[Federal Register Volume 78, Number 145 (Monday, July 29, 2013)]
[Proposed Rules]
[Pages 45781-45839]
[FR Doc No: 2013-17994]

Vol. 78

Monday,

No. 145

July 29, 2013

Part IV

Department of Health and Human Services

-----------------------------------------------------------------------

Food and Drug Administration

-----------------------------------------------------------------------

21 CFR Part 1 and 16

Accreditation of Third-Party Auditors/Certification Bodies to Conduct
Food Safety Audits and to Issue Certifications; Proposed Rule

Federal Register / Vol. 78, No. 145 / Monday, July 29, 2013 /
Proposed Rules

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 1 and 16

[Docket No. FDA-2011-N-0146]
RIN 0910-AG66

Accreditation of Third-Party Auditors/Certification Bodies to
Conduct Food Safety Audits and to Issue Certifications

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is amending its
regulations to provide for accreditation of third-party auditors/
certification bodies to conduct food safety audits of foreign food
entities, including registered foreign food facilities, and to issue
food and facility certifications, under the FDA Food Safety
Modernization Act (FSMA). Use of accredited third-party auditors/
certification bodies and food and facility certifications will help FDA
prevent potentially harmful food from reaching U.S. consumers and
thereby improve the safety of the U.S. food supply. FDA also expects
that these regulations will increase efficiency by reducing the number
of redundant food safety audits.

DATES: Submit either electronic or written comments on the proposed
rule by November 26, 2013.

ADDRESSES: You may submit comments, identified by Docket No. FDA-2011-
N-0146 and/or Regulatory Information Number (RIN) 0910-AG66, by any of
the following methods.

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.

Written Submissions

    Submit written submissions in the following ways:
     Mail/Hand delivery/Courier (for paper or CD-ROM
submissions): Division of Dockets Management (HFA-305), Food and Drug
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the Agency name
and Docket No. FDA-2011-N-0146 and/or RIN 0910-AG66 for this
rulemaking. All comments received may be posted without change to
http://www.regulations.gov, including any personal information
provided. For additional information on submitting comments, see the
``Comments'' heading of the SUPPLEMENTARY INFORMATION section of this
document.
    Docket: For access to the docket to read background documents or
comments received, go to http://www.regulations.gov and insert the
docket number, found in brackets in the heading of this document, into
the ``Search'' box and follow the prompts and/or go to the Division of
Dockets Management, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Charlotte A. Christin, Office of the
Commissioner, Office of Policy, Food and Drug Administration, 10903 New
Hampshire Ave., Bldg. 32, Rm. 4234, Silver Spring, MD 20993, 240-402-
3708.

SUPPLEMENTARY INFORMATION:

Executive Summary

Purpose of the Proposed Rule

    This proposed rule, if finalized, will help FDA ensure the
competence and independence of third-party auditors/certification
bodies who conduct foreign food safety audits. It also will help ensure
the reliability of food and facility certifications issued by third-
party auditors/certification bodies that FDA will use in making certain
decisions relating to imported food (including pet food and animal
feed). These certifications include, for example, food certifications
required by FDA as a condition of granting admission to a food
determined to pose a safety risk. Having comprehensive oversight of a
credible and reliable program for third-party audits and certifications
of foreign food facilities will help FDA prevent potentially harmful
food from reaching U.S. consumers and thereby improve the safety of the
U.S. food supply. We believe that a trusted program for foreign food
safety audits and food and facility certifications--with clear
requirements, standards, and procedures and operated under government
oversight--will be appealing to accreditation bodies, auditors/
certification bodies, and foreign food facilities. Widespread
participation and broad acceptance of audits and certifications under
the FDA program will help increase efficiency and reduce costs, by
eliminating redundant auditing to assess foreign suppliers' compliance
with the Federal Food, Drug, and Cosmetic Act (the FD&C Act).
    FSMA adds section 808 to the FD&C Act (21 U.S.C. 384d), which
directs us to establish a new program for accreditation of third-party
auditors \1\ conducting food safety audits and issuing food and
facility certifications to eligible foreign entities (including
registered foreign food facilities) that meet our applicable
requirements. Under this provision, we will recognize accreditation
bodies to accredit third-party auditors/certification bodies, except
for limited circumstances in which we may directly accredit auditors/
certification bodies to participate in the accredited third-party
audits and certification program.
---------------------------------------------------------------------------

    \1\ Section 808 of the FD&C Act uses the term ``auditor'' to
describe an entity that conducts audits and issues certifications.
We propose to use the term ``auditor/certification body,'' which
adds the words ``certification body'' to better comport with the
terminology used by the food industry and the international
standards community when describing organizations that not only
conduct audits but also issue certifications based on audit results.
We will use the statutory term only when referring to the
requirements of section 808 of the FD&C Act.

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP29JY13.008

    We will use certifications issued by accredited third-party
auditors/certification bodies in deciding whether to admit certain
imported food into the United States that FDA has determined poses a
food safety risk and in deciding whether an importer is eligible to
participate in a program for expedited review and entry of food
imports. We will exercise oversight of the accredited third-party
audits and certification program and can remove an accreditation body
or an auditor/certification body for good cause, by revoking
recognition of the accreditation body or by withdrawing accreditation
of the third-party auditor/certification body.
    We must issue implementing regulations that include measures to
protect against conflicts of interest and must issue model
accreditation standards that third-party auditors/certification bodies
must meet to qualify for accreditation.\2\ The statute directs us to
look to existing standards for guidance when developing these model
accreditation standards.
---------------------------------------------------------------------------

    \2\ We will issue draft model accreditation standards to specify
the qualifications for accreditation, such as the minimum
requirements for education and experience for third-party auditors/
certification bodies (and their audit agents) to qualify for
accreditation. We will open a public docket to accept comments on
the draft standards and plan to take necessary procedural steps to
finalize the model standards.
---------------------------------------------------------------------------

Summary of the Major Provisions of the Proposed Rule

    This proposal contains eligibility requirements for accreditation
bodies to qualify for recognition and requirements that accreditation
bodies choosing to participate in the FDA program must meet, once
recognized. It also contains eligibility requirements for third-party
auditors/certification bodies to qualify for accreditation and
requirements that third-party auditors/certification bodies choosing to
participate in the FDA program must meet, once accredited. These
requirements will ensure the competence and independence of the
accreditation bodies and third-party auditors/certification bodies
participating in the program for accredited third-party audits and
certification that is established under this subpart.
    This proposal contains procedures for recognition and
accreditation, as well as requirements relating to monitoring and
oversight of participating accreditation bodies and auditors/
certification bodies. These include procedures that we will follow when
removing an auditor/certification body or an accreditation body from
the program. The proposed rule contains requirements relating to
auditing and certification of foreign food facilities under the program
and for notifying us of conditions in an audited facility that could
cause or contribute to a serious risk to the public health. The
proposed requirements for monitoring, oversight, and notification are
needed to give us, consumers, and other stakeholders confidence in the
program and in the accredited third-party auditors/certification bodies
and recognized accreditation bodies who participate.
    The proposal also implements the authority granted by Congress in
section 801(q) of the FD&C Act (21 U.S.C. 381(q)) to make a risk-based
determination to require, as a condition of admissibility, that a food
imported or offered for import into the United States be accompanied by
a certification or other assurance that the food meets the applicable
requirements of the FD&C Act. This clear authority to require

import certification for food, based on risk, is one of the tools we
can use to help prevent potentially harmful food from reaching
consumers.
    In addition, this document proposes requirements for accredited
third-party auditors/certification bodies to follow when issuing
facility certifications that will be used by importers to establish
eligibility for the Voluntary Qualified Importer Program (VQIP) under
section 806 of the FD&C Act (21 U.S.C. 384b(a)). The VQIP program
offers participating importers expedited review and entry of food from
facilities audited and certified by third-party auditors/certification
bodies accredited under this subpart.

Costs and Benefits

    We summarize the annualized costs (over a 10-year time period
discounted at both 3 percent and 7 percent) of the third-party proposed
rule in Table 1. We are unable to estimate quantitatively the benefits
of the proposed rule. Although this proposed rule would not itself
establish safety requirements for imported food, it would benefit the
public health by helping to ensure that imported food is produced in
compliance with applicable requirements of the FD&C Act.
    The Preliminary Regulatory Impact Analyses for the proposed rules
on Current Good Manufacturing Practice and Hazard Analysis and Risk-
Based Preventive Controls for Human Food (Preventive Controls) \3\ and
the Standards for the Growing, Harvesting, Packing, and Holding of
Produce for Human Consumption (Produce Safety) \4\ consider and analyze
the number of illnesses and deaths that those proposed regulations are
aimed at reducing. The greater the compliance with the Preventive
Controls and Produce Safety proposed regulations, the greater the
reduction in illnesses and deaths and associated costs expected.
---------------------------------------------------------------------------

    \3\ The Preventive Controls proposed rule was published in the
Federal Register on January 16, 2013 (78 FR 3646).
    \4\ The Produce Safety proposed rule was published in the
Federal Register on January 16, 2013 (78 FR 3503).
---------------------------------------------------------------------------

    This proposed rule would be an important mechanism for improving
and ensuring compliance with the Preventive Controls and Produce Safety
proposed regulations as they would apply to imported food. For this
reason, we account for its public health benefits in the economic
analyses for those proposed rules and other applicable food safety
regulations, instead of in the analysis for this proposed rule.

                            Table 1--Summary of Annualized Costs of the Proposed Rule
----------------------------------------------------------------------------------------------------------------
                       Third party accreditation costs                            3 Percent         7 Percent
----------------------------------------------------------------------------------------------------------------
Third Party Accreditation Costs for All Participants........................       $55,548,432       $56,756,016
Third Party Accreditation Costs for FDA.....................................        17,063,089        17,640,083
                                                                             -----------------------------------
    Total Costs.............................................................        72,611,521        74,396,099
----------------------------------------------------------------------------------------------------------------

Table of Contents

I. Introduction
II. Background
    A. Legal Authority
    B. FDA Initiatives on Third Parties
    C. FDA's Use of Certifications for Food
    D. External Recommendations on Third-Party Certification for
Food
    E. FDA Standards for Assessing Capabilities of Food Safety
Systems
    F. U.S. Government Policies on Consensus Standards and
Conformity Assessment
G. Industry Practices on Benchmarking Standards and Third-Party
Audits and Certification for Food and Food Facilities
III. FSMA Imports Public Meeting and Stakeholder Input
IV. Purpose and Description of the Proposed Rule
    A. Proposed Revisions to Part 1, New Subpart
    B. Proposed Revisions to Part 16
V. Analysis of Environmental Impact
VI. Federalism
VII. Comments
VIII. References

I. Introduction

    Each year, about 48 million Americans (1 in 6) get sick, 128,000
are hospitalized, and 3,000 die from food-borne diseases, according to
recent estimates from the Centers for Disease Control and Prevention
(CDC). CDC food-borne illness outbreak data also show that an increased
number of outbreaks due to imported foods were reported during the most
recent years of surveillance. During 2005-2010, 39 outbreaks with 2,348
illnesses were reported where the implicated food was imported into the
United States, representing 1.5 percent of reported outbreaks during
that time. Of the 39 import-associated outbreaks, more were reported in
2009 and 2010 (n=6 and 8 outbreaks, respectively) than were reported in
each of the years between 2005 and 2008. A greater percentage of the
import-related outbreaks were multistate outbreaks as compared to the
overall percentage of multistate outbreaks reported (Ref. 1).\5\
---------------------------------------------------------------------------

    \5\ The CDC abstract on Foodborne Disease Outbreaks Associated
with Food Imported Into the United States, 2005-2010 (Ref. 1)
discussed 23 reported outbreaks with 1,994 illnesses associated with
imported foods. These data were updated for a presentation at the
International Conference on Emerging Infectious Diseases, to reflect
the numbers discussed in this proposed rule.
---------------------------------------------------------------------------

    President Obama signed FSMA (Pub. L.111-353) into law on January 4,
2011. FSMA enables us to better protect public health by helping to
ensure the safety and security of the U.S. food supply. The Web page
describing our FSMA implementation activities is at http://www.fda.gov/fsma.
    Among other things, FSMA gave us important new tools to better
ensure the safety of imported foods, which constitute approximately 15
percent of the U.S. food supply (including 80 percent of our seafood,
50 percent of our fresh fruit, and 20 percent of our vegetables). We
place high priority on ensuring the accountability of importers to
verify the safety of food produced overseas and to establish a new
program for third-party auditing and certification of regulated foreign
food firms. (By way of background, third-party audits are conducted by
an entity independent of the audited firm or those who buy its
products. Second-party audits are conducted by buyers for their
suppliers and contractors or by one division within a firm of another
division within the same firm. First-party audits are internal audits a
firm conducts itself. This proposed regulation relates only to third-
party audits.)
    In this document, we propose requirements for third-party auditors/
certification bodies choosing to become accredited to conduct food
safety audits and to issue food and facility certifications to eligible
foreign entities under this FDA program.
    The preamble that follows provides background on the following: (1)
The FSMA requirement to establish an accredited third-party auditing
and

certification program for food and related FSMA provisions, (2) other
initiatives on third parties, (3) use of food certifications, (4)
recommendations from external stakeholders on third-party
certifications for food, (5) standards for assessing programs for
oversight of food safety, (6) U.S. government policies on consensus
standards and conformity assessment, and (7) industry programs for
benchmarking standards and for auditing and certification for food
facilities and their food. We seek comments on all aspects of this
proposal.

II. Background

A. Legal Authority

1. Accreditation of Third-Party Auditors/Certification Bodies
    Section 307 of FSMA, Accreditation of Third-Party Auditors, amends
the FD&C Act (21 U.S.C. 384d) to create a new provision, section 808,
under the same name. Section 808(b)(1)(A) of the FD&C Act requires us
to establish a system, within 2 years of enactment, for the recognition
of accreditation bodies that accredit third-party auditors to conduct
food safety audits and to issue certifications for eligible foreign
food entities and their products.
    Section 808(b)(1)(A)(ii) of the FD&C Act further authorizes us to
directly accredit third-party auditors if we have not identified and
recognized an accreditation body that meets the requirements of the
section within 2 years after establishing the system for recognition.
If those conditions are met, we may begin to directly accredit third-
party auditors.
    Section 808(c)(5)(C) of the FD&C Act directs us to issue
implementing regulations for section 808 not later than 18 months after
enactment (i.e., by July 4, 2012). The regulations must require audits
to be unannounced and must contain protections against conflicts of
interest between accredited auditors (and their audit agents) and the
entities they audit or certify, including requirements on timing and
public disclosure of fees and appropriate limits on financial
affiliations. (21 U.S.C. 384d(c)(5)(C)(ii) and (c)(5)(C)(iii)). In
addition, the regulations must require audits to be unannounced (21
U.S.C. 384d(c)(5)(C)(i)).
    Section 808(b)(2) of the FD&C Act contains an additional
requirement to develop model accreditation standards to qualify third-
party auditors for accreditation under this FDA program. The statute
describes the model accreditation standards in terms of requirements an
auditor must meet to qualify for accreditation. We are including in
this proposed rule a framework for the model accreditation standards.
We currently are developing the Model Accreditation Standards document,
which elaborates on the framework and details the qualifications
required for accreditation. We are considering existing international
standards and particularly the work of the International Organization
for Standardization Committee on conformity assessment (ISO/CASCO). For
example, we are considering minimum requirements for education and
experience of auditors/certification bodies. We plan to issue draft
model standards for public comment, before finalizing them.
2. Voluntary Qualified Importer Program
    Facility certifications (as described in sections 806(a) and
808(c)(2) of the FD&C Act) will be used by FDA to help determine
whether a facility is eligible to be a facility from which food may be
offered for import under VQIP. The criteria and procedures for VQIP
participation are outside the scope of this rulemaking. FDA plans to
issue guidance on VQIP and will solicit public comment on VQIP at that
time.
3. Authority To Require Import Certifications for Food
    Food certifications (as described in sections 801(q) and 808(c)(2)
of the FD&C Act) will be required to meet a condition for admitting a
food into the United States under section 801(a) of the FD&C Act, where
necessary based on our determination of the risk of the food.
Specifically, section 801(q) of the FD&C Act gives us express authority
to require such certification based on a determination that includes
the following factors:
     The known safety risks associated with the food;
     The known food safety risks associated with the country,
territory, or region of origin (area of origin) of the food;
     A finding we make, supported by scientific, risk-based
evidence, that:
    [cir] The food safety programs, systems, and standards in the area
of origin of the food are inadequate to ensure that the article of food
is as safe as a similar article of food that is manufactured,
processed, packed, or held in the United States, in accordance with the
requirements of the FD&C Act; and
    [cir] The certification would assist us in determining whether to
refuse or admit the article of food into the United States; and
     Information submitted to us, under section 801(q)(7) of
the FD&C Act, regarding improvements to a food safety program, system,
or standard we previously found inadequate and demonstrating that those
controls are adequate to ensure that an article of food is as safe as a
similar article of food that is manufactured, processed, packed, or
held in the United States under the requirements of the FD&C Act.
    In addition to giving FDA authority to require food certifications,
section 801(q) of the FD&C Act grants FDA authority to require,
alternatively, ``such other assurance'' as FDA determines appropriate,
that the food complies with applicable requirements of the FD&C Act.
When making a determination on whether mandatory certification is
appropriate, we will consider the statutory factors in light of the
specific circumstances involved and will evaluate various types of
relevant information/evidence. We intend to exercise our authority
under section 801(q) of the FD&C Act judiciously and in conjunction
with our array of other available enforcement tools.
    Section 801(q)(3) of the FD&C Act states the food certifications or
other assurances used for purposes of section 801(a) of the FD&C Act
may be issued by third-party auditors accredited under section 808 of
the FD&C Act or by the government of the country from which such food
originated, if we so designate (21 U.S.C. 381(q)(3)). The
certifications or other assurances may take the form of shipment-
specific certificates, a listing of certified facilities that
manufacture, process, pack, or hold such food, or in such other form as
we may specify.
    Section 801(q) of the FD&C Act became effective upon enactment of
FSMA in 2011 and is expressly linked to the accreditation of third-
party auditors/certification bodies that is the subject of this
proposed rule.
4. Compliance With International Agreements
    FSMA section 404 (21 U.S.C. 2252) states that nothing in the
statute should be construed in a manner ``inconsistent with'' the
agreement establishing the World Trade Organization (WTO) or any other
treaty or international agreement to which the United States is a
party.
    FSMA was notified to the WTO on February 14, 2011 (G/SPS/N/USA/
2156) (Ref. 2), to provide information on the FD&C Act to WTO members.
The notification included an electronic mailbox link to receive
comments from members. Several comments have been received via the
mailbox. The comments

note a high degree of interest in FSMA implementation, particularly
with respect to how implementation will impact developing countries.
    Third-party certification for food is recognized as increasingly
important for developing nations to gain market access for their
products. Several international development agencies are focusing
efforts in this area. The United Nations Industrial Development
Organization, for example, is supporting the development of conformity
assessment bodies and accreditation bodies in several developing
nations (Ref. 3). The U.S. Agency for International Development has
offered its assistance and support for developing nation governments to
take a more proactive role in accreditation services, standards
development, and institutional infrastructure to assist and protect
their nationals operating in international food markets (Ref. 4).
5. Other Provisions of the Federal Food, Drug, and Cosmetic Act
    The authority for this proposed rule also derives from section
701(a) of the FD&C Act (21 U.S.C. 371(a)), which authorizes us to issue
regulations for the efficient enforcement of the FD&C Act. Regulations
for ensuring the competency and independence of recognized
accreditation bodies and of accredited third-party auditors/
certification bodies will help assure us of the validity and
reliability of certifications and other information resulting from the
food safety audits they conduct. We will accept certifications issued
by accredited third-party auditors/certification bodies for the two
purposes identified in section 808 of the FD&C Act: To establish
eligibility for VQIP participation; and to meet a condition of
admissibility for imported food subject to a mandatory certification
requirement. We also can use information from such audits for other
related purposes in enforcing the FD&C Act. For example, we propose to
allow importers to use reports of regulatory audits conducted by
accredited third-party auditors/certification bodies in meeting any
requirements for onsite audits of foreign suppliers, under the proposed
rule entitled, ``Foreign Supplier Verification Programs for Importers
of Food for Humans and Animals'' (FSVP), published elsewhere in this
issue of the Federal Register.

B. FDA Initiatives on Third Parties

1. Notice Requesting Comments on Third-Party Certification for Food and
Feed
    In the Federal Register of April 2, 2008 (73 FR 17989), we issued a
notice (2008 notice) requesting comments on the benefits, obstacles,
and availability of third-party certification programs for food and
animal feed. At the time, an increasing number of retailers and food
services providers had begun to ask their foreign and domestic
suppliers to become certified to their buyers' requirements for safety
and quality. Suppliers (such as producers, comanufacturers, and
repackers) also were increasingly looking to third-party certification
programs as a means to verify compliance with U.S. regulatory
requirements, even without requirements from buyers.
    In the 2008 notice, we asked questions about existing certification
programs and criteria, as well as obstacles and incentives for
participating in these voluntary programs. We received approximately 70
comments in response. The comments generally supported the use of
third-party certification programs and suggested that our
acknowledgment of such programs would provide additional incentives for
participation. Further discussion of the comments on the 2008 notice is
available in the ``Background'' section of the subsequently issued
draft ``Guidance for Industry on Voluntary Third-Party Certification
Programs for Foods and Feeds'' and is described in section II.B.2.
2. FDA Guidance on Third-Party Certification for Food and Feed
    In the Federal Register of July 10, 2008 (73 FR 39704), we
announced the availability of the draft ``Guidance for Industry on
Voluntary Third-Party Certification Programs for Foods and Feeds.'' The
draft guidance describes the general attributes of a voluntary third-
party certification program needed to help ensure that certification is
a reliable verification that food from certified establishment meets
applicable requirements.
    We finalized the guidance in January 2009, announcing its
availability in the Federal Register of January 16, 2009 (74 FR 3058)
(2009 Guidance) (Ref. 5). The 2009 Guidance describes the general
attributes we believe a third-party certification program should have
to give us confidence in the reliability of its certifications. It also
explains our vision, prior to FSMA enactment, of how we might use such
voluntary third-party certifications to assist in determining
inspection, field exam, and sampling priorities, as well as in making
admissibility decisions for imported food. We intend to withdraw the
2009 Guidance upon publication of a final rule for accredited third-
party certification.
3. Pilot Project on Third-Party Certification for Aquacultured Shrimp
    In the Federal Register of July 10, 2008 (73 FR 39705), we
published a notice inviting third-party certification bodies to
participate in a pilot of voluntary third-party certification of
aquacultured shrimp (shrimp pilot). The goal of the shrimp pilot was to
gain knowledge and experience with third-party certification to assist
us in evaluating the utility and feasibility of using third-party
certification programs as part of our oversight of foreign food firms.
    The pilot data indicate that having the appropriate FDA
infrastructure, including logistical and resource support, will be
critical to the success of any full-scale accredited third-party
certification program (Ref. 6). The role we played in the shrimp pilot
was analogous to the role traditionally played by an accreditation
body, monitoring the performance of certification bodies. The pilot
demonstrated to us that direct accreditation, in which we ourselves
accredit and provide direct oversight of a potentially unlimited number
of third-party certification bodies, would be costly and
administratively burdensome, though direct accreditation may be
appropriate in limited circumstances, as will be discussed in section
IV.A.8.
4. FDA Third-Party Program for Mammography
    In developing this proposed rule, we reviewed other Agency third-
party programs, including the FDA program, required by the Mammography
Quality Standards Act of 1992 (Pub. L. 102-539) (as amended), to
approve accreditation bodies to evaluate and accredit mammography
facilities based upon quality standards. Only facilities that are
accredited by, or undergoing accreditation by, an accreditation body we
approved, may receive our certificates (or the certificates of a State
certifying agency we approved) to legally perform mammography (Ref. 7).

C. FDA's Use of Certifications for Food

    For years, we have used certification as a tool for verifying that
imported foods comply with our food safety requirements and reducing
the need for

us to sample at entry. Since the late 1980s, for example, the Export
Inspection Council of the Indian Ministry of Commerce has sampled,
analyzed, and issued certificates of conformance for lots of black
pepper exported directly to the United States. Indian black pepper
shipments accompanied by such certifications are not subject to
detention without physical examination under FDA Import Alert 28-02
(Ref. 8). Under Memoranda of Understanding (MOUs) with several foreign
governments, we rely upon certifications that caseins and caseinates,
and mixtures thereof, to be exported to the United States are in
compliance with our requirements, which are intended to minimize the
need for us to extensively sample certified products (Ref. 9). These
are but a few examples of the ways we rely on certifications as a means
to help assure that an article of food complies with our requirements
and to minimize the need for extensive sampling at entry.

D. External Recommendations on Third-Party Certification for Food

    In September 2012, the Government Accountability Office (GAO)
issued a report discussing possible challenges associated with
establishing and administering the accredited third-party certification
program, including: offering incentives to encourage participation;
meeting challenges associated with creating a new program; addressing
stakeholder concerns; and conducting oversight of the program, once
established (Ref. 10). We believe this proposed rule addresses the
relevant challenges identified by GAO.
    In June 2010, a committee of experts convened by the Institute of
Medicine and the National Research Council (IOM/NRC committee) released
a report examining gaps in public health protection afforded by the
farm-to-table food safety system under our purview and identifying
opportunities to fill those gaps (Ref. 11). The IOM/NRC committee
concluded that we need to address barriers to improving the efficiency
of inspections by, among other things, exploring third-party auditing
of food facilities as an alternative model for measuring compliance.
The IOM/NRC committee's report specifically recommended that we
consider the implications of accepting inspection data from third-party
auditors inspecting facilities for compliance with food safety
regulatory requirements. The IOM/NRC report also stated that, if we use
this approach, we should set minimum standards for such auditors and
audits, with oversight and implementation being assigned to an
accreditation and standards body.

E. FDA Standards for Assessing Capabilities of Food Safety Systems

    In developing the framework for recognition of accreditation bodies
and accreditation of third-party auditors required by section 808 of
the FD&C Act, we looked at our existing standards for assessing the
capabilities of food safety systems at the State level, through the
Manufactured Foods Regulatory Program Standards (MFRPS) (Ref. 12). The
MFRPS establish a uniform foundation for the design and management of
high-quality State regulatory programs for food manufacturers, focusing
on ten key areas: (1) Regulatory foundation; (2) inspector training
program; (3) risk-based inspection program; (4) audits of the
inspection program; (5) protocols for food-related illnesses,
outbreaks, and response; (6) compliance and enforcement program; (7)
industry and other stakeholder relations; (8) program resources; (9)
program assessment; and (10) laboratory support.
    We also considered a FDA-New Zealand pilot project for assessing
food safety systems, authority, oversight and monitoring that was
discussed at a public hearing in March 2011 (Ref. 13). We found
particularly useful the draft FDA International Comparability
Assessment Tool (ICAT) used in reviewing New Zealand's food safety
regulatory system to determine if it provides a similar set of
protections to that of FDA (Ref. 14). Following the successful
completion of the New Zealand comparability pilot, in late 2012 FDA
launched a bilateral pilot project with the Canadian Food Inspection
Agency (CFIA) on systems recognition (previously known as
comparability), sharing FDA's draft ICAT as a guide for the systems
recognition process. FDA and CFIA currently are finalizing their
respective systems recognition reviews.

F. U.S. Government Policies on Consensus Standards and Conformity
Assessment

    Implementation of section 808 of the FD&C Act occurs against the
backdrop of the broader Federal policies on consensus standards and
conformity assessment under the National Technology Transfer and
Advancement Act of 1995 (NTTAA) (Public Law 104-113).
    The NTTAA, together with the Office of Management and Budget (OMB)
Circular A-119, revised February 10, 1998 (Ref. 15), directs Federal
Agencies to use voluntary consensus standards in lieu of government-
unique standards except where inconsistent with law or otherwise
impractical. OMB Circular A-119 states that the use of voluntary
standards, whenever practicable and appropriate, is intended to
eliminate the cost to government of developing its own standards and
decrease the cost of goods procured and the burden of complying with
Agency regulation; provide incentives and opportunities to establish
standards that serve national needs; encourage long-term growth for
U.S. enterprises and promote efficiency and economic competition
through harmonization of standards; and further the policy of reliance
upon the private sector to supply government needs for goods and
services.
    In addition, the U.S. Government has issued a National Standards
Policy and Federal guidance on conformity assessment activities (which
are defined as activities concerned with determining directly or
indirectly that requirements for products, services, systems, and
organizations are fulfilled) (15 CFR 287.2).
    As directed by OMB in Circular A-119 (Ref. 15), the National
Institute of Standards and Technology (NIST), in the Federal Register
of August 10, 2000 (65 FR 48894), issued policy guidance on Federal
conformity assessment activities (Federal conformity assessment
guidance) (codified at 15 CFR part 287). The guidance applies to all
Federal Agencies that set policy for, manage, operate, or use
conformity assessment activities or results, domestically and
internationally (except for activities conducted pursuant to treaties)
and is intended to eliminate unnecessary duplication and complexity in
conformity assessment requirements. (We note that OMB has announced it
is currently revising Circular A-119, and NIST is revising the Federal
conformity assessment guidance (Ref. 16)).
    The current Federal conformity assessment guidance provides for
Federal Agencies to use, where appropriate, relevant guides or
standards for conformity assessment \6\ practices from domestic and
international standardizing bodies such as the Codex Alimentarius
Commission (Codex),\7\ the International Organization

for Standardization (ISO)/International Electrotechnical Commission
(IEC),\8\ and the American National Standards Institute (ANSI). The
guidance also notes that each Agency retains the responsibility, and
authority, to select the conformity assessment activities and
procedures (e.g., guides and standards) that will best meet its
legislative mandates and programmatic objectives (15 CFR part 287).
---------------------------------------------------------------------------

    \6\ ISO/IEC 17000:2004, Conformity assessment--Vocabulary and
general principles (Ref. 17) defines ``conformity assessment'' as
``demonstration that specified requirements relating to a product,
process, systems, person or body are fulfilled.
    \7\ The Codex Alimentarius Commission, established by Food and
Agriculture Organization of the United Nations (FAO) and the World
Health Organization (WHO) in 1963 develops harmonized international
food standards, guidelines and codes of practice to protect the
health of the consumers and ensure fair trade practices in the food
trade. The Commission also promotes coordination of all food
standards work undertaken by international governmental and non-
governmental organizations. See, http://www.codexalimentarius.org/codex-home/en/.
    \8\ ISO is a voluntary, consensus, standards developer with
standards covering many aspects of technology and business,
including food safety. See, http://www.iso.org/iso/home/about.htm.
---------------------------------------------------------------------------

    In developing this proposed rule, we considered several voluntary
consensus standards, specifically ISO/IEC 17000: 2004, Conformity
assessment--Vocabulary and general principles (Ref. 17) and ISO/IEC
17011: 2004, Conformity assessment--General requirements for
accreditation bodies accrediting conformity assessment bodies (Ref.
18), which contains the following major elements: (1) Legal
responsibility, structure, and impartiality; (2) management systems,
including records, internal audits, nonconformities, and corrective
actions; (3) personnel associated with the accreditation body,
personnel associated with the accreditation process, and monitoring
performance assessments of accreditation personnel; (4) the
accreditation process; and (5) and roles and responsibilities of the
accreditation body and the certification body. We will address elements
of ISO/IEC 17011: 2004 that are relevant to this rule in our discussion
of the proposed requirements for accreditation bodies in section IV.A.2
through IV.A.4.
    In addition, we considered other ISO/IEC 17021: 2011, Conformity
assessment--Requirements for bodies providing audit and certification
of management systems (Ref. 19), which contains similar requirements
for bodies auditing management systems: (1) Legal matters and
contractual matters; (2) impartiality; (3) structural requirements; (4)
resource requirements, including competence of management and
personnel; (5) monitoring and surveillance; (6) internal audits; and
(7) records.
    We also considered ISO/IEC Guide 65: 1996, General requirements for
bodies operating product certification systems (Ref. 20).\9\ ISO also
has issued the 22000 series of standards for food safety management
systems, including ISO/TS 22003: 2007, Food safety management systems--
Requirements for bodies providing audit and certification of food
safety management systems (Ref. 21).\10\
---------------------------------------------------------------------------

    \9\ Subsequently, ISO/IEC Guide 65:1994 (Ref. 20) was updated
and incorporated into ISO/IEC 17065.
    \10\ This series includes standards the food industry uses in
establishing and maintaining its food safety management systems and
also the standards that auditors/certification bodies use in
assessing those systems.
---------------------------------------------------------------------------

    These standards are among the relevant information we used in
developing this proposed rule. We do not propose to incorporate these
standards by reference into our regulations, because they contain
additional requirements that are not relevant to our program and might
unnecessarily create disincentives to participation. A copy of each of
these ISO standards has been placed in the docket for this rulemaking
and is made available at the Division of Dockets Management at address
listed in the ADDRESSES section of this document. The standards also
are available electronically by purchase from ISO, at http://www.iso.org.
    As described more fully in section III, we developed this proposed
rule having received information and input from a broad range of
stakeholders that included public and private members of the standards
community. We met with representatives of other U.S. Government
agencies and foreign governments and participated in listening sessions
requested by stakeholders wishing to share their views on section 808
of the FD&C Act.
    We believe the proposal aligns with the NTTAA, the National
Standards Policy, and current versions of OMB Circular A-119 (Ref. 15)
and the Federal conformity assessment guidance (15 CFR part 287), in
relying upon the principles of voluntary consensus standards currently
used globally and domestically by the food industry, the international
standards community, and conformity assessment bodies.
    Under the guidance at 15 CFR 287.4(b), we seek comment on the
rationale for the conformity assessment decisions we have made in
developing this proposal. In particular, we seek comment on whether the
voluntary consensus standards we cite are the appropriate standards
upon which to base this rulemaking. If alternative standards are
suggested, we request that copies of any such standards be submitted
along with the comment(s).

G. Industry Practices on Benchmarking Standards and Third-Party Audits
and Certification for Food and Food Facilities

    As a result of consolidation within the food industry and the
globalization of the marketplace, coupled with some high-profile food
safety incidents, many food retailers and food service providers began
to require their suppliers to be audited against their standards (more
commonly known as ``buyer requirements'') (Ref. 11). Some of these
supplier audits were conducted by auditors/certification bodies
employed by, or acting as agents of, buyers. Other auditors were third
parties, independent of both buyers and suppliers.
    As buyers increasingly relied on audits to assess compliance with
their safety requirements, more and more suppliers began to face
multiple food safety audits. The proliferation of buyers' requirements
created inefficiencies that ultimately spurred several efforts to
harmonize audits. These include the Global Food Safety Initiative
(GFSI), which was established in 2000 by a group of international
retailers (Ref. 22). GFSI benchmarks food safety schemes \11\ against a
harmonized set of key elements for food safety and management systems.
GFSI's benchmarking guidance (Ref. 23), and indeed many of the food
safety schemes it benchmarks, use Codex as their foundational
standards.
---------------------------------------------------------------------------

    \11\ A food safety scheme generally includes the food safety
standard against which a food facility is assessed and the
management system associated with the standard.
---------------------------------------------------------------------------

    GFSI's benchmarking assesses a scheme's food safety standards and
the governance and management structure of the food safety scheme
owner, such as technical competence, safeguards against conflicts of
interest, and procedures for accreditation bodies to oversee the
certification bodies that audit and issue certifications under the food
safety scheme (Ref. 23). For example, the U.S.-based American National
Standards Institute (ANSI) currently provides accreditation services
for three GFSI-benchmarked food safety schemes: The Food Marketing
Institute's Safe Quality Food Initiative scheme, the British Retail
Consortium scheme, and the Global GAP scheme (Ref. 24). As is discussed
in the Preliminary Regulatory Impact Analysis (Ref. 25) for this
proposed rule, dozens of accreditation bodies worldwide accredit
certification bodies to conduct food safety audits. Both large and
small suppliers are increasingly relying on third-party audits and
certification as a means to ensure

market access for their food products. In addition, domestic and
foreign suppliers (such as producers, comanufacturers, or repackers)
are increasingly looking to third-party certification programs to
assist them in verifying that their facilities and food meet applicable
food safety standards, whether private food safety schemes such as
those benchmarked by GFSI or public standards such as the FD&C Act
requirements, which are the relevant standards for purposes of the FDA
accredited third-party audit and certification program. The Federal
Government recognizes that rigorous voluntary certification programs
can provide assurance that products meet U.S. requirements. Currently,
private food and facility certifications are frequently used but can
result in duplicate audits and certifications. Under this proposal, FDA
will oversee a certification program that will, we believe, create
efficiencies by reducing the number of redundant food safety audits and
by allowing us to better target resources for verifying compliance with
applicable requirements.

III. FSMA Imports Public Meeting and Stakeholder Input

    Since enactment of FSMA, we have reached out to stakeholders in the
food industry, the international community, standards organizations,
accreditation and certification bodies, consumer groups, government
agencies, and other interested parties to gain input and perspective on
how best to implement FSMA. Among those activities, on March 29, 2011,
we held a public meeting with stakeholders to discuss the
implementation of the FSMA import safety provisions, including section
808 of the FD&C Act on accredited third-party certification. For
additional information about this public meeting, including the agenda,
transcripts, and an archived webcast, see http://www.fda.gov/Food/FoodSafety/FSMA/ucm249257.htm.
    In conjunction with the public meeting, we opened a public docket,
with notice in the Federal Register of March 14, 2011 (76 FR 13643),
soliciting comments on implementation of section 808 of the FD&C Act
and other import provisions added or amended by FSMA. We received
several comments on accredited third-party certification, from a
variety of stakeholders including a foreign authority (1); trade
associations (11); auditors/certification bodies and a laboratory (4);
consumer groups (3); other non-profits (1); and an individual (1). Some
common themes emerged, including comments on using existing systems as
a model; considering impacts on small and medium-sized businesses;
requiring notification of conditions that could cause or contribute to
a serious risk to public health; ensuring auditor competency; and
preventing conflicts of interest. This docket (FDA-2011-N-0146) is
available electronically at http://www.regulations.gov, or at the
Division of Dockets Management (see ADDRESSES).
    In addition to attending the public meeting, several stakeholders
requested meetings to discuss their current programs and to share their
views and recommendations for implementing section 808 of the FD&C Act.
These stakeholders represented a broad range of interests, including
consumer groups, trade associations, auditors/certification bodies and
laboratories. We also met with representatives of foreign governments,
as part of ongoing outreach and collaboration with foreign regulatory
partners. Topics for these meetings included the statutory requirements
for accreditation of third-party auditors, including FDA's authority to
directly accredit third-party auditors/certification bodies; \12\
voluntary consensus standards and industry practices on accreditation,
auditing, and certification; and international considerations.
Additionally, we note that FDA representatives have been invited to
attend meetings, hosted by stakeholders, which included discussions of
third-party audits and certifications.
---------------------------------------------------------------------------

    \12\ The docket for this rulemaking contains, as background
material, a letter from Caroline Smith DeWaal of the Center for
Science in the Public Interest, which was received after the docket
for the public meeting closed and before issuance of this proposed
rule. The letter offers an analysis of FDA's authority for direct
accreditation.
---------------------------------------------------------------------------

    The input and perspectives gained through each of these
interactions helped shape this proposed rule. We have identified some
common themes from these interactions. Most stakeholders expressed
significant concerns regarding existing capacity of third-party food
safety auditors/certification bodies and, for some stakeholders, the
degree of competency demonstrated by the available cadre of auditors/
certification bodies. We recognize that the credibility of the new
third-party program rests largely on the quality of the auditing and
certification work performed by accredited third-party auditors/
certification bodies and have attempted to address those concerns in
this rulemaking.
    In other areas, stakeholders' interests diverged. For example,
consumer groups expressed a strong interest in transparency of the
program, including public disclosure of audit reports. Current industry
practice is to maintain the confidentiality of audit reports except to
the extent that the audited firm waives confidentiality or where
otherwise required by law. Industry also has expressed concern about
the statutory requirement for accredited auditors to notify us of
conditions in an audited firm that could cause or contribute to a
serious risk to the public health. Some in industry have taken the
position that stringent disclosure and transparency requirements may
dissuade food firms from using third-party auditors/certification
bodies accredited under our program.
    As an initial matter, we note that we are bound to implement FSMA
as enacted and to comply with all other applicable disclosure laws
(e.g., the Freedom of Information Act (FOIA)) (5 U.S.C. 552). Within
that legal framework, we have balanced the following competing public
interests: (1) Providing as much information to the public as possible
about audits of foreign food entities and the performance of accredited
auditors/certification bodies, so that individuals may assess the
performance and credibility of the accredited third-party audits and
certification program; (2) protecting the proprietary interests of food
entities related to their trade secrets and confidential commercial
information to the extent allowable by statute, as well concerns about
public release of sensitive information that would not otherwise be
publicly available; and (3) protecting the public health by being able
to attract sufficient numbers of foreign food entities, third-party
auditors/certification bodies, and accreditation bodies to make the
program cost-effective and otherwise successful.
    To gain credibility with consumers and address industry views on
sensitive information, this proposed rule seeks to balance disclosure
and confidentiality concerns. It reflects our views on how best to
strike the balance between these and other competing interests. We
believe this proposal reflects the intent of section 808 of the FD&C
Act and the purpose of the law, offering a practical, flexible, and
effective approach to the accredited third-party audits and
certification program. We seek comment on the framework this proposed
rule would create for recognition of accreditation bodies and
accreditation of third-party auditors/certification bodies, how it
aligns with existing voluntary industry programs, and what expectations
consumers have for the ability of this program to help us ensure the
safety of imported food.

    In addition, we invite comments on possible effects of the creation
of an FDA program for accredited third-party audits and certification.
We are particularly interested in receiving comments and data on the
availability of competent auditors/certification bodies to participate
in our program or about the likelihood of entities being able to scale-
up their capacity to participate in our program and to serve demand
outside the scope of our program. We understand from public comments
and stakeholder meetings that industry and the conformity assessment
community have concerns about access to sufficient numbers of qualified
third-party auditors/certification bodies under current conditions. We
also understand that some industry leaders have developed various
strategies and plans for increasing auditor capacity. We request
comments and information on the progress of these efforts and the
impact the establishment of our program will have on accelerating these
efforts. Given that this program is for food and facility
certifications only for purposes of mandatory certification and VQIP
eligibility under sections 801(q) and 806 of the FD&C Act
(respectively), what effect, if any, do stakeholders anticipate this
program will have on current capacity issues?
    We also request stakeholder input on any possible trade impacts of
the program, once established. What effect might this program have on
the existing issues with auditor capacity? Will it affect foreign or
domestic food firms' ability to provide certifications to their
customers? If so, are foreign and domestic firms likely to be affected
in the same manner and to the same degree? If not, what are the likely
impacts to each? Are there particular types of food firms or food
products, or certain areas of the world in which capacity issues are
more likely to be prevalent and to what degree? Are there other factors
impacting the availability of competent auditors? Are there any
solutions or approaches that might be practical and appropriate for
FDA, as a regulatory Agency, to use in addressing auditor capacity
issues within the accredited third-party audits and certification
program?
    We encourage stakeholders to consider and comment on this proposed
rule and the various interests at stake in this rulemaking, with
recommendations about the proper balance of competing interests.

IV. Purpose and Description of the Proposed Rule

    In section 808 of the FD&C Act, Congress directed us to establish
an accredited third-party audits and certification program that
leverages the work of existing private sector audit programs and
efforts, while requiring measures to better ensure audit rigor and
objectivity. We believe this proposed rule, coupled with our oversight
of the program, will help ensure the competence and independence of
third-party auditors/certification bodies who conduct foreign food
safety audits. It also will help ensure the reliability of
certifications issued by third-party auditors/certification bodies that
we may use in making certain decisions relating to imported food.
    Having comprehensive oversight of a credible and reliable program
for third-party audits and certifications of foreign food facilities
will help us prevent potentially harmful food from reaching U.S.
consumers and thereby improve the safety of the U.S. food supply. As
explained previously, we believe this new program will draw a
significant number of participants and will be broadly accepted by
industry. Currently, buyers seeking to import regulated product from a
foreign food facility often require food safety audits that are
conducted under varying audit criteria. By establishing a trusted
program for third-party audits and certification of foreign food
facilities that operates under public oversight, we expect that the
number of redundant food safety audits performed to assess compliance
with the FD&C Act will be reduced, which, in turn, will increase
efficiency and reduce costs to industry. Our estimates relating to
reductions in redundant audits are addressed more fully in the
Preliminary Regulatory Impact Analysis (Ref. 25).
    More broadly, we think that by capitalizing on private sector food
safety efforts and linking them to the public assurance system,
accredited third-party certification can help transform the way we
ensure the safety of globally traded food that is consumed in the
United States. In our vision of the future, we do not see third-party
audits replacing public oversight, but rather helping us ensure that we
make the best, most efficient use of both public and private resources
to produce a safe food supply.
    We are proposing requirements that would apply to several different
types of entities--i.e., accreditation bodies, third-party auditors/
certification bodies, and eligible entities--and an option for
importers as well. We are organizing this proposed rule by those
categories, with specific requirements for accreditation bodies
(proposed Sec. Sec.  1.610 through 1.636), third-party auditors/
certification bodies (proposed Sec. Sec.  1.640 through 1.672),
eligible entities (proposed Sec. Sec.  1.680 and 1.681), and importers
(proposed Sec.  1.698). Provisions of general applicability appear in
proposed Sec. Sec.  1.600 and 1.601 (definitions and scope), Sec.
1.690 (publicly available information), Sec. Sec.  1.691 through 1.693
(challenges to FDA decisions).
    Accordingly, we are proposing to amend our regulations in parts 1
and 16 (21 CFR parts 1 and 16) to implement FSMA section 307, which
adds section 808 to the FD&C Act and is codified at 21 U.S.C. 384d. We
are proposing to add new subpart M to part 1 and to amend existing part
16 (21 CFR part 16) as follows:

A. Proposed Revisions to Part 1, New Subpart

1. Definitions and Scope
    a. What definitions apply to this subpart? (Proposed Sec.  1.600).
Proposed Sec.  1.600 contains definitions of several terms used in this
rule. Where possible, we propose to rely on existing statutory and
regulatory definitions. Where necessary to provide clarity to this
rule, we have developed some additional definitions that align with
existing law and regulations, as well as current practices of the
international community, accreditation and certification bodies, and
the food industry.
    Proposed Sec.  1.600(a) and (b) state that definitions contained in
section 201 of the FD&C Act (21 U.S.C. 321) will apply to this rule,
except as those terms are otherwise defined in paragraph (c). Because
``food'' is defined in section 201(f) of the FD&C Act, but not in
proposed Sec.  1.600(c), the definition of ``food'' that we propose to
apply to this rule is the definition of ``food'' appearing in section
201(f). Examples of ``food'' under this proposed definition would
include, but not be limited to, fruits, vegetables, fish, dairy
products, eggs, raw agricultural commodities for use as food or
components of food, animal feed (including pet food), food and feed
ingredients and additives (including substances that migrate into food
from packaging and other articles that contact food), dietary
supplements and dietary ingredients, infant formula, beverages
(including bottled water), live food animals, bakery goods, snack
foods, candy, and canned food. (See, e.g., 21 CFR 1.377. See also the
discussion of proposed Sec.  1.601(d)

regarding a limited exemption for alcoholic beverages and prepackaged
foods from certain facilities.)
    ``Accreditation'' means a determination by a recognized
accreditation body, or by FDA in the case of direct accreditation, that
a third-party auditor/certification body is competent to perform the
activities required of an accredited auditor/certification body for the
purposes of this rule. In developing this definition, we considered
international standards on accreditation, including ISO/IEC 17011:2004
(Ref. 18), which defines accreditation as an attestation ``conveying
formal demonstration'' of a conformity assessment body's competence to
carry out specific conformity assessment tasks.
    ``Accreditation body'' means an authority that performs
accreditation of third-party auditors/certification bodies. This
definition is already in use in section 808(a) of the FD&C Act and is
consistent with international standards, such as ISO/IEC 17011:2004
(Ref. 18), which defines ``accreditation body'' as an ``authoritative
body'' that conducts accreditation.
    ``Accredited auditor/certification body'' means a third-party
auditor/certification body that a recognized accreditation body (or, in
the case of direct accreditation, FDA) has determined meets the
applicable requirements of this subpart and is authorized to conduct
food safety audits and to issue food or facility certifications to
eligible entities. This definition reflects the statutory definitions
of ``accredited third party auditor'' and ``third party auditor'' and a
common understanding of the activities to be performed under this
program.
    ``Audit'' means:
    1. With respect to an accreditation body, the systematic,
independent, and documented examination (through observation,
investigation, and records review) by FDA to assess the accreditation
body's authority, qualifications (including its expertise and training
programs), and resources; its procedures for quality assurance,
conflicts of interest, and records; its performance in accreditation
activities; and its capability to meet the applicable requirements of
this subpart.
    2. With respect to a third-party auditor/certification body, the
systematic, independent, and documented examination (through
observation, investigation, and records review) by a recognized
accreditation body (or, in the case of direct accreditation, FDA) to
assess the third-party auditor's/certification body's authority,
qualifications (including its expertise and training programs), and
resources; its procedures for quality assurance, conflicts of interest,
and records; its performance in auditing and certification activities;
and its capability to meet the applicable requirements of this subpart;
and
    3. With respect to an eligible entity, the systematic, independent,
and documented examination (through observation, investigation, records
review, and as appropriate, sampling and laboratory analysis) by an
accredited auditor/certification body to assess the entity, its
facility, system(s), and food for the purpose of determining whether
the food or facility of the eligible entity is in compliance with the
FD&C Act (which includes, where applicable, an assessment of the
entity's preventative controls, sanitation, monitoring, verification,
corrective actions, and recalls) and, for consultative audits, also
includes an assessment of compliance with applicable industry standards
and practices.
    The term describes the nature and scope of activities involved in
the various types of audits and assessments that will be conducted
under this program. We incorporated relevant language from the
definitions of consultative audit and regulatory audit in section
808(a)(5) and (a)(7) of the FD&C Act and language specific to the
requirements used in audits and assessments of accreditation bodies,
third-party auditors/certification bodies, and eligible entities.
    We considered our 2009 guidance (Ref. 5) and the descriptions of
audit activities under our MFRPS (Ref. 12). We also examined usage in
international standards, such as the Codex Principles for Food Import
and Export Certification (CAC/GL 20-1995) (Ref. 26), which define
``audit'' as a ``systematic and functionally independent examination to
determine whether activities and related results comply with planned
objectives.'' Additionally, we looked at ISO/IEC 17000:2004 (Ref. 17),
which defines ``audit'' as a ``systematic, independent, documented
process for obtaining records, statements of fact or other relevant
information and assessing them objectively to determine the extent to
which specified requirements are fulfilled.''
    ``Audit agent'' means an individual who is an employee or other
agent of an accredited auditor/certification body who, although not
individually accredited, is qualified to conduct food safety audits on
behalf of an accredited auditor/certification body. An audit agent
includes a contractor of the accredited auditor/certification body.
    The term is based on section 808(a)(1) of the FD&C Act, which
defines ``audit agent'' as an employee or agent of an accredited
auditor[/certification body] who is qualified to conduct food safety
audits on its behalf. In the definition, we clarify that contractors
who are authorized to act for, and under the direction of, the
accredited auditor/certification body are allowed to serve as an audit
agents.
    ``Certification body'' means a foreign government, agency of a
foreign government, foreign cooperative, or any other third party that
is eligible to be considered for accreditation to conduct food safety
audits and to certify that eligible entities meet the requirements of
the FD&C Act. A certification body may be a single individual or an
organization. A certification body may use audit agents to conduct food
safety audits. Certification Body has the same meaning as Third-Party
Auditor as that term is defined in section 808 of the FD&C Act and in
this subpart.
    This definition emphasizes the role of ``third-party auditors,''
under section 808 of the FD&C Act, in issuing facility certifications
that importers must use to establish eligibility for VQIP participation
and food certifications that may be required to satisfy a condition of
admissibility for an imported food we determine poses a safety risk
under section 801(q) of the FD&C Act.
    In developing the definition of ``certification body,'' we looked
at the definition of ``third-party auditor'' in section 808(a)(3) of
the FD&C Act, as well as terminology used by the international
community and the food industry. For example, ISO/IEC 17000:2004 (Ref.
17) explains that a ``certification system'' is a conformity assessment
system that includes ``selection, determination, review and finally
certification as the attestation activity'. See also, ISO/IEC Guide
65:1996 (Ref. 20) and ISO/IEC 17021: 2011 (Ref. 19). The term
``certification body'' also is used by those in the food industry who
currently rely on audits and certifications as part of their business
practices. We believe this proposed language more clearly explains the
role of accredited auditors/certification bodies and the requirements
for issuance of certification under this program.
    ``Consultative audit'' means an audit of an eligible entity:
    1. To determine whether such entity is in compliance with
applicable requirements of the FD&C Act and industry standards and
practices; and

    2. The results of which are for internal purposes only and cannot
be used to determine eligibility for a food or facility certification
issued under this subpart or in meeting the requirements for an onsite
audit of a foreign supplier under subpart L of this part.
    This reflects the definition of ``consultative audit'' in section
808(a)(5) of the FD&C Act and emphasizes that the results of a
consultative audit cannot be used in lieu of a regulatory audit to meet
the criteria for issuance of food or facility certification under
section 808(c)(2)(C) of the FD&C Act. It also incorporates language
from proposed Sec.  1.698, which would allow only reports of regulatory
audits to be used by importers in meeting proposed verification
requirements under the Foreign Supplier Verification Rule (FSVP) (to be
codified in 21 CFR, part 1, subpart L).
    ``Direct accreditation'' means accreditation of a third-party
auditor/certification body by FDA and is a term used in section
808(b)(1)(A)(ii) of the FD&C Act when describing FDA accreditation of
third-party auditors/certification bodies, without the involvement of a
recognized accreditation body. The distinction between direct
accreditation and accreditation by an FDA-recognized accreditation body
is relevant for some provisions of this rule. For example, under
proposed Sec.  1.656(b), a directly accredited auditor/certification
body must send its annual self-assessment reports to FDA, while an
auditor/certification body accredited by a recognized accreditation
body must submit its annual self-assessment reports to the
accreditation body, who is responsible for monitoring and ensuring its
accredited auditors/certification bodies take timely and effective
corrective actions, where necessary. FDA will access the accredited
auditor/certification body self-assessments in monitoring recognized
accreditation bodies and in conducting the periodic monitoring required
by section 808(f)(2) of the FD&C Act. This definition will help
accredited auditors/certification bodies determine which requirements
apply to them.
    ``Eligible entity'' means a foreign entity that chooses to be
subject to a food safety audit by an accredited auditor/certification
body. Eligible entities include foreign facilities subject to the
registration requirements of 21 CFR part 1, subpart H. The definition
of ``eligible entity'' corresponds to section 808(a)(6) of the FD&C
Act, which defines ``eligible entity'' as including (and thus not
limited to) foreign facilities subject to the registration requirements
of section 415 of the FD&C Act (21 U.S.C. 350d).
    We seek comment on whether to provide examples of specific types of
entities that may meet the definition of eligible entity. For example,
are foreign cooperatives \13\ that aggregate product, such as fruits or
vegetables, the types of entities that should be able to seek audits
and certification under this program? We note that the National Organic
Program (NOP) administered by the U.S. Department of Agriculture's
(USDA's) Agricultural Marketing Service (AMS), allows producers who are
located in geographic proximity, who are organized under a single
management and marketing system and whose farms are ``uniform in most
ways'' to be certified as a group (Ref. 27).\14\ We seek comment on
whether these NOP criteria are relevant in determining whether a
foreign cooperative is an ``eligible entity'' under this proposed rule,
Are there other types of foreign entities or facilities that should be
eligible to seek audits and certification under the FDA program?
---------------------------------------------------------------------------

    \13\ Under section 808 of the FD&C Act, foreign cooperatives are
among the types of groups that are eligible to seek accreditation as
third-party auditors, provided that they meet the standards and
requirements for accreditation (e.g., for conflicts of interest).
    \14\ Per USDA, grower group certifications have historically
been used for the certification of cooperatives located in
geographical proximity, whose crops are marketed collectively.
Primary crops produced by grower groups include coffee, cocoa, tea,
spices, and tropical fruits (Ref. 27).
---------------------------------------------------------------------------

    ``Facility'' means any structure, or structures of an eligible
entity under one ownership at one general physical location, or, in the
case of a mobile facility, traveling to multiple locations, that
manufactures/processes, packs, or holds food for consumption in the
United States. Transport vehicles are not facilities if they hold food
only in the usual course of business as carriers. A facility may
consist of one or more contiguous structures, and a single building may
house more than one distinct facility if the facilities are under
separate ownership. The private residence of an individual is not a
facility. Non-bottled water drinking water collection and distribution
establishments and their structures are not facilities. This same
definition of ``facility'' appears in subpart H (21 CFR 1.227(b)(2)).
    ``Facility certification'' means an attestation, issued for
purposes of section 806 of the FD&C Act by an accredited auditor/
certification body, after conducting a regulatory audit and any other
activities necessary to establish that a facility meets the applicable
requirements of the FD&C Act.
    ``Food certification'' means an attestation, issued for purposes of
section 801(q) of the FD&C Act by an accredited auditor/certification
body, after conducting a regulatory audit and any other activities
necessary to establish that a food meets the applicable requirements of
the FD&C Act.
    These definitions reflect the requirements for, and purpose of,
certification as described in section 808(c)(2)(B) and (c)(2)(C) of the
FD&C Act, referencing sections 801(q) (food certification) and 806
(facility certification) of the FD&C Act. Food and facility
certifications are the two types of certifications authorized by
section 808 of the FD&C Act. Further, the food and facility
certification definitions emphasize that certification is an
attestation \15\ by the accredited third-party auditor/certification
body that it has: (1) Conducted a regulatory audit (and any other
activities necessary to establish compliance); (2) verified that the
specified criteria have been met; and (3) determined, based on the
results of those activities, that food or facility certification under
this program is appropriate.
---------------------------------------------------------------------------

    \15\ We propose to use the word ``attestation'' in Sec.  1.600
to characterize the nature of the statement that certification
represents. This is the term used in ISO/IEC 17000:2004 (Ref. 20)
and also is the term we use when characterizing the nature of our
export certifications (Ref. 28). We believe that ``attestation'' is
similar to ``assurance,'' which is the term used in Codex CAC/GL 20-
1995 (Ref. 27).
---------------------------------------------------------------------------

    Codex CAC/GL 20-1995 (Ref. 26) defines ``certification'' as the
procedure by which certification bodies provide ``written or equivalent
assurance that foods or food control systems conform to requirements.''
ISO/IEC 17000:2004 (Ref. 17) describes certification as an
``attestation'' related to products, processes, systems, or
persons.\16\
---------------------------------------------------------------------------

    \16\ We are not defining ``facility certification'' or ``food
certification'' as an ``approval'' by an accredited auditor/
certification body or by (or on behalf of) FDA, nor do we intend for
it to be interpreted as such. Among other reasons, we do not have
preapproval authority for food, except for certain additives that
are required by law to have our approval prior to marketing.
Moreover, neither Codex CAC/GL 20-1995 (Ref. 27), nor ISO/IEC
17000:2004 (Ref. 20) uses the term ``approval'' in defining
``certification.''
---------------------------------------------------------------------------

    We seek comment on our proposed definitions of ``facility
certification'' and ``food certification'' and on whether the scope of
these definitions is sufficiently broad to fulfill the objectives of
section 808 of the FD&C Act. In addition, we seek comment on whether to
allow groups meeting the NOP criteria (i.e., having multiple sites
operating under a single management system and whose

farms are ``uniform in most ways,'' to be issued (group) food
certifications, facility certifications, or both.
    ``Food safety audit'' means a regulatory audit or a consultative
audit by an accredited auditor/certification body under this program.
This term is used throughout section 808 of the FD&C Act, including in
the definitions of ``audit agent,'' ``third-party auditor,'' and
``accredited third-party auditor.'' The definition of ``third-party
auditor'' in section 808(a)(3) of the FD&C Act in particular, mentions
regulatory and consultative audits in the context of food safety
audits. Therefore, we used the definitions of ``consultative audit''
and ``regulatory audit'' contained in section 808(a)(5) and (a)(7) of
the FD&C Act in developing a definition of ``food safety audit.''
    Table 1 describes consultative audits and regulatory audits and the
distinctions between them.

                Table 1--Types and Characteristics of Food Safety Audits Under the Proposed Rule
----------------------------------------------------------------------------------------------------------------
                                                                  Report submitted to
            Type of audit                      Purpose                    FDA?            Records access by FDA?
----------------------------------------------------------------------------------------------------------------
Regulatory Audit.....................  For certification and    Yes....................  FDA may request
                                        report may be used      Submitted no later than   submission at any
                                        under FSVP.              45 days after the        time.
                                                                 audit..
Consultative Audit...................  Internal purposes......  No.....................  FDA access under
                                                                                section 414 of the
                                                                                FD&C Act.
----------------------------------------------------------------------------------------------------------------

    ``Foreign cooperative'' means an entity that aggregates food from
growers or processors that is intended for export to the United States.
Section 808 of the FD&C Act does not provide a definition of ``foreign
cooperative,'' so we relied upon the statutory description of foreign
cooperatives in section 808(c)(1)(B) of the FD&C Act.
    ``Recognized accreditation body'' means an accreditation body that
FDA has determined meets the applicable requirements and is authorized
to accredit third-party auditors/certification bodies under this
program. This definition is based in part on the definition of
accreditation body in section 808 of the FD&C Act and incorporates the
concept of ``recognition'' that also appears there. The term
``recognition'' is also used in section 422 of the FD&C Act (21 U.S.C.
350k), as amended by FSMA, to describe the status we will accord to a
laboratory accreditation body that accredits laboratories for purposes
of food testing under the FD&C Act.
    We also use the term ``recognition'' in the 2009 guidance (Ref. 5)
and in other FDA programs. In the 2009 guidance, which predates FSMA,
we mentioned the possible future ``recognition'' of one or more third-
party certification programs. Though FSMA directs us to structure our
third-party program differently than we envisioned in 2009, the concept
of ``recognition'' by FDA is similar.
    ``Regulatory audit'' is defined in the statute and means an audit
of an eligible entity:
    1. To determine whether such entity is in compliance with the
provisions of the FD&C Act; and
    2. The results of which are used in determining eligibility for
food certification under section 801(q) of the FD&C Act or facility
certification under section 806 of the FD&C Act. This definition
includes language from proposed Sec.  1.698, which would allow an
importer to use a regulatory audit report in meeting proposed
requirements for verification of a foreign supplier under subpart L of
this part.
    ``Relinquishment'' means:
    1. With respect to an accreditation body, a decision to cede
voluntarily its authority to accredit third-party auditors/
certification bodies as a recognized accreditation body; and
    2. With respect to a third-party auditor/certification body, a
decision to cede voluntarily its authority to conduct food safety
audits and to issue food and facility certifications to eligible
entities.
    We included a definition of ``relinquishment'' in this proposed
rule because we recognize that an accreditation body, once recognized,
or a third-party auditor/certification body, once accredited, may
decide to leave the program and would need a process to voluntarily
exit the program. Relinquishment differs from revocation of recognition
and withdrawal of accreditation, as it occurs on the initiative of the
accreditation body or third-party auditor/certification body and not as
a result of our finding good cause to remove its recognition or
accreditation status. Analogous language on relinquishment of
accreditation appears in our mammography regulations in 21 CFR 900.3.
    ``Self-assessment'' means a systematic assessment conducted by an
accreditation body to determine whether it meets the recognition
requirements in Sec. Sec.  1.610 through 1.625, or by a third-party
auditor/certification body to determine whether it meets the
accreditation requirements in Sec. Sec.  1.640 through 1.658. ``Self-
assessment'' is defined in this proposed rule in a manner consistent
with its use in our MFRPS for State food regulatory programs (Ref. 12).
The MFRPS require States to conduct periodic self-assessments of their
manufactured food regulatory programs against each of the 10 program
standards. These self-assessments are designed to identify the
strengths and weaknesses of the State program by determining the level
of conformance with the program standards and are independently
verified through an audit. The results of the initial self-assessments
are used to develop an improvement plan, and subsequent self-
assessments are used to track the State's progress toward meeting and
maintaining conformance with the MFRPS.
    The concept of self-assessment is used in international consensus
standards as well. For example, ISO/IEC Guide 65:1996 (Ref. 20)
requires a certification body to conduct periodic internal audits to
verify that its quality system is implemented and effective, that
corrective actions are taken in a timely and appropriate manner, and
that records of such reviews are maintained. Both ISO/IEC 17011:2004
(Ref. 18) and ISO/IEC 17021:2011 (Ref. 19) require internal audits as
well. Self-assessments are a valuable component of a continuous
improvement process under our standards and the voluntary consensus
standards described in this preamble.
    ``Third-Party Auditor'' means a foreign government, agency of a
foreign government, foreign cooperative, or any other third party that
is eligible to be considered for accreditation to conduct food safety
audits and to certify that eligible entities meet the applicable
requirements of the FD&C Act. A third-party auditor may be a single
individual or an organization. A third-party auditor may use audit
agents to conduct food safety audits. Third-Party Auditor has the same
meaning as Certification Body as that term is defined in this subpart.

The definition of ``third-party auditor'' is based on section 808 of
the FD&C Act and clarifies our role in direct accreditation and the
relationship between audits and certifications under section 808 of the
FD&C Act. For the reasons explained in the preamble discussion of the
definition of ``certification body,'' ``third-party auditor'' will have
the same meaning as ``certification body'' for purposes of this rule.
    b. Who is subject to this subpart? (Proposed Sec.  1.601). This
proposed rule would apply to those accreditation bodies, third-party
auditors/certification bodies, and eligible entities that seek to
participate in our program for third-party food safety audits and
certification. Participating is voluntary; however any accreditation
body wishing to accredit third-party auditors/certification bodies
under our program would have to comply with the applicable requirements
of the final rule. Under the FDA program, any third-party auditor/
certification body wishing to conduct food safety audits and issue food
and facility certifications and any eligible entity that seeks a food
safety audit or food or facility certification would have to comply
with the applicable requirements of the final rule.\17\
---------------------------------------------------------------------------

    \17\ The terms, ``third-party auditor/certification body,''
``consultative audit,'' ``regulatory audit,'' ``food
certification,'' ``facility certification,'' and ``eligible entity''
are defined under this proposed rule.
---------------------------------------------------------------------------

    This proposed rule would codify a limited exemption created by
section 116 of FSMA (21 U.S.C. 2206) applicable to certification of
food under section 801(q) of the FD&C Act. Section 116(a) of FSMA
states that, except as provided by certain listed sections in the FSMA,
nothing in FSMA, or the amendments made by FSMA, will be construed to
apply to a facility that (1) under the Federal Alcohol Administration
Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal
Revenue Code of 1986 (26 U.S.C. 5001 et seq.) is required to obtain a
permit or to register with the Secretary of the Treasury as a condition
of doing business in the United States; and (2) under section 415 of
the FD&C Act is required to register as a facility because such
facility is engaged in manufacturing, processing, packing, or holding
one or more alcoholic beverages (with respect to the activities of such
facility that relate to the manufacturing, processing, packing, or
holding of alcoholic beverages).
    Section 116(b) of FSMA provides that section 116(a) does not apply
to a facility engaged in the receipt and distribution of any non-
alcohol food, except that section 116(a) does apply to a facility
described in section 116(a) that receives and distributes non-alcohol
food, provided such food is received and distributed (1) in a
prepackaged form that prevents any direct human contact with such food,
and (2) in amounts that constitute not more than 5 percent of the
overall sales of such facility, as determined by the Secretary of the
Treasury.
    Section 116(c) of FSMA provides that, except as provided in section
116(a) and (b), section 116 cannot be construed to exempt any food,
other than alcoholic beverages, as defined in section 214 of the
Federal Alcohol Administration Act (27 U.S.C. 214), from the
requirements of FSMA (including amendments made by FSMA).
    The Preventive Controls proposed rule includes provisions
implementing the exemptions provided in section 116 of FSMA to
establish by regulation the reach of the exemptions. As discussed in
the preamble to the Preventive Controls proposed rule, FDA tentatively
concludes the following regarding the reach of the exemptions for the
purposes of that rule:
     The phrase ``obtain a permit or register'' should be
interpreted broadly, to include not only facilities that must obtain
what is technically named a ``permit'' or must ``register'' with
Treasury, but also those facilities that must adhere to functionally
similar requirements as a condition of doing business in the United
States, namely, by submitting a notice or application to Treasury and
obtaining Treasury approval of that notice or application.
     The exemption would apply not only to domestic facilities
that are required to secure a permit, registration, or approval from
Treasury under the relevant statutes, but also to foreign facilities of
a type that would require such a permit, registration, or approval if
they were domestic facilities.
     Activities related to alcoholic beverages (including the
manufacturing, processing, packing, or holding of alcoholic beverages)
at facilities within the scope of section 116(a) of FSMA would not be
subject to section 418 of the FD&C Act. Activities related to foods
other than alcoholic beverages (including the receiving, manufacturing,
processing, packing, holding, and distributing of such foods) would be
subject to section 418 even if those activities occur at facilities
that are otherwise within the scope of section 116(a) (unless they
qualify for another exemption or are in prepackaged form and constitute
5 percent or less of the facility's overall sales). (For clarity, we
use the term ``food other than alcoholic beverages'' rather than ``non-
alcohol food'' in the Preventive Controls proposed rule and in this
document.)
     Section 418 of the FD&C Act does not apply to the
manufacturing, processing, packing, or holding of food other than
alcoholic beverages to the extent that it is physically inseparable
from the manufacturing, processing, packing, or holding of alcoholic
beverages.
    Section 116 of FSMA is premised in part upon status as a facility
required to register under section 415 of the FD&C Act (section
116(a)(2) of FSMA). As provided in section 808, eligible entities
include foreign facilities registered under section 415 of the FD&C
Act.
    Therefore, to implement the exemption in section 116 of FSMA, under
proposed Sec.  1.601(d)(1), certification of food under section 801(q)
of the FD&C Act would not apply with respect to alcoholic beverages
from an eligible entity that is a facility that meets the following two
conditions:
     Under the Federal Alcohol Administration Act or chapter 51
of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et
seq.), the facility is a foreign facility of a type that, if it were a
domestic facility, would require obtaining a permit from, registering
with, or obtaining approval of a notice or application from the
Secretary of the Treasury as a condition of doing business in the
United States; and
     Under section 415 of the FD&C Act, the facility is
required to register as a facility because it is engaged in
manufacturing/processing one or more alcoholic beverages.
    Proposed Sec.  1.601(d)(2) specifies that certification of food
under section 801(q) of the FD&C Act also would not apply with respect
to food other than alcoholic beverages from a facility described in
paragraph (d)(2), provided such food:
     Is in prepackaged form that prevents any direct human
contact with such food; and
     Constitutes not more than 5 percent of the overall sales
of the facility, as determined by the Secretary of the Treasury.
    This exemption does not apply to facility certification required by
section 806 of the FD&C Act.
    We request comment on our proposed exemption of alcoholic beverages
and food other than alcoholic beverages under the conditions specified
in proposed Sec.  1.601(d).
    As described in the ``Summary of Major Provisions of the Proposed
Rule,'' this rule would apply only to entities

that voluntarily participate in our accredited third-party audits and
certification program, which would be the following: (1) Accreditation
bodies seeking recognition, or recognized, under this program; (2)
third-party auditors/certification bodies (including their audit
agents) that seek accreditation, or are accredited under this program;
and (3) eligible entities that seek food safety audits from, or that
are audited or certified by, accredited auditors/certification bodies
under this program, except for an eligible entity that meets the
criteria for exemption under section 116 of FSMA.
    We invite comment on the scope of this proposed rule, including
comments on its anticipated effects on accreditation bodies and third-
party auditors/certification bodies already performing these
activities, or that may be interested in doing so. We also seek comment
on its anticipated effect on foreign food facilities and other eligible
entities that are currently audited by third-party auditors/
certification bodies.
2. Recognition of Accreditation Bodies
    This rule would establish the following: (1) The eligibility
requirements for an accreditation body to be authorized
(``recognized'') by FDA to accredit third-party auditors/certification
bodies under the accredited third-party audits and certification
program; (2) requirements on recognized accreditation bodies for
activities conducted under our program; and (3) procedures FDA and
accreditation bodies will follow relating to recognition, including
application, renewal, revocation, voluntary relinquishment, and
reinstatement of recognition.

         Table 2--Proposed Requirements for Accreditation Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
         Recognition of accreditation bodies under this subpart
------------------------------------------------------------------------
1.610..................  Who is eligible for recognition?
1.611..................  What legal authority must an accreditation body
                          have to qualify for recognition?
1.612..................  What competency and capacity must an
                          accreditation body have to qualify for
                          recognition?
1.613..................  What protections against conflicts of interest
                          must an accreditation body have to qualify for
                          recognition?
1.614..................  What quality assurance procedures must an
                          accreditation body have to qualify for
                          recognition?
1.615..................  What records procedures must an accreditation
                          body have to qualify for recognition?
------------------------------------------------------------------------
   Requirements for recognized accreditation bodies under this subpart
------------------------------------------------------------------------
1.620..................  How must a recognized accreditation body assess
                          third-party auditors/certification bodies
                          seeking accreditation?
1.621..................  How must a recognized accreditation body
                          monitor the performance of auditors/
                          certification bodies it accredits?
1.622..................  How must a recognized accreditation body
                          monitor its own performance?
1.623..................  What reports and notifications must a
                          recognized accreditation body submit to FDA?
1.624..................  How must a recognized accreditation body
                          protect against conflicts of interest?
1.625..................  What records requirements must a recognized
                          accreditation body meet?
------------------------------------------------------------------------
  Procedures for recognition of accreditation bodies under this subpart
------------------------------------------------------------------------
1.630..................  How do I apply to FDA for recognition or
                          renewal of recognition?
1.631..................  How will FDA review applications for
                          recognition and for renewal of recognition?
1.632..................  What is the duration of recognition?
1.633..................  How will FDA monitor recognized accreditation
                          bodies?
1.634..................  When will FDA revoke recognition?
1.635..................  How do I voluntarily relinquish recognition?
1.636..................  How do I request reinstatement of recognition?
------------------------------------------------------------------------

    Section 808 of the FD&C Act directs us to establish a system for
recognition of accreditation bodies to accredit third-party auditors/
certification bodies and generally describes the roles and
responsibilities of recognized accreditation bodies under the
accredited third-party audits and certification program. The statute
requires each recognized accreditation body to: (1) Ensure that third-
party auditors/certification bodies (and audit agents) meet FDA's model
accreditation standards; (2) perform such reviews and audits necessary
to determine that a third-party auditor/certification body meets the
statutory requirements for accreditation; \18\ (3) require a third-
party auditor/certification body to agree to issue certifications in a
form required by FDA, as a condition of accreditation; and (4) submit
to FDA a list of all third-party auditors/certification bodies it
accredited (and the audit agents of each).
---------------------------------------------------------------------------

    \18\ See section 808(c)(1)(A) and (c)(1)(B) of the FD&C Act.
---------------------------------------------------------------------------

    a. Who is eligible for recognition? (Proposed Sec.  1.610). This
proposed rule would establish eligibility requirements an accreditation
body would have to meet to qualify for recognition by FDA under the
accredited third-party audits and certification program. Proposed Sec.
1.610 states that an accreditation body is eligible for recognition if
it can demonstrate that it meets requirements relating to legal
authority, competency, capacity, conflicts of interest, quality
assurance, and records in proposed Sec. Sec.  1.611 through 1.615.
    In developing this proposed rule, we considered eligibility
requirements that would help us ensure that accreditation bodies
seeking recognition--whether public or private, newly formed or long
standing--are sufficiently qualified to accredit third-party auditors/
certification bodies under our program. We considered the approach
taken by NIST in its National Voluntary Conformity Assessment Systems
Evaluation (NVCASE) Program, which is a voluntary program to evaluate
and recognize organizations which support conformity assessment
activities (Ref. 28). The NVCASE program handbook states that ISO/IEC
17011:2004 (Ref. 18) provides that the basic general criteria

that an accreditor of certification bodies must satisfy for NVCASE
recognition (Ref. 28). We have tentatively concluded that key elements
of ISO/IEC 17011: 2004 (Ref. 18) provide an appropriate basis for these
requirements.\19\ We also considered our 2009 FDA guidance (Ref.
5),\20\ which states that conformance to ISO/IEC 17011:2004 (Ref. 18)
helps provide assurance of the reliability and competence of
accreditation bodies.
---------------------------------------------------------------------------

    \19\ ISO/IEC 17011:2004 contains requirements that are not
applicable to our program (e.g., liability arrangements). While an
accreditation body would not need to conform to ISO/IEC 17011:2004
to qualify for recognition under our program, an accreditation body
that satisfies the requirements of ISO/IEC 17011:2004 could use that
in demonstrating it meets the recognition requirements in this rule.
    \20\ We intend to withdraw the 2009 Guidance upon publication of
a final rule for accredited third-party audits and certification
under section 808 of the FD&C Act.
---------------------------------------------------------------------------

    We also considered current food industry practices. For example,
GFSI requires food safety scheme owners to use accreditation bodies
that comply with ISO/IEC 17011:2004 (Ref. 18) for GFSI-benchmarked food
safety schemes (Ref. 29). In stakeholder meetings, some stakeholders
have suggested that FDA consider requiring accreditation bodies
participating in the accredited third-party audits and certification
program to be signatories to a multilateral recognition agreement of
the International Accreditation Forum (IAF). IAF is an organization for
accreditors of conformity assessment bodies and is a counterpart to
International Laboratory Accreditation Cooperation (ILAC), for
laboratory accreditation bodies.\21\ The IAF multilateral recognition
arrangement (IAF-MLA) (Ref. 30) requires signatories to conform to ISO/
IEC 17011:2004, among other things.
---------------------------------------------------------------------------

    \21\ The ILAC is an international body, established in 1977, to
help ensure the competency, independence, rigor, and objectivity of
accreditation bodies that accredit laboratories against
international standards. The ILAC-mutual recognition agreement
requires signatories to conduct their activities in accordance with
ISO/IEC 17011:2004. FDA laboratory programs have worked with ILAC
and other ILAC signatories for many years.
---------------------------------------------------------------------------

    Unlike our established history with ILAC and ILAC signatories, our
food and feed programs lack similar experience with the IAF. We have
found few examples of Federal agencies that require accreditation
bodies for conformity assessment bodies to be signatories to the IAF-
MLA (for accreditation of product and management system certification)
and that use signatory status as the sole criterion for accreditation
bodies. For example, the Department of Health and Human Services is not
requiring approved accreditors in its Health Information Technology
certification program (45 CFR part 170) to be signatories to the IAF-
MLA, although signatory status could be provided in support of an
applicant's request for approval. By contrast, the Environmental
Protection Agency's WaterSense program (Ref. 31) requires product
accreditors to be signatories to the IAF-MLA (Ref. 30). The WaterSense
program is not a regulatory program; rather, it is a partnership
program.
    We do not have adequate information at this time to propose to
require accreditation bodies participating in the accredited third-
party audits and certification regulatory program to be IAF-MLA
signatories--whether as the sole requirement for recognition under
Sec.  1.610 or as one of several factors in support of recognition. We
have, however, tentatively concluded that documented conformance to
ISO/IEC 17011:2004 (Ref. 18) would be relevant in demonstrating that an
accreditation body is qualified for recognition. We invite comments and
examples (in particular, examples from regulatory programs) in support
of, or opposition to, using an accreditation body's status as a
signatory to an IAF MLA as the sole criterion for recognition or as a
factor weighing in favor of an application for recognition under the
accredited third-party audits and certification program.
    b. What legal authority must an accreditation body have to qualify
for recognition? (Proposed Sec.  1.611). This proposed rule would
require accreditation bodies seeking recognition to demonstrate they
have sufficient legal authority to adequately assess third-party
auditors/certification bodies for accreditation and in conducting
oversight of them, once accredited.
    Proposed Sec.  1.611 would allow both governmental bodies, with
accreditation authority inherent in their roles as public officials,
and private bodies, who have authority under contracts with third-party
auditors/certification bodies, to qualify for recognition if they have
the sufficient authority to conduct accreditation activities. This
includes adequate authority to access records; to conduct onsite
performance assessments, reassessments, and surveillance; and to grant,
modify, and remove accreditation status.
    ISO/IEC 17011:2004 (Ref. 18) contains similar requirements for
bodies accrediting third-party auditors/certification bodies for
product and management system certification. Clause 4.1 requires
accreditation bodies to be registered legal entities and explains that
governmental accreditation bodies are considered legal entities because
of their governmental status. Clause 4.2.2 states that accreditation
bodies must have the authority and responsibility to decide on
granting, maintaining, extending, reducing, suspending, and withdrawing
accreditation.\22\
---------------------------------------------------------------------------

    \22\ ISO/IEC 17011:2004 also contains requirements relating to
documentation of the roles and responsibilities of accreditation
body management and personnel involved in accreditation activities.
Matters such as these will be more fully explained in the Model
Accreditation Standards we plan to issue.
---------------------------------------------------------------------------

    Proposed Sec.  1.611(b) would require an accreditation body to
demonstrate that it has the adequate legal authority to meet the
requirements for a recognized accreditation body in proposed Sec. Sec.
1.611 through 1.615, including assessing third-party auditors/
certification bodies for accreditation, monitoring accredited auditors/
certification bodies, perform self-assessments, submitting reports and
notifications to FDA, implementing procedures to protect against
conflicts of interest, establishing and maintaining records, and
following the applicable procedural requirements of our program.
    We are not proposing to require a newly recognized accreditation
body to wait a certain period of time before beginning to conduct
accreditation activities under our program. Its accreditation authority
goes into effect at the moment of recognition. Therefore, we believe
that an accreditation body seeking recognition must demonstrate its
capacity to fulfill the roles and responsibilities of recognition, if
granted. We believe that an accreditation body could meet this
requirement by providing documentation of its authority to perform
activities required by proposed Sec. Sec.  1.611 through 1.615. We
expect this documentation to be provided primarily in the form of
standard language for contracts with eligible entities under the FDA
accredited third-party audits and certification program. However, we
will accept other types of documents (e.g., Standard Operating
Procedures) that can (individually or as part of a set of documents)
demonstrate that the accreditation body has adequate legal authority to
conduct the activities required by proposed Sec.  1.611 through 1.615.
    We invite comment on our proposal to require accreditation bodies
to have demonstrable evidence to support a conclusion that they would
have adequate legal authority to meet our requirements (e.g., authority
to withdraw accreditation for cause), if recognized. We also seek
examples of other types of evidence that might

demonstrate the scope of an applicant's legal authority. For comments
opposing this requirement, we request comment on what, if any,
requirements we should put in place to ensure that an accreditation
body applying to us for recognition would be equipped, upon
recognition, to perform the obligations required under the program.
    c. What competency and capacity must an accreditation body have to
qualify for recognition? (Proposed Sec.  1.612). This rule would
require accreditation bodies seeking recognition to demonstrate
adequate resources to fully implement its accreditation program. Under
proposed Sec.  1.612, an accreditation body must have adequate numbers
of personnel or other agents with relevant knowledge, skills, and
experience to adequately assess and monitor third-party auditors/
certification bodies. The accreditation body also would have to show it
has adequate financial resources for its operations. In the guidance,
we will explain the types of expertise and training we expect to see
when reviewing accreditation body records and conducting onsite
performance assessments. We also will explain the types of
documentation that might be used to demonstrate financial viability.
    ISO/IEC 17011: 2004, clause 6.1 (Ref. 18) requires accreditation
bodies to have a sufficient number of competent personnel (internal and
external) with the educational background, technical qualifications,
training, skills, and experience necessary for the accreditation body's
activities. Clause 4.5.2 requires accreditation bodies to demonstrate
they have financial resource required for accreditation activities.\23\
---------------------------------------------------------------------------

    \23\ ISO/IEC 17011:2004 contains some requirements that are not
applicable to our program. For example, it contains requirements
relating to liability coverage.
---------------------------------------------------------------------------

    Under proposed Sec.  1.612(b) an accreditation body seeking to
qualify for recognition must demonstrate that it has the capability to
adequately assess third-party auditors/certification bodies seeking
accreditation and to monitor accredited auditors/certification bodies
through performance assessments. It also must be capable of submitting
reports and notifications to FDA in the manner we propose and to follow
the procedural requirements under our program. As previously explained,
an accreditation body will be authorized to begin accreditation
activities under our program immediately upon recognition. Therefore,
we need to have adequate assurance of its ability to meet the
competency and capacity requirements of a recognized accreditation body
when deciding whether to grant recognition.
    d. What protections against conflicts of interest must an
accreditation body have to qualify for recognition? (Proposed Sec.
1.613). This proposed rule would require accreditation bodies to have
established programs to safeguard against conflicts of interest that
might compromise their objectivity and independence from third-party
auditors/certification bodies. Proposed Sec.  1.613 would require
accreditation bodies seeking recognition to have written measures to
safeguard against financial conflicts of interest between the
accreditation body (and its officers, personnel, and other agents) and
third-party auditors/certification bodies (and their officers,
personnel, and other agents). Without these conflict of interest
requirements, we believe it would be difficult for an accreditation
body to demonstrate adequate independence in accrediting auditors/
certification bodies, as required under our accredited third-party
auditing and certification program.
    ISO/IEC 17011: 2004, clause 4.3.4 (Ref. 18) requires accreditation
bodies to ensure that personnel and committees that could influence the
accreditation process act objectively and be free from any undue
commercial pressures that could compromise impartiality.\24\
---------------------------------------------------------------------------

    \24\ ISO/IEC 17011 contains additional requirements relating to
opportunities for involvement by interested parties and the manner
in which the accreditation body presents its services. Such matters
are beyond the scope of our program.
---------------------------------------------------------------------------

    Under proposed Sec.  1.613(b), an accreditation body seeking
recognition must demonstrate the capability to meet the conflict of
interest requirements that would apply under Sec.  1.624, upon
recognition. This measure is necessary to help ensure that any
accreditation activities conducted after recognition would be
considered objective and independent under our program.
    e. What quality assurance procedures must an accreditation body
have to qualify for recognition? (Proposed Sec.  1.614). This proposed
rule would require accreditation bodies seeking recognition to have
written quality assurance procedures in place. Proposed Sec.  1.614(a)
requires an accreditation body seeking recognition to have a program
for monitoring and assessing the performance of its officers,
personnel, and other agents and for assessing the effectiveness of its
accreditation program. The program must include procedures for
identifying areas for improvement and quickly executing corrective
actions.
    ISO/IEC 17011 (Ref. 18) requires accreditation bodies to establish
procedures for internal audits (clause 5.7.1) and to identify
nonconformities in its operations (clause 5.5), opportunities for
improvement, and preventive actions to address root causes (clause
5.6). Clause 5.8 requires periodic management reviews.
    Proposed Sec.  1.614(b) requires the accreditation body to
demonstrate it has the capability to meet the quality assurance
requirements of Sec.  1.622, for performing annual self-assessments
against our requirements and reporting the results of such self-
assessments. The guidance we plan to issue will discuss the elements of
an effective quality assurance program for accreditation bodies.
    f. What records procedures must an accreditation body have to
qualify for recognition? (Proposed Sec.  1.615). This proposed rule
would require accreditation bodies seeking recognition to have written
records procedures in place. Under proposed Sec.  1.615(a), an
accreditation body would have to demonstrate that it has written
procedures for establishing, controlling, and retaining records on its
accreditation program and activities. While we are not proposing that
an accreditation body must have retained records for a specified period
of time prior to its recognition, we believe it is necessary for an
accreditation body to have maintained records for such length of time
to allow us to adequately assess its program and performance to
determine whether it is qualified for recognition. The accreditation
body also must maintain records as required by its existing legal
obligations. Our guidance will explain these recordkeeping, document
control, and retention requirements.
    Clause 5.4.1 of ISO/1EC 17011: 2004 (Ref. 18) requires
accreditation bodies to establish procedures for identification,
collection, filing, storage, maintenance, and disposal of records.
Under clause 5.4.2, records procedures must require records to be
retained for a period consistent with the accreditation body's
contractual and legal obligations. The accreditation body must have
procedures to control internal and external documents relating to its
activities, under clause 5.3.\25\
---------------------------------------------------------------------------

    \25\ Requiring accreditation bodies to exert control over
external documents relating to its accreditation activities would be
inconsistent with our program.
---------------------------------------------------------------------------

    Proposed Sec.  1.615(b) would require an accreditation body seeking
recognition to demonstrate its capability to meet the requirements of a
recognized accreditation body. This would include,

for example, capacity for maintaining records for 5 years, which is the
maximum length for which recognition could be granted. It also requires
recognized accreditation bodies to give us access to records on
activities conducted under our program. Clause 4.4 of ISO/IEC 17011:
2004 (Ref. 18) requires accreditation bodies to have adequate
arrangements to maintain the confidentiality of information obtained
through its accreditation activities. Confidential information about a
third-party auditor/certification bodies must not be disclosed without
the written consent of the auditor/certification body unless the law
requires the information to be disclosed without such consent.
Accreditation bodies applying for recognition must demonstrate their
capacity, if recognized, to grant us access to confidential
information, including information contained in records, without prior
written consent of the auditor/certification body involved. Having
access to records relating to accreditation activities (including
confidential information) under this subpart is necessary to ensure the
rigor, credibility, and independence of the program.
3. Requirements for Recognized Accreditation Bodies

  Table 3--Proposed Requirements for Accreditation Bodies Recognized by
                                   FDA
------------------------------------------------------------------------
 Proposed Rule Section                        Title
------------------------------------------------------------------------
1.620..................  How must a recognized accreditation body assess
                          third-party auditors/certification bodies
                          seeking accreditation?
1.621..................  How must a recognized accreditation body
                          monitor the performance of auditors/
                          certification bodies it accredits?
1.622..................  How must a recognized accreditation body
                          monitor its own performance?
1.623..................  What reports and notifications must a
                          recognized accreditation body submit to FDA?
1.624..................  How must a recognized accreditation body
                          protect against conflicts of interest?
1.625..................  What records requirements must a recognized
                          accreditation body meet?
------------------------------------------------------------------------

    Proposed Sec. Sec.  1.620 through 1.625 contain the requirements
that a recognized accreditation body would have to meet when conducting
activities under our program.
    a. How must a recognized accreditation body assess third-party
auditors/certification bodies seeking accreditation? (Proposed Sec.
1.620). This proposed rule would establish criteria and procedures a
recognized accreditation body must use in assessing third-party
auditors/certification bodies for accreditation.
    Proposed Sec.  1.620(a)(1) requires a recognized accreditation body
to assess foreign governments/agencies by evaluating the food safety
programs, systems, and standards of the government/agency to determine
that the government/agency meets the eligibility requirements for
accreditation under Sec.  1.640(b), except where the criteria for
direct accreditation in proposed Sec.  1.670(a) are met.\26\ Proposed
Sec.  1.620(a)(2) requires a recognized accreditation body to assess
the internal systems and the training and qualifications of audit
agents used by a foreign cooperative or other third party to determine
that the cooperative/party meets the eligibility requirements for
accreditation under Sec.  1.640(c).
---------------------------------------------------------------------------

    \26\ Under section 808(b)(1)(A)(ii) of the FD&C Act, we may
begin to directly accredit third-party auditors/certification bodies
if we have not identified and recognized an accreditation body to
meet the requirements of the section within 2 years after
establishing the system.
---------------------------------------------------------------------------

    Proposed Sec.  1.620(a)(1) and (a)(2) are based on section
808(c)(1) to (c)(3) of the FD&C Act, which distinguishes between the
assessments of foreign governments/agencies and the assessments for
foreign cooperatives/other third parties seeking accreditation. They
also require a recognized accreditation body to assess any third-party
auditor/certification body under the model accreditation standards we
must issue under section 808(b)(2) of the FD&C Act. The model
accreditation standards will specify the authority, competency,
capacity, impartiality, quality assurance, and records that a third-
party auditor/certification body must have to qualify for accreditation
under our program.
    Proposed Sec.  1.620(a)(3) requires recognized accreditation bodies
to observe a statistically significant number \27\ of onsite food
safety audits by a third-party auditor/certification body (or its audit
agents) seeking accreditation. Correspondingly, ISO/IEC 17011: 2004,
clause 7.7.3 (Ref. 18) requires an accreditation body's assessment team
to witness the performance of a representative number of staff to
provide assurance of the auditor's/certification body's competency.
---------------------------------------------------------------------------

    \27\ Generally speaking, we consider ``statistical
significance'' to be an interpretation of statistical data
indicating that an occurrence was likely the result of a causative
factor and not simply a chance result. With observations of a
statistically significant number of accredited auditors/
certification bodies, recognized accreditation bodies will be able
to exert an appropriate degree of oversight of its accredited
auditors/certification bodies, using the data to help determine
whether its accreditation program and activities are functioning
appropriately.
---------------------------------------------------------------------------

    Proposed Sec.  1.620(b) requires a recognized accreditation body to
impose three conditions on any accreditation under this program as
follows:
     The third-party auditor/certification body must comply
with the audit reporting requirements contained in proposed Sec.
1.656, which is drawn from section 808(c)(3) of the FD&C Act (which
makes it a condition of accreditation to prepare consultative audit
reports within 45 days after conducting an audit and, for regulatory
audits, to submit an audit report within 45 days after conducting an
audit).
     The third-party auditor/certification body must agree to
submit electronic certifications to FDA, where appropriate based on the
results of a regulatory audit. Under section 808(c)(2)(A) of the FD&C
Act, we have tentatively concluded that submission of electronic
certification (as opposed to paper certification) is appropriate for
the following reasons:
    [cir] It would be too time-consuming and resource intensive to
review paper-based facility certifications and might result delays that
would frustrate the purpose of the VQIP program for expedited review
and entry of products; and
    [cir] Requiring submission and manual review of paper food and
facility certifications would undermine to our efforts to use robust,
integrated databases to replace manual review, analysis, and reporting
of data.
     A third-party auditor/certification body would have to
comply with the requirement in section 808(c)(4)(A) of the FD&C Act to
notify us immediately upon discovering, during a food safety audit, a
condition that could cause or contribute to a serious risk to the
public health, as a condition of its accreditation. Having timely
notification of such risks directly affects our ability to respond
rapidly to protect the public health. We believe this notification

requirement is of such a critical nature that, we are proposing to
require compliance as a condition of accreditation. We seek comment on
our tentative conclusion to require compliance with section
808(c)(4)(A) of the FD&C Act a condition of accreditation.
    Proposed Sec.  1.620(c) requires recognized accreditation bodies to
maintain records relating to its accreditation activities under the
program. These include records on any denial of accreditation and on
any withdrawal, suspension, or decision to reduce the scope of an
accreditation for cause.\28\ Such records must include the name and
contact information for such certification body, the scope of
accreditation denied, withdrawn, suspended, or reduced, and the basis
for the action. Having access to records on denials of accreditation
and actions taken due to nonconformities will help us in assessing the
performance of the recognized accreditation body and also will allow us
to determine whether poorly performing third-party auditors/
certification bodies are attempting to ``shop'' for favorable
accreditation decisions elsewhere. Both are important for our oversight
of the program.
---------------------------------------------------------------------------

    \28\ Denial, withdrawal, suspension, and reduction in scope of
accreditation differ from voluntary relinquishment of accreditation
under proposed Sec.  1.665, which is an action taken on the
initiative of the auditor/certification body and is not based on a
finding of nonconformity by its accreditation body.