[Federal Register Volume 80, Number 228 (Friday, November 27, 2015)]
[Rules and Regulations]
[Pages 74569-74667]
[FR Doc No: 2015-28160]

Vol. 80

Friday,

No. 228

November 27, 2015

Part IV

Department of Health and Human Services

-----------------------------------------------------------------------

 Food and Drug Administration

-----------------------------------------------------------------------

21 CFR Parts 1, 11, and 16

 Accreditation of Third-Party Certification Bodies To Conduct Food
Safety Audits and To Issue Certifications; Final Rule

Federal Register / Vol. 80 , No. 228 / Friday, November 27, 2015 /
Rules and Regulations

-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 1, 11, and 16

[Docket No. FDA-2011-N-0146]
RIN 0910-AG66

Accreditation of Third-Party Certification Bodies To Conduct Food
Safety Audits and To Issue Certifications

AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or we) is adopting
regulations to provide for accreditation of third-party certification
bodies to conduct food safety audits of foreign food entities,
including registered foreign food facilities, and to issue food and
facility certifications, under the FDA Food Safety Modernization Act
(FSMA). These certifications will be required for participation in the
voluntary qualified importer program (VQIP) established under the
Federal Food, Drug, and Cosmetic Act (FD&C Act). In addition, when the
Agency has determined that an imported food is subject to certification
under FSMA, the Agency may require a certification under this rule as a
condition for admitting the food into the United States. FDA also
expects that these regulations will increase efficiency by reducing the
number of redundant food safety audits.

DATES: This rule is effective January 26, 2016.

FOR FURTHER INFORMATION CONTACT: Charlotte A. Christin, Office of Foods
and Veterinary Medicine, Food and Drug Administration, 10903 New
Hampshire Ave., Silver Spring, MD 20993,<PHONE_NUMBER>.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary
I. Introduction and Background
    A. FDA Food Safety Modernization Act
    B. Purpose of This Rulemaking
    C. The Proposed Rule
    D. Public Comments
II. Legal Authority
III. Comments on What Definitions Apply to This Subpart (Sec.
1.600)
    A. Definitions, Generally
    B. Assessment
    C. Audit
    D. Audit Agent
    E. Consultative Audit
    F. Eligible Entity
    G. Facility
    H. Facility Certification and Food Certification
    I. Food
    J. Food Safety Audit
    K. Foreign Cooperative
    L. Regulatory Audit
    M. Self-Assessment
    N. Third-Party Auditor
IV. Comments on Who Is Subject to This Subpart (Sec.  1.601)
    A. Limiting the Scope of the Rule to Regulatory Audits and
Certifications
    B. Exemption for Alcoholic Beverages
    C. USDA Regulated Products
V. Comments on Recognition of Accreditation Bodies Under This
Subpart
    A. Who is eligible to seek recognition? (Sec.  1.610)
    B. What legal authority must an accreditation body have to
qualify for recognition? (Sec.  1.611)
    C. What competency and capacity must an accreditation body have
to qualify for recognition? (Sec.  1.612)
    D. What protections against conflicts of interest must an
accreditation body have to qualify for recognition? (Sec.  1.613)
    E. What quality assurance procedures must an accreditation body
have to qualify for recognition? (Sec.  1.614)
    F. What records procedures must an accreditation body have to
qualify for recognition? (Sec.  1.615)
VI. Comments on Requirements for Accreditation Bodies That Have Been
Recognized Under This Subpart
    A. How must a recognized accreditation body evaluate third-party
certification bodies seeking accreditation? (Sec.  1.620)
    B. How must a recognized accreditation body monitor the
performance of third-party certification bodies it accredited?
(Sec.  1.621)
    C. How must a recognized accreditation body monitor its own
performance? (Sec.  1.622)
    D. What reports and notifications must a recognized
accreditation body submit to FDA? (Sec.  1.623)
    E. How must a recognized accreditation body protect against
conflicts of interest? (Sec.  1.624)
    F. What records requirements must an accreditation body that has
been recognized meet? (Sec.  1.625)
VII. Comments on Procedures for Recognition of Accreditation Bodies
Under This Subpart
    A. How do I apply to FDA for recognition or renewal of
recognition? (Sec.  1.630)
    B. How will FDA review my application for recognition or for
renewal of recognition and what happens once FDA decides on my
application? (Sec.  1.631)
    C. What is the duration of recognition? (Sec.  1.632)
    D. How will FDA monitor recognized accreditation bodies? (Sec.
1.633)
    E. When will FDA revoke recognition? (Sec.  1.634)
    F. What if I want to voluntarily relinquish recognition or do
not want to renew recognition? (Sec.  1.635)
    G. How do I request reinstatement of recognition? (Sec.  1.636)
VIII. Comments on Accreditation of Third-Party Certification Bodies
Under This Subpart
    A. Who is eligible to seek accreditation? (Sec.  1.640)
    B. What legal authority must a third-party certification body
have to qualify for accreditation? (Sec.  1.641)
    C. What competency and capacity must a third-party certification
body have to qualify for accreditation? (Sec.  1.642)
    D. What protections against conflicts of interest must a third-
party certification body have to qualify for accreditation? (Sec.
1.643)
    E. What quality assurance procedures must a third-party
certification body have to qualify for accreditation? (Sec.  1.644)
    F. What records procedures must a third-party certification body
have to qualify for accreditation? (Sec.  1.645)
IX. Comments on Requirements for Third-Party Certification Bodies
That Have Been Accredited Under This Subpart
    A. How must an accredited third-party certification body ensure
its audit agents are competent and objective? (Sec.  1.650)
    B. How must an accredited third-party certification body conduct
a food safety audit of an eligible entity? (Sec.  1.651)
    C. What must an accredited third-party certification body
include in food safety audit reports? (Sec.  1.652)
    D. What must an accredited third-party certification body do
when issuing food or facility certifications? (Sec.  1.653)
    E. When must an accredited third-party certification body
monitor an eligible entity that it has issued a food or facility
certification? (Sec.  1.654)
    F. How must an accredited third-party certification body monitor
its own performance? (Sec.  1.655)
    G. What reports and notifications must an accredited third-party
certification body submit? (Sec.  1.656)
    H. How must an accredited third-party certification body protect
against conflicts of interest? (Sec.  1.657)
    I. What records requirements must a third-party certification
body that has been accredited meet? (Sec.  1.658)
X. Comments on Procedures for Accreditation of Third-Party
Certification Bodies Under This Subpart
    A. Where do I apply for accreditation or renewal of
accreditation by a recognized accreditation body and what happens
once the recognized accreditation body decides on my application?
(Sec.  1.660)
    B. What is the duration of accreditation by a recognized
accreditation body? (Sec.  1.661)
    C. How will FDA monitor accredited third-party certification
bodies? (Sec.  1.662)
    D. How do I request an FDA waiver or waiver extension for the
13-month limit for audit agents conducting regulatory audits? (Sec.
1.663)
    E. When would FDA withdraw accreditation? (Sec.  1.664)
    F. What if I want to voluntarily relinquish accreditation or do
not want to renew accreditation? (Sec.  1.665)
    G. How do I request reaccreditation? (Sec.  1.666)

XI. Comments on Additional Procedures for Direct Accreditation of
Third-Party Certification Bodies Under This Subpart
    A. How do I apply to FDA for direct accreditation or renewal of
direct accreditation? (Sec.  1.670)
    B. How will FDA review my application for direct accreditation
or renewal of direct accreditation and what happens once FDA decides
on my application? (Sec.  1.671)
    C. What is the duration of direct accreditation? (Sec.  1.672)
XII. Comments on Requirements for Eligible Entities Under This
Subpart
    A. How and when will FDA monitor eligible entities? (Sec.
1.680)
    B. How frequently must eligible entities be recertified? (Sec.
1.681)
XIII. Comments on General Requirements of This Subpart
    A. How will FDA make information about recognized accreditation
bodies and accredited third-party certification bodies available to
the public? (Sec.  1.690)
    B. How do I request reconsideration of a denial by FDA of an
application or a waiver request? (Sec.  1.691)
    C. How do I request internal agency review of a denial of an
application or waiver request upon reconsideration? (Sec.  1.692)
    D. How do I request a regulatory hearing on a revocation of
recognition or withdrawal of accreditation? (Sec.  1.693)
    E. Are electronic records created under this subpart subject to
the electronic records requirements of part 11? (Sec.  1.694)
    F. Are the records obtained by FDA under this subpart subject to
public disclosure? (Sec.  1.695)
    G. May importers use reports of regulatory audits by accredited
certification bodies for purposes of subpart L of this part? (Sec.
1.698)
XIV. Editorial and Conforming Changes
XV. Executive Order 13175
XVI. Analysis of Economic Impact
XVII. Paperwork Reduction Act of 1995
XVIII. Analysis of Environmental Impact
XIX. Federalism
XX. References

Executive Summary

Purpose and Coverage of the Final Rule

    This rule is part of FDA's implementation of FSMA, which intends to
better protect public health by, among other things, adopting a modern,
preventive, and risk-based approach to food safety regulation. In this
document, we establish a program for accreditation of third-party
certification bodies \1\ to conduct food safety audits and issue
certifications of foreign food facilities and foods for humans and
animals for purposes of sections 801(q) and 806 of the FD&C Act. We are
also codifying certain limited exemptions to mandatory import
certification under 801(q) of the FD&C Act (21 U.S.C. 381).
---------------------------------------------------------------------------

    \1\ As explained more fully in Response 1, in response to
comments and for clarity, this final rule uses the term ``third-
party certification body'' rather than either the term ``third-party
auditor'' or the term, ``third party auditor/certification body''
(except that we will use the term ``third-party auditor'' in the
definitions of ``accredited third-party certification body'' and
``third-party certification body'' in 21 CFR 1.600(c) and in the
preamble discussion of those definitions in section III.A).
---------------------------------------------------------------------------

    FSMA added section 808 to the FD&C Act (21 U.S.C. 384d), which
directs FDA to establish a new program for accreditation of third-party
certification bodies to conduct food safety audits and to certify that
eligible foreign entities (including registered foreign food
facilities) and food produced by such entities meet applicable FDA
requirements for purposes of sections 801(q) and 806 of the FD&C Act.
This rulemaking implements section 808 of the FD&C Act; we will
recognize accreditation bodies to accredit third-party certification
bodies, except for limited circumstances in which we may directly
accredit third-party certification bodies.
    FSMA specifies two uses for the food and facility certifications
issued by accredited third-party certification bodies under this
program. First, facility certifications will be used by importers to
establish eligibility for VQIP under section 806 of the FD&C Act (21
U.S.C. 384b(a)). VQIP offers participating importers expedited review
and entry of food that is part of VQIP. One condition of participation
is importation of food from facilities audited and certified by third-
party certification bodies accredited under this subpart. FDA issued
draft guidance on VQIP on June 5, 2015 (80 FR 32136); the draft
guidance may be accessed at http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf.
    Second, section 801(q) of the FD&C Act gives FDA the authority to
make a risk-based determination to require, as a condition of
admissibility, that a food imported or offered for import into the
United States be accompanied by a certification or other assurance that
the food meets the applicable requirements of the FD&C Act. The
authority to mandate import certification for food, based on risk, is
one of the tools we can use to help prevent potentially harmful food
from reaching U.S. consumers. When FDA has determined that a food
import is subject to such certification under section 801(q) of the
FD&C Act, FDA will require, as a condition of entry, a certification
issued either by an accredited third-party certification body under
this rule or by an agency or representative of the government of the
country from which the food at issue originated, as designated by FDA.
    In addition, facilities and importers may choose to use onsite
audits conducted by third-party certification bodies accredited under
the program set out in this rule in connection with meeting supplier
verification requirements under FDA's final rules for Current Good
Manufacturing Practice and Hazard Analysis and Risk-Based Preventive
Controls for Human Food (final human preventive controls regulation)
(80 FR55907, September 17, 2015); Current Good Manufacturing Practice
and Hazard Analysis and Risk-Based Preventive Controls for Food for
Animals (final animal preventive controls regulation) (80 FR 56169,
September 17, 2015); and the Foreign Supplier Verification Programs
(FSVP) for Importers of Food for Humans and Animals (published
elsewhere in this edition of the Federal Register) (implementing
sections 418 and 805 of the FD&C Act, respectively). Under those rules,
in circumstances where an onsite audit is the appropriate supplier
verification activity, such audit must be conducted by a ``qualified
auditor.'' The definitions of ``qualified auditor'' in those rules make
clear that an example of a potential qualified auditor includes, but is
not limited to, an audit agent of a certification body that has been
accredited in accordance with regulations in part 1, subpart M of this
chapter (i.e., this rule implementing section 808 of the FD&C Act).

Summary of Major Provisions of the Final Rule

    This rule establishes the framework, procedures, and requirements
for accreditation bodies and third-party certification bodies for
purposes of section 808 of the FD&C Act. The rule sets requirements for
the legal authority, competency, capacity, conflict of interest
safeguards, quality assurance, and records procedures that
accreditation bodies must demonstrate to be eligible for recognition.
Accreditation bodies also must demonstrate capability to meet the FDA
requirements that would apply upon recognition. Additionally, the rule
establishes requirements for the legal authority, competency, capacity,
conflict of interest safeguards, quality assurance, and records
procedures that third-party certification bodies must demonstrate to be
eligible for accreditation. Third-party certification bodies also must
demonstrate capability to meet the applicable requirements of the rule
that would apply upon accreditation.
    Pursuant to FSMA section 307 (21 U.S.C. 384d), the rule requires
accredited third-party certification

bodies to perform unannounced facility audits, to notify FDA upon
discovering a condition that could cause or contribute to a serious
risk to the public health, and to submit to FDA reports of regulatory
audits conducted for certification purposes. The rule includes
stringent requirements to prevent conflicts of interest from
influencing the decisions of recognized accreditation bodies and
accredited third-party certification bodies. The rule does not,
however, establish the audit criteria that accredited third-party
certification bodies will use in examining eligible entities for
compliance with the applicable food safety requirements of the FD&C Act
and FDA regulations, because those criteria appear elsewhere in FDA
regulations and the FD&C Act.

Costs and Benefits

    Costs of the Third-Party final rule include compliance costs of
accreditation bodies and certification bodies that choose to
participate in our third-party program, and user fees imposed by FDA on
accreditation bodies and certification bodies for application review
and monitoring of program participants.

  Table 1--Summary User Fee, Compliance, Undiscounted and Annualized Costs of the Third-Party (TP) Program per
                                                   Participant
----------------------------------------------------------------------------------------------------------------
                                                                    Audited by
                                                     ----------------------------------------
                                                         Certification
                   Eligible entity                       bodies (CBs)                                Total
                                                           currently      CBs not accredited
                                                       accredited under    under any program
                                                        other programs
----------------------------------------------------------------------------------------------------------------
                                                   SCENARIO 1
----------------------------------------------------------------------------------------------------------------
Number of section 801(q) Entities...................                  10                  65                  75
Cost of Compliance with Program Requirements (TP                    $694              $2,569  ..................
 Compliance Cost)...................................
Section 801(q) Compliance Cost......................              $6,940            $166,985            $173,925
Number of section 806 Entities......................                 145                 971               1,116
TP Compliance Cost..................................                $694              $2,569  ..................
Section 806 Compliance Cost.........................            $100,630          $2,494,499          $2,595,129
                                                     -----------------------------------------------------------
    Total TP Compliance Cost--Scenario 1............  ..................  ..................          $2,769,054
----------------------------------------------------------------------------------------------------------------
                                                   SCENARIO 2
----------------------------------------------------------------------------------------------------------------
Number of section 801(q) Entities...................                  10                  65                  75
TP Compliance Cost..................................                $322              $2,197  ..................
Section 801(q) Compliance Cost......................              $3,220            $142,805            $146,025
Number of Sec.   806 Entities.......................                 459               3,068               3,527
TP Compliance Cost..................................                $322              $2,197  ..................
Section 806 Compliance Cost.........................            $147,798          $6,740,396          $6,888,194
                                                     -----------------------------------------------------------
    Total TP Compliance Cost--Scenario 2............  ..................  ..................          $7,034,219
----------------------------------------------------------------------------------------------------------------
                                                   SCENARIO 3
----------------------------------------------------------------------------------------------------------------
Number of section 801(q) Entities...................                  10                  65                  75
TP Compliance Cost..................................                $227              $2,102  ..................
Section 801(q) Compliance Cost......................              $2,270            $136,630            $138,900
Number of section 806 Entities......................                 801               5,359               6,160
TP Compliance Cost..................................                $227              $2,102  ..................
Section 806 Compliance Cost.........................            $181,827         $11,264,618         $11,446,445
                                                     -----------------------------------------------------------
    Total TP Compliance Cost--Scenario 3............  ..................  ..................         $11,585,345
----------------------------------------------------------------------------------------------------------------

    The costs that accreditation bodies and certification bodies incur
in complying with the regulation are necessarily less than the private
benefits they accrue by becoming recognized or accredited,
respectively. Through the third-party accreditation program more
effective regulatory oversight is achieved. FDA will recoup resources
in managing its third-party accreditation program through user fees
that FDA intends to impose on participating accreditation bodies and
third-party certification bodies.

I. Introduction and Background

A. FDA Food Safety Modernization Act

    FSMA (Pub. L. 111-353), signed into law by President Obama on
January 4, 2011, is intended to allow FDA to better protect public
health by helping to ensure the safety and security of the food supply.
FSMA enables us to focus more on preventing food safety problems rather
than relying primarily on reacting to problems after they occur. The
law also provides new enforcement authorities to help achieve higher
rates of compliance with risk-based, prevention-oriented safety
standards and to better respond to and contain problems when they do
occur. In addition, the law contains important new tools to better
ensure the safety of imported foods and encourages partnerships with
State, local, tribal, and territorial authorities and international
collaborations with foreign regulatory counterparts. A top priority for
FDA are those FSMA-required regulations that provide the framework for
industry's implementation of preventive controls and enhance our
ability to oversee their implementation for both domestic and imported
food. To that end, we proposed the seven foundational rules listed in
table 2 and

requested comments on all aspects of these proposed rules.

                    Table 2--Published Foundational Proposed Rules for Implementation of FSMA
----------------------------------------------------------------------------------------------------------------
                Title                        Abbreviation                          Publication
----------------------------------------------------------------------------------------------------------------
Current Good Manufacturing Practice    2013 proposed human      78 FR 3646, January 16, 2013.
 and Hazard Analysis and Risk-Based     preventive controls
 Preventive Controls for Human Food.    regulation.
Standards for the Growing,             2013 proposed produce    78 FR 3504, January 16, 2013.
 Harvesting, Packing, and Holding of    safety regulation.
 Produce for Human Consumption.
Current Good Manufacturing Practice    2013 proposed animal     78 FR 64736, October 29, 2013.
 and Hazard Analysis and Risk-Based     preventive controls
 Preventive Controls for Food for       regulation.
 Animals.
Foreign Supplier Verification          2013 proposed FSVP       78 FR 45730, July 29, 2013.
 Programs (FSVP) for Importers of       regulation.
 Food for Humans and Animals.
Accreditation of Third-Party Auditors/ 2013 proposed third-     78 FR 45782, July 29, 2013.
 Certification Bodies to Conduct Food   party certification
 Safety Audits and to Issue             regulation (also
 Certifications.                        referred to in this
                                        document as the
                                        proposed rule).
Focused Mitigation Strategies To       2013 proposed            78 FR 78014, December 24, 2013.
 Protect Food Against Intentional       intentional
 Adulteration.                          adulteration
                                        regulation.
Sanitary Transportation of Human and   2014 proposed sanitary   79 FR 7006, February 5, 2014.
 Animal Food.                           transportation
                                        regulation.
----------------------------------------------------------------------------------------------------------------

    We also issued a supplemental notice of proposed rulemaking for the
rules listed in table 3 and requested comments on specific issues
identified in each supplemental notice of proposed rulemaking.

 Table 3--Published Supplemental Notices of Proposed Rulemaking for the Foundational Rules for Implementation of
                                                      FSMA
----------------------------------------------------------------------------------------------------------------
                Title                        Abbreviation                          Publication
----------------------------------------------------------------------------------------------------------------
Current Good Manufacturing Practice    2014 supplemental human  79 FR 58524, September 29, 2014.
 and Hazard Analysis and Risk-Based     preventive controls
 Preventive Controls for Human Food.    notice.
Standards for the Growing,             2014 supplemental        79 FR 58434, September 29, 2014.
 Harvesting, Packing, and Holding of    produce safety notice.
 Produce for Human Consumption.
Current Good Manufacturing Practice    2014 supplemental        79 FR 58476, September 29, 2014.
 and Hazard Analysis and Risk-Based     animal preventive
 Preventive Controls for Food for       controls notice.
 Animals.
FSVP for Importers of Food for Humans  2014 supplemental FSVP   79 FR 58574, September 29, 2014.
 and Animals.                           notice.
----------------------------------------------------------------------------------------------------------------

    We finalized two of the foundational rulemakings listed in table 4
in September 2015.

                     Table 4--Published Foundational Final Rules for Implementation of FSMA
----------------------------------------------------------------------------------------------------------------
                Title                        Abbreviation                          Publication
----------------------------------------------------------------------------------------------------------------
Current Good Manufacturing Practice    final human preventive   80 FR 55908, September 17, 2015.
 and Hazard Analysis and Risk-Based     controls regulation.
 Preventive Controls for Human Food.
Current Good Manufacturing Practice    final animal preventive  80 FR 56170, September 17, 2015.
 and Hazard Analysis and Risk-Based     controls regulation.
 Preventive Controls for Food for
 Animals.
----------------------------------------------------------------------------------------------------------------

    As FDA finalizes these seven foundational rulemakings, we are
putting in place a modern, risk-based framework for food safety that is
based on the most recent science, that focuses efforts where the
hazards are reasonably likely to occur, and that is flexible and
practical given our current knowledge of food safety practices. To
achieve this, FDA has engaged in a significant amount of outreach to
the stakeholder community to find the right balance between flexibility
and accountability in these regulations.
    After FSMA was enacted in 2011, we have been involved in
approximately 600 stakeholder engagements on FSMA and the proposed
rules, including public meetings, webinars, listening sessions, farm
tours, and extensive presentations and meetings with various
stakeholder groups (Refs. 1, 2, 3). As a result of this stakeholder
dialogue, FDA decided to issue the four supplemental notices of
proposed rulemaking to share our current thinking on key issues and get
additional stakeholder input on those issues. As we move forward into
the next phase of FSMA implementation, we intend to continue this
dialogue and collaboration with our stakeholders, through guidance,
education, training, and assistance, to ensure that stakeholders
understand and engage in their respective roles in food safety. FDA
believes these seven foundational final rules, when implemented, will
affect the paradigm shift toward prevention that was envisioned in FSMA
and be a major step forward for food safety that will help protect
consumers into the future.

B. Purpose of This Rulemaking

    FSMA added section 808 to the FD&C Act which directs FDA to
establish a new voluntary program for accreditation of third-party
certification bodies to conduct food safety audits and to issue food
and facility certifications to eligible foreign entities (including
registered foreign food facilities) that meet our applicable
requirements for purposes of sections 801(q) and 806 of the FD&C Act.
This rulemaking implements section 808 of the FD&C Act; we will
recognize accreditation bodies to accredit third-party certification
bodies, except for limited circumstances in which we may directly
accredit third-party certification bodies.
    FSMA specifies two uses for the food and facility certifications
issued by accredited third-party certification bodies under this
program. First, facility certifications will be used by importers to
establish eligibility for VQIP under section 806 of the FD&C Act. VQIP
offers participating importers expedited review and importation for
food from facilities audited and certified by third-party certification
bodies accredited under this subpart. FDA issued draft guidance on VQIP
on June 5, 2015 (80 FR 32136); the draft guidance may be accessed at
http://www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM448558.pdf.
    Second, section 801(q) of the FD&C Act gives FDA the authority to
make a risk-based determination to require, as a condition of
admissibility, that a food imported or offered for import into the
United States be accompanied by a certification or other assurance that
the food meets the applicable requirements of the FD&C Act. The
authority to mandate import certification for food, based on risk, is
one of the tools we can use to help prevent potentially harmful food
from reaching U.S. consumers. When FDA has determined that a food
import is subject to such certification under section 801(q) of the
FD&C Act, FDA will require, as a condition of entry, a certification
issued either by an accredited third-party certification body under
this rule or by an agency or representative of the government of the
country from which the food at issue originated, as designated by FDA.
    This final rule will help FDA ensure the competence and
independence of third-party certification bodies who are accredited to
conduct foreign food safety audits to examine compliance with the
applicable food safety requirements of the FD&C Act and FDA
regulations, among other things. The document also will help ensure the
validity and reliability of certifications offered to FDA for purposes
of VQIP eligibility under section 806 of the FD&C Act and admissibility
of an imported food subject to an FDA risk determination under section
801(q) of the FD&C Act.
    The third-party certification program is part of FSMA's paradigm
shift toward a modern, preventive, and risk-based approach to food
safety regulation and new programs to facilitate global trade in safe
food. Specifically, FSMA requires FDA to issue new preventive controls
and produce safety standards that apply to domestic and foreign
processors and producers. In addition, FSMA directs FDA to issue an
FSVP regulation requiring importers to implement FSVPs that provide
adequate assurances that their foreign suppliers produce food that is
in compliance with processes and procedures, including risk-based
preventive controls, that provide the same level of public health
protection as those required under section 418 (concerning hazard
analysis and preventive controls) or 419 (concerning produce safety) of
the FD&C Act, as appropriate, and that is in compliance with sections
402 (concerning adulteration) and 403(w) (concerning misbranding
regarding allergen labeling) of the FD&C Act. We emphasize that
facilities and importers are not required to use third-party
certification bodies accredited under this rule in meeting their
supplier verification requirements under the final human or animal
preventive controls or FSVP regulations. See section XIII.G.
    By contrast, the third-party certification program established
under section 808 of the FD&C Act focuses on food safety audits to
certify that eligible foreign entities and the food produced by such
entities meet applicable FDA requirements for purposes of sections
801(q) and 806 of the FD&C Act. Although importers must obtain facility
certifications from accredited third-party certification bodies under
this rule in order to be eligible for VQIP, we note that importers
seeking to satisfy a requirement for certification as a condition of
admissibility for an article of food under section 801(q) of the FD&C
Act may offer a certification issued either by foreign governments
designated by FDA to issue such certifications or by third-party
certification bodies accredited under this rule.
    Through FSMA we are transforming our role in the global food safety
system, by building ever stronger partnerships with our foreign
regulatory counterparts and by exploring opportunities to leverage
private food safety activities to benefit of our system of public food
safety assurances. We value the role that private audits can play in
enhancing food safety when done properly, and we share common purpose
with the food industry in ensuring the rigor and objectivity of those
audits.
    The final rule on accreditation of third-party certification bodies
reflects the results of significant stakeholder engagement to help
ensure that the rule achieves its public health goal, reflects industry
best practices, and strikes the right balance between flexibility and
accountability.

C. The Proposed Rule

    FDA published a proposed rule for ``Accreditation of Third-Party
Auditors/Certification Bodies to Conduct Food Safety Audits and to
Issue Certifications'' (the proposed rule) on July 29, 2013. The
proposed rule included eligibility requirements for accreditation
bodies to qualify for recognition and requirements that accreditation
bodies choosing to participate in the FDA program must meet, once
recognized. We also proposed eligibility requirements for third-party
certification bodies to qualify for accreditation and requirements that
third-party certification bodies choosing to participate in the FDA
program must meet, once accredited. We intended the proposed
requirements to ensure the competency and independence of the
accreditation bodies and third-party certification bodies participating
in the program.
    We also proposed procedures for recognition and accreditation, as
well as requirements relating to monitoring and oversight of
participating accreditation bodies and third-party certification
bodies. These included procedures that we would follow when removing a
third-party certification body or an accreditation body from the
program. Further, we proposed requirements relating to auditing and
certification of foreign eligible entities under the program, and for
notifying us of conditions in an audited facility that could cause or
contribute to a serious risk to the public health. In response to
several requests, we extended the proposed rule comment period until
January 27, 2014.

D. Public Comments

    We received over 150 comments from accreditation bodies,
certification bodies, members of the food industry, industry
associations, foreign governments, State governments, public health
organizations, public advocacy

groups, individual consumers, consumer groups, and others. Some
submissions included signatures and statements from multiple
individuals. Taken as a whole, the comments address virtually every
provision of the proposed rule. In the remainder of this document, we
describe the comments that are within the scope of this rulemaking,
respond to them, and explain any revisions we made from the proposed
rule.
    A number of comments focus on the overarching issues of: (1)
Alignment with voluntary consensus standards; (2) the use of private
food safety schemes; (3) the relationship between the third-party
certification program, foreign competent authorities, and FDA's
international activities; and (4) the possible implications of the lack
of qualified auditors on the third-party certification program. We
address these comments generally below.
    We received several comments on the overarching issue of the use of
voluntary international consensus standards issued by the International
Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC), including the following ISO/IEC
standards: ISO/IEC 17000:2004 Conformity assessment--Vocabulary and
general principles (ISO/IEC 17000:2004) (Ref. 4); ISO/IEC 17011:2004,
Conformity assessment--General requirements for accreditation bodies
accrediting conformity assessment bodies (ISO/IEC 17011:2004) (Ref. 5);
ISO/IEC 17021:2011, Conformity assessment--Requirements for bodies
providing audit and certification of management systems (ISO/IEC
17021:2011) (Ref. 6); ISO/IEC 17065:2012, Conformity assessment--
Requirements for bodies certifying products, processes and services
(ISO/IEC 17065:2012) (Ref. 7); and ISO/IEC 19011:2011, Guidelines for
auditing management systems (ISO/IEC 19011:2011) (Ref. 8).
    Some comments support the approach to ISO/IEC standards that we
used when developing the proposed rule; some comments state that the
process for developing these standards makes them unbiased. Other
comments suggest we should place greater reliance on ISO/IEC standards,
including some comments asserting that we should incorporate ISO/IEC
standards by reference into the final rule. These comments encourage us
to follow the example of a proposed rule issued by the Environmental
Protection Agency and entitled, ``Formaldehyde; Third-Party
Certification Framework for the Formaldehyde Standards for Composite
Wood Products'' (78 FR 34795, June 10, 2013), which proposed to
incorporate by reference certain international standards. These
comments assert that by placing greater reliance on ISO standards, we
could allow ISO's broader oversight program to complement FDA's
management of these bodies.
    Implementation of section 808 of the FD&C Act occurs against the
backdrop of the broader Federal policies on consensus standards and
conformity assessment under the National Technology Transfer and
Advancement Act of 1995 (NTTAA) (Pub. L. 104-113). The NTTAA, together
with the Office of Management and Budget (OMB) Circular A-119, revised
February 10, 1998 (63 FR 8546, February 19, 1998), directs Federal
Agencies to use voluntary consensus standards in lieu of government-
unique standards except where inconsistent with law or otherwise
impractical. OMB Circular A-119 states that the use of voluntary
standards, whenever practicable and appropriate, is intended to
eliminate the cost to government of developing its own standards and
decrease the cost of goods procured and the burden of complying with
Agency regulation; provide incentives and opportunities to establish
standards that serve national needs; encourage long-term growth for
U.S. enterprises and promote efficiency and economic competition
through harmonization of standards; and further the policy of reliance
upon the private sector to supply government needs for goods and
services.
    As directed by OMB in Circular A-119, the National Institute of
Standards and Technology (NIST), in the Federal Register of August 10,
2000 (65 FR 48894), issued policy guidance on Federal conformity
assessment activities (defined as activities concerned with determining
directly or indirectly that requirements for products, services,
systems, and organizations are fulfilled) (15 CFR 287.2). The Federal
conformity assessment guidance is codified at 15 CFR part 287 and
applies to all Federal Agencies that set policy for, manage, operate,
or use conformity assessment activities or results, domestically and
internationally (except for activities conducted pursuant to treaties)
and is intended to eliminate unnecessary duplication and complexity in
conformity assessment requirements. (We note that OMB has announced it
is currently revising Circular A-119, and NIST is revising the Federal
conformity assessment guidance.)
    We agree with comments on the value of promoting international
consistency and tapping into an existing framework of consensus
standards that is familiar to industry, which may make it easier for
accreditation bodies, third-party certification bodies, and eligible
entities to comply with this rule. Therefore, we are revising the rule
to allow for accreditation bodies and third-party certification bodies
to use documentation of their conformance with ISO/IEC standards in
meeting the program requirements under this rule, supplemented as
necessary. We are not, however, incorporating these standards by
reference into the rule as further discussed in our responses to
comments in sections III. to XIII., except that we are not further
responding to comments citing specific requirements of ISO/IEC Guide
65:1996, Conformity assessment--Requirements for bodies providing audit
and certification of management systems (ISO/IEC Guide 65:1996) (Ref.
9) in sections III. to XIII., because that standard has been withdrawn
and replaced by ISO/IEC 17065:2012 (Ref. 7) in September 2015. Comments
referring to ISO/IEC 17020:2012, Conformity assessment--Requirements
for the operation of various types of bodies performing inspection
(ISO/IEC 17020:2012) (Ref. 10) are outside the scope of this
rulemaking, because that standard relates to inspections and not the
auditing and certification activities that will be performed under this
rule. Therefore, we are not responding to comments citing to ISO/IEC
17020:2012, Conformity assessment--Requirements for the operation of
various types of bodies performing inspection (ISO/IEC 17020:2012)
(Ref. 10) in sections III. to XIII.
    We also received several comments on the overarching issue of using
private food safety schemes as audit criteria for regulatory audits
conducted under the third-party certification program. Some comments
suggest that FDA should rely on private food safety schemes,
particularly those that have been benchmarked by the Global Food Safety
Initiative (GFSI), as the audit criteria for regulatory audits of
eligible entities under the third-party certification program. Other
comments suggest that FDA should establish requirements for
accreditation bodies and third-party certification bodies that are
similar to those required by GFSI, such as GFSI requirements relating
to accreditation under relevant ISO/IEC product certification or
management system standards.
    By way of background, a group of international retailers
established GFSI in 2000 with the goal of reducing the need for
duplicative third-party audits by benchmarking private food safety
schemes against a harmonized set of

criteria for food safety and management systems (see 78 FR 45782 at
45788; July 29, 2013). Under current GFSI criteria, a food safety
scheme must have a commitment with one or more accreditation bodies for
certification bodies that operate in conformance with either the
product certification standard, ISO/IEC Guide 65, or the management
system standard, ISO/IEC 17021:2006 (supplemented by ISO/TS 22003).
GFSI describes these standards as having similar requirements for how a
certification body must operate--e.g., in addressing issues of
preventing conflict of interest, managing customer information,
properly qualifying personnel, auditor calibration, and many other
aspects involved with the certification process. However, as GFSI noted
in a 2011 White Paper (Ref. 11), there is a distinct difference between
the two. ISO 17021/ISO 22003 is not product specific. ISO/IEC Guide 65,
on the other hand, is concerned with verifying that particular products
or services meet specified requirements. The type and scope of GFSI
benchmarked scheme selected, determines the accreditation standard
which applies. The majority of GFSI recognized schemes fall under ISO/
IEC Guide 65 accreditation requirements, whereas only two currently
recognized schemes are management system schemes accredited to ISO
17021/ISO 22003.
    Comments suggesting that we should rely on GFSI-benchmarked food
safety schemes or other private food safety schemes as the criteria for
certification under the third-party program are outside the scope of
this rulemaking. This rule establishes the framework for the third-
party certification program, and not the food safety standards that
accredited third-party certification bodies will use to determine an
eligible entity's compliance with the applicable food safety
requirements of the FD&C Act and FDA regulations. We are however
responding to relevant comments that address audit quality and auditor
competency, consistency, and capacity, including comments referencing
GFSI's work in these areas.
    Other overarching comments ask how the FSMA third-party
certification program relates to the roles of foreign competent
authorities and to FDA's international activities. Some comments assert
that competent authorities should be allowed to participate in the
third-party certification program purely by administrative procedures
without a formal review process. Other comments suggest that government
agencies with both regulatory and trade promotion missions face
inherent conflicts of interest.
    Some comments recommend that we should establish a different
structure for accrediting third-party certification bodies that already
have been approved by a foreign government accreditation body. Other
comments suggest that FDA should reserve the role of accreditation body
or third-party certification body for a national competent authority
that requests it. The comments argue that the responsibility for
monitoring the safety of food exports should remain with the national
competent authorities in each country.
    Some comments ask whether a national competent authority has a role
in auditing and certification activities occurring in the country,
including in countries where an FDA foreign office is located. Other
comments ask whether the competent authority may perform other
activities in the third-party certification program, such as
authentication of audit information before it is submitted to FDA.
Still other comments suggest that FDA require accredited third-party
certification bodies to review correspondence between an audited
eligible entity and the competent authorities in the country where the
eligible entity is located.
    Section 808 of the FD&C Act expressly provides for both public and
private accredited third-party certification bodies. Public
accreditation bodies and third-party certification bodies, as well as
private accreditation bodies and third-party certification bodies that
meet the eligibility requirements for recognition and accreditation
under section 808 of the FD&C Act and this rule are equally eligible to
participate in the third-party certification program. This includes
government accreditation bodies and certification bodies in countries
where FDA has a foreign office, as well as government agencies with the
dual missions of food safety and trade promotion. We believe that both
public and private third-party certification bodies and accreditation
bodies are capable of exhibiting the competency, capacity, and
impartiality necessary to meet the letter and spirit of the law and
this regulation.
    By becoming an accredited third-party certification body or a
recognized accreditation body, a competent authority for food safety or
a foreign accreditation body would establish a role in the third-party
certification program. Only if competent authorities are accredited
under this rule, may they issue food and facility certifications under
section 808 of the FD&C Act. (We note, however, that FDA may require
certifications from competent authorities under section 801(q) of the
FD&C Act for foods that FDA determines meet the criteria set forth in
that section (see 801(q)(3)(A) of the FD&C Act), regardless of whether
the competent authorities are accredited.) We acknowledge that the
third-party certification program that is the subject of this rule is
narrowly tailored and only a small piece of the much larger modernized,
prevention-oriented food safety system we are establishing under FSMA.
Broader FSMA activities are outside the scope of this rulemaking, as
are matters covered by FDA's information sharing arrangements with
foreign competent authorities.
    We received other comments on the overarching issue of how the
third-party certification program fits into FDA's international
activities. Some comments assert that, for countries with a systems
recognition agreement with FDA, there should be no need for a (direct
or indirect) role for FDA in monitoring accredited third-party
certification bodies. Other comments encourage us to recognize their
national food safety system as equivalent to that of the United States.
    The systems recognition initiative is a food safety regulatory
cooperation program that allows FDA to take into account the role of
food safety systems of exporting countries in our risk-based
decisionmaking. We are using systems recognition as a tool to determine
when we can rely on the implementation of science-based food safety
programs by foreign regulatory authorities and take action based on
information provided by such authorities.
    We note that a competent authority with whom FDA has a systems
recognition agreement must apply for recognition to make accreditation
decisions and apply for accreditation to issue certifications under
section 808 of the FD&C Act. If the competent authority applies for
recognition or direct accreditation by FDA (assuming that the statutory
criteria have been met for FDA to begin direct accreditation), FDA's
review will be informed by the data, experiences, and insights into the
foreign system that FDA gained through the systems recognition review.
Except as described above, systems recognition activities are outside
the scope of this rulemaking, as are equivalency determinations.
    We also received several overarching comments noting that the lack
of qualified food safety auditors is a problem in many countries. Some
comments suggest that we may face similar problems with the
availability of accredited third-party certification

bodies in our program. The comments assert that we should prioritize
the review of applications from foreign countries with significant
volumes of exports to the United States because of the cost and
inconvenience to foreign suppliers and the likely trade disruption that
would result if the only accredited third-party certification bodies
were located in other countries. Some comments predict that rapid
expansion in the field of food safety auditing may result in shortcuts
in auditing. Other comments contend that because of the limited
availability of qualified auditors we should adjust the timeframes for
accredited third-party certification bodies to submit information to
FDA under the regulations. The comments specifically request that we
lengthen the 45-day timeframe for submitting regulatory audit reports.
    We acknowledge the concerns about cost, inconvenience, and
disruption resulting from auditor capacity issues. We are encouraging
broad program participation to minimize the likelihood that capacity
issues might emerge, because certifications issued by accredited third-
party certification bodies under this program are intended to
facilitate trade. The certifications are used in meeting the
eligibility requirements of VQIP for expedited entry of food under
section 806 of the FD&C Act and in satisfying a condition of
admissibility for a food subject an FDA determination under section
801(q) of the FD&C Act.
    Revisions have been made to this rule made in response to comments,
such as allowing accreditation bodies and third-party certification
bodies to use documentation of their conformance with ISO/IEC standards
in support of their applications. We also are modifying our ``first in,
first out'' approach to processing applications, as comments request,
to allow for prioritizing specific applications and requests based on
program needs. We are unable to accommodate the request to lengthen the
timeframe for submission of regulatory audit reports to FDA, because
the 45-day deadline for submission is established in section
808(c)(3)(A) of the FD&C Act. Audit protocols and other requirements of
the rule are designed to prevent audit agents (auditors) and third-
party certification bodies from taking shortcuts that would jeopardize
audit results.
    Some comments addressed the Model Accreditation Standards that FDA
is required to develop under section 808(b)(2) of the FD&C Act for use
in qualifying third-party certification bodies for accreditation. Some
of these comments suggest various criteria to be included in the model
standards. Other comments suggest the proposed rule was ambiguous with
respect to the form of, and manner by which, FDA will establish the
Model Accreditation Standards.
    While the substance of the Model Accreditation Standards is outside
the scope of this rulemaking, we note that on July 24, 2015, FDA
published a draft guidance on Model Accreditation Standards. The draft
guidance can be accessed at: http://www.fda.gov/Food/GuidanceRegulation/GuidancevDocumentsRegulatoryInformation/ucm455328.htm. Additionally, a notice was published in the Federal
Register (80 FR 44137, July 24, 2015) of the availability of the draft
guidance and of the opening of a docket for public comments on the
document. As explained in the draft guidance, section 808(b)(2) of the
FD&C Act requires FDA to develop Model Accreditation Standards that
recognized accreditation bodies shall use to qualify third-party
certification bodies for accreditation, and in so doing, to look to
existing standards for certification bodies (as of the date of
enactment of FSMA) to avoid unnecessary duplication of efforts and
costs. The draft guidance contains FDA recommendations on third-party
certification body qualifications, including recommendations based on
relevant provisions in the proposed rule. This final rule will serve as
a framework for the Model Accreditation Standards final guidance, which
will include more detailed recommendations on third-party certification
body qualifications.
    Some comments respond to our request for input on the question
about the value of, and possible need for, FDA to establish a program
for use of accredited third-party certification bodies to conduct
domestic food safety audits (78 FR 45782 at 45823). We received
comments on all sides, expressing various views. We are taking these
comments under advisement at this time, as the focus of this final rule
is on establishing and implementing the third-party certification
program set forth in section 808 of the FD&C Act.
    Other comments addressed the substance of VQIP, import
certification, laboratory accreditation, and provisions in the proposed
FSVP rule and/or other FMSA rules that are outside the scope of this
rulemaking; accordingly we will not be responding to those comments
here. Other comments that fall outside the scope of this rulemaking,
and to which we will therefore not be responding, include comments on
the value of a universal, mandatory food safety system; comments
advocating for policies promoting locally grown produce; comments
addressing the information technology infrastructure needs of the
third-party certification program; comments suggesting the value of
student interns to the food safety system; and comments on factors
beyond the use of third-party audits that FDA should consider in
setting inspection priorities.
    We also received a few comments concerning the rulemaking process.
Comments suggest that we devise a new process for regularly updating
the rule; they state that FDA has cumbersome requirements for modifying
rules. FDA's current rulemaking process is consistent with FDA's
obligations under the Administrative Procedure Act (5 U.S.C. 551-559).

II. Legal Authority

    Section 307 of FSMA, Accreditation of Third-Party Auditors, amends
the FD&C Act to create a new provision, section 808, under the same
name. Section 808(b)(1)(A) of the FD&C Act requires us to establish a
system, within 2 years of the enactment of FSMA, for the recognition of
accreditation bodies that accredit third-party certification bodies to
conduct food safety audits and to issue certifications for eligible
foreign food entities and their products for purposes of sections
801(q) and 806 of the FD&C Act.
    Section 808(c)(5)(C) of the FD&C Act directs us to issue
implementing regulations for section 808 of the FD&C Act. The
regulations must require audits to be unannounced and must contain
protections against conflicts of interest between accredited third-
party certification bodies (and their audit agents) and the entities
they audit or certify, including requirements on timing and public
disclosure of fees and appropriate limits on financial affiliations (21
U.S.C. 384d(c)(5)(C)(i), (ii), and (iii)).
    This final rule establishes regulations implementing section 808 of
the FD&C Act. The authority for the requirements in this rule comes
primarily from section 808 of the FD&C Act. However, FDA also derives
authority for this final rule from other sections of the FD&C Act,
including section 701(a) of the FD&C Act (21 U.S.C. 371(a)), which
authorizes us to issue regulations for the efficient enforcement of the
FD&C Act. The regulations in this final rule ensure the competency and
independence of recognized accreditation bodies and of accredited
third-party certification bodies, which will help ensure the validity
and reliability of certifications and other information resulting from
the food safety audits conducted by

accredited third-party certification bodies. These features of the
final rule are essential to the operation of the third-party program.
This rule also is consistent with section 404 of FSMA (21 U.S.C. 2252),
which states that nothing in FSMA should be construed in a manner that
is inconsistent with the agreement establishing the World Trade
Organization or any other treaty or international agreement to which
the United States is a party.
    This rule establishes requirements for accreditation bodies and
third-party certification bodies seeking recognition and accreditation,
respectively. These requirements will help ensure that any
accreditation bodies that we recognize, and any certification bodies
that are accredited, are capable of meeting all of the requirements of
this program. This includes requirements, for example, for legal
authority and competency and capacity. It also includes provisions for
the direct accreditation of third-party certification bodies by FDA in
accordance with section 808(b)(1)(A)(ii) of the FD&C Act. This rule
also establishes requirements for accreditation bodies that have been
recognized, and third-party certification bodies that have been
accredited. This includes requirements designed to decrease the
potential for conflicts of interest in accordance with section
808(c)(5)(C)(ii) of the FD&C Act. Additionally, this rule establishes
requirements for eligible entities that want to be certified under this
program. This includes requirements for onsite audits by FDA for the
purpose of monitoring in accordance with section 808(f)(3) of the FD&C
Act. Finally, this rule establishes general requirements related to the
operation of this program. These include requirements for requesting a
regulatory hearing on revocation of recognition or withdrawal of
accreditation.
    Some of the requirements under this final rule are also
established, in part, under the authority in sections 806 and 801(q) of
the FD&C Act. Section 806 of the FD&C Act describes a voluntary program
to provide for the expedited review and importation of food offered for
importation from certified facilities (VQIP). Section 801(q) of the
FD&C Act gives FDA authority to require certifications for imported
food in certain situations. This final rule does not set up the
framework for participation in the program described under section 806
of the FD&C Act, nor does it describe the circumstances under which FDA
might require certification under section 801(q) of the FD&C Act.
However, this rule does describe circumstances under which FDA might
refuse to consider a certification issued under this program in
determining the admissibility of an article of food for which the
certification was offered under section 801(q) of the FD&C Act, or in
determining eligibility for participation in VQIP under section 806 of
the FD&C Act. Additionally, this rule creates limited exemptions from
the certification requirements of section 801(q) of the FD&C Act for
certain alcoholic beverages, including certain raw materials and
ingredients that are used to manufacture/process alcoholic beverages.
The exemptions are being promulgated consistent with section 116 of
FSMA (21 U.S.C. 2206). Section 116(a) of FSMA states that, except as
provided by certain listed sections in FSMA, nothing in FSMA, or the
amendments made by FSMA, will be construed to apply to a facility that:
(1) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986
(26 U.S.C. 5001 et seq.) is required to obtain a permit or to register
with the Secretary of the Treasury as a condition of doing business in
the United States and (2) under section 415 of the FD&C Act (21 U.S.C.
350d) is required to register as a facility because such facility is
engaged in manufacturing, processing, packing, or holding one or more
alcoholic beverages (with respect to the activities of such facility
that relate to the manufacturing, processing, packing, or holding of
alcoholic beverages). This rule also creates exemptions from the
certification requirements of section 801(q) of the FD&C Act for
products subject to the requirements of the U.S. Department of
Agriculture (USDA) under the Federal Meat Inspection Act (FMIA) (21
U.S.C. 601 et seq.), the Poultry Products Inspection Act (PPIA) (21
U.S.C. 451 et seq.), or the Egg Products Inspection Act (EPIA) (21
U.S.C. 1031 et seq.) at the time of importation. We conclude that this
provision is consistent with section 403 of FSMA, entitled ``Rule of
Construction,'' which states that nothing in FSMA shall be construed to
alter or limit the jurisdiction of the Secretary of the Department of
Agriculture.

III. Comments on What Definitions Apply to This Subpart (Sec.  1.600)

    We proposed to codify definitions of several terms used in the
third-party certification regulations. We received several comments on
this section. As discussed in the following paragraphs, we have revised
many of the proposed definitions in response to comments as well as on
our own initiative. Where we disagree with comments or decline a
suggested revision, we offer an explanation in response. Some
definitions were finalized as proposed.
    The definitions for terms used in the third-party certification
regulations are codified in 21 CFR 1.600.

A. Definitions, Generally

    (Comment 1) Several comments encourage us to more closely align the
definitions in Sec.  1.600 with international standards to promote
consistency and common understanding of the rule. The comments explain
that the terms and definitions used in section 808 of the FD&C Act and
in the proposed rule convey a different meaning for accreditation
bodies, certification bodies, and the standards community. To that end,
some comments encourage us to avoid using the term ``third-party
auditor'' synonymously with ``certification body,'' to be consistent
with international standards, which use the term ``certification body''
(e.g., ISO/IEC 17065:2012 (Ref.7).
    Similarly, some comments indicate that, the language of the statute
notwithstanding, it is not correct to use the term ``third-party
auditor'' when describing the activities of a ``third-party
certification body.'' The comments explain that auditors are
individuals contracted or employed by certification bodies to conduct
audits, and they urge us to clarify the rule by substituting
``certification body'' for ``third-party auditor.''
    (Response 1) We agree that alignment with the terminology used in
international standards is preferable, wherever possible. Congress
recognized the value of international standards in accreditation and
certification, having instructed us in section 808(b)(2) of the FD&C
Act to look to existing standards in developing our model accreditation
standards to avoid unnecessary duplication of efforts and costs. We
believe it is particularly useful to rely on definitions and
terminology from international consensus standards when possible where,
as here, the rule is establishing a voluntary program with an
international focus. In addition, we agree that, notwithstanding the
use of the term ``third-party auditor'' in the statute, the use of the
term ``third-party certification body'' instead of the term ``third-
party auditor'' provides some clarity for purposes of referring to
bodies that employ or contract individuals to perform audits.
    Therefore, in response to the comments suggesting the term ``third-
party auditor'' is confusing and inconsistent with international
standards, we are using the term ``third-party certification body'' in
the

remainder of the preamble and in the codified of this final rule,
except in the definitions of ``Accredited third-party certification
body'' and ``Third-party certification body'' in Sec.  1.600(c) and in
the preamble discussion of those definitions.
    On our own initiative, we are including the descriptor ``third-
party'' before ``certification body'' throughout this final rule. We
did not use that descriptor in the proposed rule when referring to a
third-party auditor/certification body once accredited. We are doing so
now in order that the term accurately reflects that, under this
subpart, only third-party certification bodies are eligible for
accreditation. We are making corresponding changes to the term
``accredited auditor/certification body;'' and in this final rule we
will instead use the term, ``accredited third-party certification
body.''
    Accordingly, we have revised the proposed definitions of
``accreditation,'' ``accreditation body,'' ``accredited auditor/
certification body,'' ``audit,'' ``audit agent,'' ``certification
body,'' ``direct accreditation,'' ``eligible entity,'' ``facility
certification,'' ``food certification,'' ``recognized accreditation
body,'' ``relinquishment,'' and ``self-assessment,'' to replace the
term ``third-party auditor'' with the term ``third-party certification
body,'' or ``third-party certification bodies,'' and to remove
``auditor/'' from in the term ``third-party auditor/certification
body'' or ``third-party auditors/certification bodies'' that was used
in the proposed rule.
    On our own initiative, we added a sentence to the definition of
``accredited third-party certification body'' in Sec.  1.600 of this
final rule to explain that the term has the same meaning as
``accredited third-party auditor'' as defined in section 808(a)(4) of
the FD&C Act. Similarly, we added language to the definition of
``third-party certification body'' in Sec.  1.600 of this final rule
explaining that the term has the same meaning as ``third-party
auditor'' as defined in section 808(a)(3) of the FD&C Act.
    (Comment 2) Some comments encourage us to make the definitions in
this rule consistent with the definitions in other FSMA proposed rules,
such as the 2013 proposed FSVP regulation, the 2013 proposed human
preventive controls regulation, the 2013 proposed animal preventive
controls regulation, and the 2012 proposed produce safety regulation,
where feasible.
    (Response 2) We agree with the comments on the overarching goal of
alignment across regulations and accepted suggested revisions, where
feasible and appropriate. However, it is not always possible to develop
uniform definitions due to the distinct statutory requirements and the
framework of each program. In such cases where it was not feasible or
appropriate, we declined the suggested revisions from comments. We
discuss such comments and our responses under each relevant term.

B. Assessment

    We did not define ``assessment'' in the proposed rule.
    (Comment 3) Some comments recommend adding a definition of
``assessment'' based on ISO/IEC 17011:2004 (Ref. 5), clause 3.7, which
describes the process for evaluating certification bodies. The comments
explain that defining such evaluations as ``audits,'' as we had
proposed, is inconsistent with international standards. The comments
suggest consulting with other ISO/IEC standards for relevant
terminology.
    (Response 3) We agree that the term ``assessment'' should be used,
in part, to refer to the activity undertaken to assess the competency
and capacity of a third-party certification body under the rule. We
reviewed ISO/IEC 17011:2004 (Ref. 5) (clause 3.7 and NOTE) and ISO/IEC
17000:2004 (Ref. 4), ISO/IEC 17040:2005 Conformity assessment--General
requirements for peer assessment of conformity assessment bodies and
accreditation bodies (ISO/IEC 17040:2005) (Ref. 12), and an
International Accreditation Forum (IAF) document entitled, ``IAF
Endorsed Normative Documents'' (Ref. 13).
    After considering the comments and reviewing the referenced
documents, we developed a definition of ``assessment'' that describes,
with respect to accreditation bodies, the activity undertaken by FDA to
evaluate the competency and capacity of the accreditation body under
the applicable requirements of this rule. With respect to certification
bodies, ``assessment'' describes the activity undertaken by a
recognized accreditation body (or, in the case of direct accreditation,
FDA) to evaluate the competency and capacity of a certification body
under the applicable requirements of this rule. We also made
corresponding changes to the definition of ``audit'' from proposed
Sec.  1.600(c) by removing clauses (1) and (2).

C. Audit

    We proposed a definition of ``audit'' describing the examination of
accreditation bodies, third-party certification bodies, and eligible
entities. We proposed to define an audit of an accreditation body as an
examination by FDA of the accreditation body's authority,
qualifications, resources, policies, procedures, and performance, as
well as of its capability to meet the requirements of the proposed
rule. We proposed to define an audit of a third-party certification
body as an examination by a recognized accreditation body (or, by FDA,
for direct accreditation) of the third-party certification body's
authority, qualifications, resources, policies, procedures, and
performance, as well as of its capability to meet the requirements of
the proposed rule. We proposed to define an audit of an eligible entity
as an examination by an accredited third-party certification body of
the eligible entity to assess the entity, its facility, system(s), and
food using audit criteria for consultative or regulatory audits, and,
for consultative audits, also including an assessment of compliance
with applicable industry standards and practices.
    We received some comments on the proposed definition of ``audit,''
and the related definitions of ``consultative audit'' and ``regulatory
audit.'' Comments specific to the definition of ``consultative audit''
are discussed in section III.E., and comments on the definition of
``regulatory audit'' are discussed in section III.L. As described in
Response 3, we also removed clauses (1) and (2) from the proposed
definition of ``audit'' because those evaluations are ``assessments''
as the term is defined in Sec.  1.600(c).
    On our own initiative, we are revising the definition of ``audit''
to clarify that an audit conducted under this subpart is not an
inspection under section 704 of the FD&C Act (21 U.S.C. 374).
    (Comment 4) Several comments encourage us to align our definition
of audit with relevant international standards, and some comments
request that we use the definition of ``audit'' from the Codex
``Principles for Food Import and Export Inspection and Certification''
(CAC/GL 20-1995) (Ref. 14), which defines ``audit'' as a ``systematic
and functionally independent examination to determine whether
activities and related results comply with planned objectives.''
    (Response 4) We agree with the general principle of creating
consistency with international standards and have revised the
definition of ``audit'' in Sec.  1.600(c) accordingly. Rather than
describing the determination of whether activities comply with
``planned objectives'' that appears in the Codex definition of
``audit'' (Ref. 14), we inserted a brief description of the objectives
of consultative and regulatory audits from the definitions in section
808(a)(5) and (7) of the FD&C Act (i.e.,

the examination of an eligible entity under this rule).
    (Comment 5) Some comments encourage us to remove the proposed
definition of ``audit'' in Sec.  1.600(c) and substitute the FSVP
definition of ``audit'' instead, to promote consistency and a common
understanding of terminology.
    (Response 5) We disagree. We believe that it is more important for
the definition in this rule to reflect international standards that are
generally well known to the parties subject to this rule than it is for
the definition to mirror the definition in FSVP, which has different
applicability. FSVP applies to importers; this rule applies to
accreditation bodies, third-party certification bodies, and eligible
entities. Therefore, we are rejecting the suggestion to use the FSVP
definition of ``audit'' as the definition of ``audit'' in Sec.
1.600(c).
    (Comment 6) We received some comments on the definition of
``audit'' regarding its relationship to the related definitions of
``consultative audit'' and ``regulatory audit'' in Sec.  1.600(c). Some
comments recommend that we revise the definition of ``audit'' to mean
only regulatory audits, and not consultative audits, asserting that is
how the word ``audit'' is used in the statute. These comments contend
that the statute must be interpreted in light of the fact that section
808 of the FD&C Act is directed to food and facility certifications,
which are only accomplished through regulatory audits. Other comments
ask us to clarify that the services of an accredited third-party
certification body that fall short of the definition of an ``audit''
(e.g., informal consulting, continuous improvement programs, and
limited purpose audits) under this rule, are not subject to the
requirements of the rule.
    (Response 6) We decline the suggestion to interpret section 808 of
the FD&C Act in a manner that would equate ``audit'' with ``regulatory
audit.'' Section 808 of the FD&C Act defines two types of audits used
under the program, consultative audits and regulatory audits, and
contains requirements relating to each. (See, e.g., section 808(a)(5),
(7), and (c)(3)(A) of the FD&C Act). In addition, section 808(c)(4)(B)
of the FD&C Act expressly allows an accredited third-party
certification body or an audit agent of such auditor to perform
consultative and regulatory audits of eligible entities.
    To the extent that other comments suggest creating a list of
exceptions from the definition of ``audit'' in the codified for this
rule, we decline to do so. To the extent that these comments were
seeking clarification of the definition of ``consultative audit'' in
Sec.  1.600(c), and what types of activities might fall outside of that
definition as well as outside of this program, please see the
discussion in Response 9 in section III.E.
    (Comment 7) Some comments express confusion about the criteria that
accredited third-party certification bodies will be using in conducting
audits under subpart M and ask us to more clearly describe the
``applicable requirements'' against which compliance will be evaluated.
Some comments are concerned that eligible entities might be audited
against requirements that do not apply to their operations. For
example, some comments note that firms subject to the final animal
preventive controls regulation should not be assessed for compliance
with the allergen cross contamination requirements of the final human
preventive controls regulation. Other comments ask us to clarify
whether the ``applicable requirements'' are limited to requirements
that appear in the FD&C Act or FDA regulations, or both.
    (Response 7) During regulatory and consultative audits, accredited
third-party certification bodies will examine compliance with
applicable food safety requirements of the FD&C Act and FDA regulations
within the scope of the audit. In consultative audits, the third-party
certification bodies also may be conducting an examination to determine
conformance with applicable industry standards and practices.
    The applicable requirements that accredited third-party
certification bodies and their audit agents will use relate to the food
safety standards under the FD&C Act, such as the adulterated food
provisions in section 402 of the FD&C Act and the provisions on the
misbranding of food allergens in section 403(w) of the FD&C Act. The
applicable requirements of the FD&C Act and FDA regulations would
depend on the type of eligible entity being audited. To use the example
given by one of the comments, an eligible entity that is subject to the
requirements of the final animal preventive controls regulation, but
not the final human preventive controls regulation, would not be
subject to an audit examining its practices relating to cross-
contamination by food allergens under the final human preventive
controls regulation because those are not ``applicable food safety
requirements'' for such an entity.
    To help clarify this rule for eligible entities, third-party
certification bodies, and accreditation bodies who may be interested in
participating in the program and who may not yet be familiar with U.S.
laws and regulations, we are using the phrase ``applicable food safety
requirements of the FD&C Act and FDA regulations'' in place of the
phrase ``applicable requirements'' in the definition of ``audit'' in
Sec.  1.600(c) and elsewhere throughout the rule where we are
discussing the requirements that will be used in auditing eligible
entities.\2\
---------------------------------------------------------------------------

    \2\ Although we have elected to cite to both the FD&C Act and
FDA regulations in this definition, we otherwise will follow the
conventional practice of using the words ``applicable requirements''
to refer the applicable requirements of the FD&C Act and FDA
regulations.
---------------------------------------------------------------------------

D. Audit Agent

    We proposed to define an ``audit agent'' as an individual who is an
employee or other agent of an accredited third-party certification body
who, although not individually accredited, is qualified to conduct food
safety audits on behalf of an accredited third-party certification
body. Under the proposed rule we also defined an audit agent to include
a contractor of the accredited third-party certification body.
    (Comment 8) Some comments express concern about our proposal to
allow a contractor of an accredited third-party certification body to
serve as an audit agent, asserting that ``[w]ith each step that is
further removed in this process, institutional control is lost
exponentially.'' The comments point out that a subcontractor conducted
the audit and gave a passing audit score to a cantaloupe farm and
packing facility that used ``improper and unsafe processing equipment''
and subsequently was linked to a deadly outbreak caused by Listeria
monocytogenes. Other comments mentioning the incident cite to an
article in Bloomberg News explaining that auditors often outsource to
independent contractors over whom they do not have direct management
control (Ref. 15). Still other comments offer the cantaloupe outbreak
as an example of why auditors must be competent and accountable for
their activities.
    (Response 8) We understand that third-party certification bodies
currently work with individual auditors under many different types of
arrangements. We acknowledge concerns raised by comments about recent
outbreaks at some domestic facilities that had received satisfactory
scores in food safety audits. Further, we agree with the comments on
the importance of an accredited third-party certification body
exercising adequate control over an audit agent conducting audits on
its

behalf. We believe that principle is equally true whether the audit
agent is an employee or a contract auditor.
    International standards, such as ISO/IEC 17021:2011 (Ref. 6),
specifically allow accredited third-party certification bodies to use
contractors to perform audits if certain conditions are met. Among
other conditions, contract auditors must meet the same level of
qualifications (e.g., knowledge, skills, and experience) and the same
requirements for impartiality and objectivity as do the auditors the
third-party certification body employs. The third-party certification
body must exercise adequate control and oversight over a contractor
such that the third-party certification body accepts the result of the
contractor's audit as its own.
    When we proposed to define ``audit agent'' to include a contractor,
we were contemplating arrangements such as those described in ISO/IEC
17021:2011 (Ref. 6) that involve a direct relationship between the
accredited third-party certification body and its auditors. We are
revising the definition of ``audit agent'' to clarify that we are
excluding subcontractors and other types of outsourcing arrangements;
we have concluded that such arrangements fail to provide the degree of
control and oversight necessary for an accredited third-party
certification body to ensure that its audit agents are competent and
objective. An accredited third-party certification body exercises
direct supervision over the activities of its employees, and has a
direct relationship with a contractor; but the relationship between the
third-party certification body and a subcontractor or other type of
outsourced staff is attenuated--the third-party certification body may
not even choose such persons and may not have any direct authority over
them. We do not believe such diminished oversight is appropriate, given
the important role of audit agents in this program.
    By revising the definition of ``audit agent'' we are not preventing
an accredited third-party certification body from subcontracting for
services in areas other than the conduct of audits. For example, an
accredited third-party certification body may use subcontractors or
other outsourcing arrangements to deliver annual training to its audit
agents under Sec.  1.650 or may use subcontractors or other outsourcing
arrangements to investigate and decide on appeals of adverse regulatory
audit results under Sec.  1.651. However, we are limiting the role of
``audit agent'' to employees and contractors of the accredited third-
party certification body.

E. Consultative Audit

    We proposed to define a ``consultative audit'' as an audit of an
eligible entity: (1) To determine whether such entity is in compliance
with applicable requirements of the FD&C Act and industry standards and
practices and (2) the results of which are for internal purposes only
and cannot be used to determine eligibility for a food or facility
certification issued under this subpart or in meeting the requirements
for an onsite audit of a foreign supplier under subpart L of this part.
    (Comment 9) We received several comments on the definition of
``consultative audit.'' Many comments express concern that the
definition of ``consultative audit'' is overly broad and that some of
the requirements that would apply to consultative audits under the
proposed rule might create a disincentive to using accredited third-
party certification bodies. Some comments urge FDA to remove all
requirements associated with consultative audits from the rule. Other
comments identify two requirements of particular concern: (1) Proposed
Sec.  1.656, requiring an accredited third-party certification body
conducting a consultative audit or regulatory audit under the rule to
notify FDA immediately upon discovering a condition that could cause or
contribute to a serious risk to public health (the notification
requirement) and (2) proposed Sec.  1.652, requiring an accredited
third-party certification body to provide FDA access to a consultative
audit report when the criteria for records access under section 414 of
the FD&C Act (21 U.S.C. 350c) are met (the records access requirement).
The comments explain that many firms use certification bodies (and/or
their consulting divisions) to help establish, maintain, and improve
their food safety practices. For example, some firms use certification
bodies (and/or their consulting divisions) to help in identifying root
causes and remediating food safety problems. Comments also note that
certification bodies (and/or their consulting divisions) provide
informal counseling, perform preliminary evaluations, limited purpose
audits, and activities in support of firms' continuous improvement
programs.
    Comments express concern that if these types of activities are
subject to notification, records access, and other requirements of the
rule, firms located outside the United States might not use accredited
third-party certification bodies, instead choosing unaccredited third-
party certification bodies to avoid the requirements of this rule. The
comments assert that unaccredited third-party certification bodies are
less likely to have qualified auditors and their independence and
objectivity is less certain, than third-party certification bodies that
have been evaluated and issued accreditation.
    Comments also argue that the definition of ``consultative audit,''
which states that the results of such an audit are ``for internal
purposes only,'' is inconsistent with the requirements for notification
and records access that would apply to consultative audits under the
proposed rule. Other comments ask us to clarify that audits conducted
for external purposes--for example, an audit for purposes of compliance
with FSVP--do not satisfy the definition of a consultative audit
because consultative audits are for internal purposes only.
    Some comments suggest that the proposed definition of
``consultative audit,'' taken together with the proposed definitions of
``food safety audit'' and ``regulatory audit,'' could preclude third-
party certification bodies from conducting any audits that are outside
the scope of subpart M, once accredited. Based on that interpretation,
the comments predict that few if any third-party certification bodies
would want to participate in the program.
    Many of the comments that express concern about disincentives also
suggest that Congress intended the third-party program to be much
narrower than our proposed definition of ``consultative audit'' would
suggest. These comments suggest that the FSMA third-party certification
program was intended to be focused on regulatory audits and the
issuance of certifications to be used for two limited purposes: i.e.,
in establishing an importer's eligibility for VQIP and in satisfying a
condition of admissibility for a food subject to an FDA safety
determination under section 801(q) of the FD&C Act. These comments
argue further that Congress inserted the term ``consultative audit'' in
the statute to be used only in reference to the conflicts of interest
provisions in section 808(c)(4)(C) and (c)(5) of the FD&C Act;
therefore, a broad interpretation of ``consultative audit'' is
inconsistent with Congressional intent. The comments urge us to
construe the term ``consultative audit'' as narrowly as possible.
    (Response 9) We recognize that food firms use accredited third-
party certification bodies (and their consulting divisions) in various

capacities that serve the ultimate goal of improving food safety. We do
not want, nor do we believe Congress intended, for our third-party
certification program to create disincentives for food firms seeking to
use accredited third-party certification bodies for various purposes to
improve food safety practices in their operations. Nevertheless, we
decline the request to remove all requirements relating to consultative
audits from this final rule. Section 808(c)(5)(C) of the FD&C Act
directs us to issue implementing regulations for section 808 of the
FD&C Act, which includes some specific provisions relating to
consultative audits (e.g., section 808(c)(3)(A) and (C) on consultative
audit reports and section 808 (c)(4)(C) of the FD&C Act on audit agents
performing regulatory audits of eligible entities of which they
performed consultative or regulatory audits within the preceding 13
months). We have, however, revised the definition of ``consultative
audit'' as explained below and have made other revisions to the rule to
clarify the scope of such audits and help mitigate possible
disincentives to conduct consultative audits, while fulfilling the
letter and spirit of the law.
    With regard to the comments expressing concerns about an overly
broad interpretation of ``consultative audit,'' we remind readers that
the statute endows both regulatory and consultative audits with certain
characteristics. For example, section 808(a)(6) of the FD&C Act
indicates that an eligible entity must choose to be audited by an
accredited third-party certification body, and section 808(c)(5)(C)(i)
of the FD&C Act states that audits under this program must be
unannounced. We understand these provisions to mean that, at the time
the audit services are arranged, an eligible entity must specifically
request from an accredited third-party certification body a food safety
audit under this rule--that is the only way the accredited third-party
certification body would know that the eligible entity is requesting an
unannounced subpart M audit to determine compliance with the applicable
food safety requirements of the FD&C Act and FDA regulations. Further,
the eligible entity would need to specify whether it is seeking a
regulatory or consultative audit. (In addition to determining whether
the eligible entity is in compliance with the food safety requirements
of the FD&C Act, consultative audits under section 808 of the FD&C Act
also determine whether the eligible entity is in compliance with
applicable industry standards and practices). Audits that fall outside
the purview of this rule--for example, audits that are conducted by
third-party certification bodies that are not accredited under this
program, audits that determine compliance with standards other than the
food safety requirements of the FD&C Act and FDA regulations (e.g.,
audits that determine compliance with private standards), audits that
are announced, and audits conducted solely for the purposes of supplier
verification under the final human or animal preventive controls
regulations or the final FSVP regulations--are not covered by, or
subject to, the requirements of this rule.
    It is impossible to describe or predict all of the audit scenarios
that may occur. We emphasize that an accredited third-party
certification body can continue to offer auditing and certification
services that are outside the scope of this rule, such as on-site
supplier verification audits under the final human or animal food
preventive controls regulations or the final FSVP regulation. Such
audits would not be subject to the requirements of this rule, including
the reporting and notification requirements.
    In response to comments, we revised the proposed definition of
``consultative audit'' to clarify that it is an audit conducted in
preparation for a regulatory audit under the third-party certification
program. A consultative audit would thus be a pre-examination or pre-
assessment type of activity imbued with certain characteristics. We
further clarify the characteristics of a consultative audit, as well as
of a regulatory audit (the results of which can form the basis for
issuance of certification under the rule), in the definition of ``food
safety audit'' discussed in section III.J.

F. Eligible Entity

    We proposed to define an ``eligible entity'' as a foreign entity
that chooses to be subject to a food safety audit by an accredited
third-party certification body. We further proposed that eligible
entities include foreign facilities subject to the registration
requirements in FDA regulations.
    (Comment 10) We received several comments on the definition of
``eligible entity.'' Some comments request that we provide examples of
specific types of entities that satisfy the definition. Some comments
offer examples of ``eligible entities,'' including orchards or farms,
packing houses, processing plants, and storage facilities. Other
comments suggest we add ``and foreign farms'' to the end of the
definition, to clarify that such entities are eligible to receive
audits under subpart M. Some comments encourage us to adjust the
definition of ``eligible entity'' to make it mandatory for foreign food
facilities to undergo food safety audits by accredited third-party
certification bodies.
    (Response 10) The proposed definition of ``eligible entity'' was
based on the statutory definition, which includes facilities subject to
the registration requirements in section 415 of the FD&C Act that
choose to be audited under the program. At our own initiative we are
revising the definition of ``eligible entity'' in the codified to more
accurately track the statute, and we decline the suggestion to add
specific examples, such as orchards or farms, that are not included in
the statutory definition of ``eligible entity.'' However, as explained
in Response 12 we are revising the definition of ``facility'' in Sec.
1.600(c) to clarify that entities that grow, harvest, or raise animals
for food for consumption in the United States are facilities that are
eligible for auditing and certification under this subpart.
    We disagree with the comment suggesting that we should make audits
under this program mandatory for all foreign food firms by modifying
the definition of ``eligible entity.'' The statute clearly indicates
that participation in this program is intended to be voluntary, and
only entities that choose to be audited under the program are subject
to its requirements (see section 808(a)(6) of the FD&C Act).
    (Comment 11) In the proposed rule, we specifically asked for
comment on whether to allow for food or facility certification to be
issued to a producer group, offering as an example the criteria for
groups under the National Organic Program (NOP)--i.e., having multiple
sites operating under a single management system and whose farms are
``uniform in most ways.'' Several comments responded to this inquiry in
relation to the definition of ``eligible entity.''
    Comments in support of certification of a group (e.g., a
cooperative being audited as a single eligible entity) note that some
producers are very small and might find it difficult on their own to
obtain third-party certification, but taken as a group the task would
likely be more manageable. Other comments note that treating multiples
sites with a single management system as a single eligible entity could
be particularly helpful in sectors or regions where there is a scarcity
of accredited third-party certification bodies. Some comments argue in
support of groups functioning as a single eligible entity as long as
the central management system functions effectively, providing
oversight to the

members. Comments also note that some multisite sampling protocols have
been developed by international organizations, such as ISO.
    Other comments encourage us to ensure that cooperatives are subject
to this rule, so that all the links in a foreign supply chain are
appropriately inspected, and so that they are subject to any applicable
regulations before their product is exported to the United States.
    Comments not in support of cooperatives being classified as
eligible entities note that food safety practices and conditions are
site-specific and can vary significantly even if the individual farms
are located in the same geographic area (for example, due to soil
composition, agricultural water runoff, or the manner in which the land
was used in the past). They also note that organic production standards
and scientifically-based food safety standards are not the same, so
what works for the NOP may not be appropriate here
    Some comments encourage us to provide guidance on the acceptable
parameters of a cooperative. Some comments encourage us to consider
guidance available from other sources beyond the NOP, such as the
International Federation of Organic Agriculture Movements.
    (Response 11) We decline to revise the definition of eligible
entities to include a group. We acknowledge that some very small
producers might be daunted by the prospect of working individually with
an accredited third-party certification body, and there would be
obvious economies in banding together with other very small producers
to gain certification. We also acknowledge that some sets of producers
do currently function as a unit under a centralized management system,
and that group certification may make it easier for entities to access
accredited third-party certification bodies in areas or regions where
they may be scarce. Nevertheless, after reviewing the NOP, the
International Federation of Organic Agricultural Movements, the Canada
Organic Office Operation Manual, the USDA Agricultural Marketing
Service pilot program on group certification, and other recommended
sources, we conclude that it would not be appropriate to allow groups
to be certified under this program. Group certification raises a myriad
of complicated issues such as establishing who may act as a group,
determining the requisites of a central management system, and
delineating the minimum requirements for accredited third-party
certification body audits of a group.
    With regard to the comments contending that certifications from
individual eligible entities that might otherwise act as a group would
create redundant and unnecessary paperwork for FDA, we will take that
sort of information into account as we gain experience with the
program. Finally, with regard to the comments encouraging us to define
``eligible entity'' to include groups to ensure that all their members
are examined for compliance with applicable food safety regulations
before their food is exported to the United States, we note that this
rule does not create audit obligations for all foreign suppliers or for
all importers. The third-party certification program created by this
rule is a voluntary program for eligible entities who wish to
participate.

G. Facility

    We proposed to define ``facility'' as any structure, or structures
of an eligible entity under one ownership at one general physical
location, or, in the case of a mobile facility, traveling to multiple
locations, which manufactures/processes, packs, or holds food for
consumption in the United States. The definition went on to state that:
(1) Transport vehicles are not facilities if they hold food only in the
usual course of business as carriers; (2) a facility may consist of one
or more contiguous structures, and a single building may house more
than one distinct facility if the facilities are under separate
ownership; (3) the private residence of an individual is not a
facility; and (4) non-bottled water drinking water collection and
distribution establishments and their structures are not facilities.
    On our own initiative, we are clarifying that facilities for the
purposes of this subpart are not limited to facilities required to be
registered under Subpart H.
    (Comment 12) Some comments encourage us to align the proposed
definition of ``facility'' to the definition of ``facility'' in the
human and animal preventive controls, produce safety, and FSVP
regulations, to promote consistency and common understanding of the
rules.
    (Response 12) As previously noted, we agree with the comments on
the importance of consistency across regulations, where feasible and
appropriate. We reviewed the definitions of ``facility'' in the final
FSVP and final human preventive controls regulations, and found those
definitions to be too narrow in light of the purpose of this rule to
establish a voluntary program for certification of foods and facilities
and the broad definition of ``eligible entity'' in section 808(a)(6) of
the FD&C Act. Of our own initiative, in order to preserve the option
for broad participation in the third-party program, we are expressly
including in the definition of ``facility'' those entities that grow,
harvest, or raise animals for food for consumption in the United
States.

H. Facility Certification and Food Certification

    We proposed to define ``facility certification'' as an attestation,
issued for purposes of section 806 of the FD&C Act by an accredited
third-party certification body, after conducting a regulatory audit and
any other activities necessary to establish that a facility meets the
applicable requirements of the FD&C Act. We proposed to define ``food
certification'' as an attestation, issued for purposes of section
801(q) of the FD&C Act by an accredited third-party certification body,
after conducting a regulatory audit and any other activities necessary
to establish that a food meets the applicable requirements of the FD&C
Act.
    (Comment 13) We received some comments on the definitions of
``facility certification'' and ``food certification.'' Some of these
comments raise group certification issues which we address above, in
connection with the definition of ``foreign cooperative.'' Some
comments state that ``food certification'' is improper terminology,
because it implies a product certification model, whereas audits of
eligible entities--particularly in the produce sector--generally assess
processes and/or management systems.
    (Response 13) The term ``food certification'' appears in the
statute and is specifically discussed in the statute as a type of
certification that may be used in meeting a condition of admissibility
under section 801(q) of the FD&C Act. Under section 808(c)(2)(C) of the
FD&C Act, food certifications may only issue upon conduct of a
regulatory audit. In light of the statutory language, we decline to
revise the term ``food certification'' in response to the comments on
this rule.
    We also note that section 801(q)(1) of the FD&C Act allows for FDA
to accept ``a listing of certified facilities that manufacture,
process, pack, or hold food, or other assurances deemed appropriate by
FDA'' to satisfy the condition of admissibility. Of our own initiative,
in light of this statutory language, we are clarifying in the
definition of ``facility certification'' that

a facility certification may be issued for purposes of 801(q) of the
FD&C Act.

I. Food

    In proposed Sec.  1.600(b), we stated unless otherwise defined in
Sec.  1.600(c) of the proposed rule, definitions of terms in section
201 of the FD&C Act would apply to terms used in this subpart. Section
201 of the FD&C Act defines ``food'' as ``(1) articles used for food or
drink for man or other animals, (2) chewing gum, and (3) articles used
for components of any such article.'' Proposed Sec.  1.600(c) did not
define the term ``food.''
    (Comment 14) Some comments request that we define ``food''
consistent with how it was defined in the FSVP proposed rule for
consistency and to indicate that producers of food contact substances
are eligible entities.
    (Response 14) The proposed definition of ``food'' under Sec.  1.600
would include pesticides when they meet the definition of ``food''
under section 201 of the FD&C Act. By contrast, the FSVP rule's
proposed definition of food explicitly does not include pesticides, as
defined in 7 U.S.C. 136(u), consistent with the definition of ``food''
used in the rulemaking on the Prior Notice of Imported Food Under the
Public Health Security and Bioterrorism Preparedness Act of 2002 (prior
notice rule). FDA received comments during that rulemaking questioning
the applicability of the rule to pesticides, so FDA clarified that
``food'' for the purposes of that rule did not include pesticides.
    The final FSVP regulation, which is publishing elsewhere in this
issue of the Federal Register, retains the exclusion of pesticides from
the definition of ``food.''
    In response to comments suggesting revision of the definition of
``food'' in this rule to be consistent with the final FSVP regulation,
we considered the purposes that certifications serve under this program
and the nature of comments we received on the third-party proposed
rule, including general comments requesting alignment across the FSMA
rules and comments specifically requesting that we use the FSVP
definition of ``food.'' Certifications issued by accredited third-party
certification bodies may be used in establishing an importer's
eligibility to participate in VQIP and in satisfying a condition of
admissibility for an imported food that we determine poses a safety
risk under section 801(q) of the FD&C Act.
    While certifications may be useful in addressing pesticide
contamination of food (e.g., pesticide levels in food that exceed
established tolerances), we have not identified a need for
certifications to address pesticides as articles of food, nor do we
anticipate a role for food safety audits in pesticide manufacturing
facilities. Accordingly, we are revising the final rule by adding to
Sec.  1.600(c) a definition of ``food'' that excludes pesticides.
    We also agree with the comment that producers of food contact
substances could be eligible entities under this rule and that food
contact substances should be considered food for the purposes of this
rule. Third-party food safety audits and certifications for food
contact substances could potentially be useful given the possibility of
migration of harmful food contact substances into food or contamination
of food contact materials that directly contact food. Accordingly, we
are revising the proposed definition of ``food'' to exclude pesticides
and retain ``food contact substances'' in the definition of ``food'' in
this final rule, consistent with the definition of ``food'' in the
final FSVP regulation.

J. Food Safety Audit

    We proposed to define ``food safety audit'' as a regulatory audit
or a consultative audit.
    (Comment 15) We received a few comments on the definition of ``food
safety audit.'' Some comments request that we remove consultative
audits from the definition of ``food safety audit,'' asserting that
consultative audits should not be subject to the reporting and
notification requirements associated with ``food safety audits.'' Other
comments say we should replace the term ``food safety audit'' with
``regulatory audit,'' as a matter of statutory construction and sound
policy. Finally, some comments suggest that we delete the definition of
``food safety audit'' altogether.
    (Response 15) We are retaining the definition of ``food safety
audit'' as a useful definition to describe regulatory and consultative
audits that fall under the requirements of this rule. As described in
Response 9, we have revised the definition of ``consultative audit'' to
clarify that it is an audit conducted in preparation for a regulatory
audit under the third-party certification program. Although an audit
meeting that definition would be subject to certain reporting and
notification requirements, there are many types of audits/arrangements
that would not fall within the definition of ``consultative audit'' or
``regulatory audit,'' and would therefore not be subject to the
requirements of this rule, including the reporting and notification
requirements. Therefore, including consultative audits in the
definition of ``food safety audit'' will not prevent eligible entities
from using accredited third-party certification bodies for auditing
arrangements that fall outside of the scope of this rule and do not
trigger the requirements of this rule. To further address comments'
concerns, we are modifying the definition of ``food safety audit'' to
provide clarification regarding what types of audits/activities would
fall outside of the scope of this rule. Specifically, we clarify that a
food safety audit must be declared by an eligible entity at the time of
audit planning and must be conducted on an unannounced basis consistent
with sections 808(b)(6) and 808(c)(5)(C) of the FD&C Act.

K. Foreign Cooperative

    We proposed to define ``foreign cooperative'' as an entity that
aggregates food from growers or processors that is intended for export
to the United States.
    On our own initiative, we are replacing the phrase ``entity that
aggregates'' with ``autonomous association of persons, identified as
members, who are united through a jointly owned enterprise to
aggregate'' for clarification purposes.
    (Comment 16) Some comments suggest that we add a definition for
``consolidator.'' The comments contrast consolidators with cooperatives
and argue that consolidators act essentially as brokers that purchase
products from several sources and then export the total set to the
United States. According to these comments, consolidators do not own or
manage the individual sites and generally do not have control over or
even knowledge of the processing procedures.
    (Response 16) We agree with the comment that an entity without a
single management system that exercises control over the manner in
which individual sites meet the applicable food safety requirements of
the FD&C Act and FDA regulations would not be an eligible entity.
However, we disagree that adding a definition of ``consolidator'' would
be helpful because whether an entity is a ``consolidator'' has no
bearing on the requirements of this rule.
    (Comment 17) Some comments point out that while the proposed rule
indicates a foreign cooperative could be an accreditation body or a
third-party certification body, in their countries the government is
the accreditation body. Also, in some places the government authorizes
certain parties to conduct audit activities and those parties are under
the control and supervision of the

government. Accordingly, the comments suggest that we indicate in which
countries and in which cases a foreign cooperative could be an
accreditation body or a third-party certification body. Other comments
recommend more detail on how cooperatives are defined, and how they
would conform to FDA requirements for third-party certification bodies.
    (Response 17) We currently are not in a position to be able to
determine which countries or which foreign cooperatives may be
adequately qualified to become accredited under the third-party
certification program. We note that section 808 of the FD&C Act
expressly allows foreign cooperatives to serve as accredited third-
party certification bodies if they are adequately qualified and
independent of the eligible entities they audit or certify under the
third-party certification program. Therefore, we are not categorically
excluding foreign cooperatives from the third-party certification
program, nor are we making any categorical decisions on whether
governmental accreditation bodies have conflicts that would preclude
them from accrediting such foreign cooperatives under the program.

L. Regulatory Audit

    We proposed to define a ``regulatory audit'' as an audit of an
eligible entity to determine whether such entity is in compliance with
the provisions of the FD&C Act and the results of which are used in
determining eligibility for food certification under section 801(q) of
the FD&C Act or facility certification under section 806 of the FD&C
Act, and may be used by an importer in meeting the requirements for an
onsite audit of a foreign supplier under the FSVP program.
    (Comment 18) Some comments request that we clarify the definition
of ``regulatory audit.''
    (Response 18) The comments requesting clarification failed to
mention specific characteristics in the definition needing
clarification and did not offer suggestions for clarification.
Therefore, we decline to modify the definition based on these comments.
However, on our own initiative we have revised the definition of
``regulatory audit'' by removing the clause ``, and may be used by an
importer in meeting the requirements for an onsite audit of a foreign
supplier under subpart L of this part'' that does not appear in the
statute. We did this in part to avoid confusion. We emphasize that an
audit conducted for the purposes of FSVP would not need to be conducted
by a third-party certification body under this subpart. See section
XIII.G. Nor are facilities required to use third-party certification
bodies accredited under this rule in meeting their supplier
verification requirements under the final human or animal preventive
controls regulations. On our own initiative, we are revising the
definition of ``regulatory audit'' to clarify that the results of a
regulatory audit may be used to determine eligibility for any
certifications that may be used for purposes of section 801(q) or
section 806 of the FD&C Act.

M. Self-Assessment

    We proposed to define ``self-assessment'' as a systematic
assessment conducted by an accreditation body or by a third-party
certification body to determine whether it meets the applicable
requirements of this subpart.
    We received no adverse comments about our proposed definition.
However, on our own initiative, we are revising the definition of
``self-assessment'' to improve clarity and to specify what is required
of a recognized accreditation body and an accredited third-party
certification body when performing these evaluations.

N. Third-Party Auditor

    We proposed to define a ``third-party auditor'' as a foreign
government, agency of a foreign government, foreign cooperative, or any
other third-party that is eligible to be considered for accreditation
to conduct food safety audits and to certify that eligible entities
meet the applicable requirements of the FD&C Act. We further proposed
that a third-party auditor may be a single individual or an
organization and may use audit agents to conduct food safety audits.
Finally, we proposed that ``third-party auditor'' has the same meaning
as ``certification body'' as that term was defined in the proposed
rule.
    (Comment 19) As described in Comment 1, we received several
comments urging us to align our definitions and terminology with
international standards. Some comments state that the term ``third-
party auditor,'' the language of the statute notwithstanding, is not
correct terminology to use interchangeably with ``third-party
certification body.''
    (Response 19) As discussed previously, we agree that it is
beneficial to use terminology in this rule that is consistent with
terminology used in international standards when feasible and
appropriate. Therefore, we are deleting the definition of ``third-party
auditor'' in the final rule and will use the term ``third-party
certification body'' in this rule except that we will use the term
``third-party auditor'' in the definitions of ``Accredited third-party
certification body'' and ``Third-party certification body'' in Sec.
1.600(c) and in the preamble discussion of those definitions in section
III.A. We are clarifying in the definition of ``third-party
certification body'' in Sec.  1.600(c) that the term has the same
meaning as ``third-party auditor'' as defined in section 808(a)(3) of
the FD&C Act.

IV. Comments on Who Is Subject to This Subpart (Sec.  1.601)

    We proposed in Sec.  1.601 that this rule would apply to those
accreditation bodies, third-party certification bodies, and eligible
entities that seek to participate in this voluntary third-party
certification program. We proposed two limited exemptions from section
801(q) of the FD&C Act: One related to alcoholic beverages from an
eligible entity that is a facility that meets certain conditions, and
another related to certain food constituting not more than 5 percent of
the overall sales of a facility meeting the conditions of the first
exemption.

A. Limiting the Scope of the Rule to Regulatory Audits and
Certifications

    Under proposed Sec.  1.601(b), we proposed that subpart M would
apply to third-party certification bodies seeking accreditation to
conduct food safety audits and issue certifications for purposes of
sections 801(q) and 806 of the FD&C Act.
    (Comment 20) Some comments suggest we modify the language in Sec.
1.601(b) regarding third-party certification bodies seeking
accreditation to clarify that requirements of the rule apply only to
imported foods that are subject to a condition of admissibility under
section 801(q) of the FD&C Act and imported foods offered by an
importer seeking to establish eligibility to participate in VQIP. In
this view, the requirements of the rule (e.g., the notification
requirements) should not apply to audits other than regulatory audits
that are conducted for certification purposes.
    (Response 20) We decline to make the suggested revisions to Sec.
1.601(b) because Sec.  1.601(b)(2) already describes the two types of
certifications that may be issued by accredited third-party
certification bodies under the final rule and the types of audits that
they would conduct under this program (i.e., food safety audits, which
include both consultative and regulatory audits). Audits conducted by
third-party certification bodies that are outside of the scope of this
program, and eligible entities receiving audits outside of the scope of
this program, would not be

subject to the requirements of this final rule. With respect to the
suggestion that the final rule should apply only to regulatory audits,
and therefore not to consultative audits, we note, as previously
discussed, that section 808 of the FD&C Act specifically defines
``consultative audit'' and contains requirements for the conduct of
both regulatory and consultative audits (see, e.g., section 808(a)(5)
and (c)(4)(B) of the FD&C Act). Therefore, this final rule establishes
requirements for consultative audits that are consistent with the
provisions on consultative audits in the statute.

B. Exemption for Alcoholic Beverages

    Under proposed Sec.  1.601(d), we proposed to exempt from the
certification requirements under section 801(q) of the FD&C Act
alcoholic beverages that are imported from an eligible entity that is a
facility that meets the following two conditions:
     Under the Federal Alcohol Administration Act or chapter 51
of subtitle E of the Internal Revenue Code of 1986, the facility is a
foreign facility of a type that, if it were a domestic facility, would
require obtaining a permit from, registering with, or obtaining
approval of a notice or application from the Secretary of the Treasury
as a condition of doing business in the United States; and
     Under section 415 of the Federal Food, Drug, and Cosmetic
Act, the facility is required to register as a facility because it is
engaged in manufacturing/processing one or more alcoholic beverages.
    We also proposed that the certification requirements under section
801(q) of the FD&C Act would not apply to food other than alcoholic
beverages that is imported from a facility described in Sec.
1.601(d)(1) provided that such food:
    (i) Is in prepackaged form that prevents any direct human contact
with such food; and
    (ii) Constitutes not more than 5 percent of the overall sales of
the facility, as determined by the Secretary of the Treasury.
    We tentatively concluded that these provisions were consistent with
the provisions on alcohol-related facilities in section 116 of FSMA.
    (Comment 21) Some comments support the proposed exemption of
imported beverage alcohol products, but encourage us to clarify and
amplify the exemption to cover the raw materials and ingredients (e.g.,
grapes, grains, hops, flavors) used to produce alcoholic beverages. The
comments assert that the requested exemption would provide for
consistency between domestic and foreign facilities and would be
consistent with Congressional intent regarding section 116 of FSMA. The
comments assert that the expanded exemption would be consistent with
the regulations on preventive controls for human food. The comments
urge us to consult their comments on the FSVP proposed rule.
    (Response 21) As requested, we consulted comments submitted on
proposed Sec.  1.501(e) in the FSVP proposed rule, requesting an
exemption from the FSVP requirements for the importation of the raw
materials and ingredients (e.g., grapes, grains, hops, flavors) used to
produce alcoholic beverages, and asserting that such an exemption would
be consistent with Congressional intent regarding section 116 of FSMA.
    We considered the comments' request in light of the risk-based
public health principles generally underlying FSMA and have concluded
that Congress did not intend for FSMA's core requirements to apply to
the manufacture/processing, packing, and holding of alcoholic
beverages. Congress may have made such a conclusion in light of the
potential antimicrobial function of the alcohol content in such
beverages and the concurrent regulation of alcoholic beverage-related
facilities by both FDA and the Alcohol and Tobacco Tax and Trade
Bureau. In light of this context, we have concluded that section 116 of
FSMA should be interpreted to mean that the manufacturing, processing,
packing, or holding of alcoholic beverages at most alcohol-related
facilities should not be subject to this rule.
    We believe the same rationale supports the comments' request.
Accordingly, and consistent with the final FSVP regulation, we are
expanding the exemption from certification under section 801(q) of the
FD&C Act in Sec.  1.601(d) to cover raw materials or other ingredients
that are used to manufacture/process, pack or hold alcoholic beverages
by an importer required to be registered under section 415 of the FD&C
Act, when such facilities are exempt from the preventive controls
regulations under 21 CFR 117.5(i).
    Also in this final rule, we are replacing the term ``food other
than alcoholic beverages,'' to describe the applicability of the
exemption, with the term ``food that is not an alcoholic beverage.''

C. USDA Regulated Products

    (Comment 22) Some comments suggest we explicitly exempt products
under USDA jurisdiction from the requirements of this rule.
    (Response 22) We agree that an exemption to 801(q) is appropriate
with respect to meat, poultry, and egg products regulated by USDA at
the time of importation. The final rule adds a new Sec.  1.601(d)(2)
which states that any certification under 801(q) does not apply to
meat, poultry, and egg products that at the time of importation are
subject to the requirements of the USDA under FMIA (21 U.S.C. 601 et
seq.), PPIA (21 U.S.C. 451 et seq.), or EPIA (21 U.S.C. 1031 et seq.).
We conclude that this provision is consistent with section 403 of FSMA,
entitled ``Rule of Construction,'' which states that nothing in FSMA
shall be construed to alter or limit the jurisdiction of the Secretary
of the Department of Agriculture. For many decades, USDA has exercised
authority and responsibility over the import of such meat, poultry, and
egg products, and has detailed regulations and procedures implementing
this authority. In light of USDA's role with respect to the importation
of these products, and also in light of section 403 of FSMA, we believe
that Congress did not intend for an FDA determination under section
801(q) of the FD&C Act to apply to meat, poultry, and egg products that
at the time of importation are subject to USDA requirements under the
MPIA, PPIA, and EPIA, respectively. We therefore conclude that final
Sec.  1.601(d)(2) is consistent with Congress's intent in promulgating
section 403 of FSMA.