beverages

Under proposed § 1.601(d), we proposed to exempt from the certification requirements under section 801(q) of the FD&C Act alcoholic beverages that are imported from an eligible entity that is a facility that meets the following two conditions:

• Under the Federal Alcohol Administration Act or chapter 51 of subtitle E of the Internal Revenue Code of 1986, the facility is a foreign facility of a type that, if it were a domestic facility, would require obtaining a permit from, registering with, or obtaining approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States; and

• Under section 415 of the Federal Food, Drug, and Cosmetic Act, the facility is required to register as a facility because it is engaged in manufacturing/processing one or more alcoholic beverages.

We also proposed that the certification requirements under section 801(q) of the FD&C Act would not apply to food other than alcoholic beverages that is imported from a facility described in § 1.601(d)(1) provided that such food:

(i) Is in prepackaged form that prevents any direct human contact with such food; and

(ii) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury.

We tentatively concluded that these provisions were consistent with the provisions on alcohol-related facilities in section 116 of FSMA.

(Comment 21) Some comments support the proposed exemption of imported beverage alcohol products, but encourage us to clarify and amplify the exemption to cover the raw materials and ingredients (
e.g.,
grapes, grains, hops, flavors) used to produce alcoholic beverages. The comments assert that the requested exemption would provide for consistency between domestic and foreign facilities and would be consistent with Congressional intent regarding section 116 of FSMA. The comments assert that the expanded exemption would be consistent with the regulations on preventive controls for human food. The comments urge us to consult their comments on the FSVP proposed rule.

(Response 21) As requested, we consulted comments submitted on proposed § 1.501(e) in the FSVP proposed rule, requesting an exemption from the FSVP requirements for the importation of the raw materials and ingredients (
e.g.,
grapes, grains, hops, flavors) used to produce alcoholic beverages, and asserting that such an exemption would be consistent with Congressional intent regarding section 116 of FSMA.

We considered the comments' request in light of the risk-based public health principles generally underlying FSMA and have concluded that Congress did not intend for FSMA's core requirements to apply to the manufacture/processing, packing, and holding of alcoholic beverages. Congress may have made such a conclusion in light of the potential antimicrobial function of the alcohol content in such beverages and the concurrent regulation of alcoholic beverage-related facilities by both FDA and the Alcohol and Tobacco Tax and Trade Bureau. In light of this context, we have concluded that section 116 of FSMA should be interpreted to mean that the manufacturing, processing, packing, or holding of alcoholic beverages at most alcohol-related facilities should not be subject to this rule.

We believe the same rationale supports the comments' request. Accordingly, and consistent with the final FSVP regulation, we are expanding the exemption from certification under section 801(q) of the FD&C Act in § 1.601(d) to cover raw materials or other ingredients that are used to manufacture/process, pack or hold alcoholic beverages by an importer required to be registered under section 415 of the FD&C Act, when such facilities are exempt from the preventive controls regulations under 21 CFR 117.5(i).

Also in this final rule, we are replacing the term “food other than alcoholic beverages,” to describe the applicability of the exemption, with the term “food that is not an alcoholic beverage.”

C. USDA Regulated Products

(Comment 22) Some comments suggest we explicitly exempt products under USDA jurisdiction from the requirements of this rule.

(Response 22) We agree that an exemption to 801(q) is appropriate with respect to meat, poultry, and egg products regulated by USDA at the time of importation. The final rule adds a new § 1.601(d)(2) which states that any certification under 801(q) does not apply to meat, poultry, and egg products that at the time of importation are subject to the requirements of the USDA under FMIA (21 U.S.C. 601
et seq.
), PPIA (21 U.S.C. 451
et seq.
), or EPIA (21 U.S.C. 1031
et seq.
). We conclude that this provision is consistent with section 403 of FSMA, entitled “Rule of Construction,” which states that nothing in FSMA shall be construed to alter or limit the jurisdiction of the Secretary of the Department of Agriculture. For many decades, USDA has exercised authority and responsibility over the import of such meat, poultry, and egg products, and has detailed regulations and procedures implementing this authority. In light of USDA's role with respect to the importation of these products, and also in light of section 403 of FSMA, we believe that Congress did not intend for an FDA determination under section 801(q) of the FD&C Act to apply to meat, poultry, and egg products that at the time of importation are subject to USDA requirements under the MPIA, PPIA, and EPIA, respectively. We therefore conclude that final § 1.601(d)(2) is consistent with Congress's intent in promulgating section 403 of FSMA.

With respect to the third-party program, we note that the program establishes a voluntary system of certification by accredited third-party certification bodies that food and facilities meet applicable requirements of the FD&C Act and FDA regulations. Certifications issued under this program will not be used to facilitate entry of meat, poultry, and egg products that are regulated by USDA at the time of importation, as defined above.

V. Comments on Recognition of Accreditation Bodies Under This Subpart

A. Who is eligible to seek recognition? (§ 1.610)

Proposed § 1.610 states that an accreditation body would be eligible for recognition if it could demonstrate that it meets the requirements related to legal authority, competency, capacity, conflicts of interest, quality assurance, and records in §§ 1.611 through 1.615. In our discussion of this section in the preamble of the proposed rule we stated our tentative conclusions that key

elements of ISO/IEC 17011:2004 (Ref. 5) would form a basis for our requirements, and that documented conformance to that standard would be relevant in demonstrating that an accreditation body is qualified for recognition.

(Comment 23) Some comments recommend that we require accreditation bodies to be signatories to IAF multilateral recognition agreements (IAF-MLAs) (which requires signatories, among

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2015-28160. Public record. Not legal advice.