Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications, 45781-45839 [2013-17994]

Agencies

• Food and Drug Administration
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 78, Number 145 (Monday, July 29, 2013)]
[Proposed Rules]
[Pages 45781-45839]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-17994]



[[Page 45781]]

Vol. 78

Monday,

No. 145

July 29, 2013

Part IV





Department of Health and Human Services





-----------------------------------------------------------------------





Food and Drug Administration





-----------------------------------------------------------------------





21 CFR Part 1 and 16





Accreditation of Third-Party Auditors/Certification Bodies to Conduct 
Food Safety Audits and to Issue Certifications; Proposed Rule

Federal Register / Vol. 78, No. 145 / Monday, July 29, 2013 / 
Proposed Rules

[[Page 45782]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

21 CFR Parts 1 and 16

[Docket No. FDA-2011-N-0146]
RIN 0910-AG66


Accreditation of Third-Party Auditors/Certification Bodies to 
Conduct Food Safety Audits and to Issue Certifications

AGENCY: Food and Drug Administration, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA) is amending its 
regulations to provide for accreditation of third-party auditors/
certification bodies to conduct food safety audits of foreign food 
entities, including registered foreign food facilities, and to issue 
food and facility certifications, under the FDA Food Safety 
Modernization Act (FSMA). Use of accredited third-party auditors/
certification bodies and food and facility certifications will help FDA 
prevent potentially harmful food from reaching U.S. consumers and 
thereby improve the safety of the U.S. food supply. FDA also expects 
that these regulations will increase efficiency by reducing the number 
of redundant food safety audits.

DATES: Submit either electronic or written comments on the proposed 
rule by November 26, 2013.

ADDRESSES: You may submit comments, identified by Docket No. FDA-2011-
N-0146 and/or Regulatory Information Number (RIN) 0910-AG66, by any of 
the following methods.

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.

Written Submissions

    Submit written submissions in the following ways:
     Mail/Hand delivery/Courier (for paper or CD-ROM 
submissions): Division of Dockets Management (HFA-305), Food and Drug 
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
    Instructions: All submissions received must include the Agency name 
and Docket No. FDA-2011-N-0146 and/or RIN 0910-AG66 for this 
rulemaking. All comments received may be posted without change to 
https://www.regulations.gov, including any personal information 
provided. For additional information on submitting comments, see the 
``Comments'' heading of the SUPPLEMENTARY INFORMATION section of this 
document.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov and insert the 
docket number, found in brackets in the heading of this document, into 
the ``Search'' box and follow the prompts and/or go to the Division of 
Dockets Management, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.

FOR FURTHER INFORMATION CONTACT: Charlotte A. Christin, Office of the 
Commissioner, Office of Policy, Food and Drug Administration, 10903 New 
Hampshire Ave., Bldg. 32, Rm. 4234, Silver Spring, MD 20993, 240-402-
3708.

SUPPLEMENTARY INFORMATION:

Executive Summary

Purpose of the Proposed Rule

    This proposed rule, if finalized, will help FDA ensure the 
competence and independence of third-party auditors/certification 
bodies who conduct foreign food safety audits. It also will help ensure 
the reliability of food and facility certifications issued by third-
party auditors/certification bodies that FDA will use in making certain 
decisions relating to imported food (including pet food and animal 
feed). These certifications include, for example, food certifications 
required by FDA as a condition of granting admission to a food 
determined to pose a safety risk. Having comprehensive oversight of a 
credible and reliable program for third-party audits and certifications 
of foreign food facilities will help FDA prevent potentially harmful 
food from reaching U.S. consumers and thereby improve the safety of the 
U.S. food supply. We believe that a trusted program for foreign food 
safety audits and food and facility certifications--with clear 
requirements, standards, and procedures and operated under government 
oversight--will be appealing to accreditation bodies, auditors/
certification bodies, and foreign food facilities. Widespread 
participation and broad acceptance of audits and certifications under 
the FDA program will help increase efficiency and reduce costs, by 
eliminating redundant auditing to assess foreign suppliers' compliance 
with the Federal Food, Drug, and Cosmetic Act (the FD&C Act).
    FSMA adds section 808 to the FD&C Act (21 U.S.C. 384d), which 
directs us to establish a new program for accreditation of third-party 
auditors \1\ conducting food safety audits and issuing food and 
facility certifications to eligible foreign entities (including 
registered foreign food facilities) that meet our applicable 
requirements. Under this provision, we will recognize accreditation 
bodies to accredit third-party auditors/certification bodies, except 
for limited circumstances in which we may directly accredit auditors/
certification bodies to participate in the accredited third-party 
audits and certification program.
---------------------------------------------------------------------------

    \1\ Section 808 of the FD&C Act uses the term ``auditor'' to 
describe an entity that conducts audits and issues certifications. 
We propose to use the term ``auditor/certification body,'' which 
adds the words ``certification body'' to better comport with the 
terminology used by the food industry and the international 
standards community when describing organizations that not only 
conduct audits but also issue certifications based on audit results. 
We will use the statutory term only when referring to the 
requirements of section 808 of the FD&C Act.

---------------------------------------------------------------------------

[[Page 45783]]

[GRAPHIC] [TIFF OMITTED] TP29JY13.008

    We will use certifications issued by accredited third-party 
auditors/certification bodies in deciding whether to admit certain 
imported food into the United States that FDA has determined poses a 
food safety risk and in deciding whether an importer is eligible to 
participate in a program for expedited review and entry of food 
imports. We will exercise oversight of the accredited third-party 
audits and certification program and can remove an accreditation body 
or an auditor/certification body for good cause, by revoking 
recognition of the accreditation body or by withdrawing accreditation 
of the third-party auditor/certification body.
    We must issue implementing regulations that include measures to 
protect against conflicts of interest and must issue model 
accreditation standards that third-party auditors/certification bodies 
must meet to qualify for accreditation.\2\ The statute directs us to 
look to existing standards for guidance when developing these model 
accreditation standards.
---------------------------------------------------------------------------

    \2\ We will issue draft model accreditation standards to specify 
the qualifications for accreditation, such as the minimum 
requirements for education and experience for third-party auditors/
certification bodies (and their audit agents) to qualify for 
accreditation. We will open a public docket to accept comments on 
the draft standards and plan to take necessary procedural steps to 
finalize the model standards.
---------------------------------------------------------------------------

Summary of the Major Provisions of the Proposed Rule

    This proposal contains eligibility requirements for accreditation 
bodies to qualify for recognition and requirements that accreditation 
bodies choosing to participate in the FDA program must meet, once 
recognized. It also contains eligibility requirements for third-party 
auditors/certification bodies to qualify for accreditation and 
requirements that third-party auditors/certification bodies choosing to 
participate in the FDA program must meet, once accredited. These 
requirements will ensure the competence and independence of the 
accreditation bodies and third-party auditors/certification bodies 
participating in the program for accredited third-party audits and 
certification that is established under this subpart.
    This proposal contains procedures for recognition and 
accreditation, as well as requirements relating to monitoring and 
oversight of participating accreditation bodies and auditors/
certification bodies. These include procedures that we will follow when 
removing an auditor/certification body or an accreditation body from 
the program. The proposed rule contains requirements relating to 
auditing and certification of foreign food facilities under the program 
and for notifying us of conditions in an audited facility that could 
cause or contribute to a serious risk to the public health. The 
proposed requirements for monitoring, oversight, and notification are 
needed to give us, consumers, and other stakeholders confidence in the 
program and in the accredited third-party auditors/certification bodies 
and recognized accreditation bodies who participate.
    The proposal also implements the authority granted by Congress in 
section 801(q) of the FD&C Act (21 U.S.C. 381(q)) to make a risk-based 
determination to require, as a condition of admissibility, that a food 
imported or offered for import into the United States be accompanied by 
a certification or other assurance that the food meets the applicable 
requirements of the FD&C Act. This clear authority to require

[[Page 45784]]

import certification for food, based on risk, is one of the tools we 
can use to help prevent potentially harmful food from reaching 
consumers.
    In addition, this document proposes requirements for accredited 
third-party auditors/certification bodies to follow when issuing 
facility certifications that will be used by importers to establish 
eligibility for the Voluntary Qualified Importer Program (VQIP) under 
section 806 of the FD&C Act (21 U.S.C. 384b(a)). The VQIP program 
offers participating importers expedited review and entry of food from 
facilities audited and certified by third-party auditors/certification 
bodies accredited under this subpart.

Costs and Benefits

    We summarize the annualized costs (over a 10-year time period 
discounted at both 3 percent and 7 percent) of the third-party proposed 
rule in Table 1. We are unable to estimate quantitatively the benefits 
of the proposed rule. Although this proposed rule would not itself 
establish safety requirements for imported food, it would benefit the 
public health by helping to ensure that imported food is produced in 
compliance with applicable requirements of the FD&C Act.
    The Preliminary Regulatory Impact Analyses for the proposed rules 
on Current Good Manufacturing Practice and Hazard Analysis and Risk-
Based Preventive Controls for Human Food (Preventive Controls) \3\ and 
the Standards for the Growing, Harvesting, Packing, and Holding of 
Produce for Human Consumption (Produce Safety) \4\ consider and analyze 
the number of illnesses and deaths that those proposed regulations are 
aimed at reducing. The greater the compliance with the Preventive 
Controls and Produce Safety proposed regulations, the greater the 
reduction in illnesses and deaths and associated costs expected.
---------------------------------------------------------------------------

    \3\ The Preventive Controls proposed rule was published in the 
Federal Register on January 16, 2013 (78 FR 3646).
    \4\ The Produce Safety proposed rule was published in the 
Federal Register on January 16, 2013 (78 FR 3503).
---------------------------------------------------------------------------

    This proposed rule would be an important mechanism for improving 
and ensuring compliance with the Preventive Controls and Produce Safety 
proposed regulations as they would apply to imported food. For this 
reason, we account for its public health benefits in the economic 
analyses for those proposed rules and other applicable food safety 
regulations, instead of in the analysis for this proposed rule.

                            Table 1--Summary of Annualized Costs of the Proposed Rule
----------------------------------------------------------------------------------------------------------------
                       Third party accreditation costs                            3 Percent         7 Percent
----------------------------------------------------------------------------------------------------------------
Third Party Accreditation Costs for All Participants........................       $55,548,432       $56,756,016
Third Party Accreditation Costs for FDA.....................................        17,063,089        17,640,083
                                                                             -----------------------------------
    Total Costs.............................................................        72,611,521        74,396,099
----------------------------------------------------------------------------------------------------------------

Table of Contents

I. Introduction
II. Background
    A. Legal Authority
    B. FDA Initiatives on Third Parties
    C. FDA's Use of Certifications for Food
    D. External Recommendations on Third-Party Certification for 
Food
    E. FDA Standards for Assessing Capabilities of Food Safety 
Systems
    F. U.S. Government Policies on Consensus Standards and 
Conformity Assessment
G. Industry Practices on Benchmarking Standards and Third-Party 
Audits and Certification for Food and Food Facilities
III. FSMA Imports Public Meeting and Stakeholder Input
IV. Purpose and Description of the Proposed Rule
    A. Proposed Revisions to Part 1, New Subpart
    B. Proposed Revisions to Part 16
V. Analysis of Environmental Impact
VI. Federalism
VII. Comments
VIII. References

I. Introduction

    Each year, about 48 million Americans (1 in 6) get sick, 128,000 
are hospitalized, and 3,000 die from food-borne diseases, according to 
recent estimates from the Centers for Disease Control and Prevention 
(CDC). CDC food-borne illness outbreak data also show that an increased 
number of outbreaks due to imported foods were reported during the most 
recent years of surveillance. During 2005-2010, 39 outbreaks with 2,348 
illnesses were reported where the implicated food was imported into the 
United States, representing 1.5 percent of reported outbreaks during 
that time. Of the 39 import-associated outbreaks, more were reported in 
2009 and 2010 (n=6 and 8 outbreaks, respectively) than were reported in 
each of the years between 2005 and 2008. A greater percentage of the 
import-related outbreaks were multistate outbreaks as compared to the 
overall percentage of multistate outbreaks reported (Ref. 1).\5\
---------------------------------------------------------------------------

    \5\ The CDC abstract on Foodborne Disease Outbreaks Associated 
with Food Imported Into the United States, 2005-2010 (Ref. 1) 
discussed 23 reported outbreaks with 1,994 illnesses associated with 
imported foods. These data were updated for a presentation at the 
International Conference on Emerging Infectious Diseases, to reflect 
the numbers discussed in this proposed rule.
---------------------------------------------------------------------------

    President Obama signed FSMA (Pub. L.111-353) into law on January 4, 
2011. FSMA enables us to better protect public health by helping to 
ensure the safety and security of the U.S. food supply. The Web page 
describing our FSMA implementation activities is at https://www.fda.gov/fsma.
    Among other things, FSMA gave us important new tools to better 
ensure the safety of imported foods, which constitute approximately 15 
percent of the U.S. food supply (including 80 percent of our seafood, 
50 percent of our fresh fruit, and 20 percent of our vegetables). We 
place high priority on ensuring the accountability of importers to 
verify the safety of food produced overseas and to establish a new 
program for third-party auditing and certification of regulated foreign 
food firms. (By way of background, third-party audits are conducted by 
an entity independent of the audited firm or those who buy its 
products. Second-party audits are conducted by buyers for their 
suppliers and contractors or by one division within a firm of another 
division within the same firm. First-party audits are internal audits a 
firm conducts itself. This proposed regulation relates only to third-
party audits.)
    In this document, we propose requirements for third-party auditors/
certification bodies choosing to become accredited to conduct food 
safety audits and to issue food and facility certifications to eligible 
foreign entities under this FDA program.
    The preamble that follows provides background on the following: (1) 
The FSMA requirement to establish an accredited third-party auditing 
and

[[Page 45785]]

certification program for food and related FSMA provisions, (2) other 
initiatives on third parties, (3) use of food certifications, (4) 
recommendations from external stakeholders on third-party 
certifications for food, (5) standards for assessing programs for 
oversight of food safety, (6) U.S. government policies on consensus 
standards and conformity assessment, and (7) industry programs for 
benchmarking standards and for auditing and certification for food 
facilities and their food. We seek comments on all aspects of this 
proposal.

II. Background

A. Legal Authority

1. Accreditation of Third-Party Auditors/Certification Bodies
    Section 307 of FSMA, Accreditation of Third-Party Auditors, amends 
the FD&C Act (21 U.S.C. 384d) to create a new provision, section 808, 
under the same name. Section 808(b)(1)(A) of the FD&C Act requires us 
to establish a system, within 2 years of enactment, for the recognition 
of accreditation bodies that accredit third-party auditors to conduct 
food safety audits and to issue certifications for eligible foreign 
food entities and their products.
    Section 808(b)(1)(A)(ii) of the FD&C Act further authorizes us to 
directly accredit third-party auditors if we have not identified and 
recognized an accreditation body that meets the requirements of the 
section within 2 years after establishing the system for recognition. 
If those conditions are met, we may begin to directly accredit third-
party auditors.
    Section 808(c)(5)(C) of the FD&C Act directs us to issue 
implementing regulations for section 808 not later than 18 months after 
enactment (i.e., by July 4, 2012). The regulations must require audits 
to be unannounced and must contain protections against conflicts of 
interest between accredited auditors (and their audit agents) and the 
entities they audit or certify, including requirements on timing and 
public disclosure of fees and appropriate limits on financial 
affiliations. (21 U.S.C. 384d(c)(5)(C)(ii) and (c)(5)(C)(iii)). In 
addition, the regulations must require audits to be unannounced (21 
U.S.C. 384d(c)(5)(C)(i)).
    Section 808(b)(2) of the FD&C Act contains an additional 
requirement to develop model accreditation standards to qualify third-
party auditors for accreditation under this FDA program. The statute 
describes the model accreditation standards in terms of requirements an 
auditor must meet to qualify for accreditation. We are including in 
this proposed rule a framework for the model accreditation standards. 
We currently are developing the Model Accreditation Standards document, 
which elaborates on the framework and details the qualifications 
required for accreditation. We are considering existing international 
standards and particularly the work of the International Organization 
for Standardization Committee on conformity assessment (ISO/CASCO). For 
example, we are considering minimum requirements for education and 
experience of auditors/certification bodies. We plan to issue draft 
model standards for public comment, before finalizing them.
2. Voluntary Qualified Importer Program
    Facility certifications (as described in sections 806(a) and 
808(c)(2) of the FD&C Act) will be used by FDA to help determine 
whether a facility is eligible to be a facility from which food may be 
offered for import under VQIP. The criteria and procedures for VQIP 
participation are outside the scope of this rulemaking. FDA plans to 
issue guidance on VQIP and will solicit public comment on VQIP at that 
time.
3. Authority To Require Import Certifications for Food
    Food certifications (as described in sections 801(q) and 808(c)(2) 
of the FD&C Act) will be required to meet a condition for admitting a 
food into the United States under section 801(a) of the FD&C Act, where 
necessary based on our determination of the risk of the food. 
Specifically, section 801(q) of the FD&C Act gives us express authority 
to require such certification based on a determination that includes 
the following factors:
     The known safety risks associated with the food;
     The known food safety risks associated with the country, 
territory, or region of origin (area of origin) of the food;
     A finding we make, supported by scientific, risk-based 
evidence, that:
    [cir] The food safety programs, systems, and standards in the area 
of origin of the food are inadequate to ensure that the article of food 
is as safe as a similar article of food that is manufactured, 
processed, packed, or held in the United States, in accordance with the 
requirements of the FD&C Act; and
    [cir] The certification would assist us in determining whether to 
refuse or admit the article of food into the United States; and
     Information submitted to us, under section 801(q)(7) of 
the FD&C Act, regarding improvements to a food safety program, system, 
or standard we previously found inadequate and demonstrating that those 
controls are adequate to ensure that an article of food is as safe as a 
similar article of food that is manufactured, processed, packed, or 
held in the United States under the requirements of the FD&C Act.
    In addition to giving FDA authority to require food certifications, 
section 801(q) of the FD&C Act grants FDA authority to require, 
alternatively, ``such other assurance'' as FDA determines appropriate, 
that the food complies with applicable requirements of the FD&C Act. 
When making a determination on whether mandatory certification is 
appropriate, we will consider the statutory factors in light of the 
specific circumstances involved and will evaluate various types of 
relevant information/evidence. We intend to exercise our authority 
under section 801(q) of the FD&C Act judiciously and in conjunction 
with our array of other available enforcement tools.
    Section 801(q)(3) of the FD&C Act states the food certifications or 
other assurances used for purposes of section 801(a) of the FD&C Act 
may be issued by third-party auditors accredited under section 808 of 
the FD&C Act or by the government of the country from which such food 
originated, if we so designate (21 U.S.C. 381(q)(3)). The 
certifications or other assurances may take the form of shipment-
specific certificates, a listing of certified facilities that 
manufacture, process, pack, or hold such food, or in such other form as 
we may specify.
    Section 801(q) of the FD&C Act became effective upon enactment of 
FSMA in 2011 and is expressly linked to the accreditation of third-
party auditors/certification bodies that is the subject of this 
proposed rule.
4. Compliance With International Agreements
    FSMA section 404 (21 U.S.C. 2252) states that nothing in the 
statute should be construed in a manner ``inconsistent with'' the 
agreement establishing the World Trade Organization (WTO) or any other 
treaty or international agreement to which the United States is a 
party.
    FSMA was notified to the WTO on February 14, 2011 (G/SPS/N/USA/
2156) (Ref. 2), to provide information on the FD&C Act to WTO members. 
The notification included an electronic mailbox link to receive 
comments from members. Several comments have been received via the 
mailbox. The comments

[[Page 45786]]

note a high degree of interest in FSMA implementation, particularly 
with respect to how implementation will impact developing countries.
    Third-party certification for food is recognized as increasingly 
important for developing nations to gain market access for their 
products. Several international development agencies are focusing 
efforts in this area. The United Nations Industrial Development 
Organization, for example, is supporting the development of conformity 
assessment bodies and accreditation bodies in several developing 
nations (Ref. 3). The U.S. Agency for International Development has 
offered its assistance and support for developing nation governments to 
take a more proactive role in accreditation services, standards 
development, and institutional infrastructure to assist and protect 
their nationals operating in international food markets (Ref. 4).
5. Other Provisions of the Federal Food, Drug, and Cosmetic Act
    The authority for this proposed rule also derives from section 
701(a) of the FD&C Act (21 U.S.C. 371(a)), which authorizes us to issue 
regulations for the efficient enforcement of the FD&C Act. Regulations 
for ensuring the competency and independence of recognized 
accreditation bodies and of accredited third-party auditors/
certification bodies will help assure us of the validity and 
reliability of certifications and other information resulting from the 
food safety audits they conduct. We will accept certifications issued 
by accredited third-party auditors/certification bodies for the two 
purposes identified in section 808 of the FD&C Act: To establish 
eligibility for VQIP participation; and to meet a condition of 
admissibility for imported food subject to a mandatory certification 
requirement. We also can use information from such audits for other 
related purposes in enforcing the FD&C Act. For example, we propose to 
allow importers to use reports of regulatory audits conducted by 
accredited third-party auditors/certification bodies in meeting any 
requirements for onsite audits of foreign suppliers, under the proposed 
rule entitled, ``Foreign Supplier Verification Programs for Importers 
of Food for Humans and Animals'' (FSVP), published elsewhere in this 
issue of the Federal Register.

B. FDA Initiatives on Third Parties

1. Notice Requesting Comments on Third-Party Certification for Food and 
Feed
    In the Federal Register of April 2, 2008 (73 FR 17989), we issued a 
notice (2008 notice) requesting comments on the benefits, obstacles, 
and availability of third-party certification programs for food and 
animal feed. At the time, an increasing number of retailers and food 
services providers had begun to ask their foreign and domestic 
suppliers to become certified to their buyers' requirements for safety 
and quality. Suppliers (such as producers, comanufacturers, and 
repackers) also were increasingly looking to third-party certification 
programs as a means to verify compliance with U.S. regulatory 
requirements, even without requirements from buyers.
    In the 2008 notice, we asked questions about existing certification 
programs and criteria, as well as obstacles and incentives for 
participating in these voluntary programs. We received approximately 70 
comments in response. The comments generally supported the use of 
third-party certification programs and suggested that our 
acknowledgment of such programs would provide additional incentives for 
participation. Further discussion of the comments on the 2008 notice is 
available in the ``Background'' section of the subsequently issued 
draft ``Guidance for Industry on Voluntary Third-Party Certification 
Programs for Foods and Feeds'' and is described in section II.B.2.
2. FDA Guidance on Third-Party Certification for Food and Feed
    In the Federal Register of July 10, 2008 (73 FR 39704), we 
announced the availability of the draft ``Guidance for Industry on 
Voluntary Third-Party Certification Programs for Foods and Feeds.'' The 
draft guidance describes the general attributes of a voluntary third-
party certification program needed to help ensure that certification is 
a reliable verification that food from certified establishment meets 
applicable requirements.
    We finalized the guidance in January 2009, announcing its 
availability in the Federal Register of January 16, 2009 (74 FR 3058) 
(2009 Guidance) (Ref. 5). The 2009 Guidance describes the general 
attributes we believe a third-party certification program should have 
to give us confidence in the reliability of its certifications. It also 
explains our vision, prior to FSMA enactment, of how we might use such 
voluntary third-party certifications to assist in determining 
inspection, field exam, and sampling priorities, as well as in making 
admissibility decisions for imported food. We intend to withdraw the 
2009 Guidance upon publication of a final rule for accredited third-
party certification.
3. Pilot Project on Third-Party Certification for Aquacultured Shrimp
    In the Federal Register of July 10, 2008 (73 FR 39705), we 
published a notice inviting third-party certification bodies to 
participate in a pilot of voluntary third-party certification of 
aquacultured shrimp (shrimp pilot). The goal of the shrimp pilot was to 
gain knowledge and experience with third-party certification to assist 
us in evaluating the utility and feasibility of using third-party 
certification programs as part of our oversight of foreign food firms.
    The pilot data indicate that having the appropriate FDA 
infrastructure, including logistical and resource support, will be 
critical to the success of any full-scale accredited third-party 
certification program (Ref. 6). The role we played in the shrimp pilot 
was analogous to the role traditionally played by an accreditation 
body, monitoring the performance of certification bodies. The pilot 
demonstrated to us that direct accreditation, in which we ourselves 
accredit and provide direct oversight of a potentially unlimited number 
of third-party certification bodies, would be costly and 
administratively burdensome, though direct accreditation may be 
appropriate in limited circumstances, as will be discussed in section 
IV.A.8.
4. FDA Third-Party Program for Mammography
    In developing this proposed rule, we reviewed other Agency third-
party programs, including the FDA program, required by the Mammography 
Quality Standards Act of 1992 (Pub. L. 102-539) (as amended), to 
approve accreditation bodies to evaluate and accredit mammography 
facilities based upon quality standards. Only facilities that are 
accredited by, or undergoing accreditation by, an accreditation body we 
approved, may receive our certificates (or the certificates of a State 
certifying agency we approved) to legally perform mammography (Ref. 7).

C. FDA's Use of Certifications for Food

    For years, we have used certification as a tool for verifying that 
imported foods comply with our food safety requirements and reducing 
the need for

[[Page 45787]]

us to sample at entry. Since the late 1980s, for example, the Export 
Inspection Council of the Indian Ministry of Commerce has sampled, 
analyzed, and issued certificates of conformance for lots of black 
pepper exported directly to the United States. Indian black pepper 
shipments accompanied by such certifications are not subject to 
detention without physical examination under FDA Import Alert 28-02 
(Ref. 8). Under Memoranda of Understanding (MOUs) with several foreign 
governments, we rely upon certifications that caseins and caseinates, 
and mixtures thereof, to be exported to the United States are in 
compliance with our requirements, which are intended to minimize the 
need for us to extensively sample certified products (Ref. 9). These 
are but a few examples of the ways we rely on certifications as a means 
to help assure that an article of food complies with our requirements 
and to minimize the need for extensive sampling at entry.

D. External Recommendations on Third-Party Certification for Food

    In September 2012, the Government Accountability Office (GAO) 
issued a report discussing possible challenges associated with 
establishing and administering the accredited third-party certification 
program, including: offering incentives to encourage participation; 
meeting challenges associated with creating a new program; addressing 
stakeholder concerns; and conducting oversight of the program, once 
established (Ref. 10). We believe this proposed rule addresses the 
relevant challenges identified by GAO.
    In June 2010, a committee of experts convened by the Institute of 
Medicine and the National Research Council (IOM/NRC committee) released 
a report examining gaps in public health protection afforded by the 
farm-to-table food safety system under our purview and identifying 
opportunities to fill those gaps (Ref. 11). The IOM/NRC committee 
concluded that we need to address barriers to improving the efficiency 
of inspections by, among other things, exploring third-party auditing 
of food facilities as an alternative model for measuring compliance. 
The IOM/NRC committee's report specifically recommended that we 
consider the implications of accepting inspection data from third-party 
auditors inspecting facilities for compliance with food safety 
regulatory requirements. The IOM/NRC report also stated that, if we use 
this approach, we should set minimum standards for such auditors and 
audits, with oversight and implementation being assigned to an 
accreditation and standards body.

E. FDA Standards for Assessing Capabilities of Food Safety Systems

    In developing the framework for recognition of accreditation bodies 
and accreditation of third-party auditors required by section 808 of 
the FD&C Act, we looked at our existing standards for assessing the 
capabilities of food safety systems at the State level, through the 
Manufactured Foods Regulatory Program Standards (MFRPS) (Ref. 12). The 
MFRPS establish a uniform foundation for the design and management of 
high-quality State regulatory programs for food manufacturers, focusing 
on ten key areas: (1) Regulatory foundation; (2) inspector training 
program; (3) risk-based inspection program; (4) audits of the 
inspection program; (5) protocols for food-related illnesses, 
outbreaks, and response; (6) compliance and enforcement program; (7) 
industry and other stakeholder relations; (8) program resources; (9) 
program assessment; and (10) laboratory support.
    We also considered a FDA-New Zealand pilot project for assessing 
food safety systems, authority, oversight and monitoring that was 
discussed at a public hearing in March 2011 (Ref. 13). We found 
particularly useful the draft FDA International Comparability 
Assessment Tool (ICAT) used in reviewing New Zealand's food safety 
regulatory system to determine if it provides a similar set of 
protections to that of FDA (Ref. 14). Following the successful 
completion of the New Zealand comparability pilot, in late 2012 FDA 
launched a bilateral pilot project with the Canadian Food Inspection 
Agency (CFIA) on systems recognition (previously known as 
comparability), sharing FDA's draft ICAT as a guide for the systems 
recognition process. FDA and CFIA currently are finalizing their 
respective systems recognition reviews.

F. U.S. Government Policies on Consensus Standards and Conformity 
Assessment

    Implementation of section 808 of the FD&C Act occurs against the 
backdrop of the broader Federal policies on consensus standards and 
conformity assessment under the National Technology Transfer and 
Advancement Act of 1995 (NTTAA) (Public Law 104-113).
    The NTTAA, together with the Office of Management and Budget (OMB) 
Circular A-119, revised February 10, 1998 (Ref. 15), directs Federal 
Agencies to use voluntary consensus standards in lieu of government-
unique standards except where inconsistent with law or otherwise 
impractical. OMB Circular A-119 states that the use of voluntary 
standards, whenever practicable and appropriate, is intended to 
eliminate the cost to government of developing its own standards and 
decrease the cost of goods procured and the burden of complying with 
Agency regulation; provide incentives and opportunities to establish 
standards that serve national needs; encourage long-term growth for 
U.S. enterprises and promote efficiency and economic competition 
through harmonization of standards; and further the policy of reliance 
upon the private sector to supply government needs for goods and 
services.
    In addition, the U.S. Government has issued a National Standards 
Policy and Federal guidance on conformity assessment activities (which 
are defined as activities concerned with determining directly or 
indirectly that requirements for products, services, systems, and 
organizations are fulfilled) (15 CFR 287.2).
    As directed by OMB in Circular A-119 (Ref. 15), the National 
Institute of Standards and Technology (NIST), in the Federal Register 
of August 10, 2000 (65 FR 48894), issued policy guidance on Federal 
conformity assessment activities (Federal conformity assessment 
guidance) (codified at 15 CFR part 287). The guidance applies to all 
Federal Agencies that set policy for, manage, operate, or use 
conformity assessment activities or results, domestically and 
internationally (except for activities conducted pursuant to treaties) 
and is intended to eliminate unnecessary duplication and complexity in 
conformity assessment requirements. (We note that OMB has announced it 
is currently revising Circular A-119, and NIST is revising the Federal 
conformity assessment guidance (Ref. 16)).
    The current Federal conformity assessment guidance provides for 
Federal Agencies to use, where appropriate, relevant guides or 
standards for conformity assessment \6\ practices from domestic and 
international standardizing bodies such as the Codex Alimentarius 
Commission (Codex),\7\ the International Organization

[[Page 45788]]

for Standardization (ISO)/International Electrotechnical Commission 
(IEC),\8\ and the American National Standards Institute (ANSI). The 
guidance also notes that each Agency retains the responsibility, and 
authority, to select the conformity assessment activities and 
procedures (e.g., guides and standards) that will best meet its 
legislative mandates and programmatic objectives (15 CFR part 287).
---------------------------------------------------------------------------

    \6\ ISO/IEC 17000:2004, Conformity assessment--Vocabulary and 
general principles (Ref. 17) defines ``conformity assessment'' as 
``demonstration that specified requirements relating to a product, 
process, systems, person or body are fulfilled.
    \7\ The Codex Alimentarius Commission, established by Food and 
Agriculture Organization of the United Nations (FAO) and the World 
Health Organization (WHO) in 1963 develops harmonized international 
food standards, guidelines and codes of practice to protect the 
health of the consumers and ensure fair trade practices in the food 
trade. The Commission also promotes coordination of all food 
standards work undertaken by international governmental and non-
governmental organizations. See, https://www.codexalimentarius.org/codex-home/en/.
    \8\ ISO is a voluntary, consensus, standards developer with 
standards covering many aspects of technology and business, 
including food safety. See, https://www.iso.org/iso/home/about.htm.
---------------------------------------------------------------------------

    In developing this proposed rule, we considered several voluntary 
consensus standards, specifically ISO/IEC 17000: 2004, Conformity 
assessment--Vocabulary and general principles (Ref. 17) and ISO/IEC 
17011: 2004, Conformity assessment--General requirements for 
accreditation bodies accrediting conformity assessment bodies (Ref. 
18), which contains the following major elements: (1) Legal 
responsibility, structure, and impartiality; (2) management systems, 
including records, internal audits, nonconformities, and corrective 
actions; (3) personnel associated with the accreditation body, 
personnel associated with the accreditation process, and monitoring 
performance assessments of accreditation personnel; (4) the 
accreditation process; and (5) and roles and responsibilities of the 
accreditation body and the certification body. We will address elements 
of ISO/IEC 17011: 2004 that are relevant to this rule in our discussion 
of the proposed requirements for accreditation bodies in section IV.A.2 
through IV.A.4.
    In addition, we considered other ISO/IEC 17021: 2011, Conformity 
assessment--Requirements for bodies providing audit and certification 
of management systems (Ref. 19), which contains similar requirements 
for bodies auditing management systems: (1) Legal matters and 
contractual matters; (2) impartiality; (3) structural requirements; (4) 
resource requirements, including competence of management and 
personnel; (5) monitoring and surveillance; (6) internal audits; and 
(7) records.
    We also considered ISO/IEC Guide 65: 1996, General requirements for 
bodies operating product certification systems (Ref. 20).\9\ ISO also 
has issued the 22000 series of standards for food safety management 
systems, including ISO/TS 22003: 2007, Food safety management systems--
Requirements for bodies providing audit and certification of food 
safety management systems (Ref. 21).\10\
---------------------------------------------------------------------------

    \9\ Subsequently, ISO/IEC Guide 65:1994 (Ref. 20) was updated 
and incorporated into ISO/IEC 17065.
    \10\ This series includes standards the food industry uses in 
establishing and maintaining its food safety management systems and 
also the standards that auditors/certification bodies use in 
assessing those systems.
---------------------------------------------------------------------------

    These standards are among the relevant information we used in 
developing this proposed rule. We do not propose to incorporate these 
standards by reference into our regulations, because they contain 
additional requirements that are not relevant to our program and might 
unnecessarily create disincentives to participation. A copy of each of 
these ISO standards has been placed in the docket for this rulemaking 
and is made available at the Division of Dockets Management at address 
listed in the ADDRESSES section of this document. The standards also 
are available electronically by purchase from ISO, at https://www.iso.org.
    As described more fully in section III, we developed this proposed 
rule having received information and input from a broad range of 
stakeholders that included public and private members of the standards 
community. We met with representatives of other U.S. Government 
agencies and foreign governments and participated in listening sessions 
requested by stakeholders wishing to share their views on section 808 
of the FD&C Act.
    We believe the proposal aligns with the NTTAA, the National 
Standards Policy, and current versions of OMB Circular A-119 (Ref. 15) 
and the Federal conformity assessment guidance (15 CFR part 287), in 
relying upon the principles of voluntary consensus standards currently 
used globally and domestically by the food industry, the international 
standards community, and conformity assessment bodies.
    Under the guidance at 15 CFR 287.4(b), we seek comment on the 
rationale for the conformity assessment decisions we have made in 
developing this proposal. In particular, we seek comment on whether the 
voluntary consensus standards we cite are the appropriate standards 
upon which to base this rulemaking. If alternative standards are 
suggested, we request that copies of any such standards be submitted 
along with the comment(s).

G. Industry Practices on Benchmarking Standards and Third-Party Audits 
and Certification for Food and Food Facilities

    As a result of consolidation within the food industry and the 
globalization of the marketplace, coupled with some high-profile food 
safety incidents, many food retailers and food service providers began 
to require their suppliers to be audited against their standards (more 
commonly known as ``buyer requirements'') (Ref. 11). Some of these 
supplier audits were conducted by auditors/certification bodies 
employed by, or acting as agents of, buyers. Other auditors were third 
parties, independent of both buyers and suppliers.
    As buyers increasingly relied on audits to assess compliance with 
their safety requirements, more and more suppliers began to face 
multiple food safety audits. The proliferation of buyers' requirements 
created inefficiencies that ultimately spurred several efforts to 
harmonize audits. These include the Global Food Safety Initiative 
(GFSI), which was established in 2000 by a group of international 
retailers (Ref. 22). GFSI benchmarks food safety schemes \11\ against a 
harmonized set of key elements for food safety and management systems. 
GFSI's benchmarking guidance (Ref. 23), and indeed many of the food 
safety schemes it benchmarks, use Codex as their foundational 
standards.
---------------------------------------------------------------------------

    \11\ A food safety scheme generally includes the food safety 
standard against which a food facility is assessed and the 
management system associated with the standard.
---------------------------------------------------------------------------

    GFSI's benchmarking assesses a scheme's food safety standards and 
the governance and management structure of the food safety scheme 
owner, such as technical competence, safeguards against conflicts of 
interest, and procedures for accreditation bodies to oversee the 
certification bodies that audit and issue certifications under the food 
safety scheme (Ref. 23). For example, the U.S.-based American National 
Standards Institute (ANSI) currently provides accreditation services 
for three GFSI-benchmarked food safety schemes: The Food Marketing 
Institute's Safe Quality Food Initiative scheme, the British Retail 
Consortium scheme, and the Global GAP scheme (Ref. 24). As is discussed 
in the Preliminary Regulatory Impact Analysis (Ref. 25) for this 
proposed rule, dozens of accreditation bodies worldwide accredit 
certification bodies to conduct food safety audits. Both large and 
small suppliers are increasingly relying on third-party audits and 
certification as a means to ensure

[[Page 45789]]

market access for their food products. In addition, domestic and 
foreign suppliers (such as producers, comanufacturers, or repackers) 
are increasingly looking to third-party certification programs to 
assist them in verifying that their facilities and food meet applicable 
food safety standards, whether private food safety schemes such as 
those benchmarked by GFSI or public standards such as the FD&C Act 
requirements, which are the relevant standards for purposes of the FDA 
accredited third-party audit and certification program. The Federal 
Government recognizes that rigorous voluntary certification programs 
can provide assurance that products meet U.S. requirements. Currently, 
private food and facility certifications are frequently used but can 
result in duplicate audits and certifications. Under this proposal, FDA 
will oversee a certification program that will, we believe, create 
efficiencies by reducing the number of redundant food safety audits and 
by allowing us to better target resources for verifying compliance with 
applicable requirements.

III. FSMA Imports Public Meeting and Stakeholder Input

    Since enactment of FSMA, we have reached out to stakeholders in the 
food industry, the international community, standards organizations, 
accreditation and certification bodies, consumer groups, government 
agencies, and other interested parties to gain input and perspective on 
how best to implement FSMA. Among those activities, on March 29, 2011, 
we held a public meeting with stakeholders to discuss the 
implementation of the FSMA import safety provisions, including section 
808 of the FD&C Act on accredited third-party certification. For 
additional information about this public meeting, including the agenda, 
transcripts, and an archived webcast, see https://www.fda.gov/Food/FoodSafety/FSMA/ucm249257.htm.
    In conjunction with the public meeting, we opened a public docket, 
with notice in the Federal Register of March 14, 2011 (76 FR 13643), 
soliciting comments on implementation of section 808 of the FD&C Act 
and other import provisions added or amended by FSMA. We received 
several comments on accredited third-party certification, from a 
variety of stakeholders including a foreign authority (1); trade 
associations (11); auditors/certification bodies and a laboratory (4); 
consumer groups (3); other non-profits (1); and an individual (1). Some 
common themes emerged, including comments on using existing systems as 
a model; considering impacts on small and medium-sized businesses; 
requiring notification of conditions that could cause or contribute to 
a serious risk to public health; ensuring auditor competency; and 
preventing conflicts of interest. This docket (FDA-2011-N-0146) is 
available electronically at https://www.regulations.gov, or at the 
Division of Dockets Management (see ADDRESSES).
    In addition to attending the public meeting, several stakeholders 
requested meetings to discuss their current programs and to share their 
views and recommendations for implementing section 808 of the FD&C Act. 
These stakeholders represented a broad range of interests, including 
consumer groups, trade associations, auditors/certification bodies and 
laboratories. We also met with representatives of foreign governments, 
as part of ongoing outreach and collaboration with foreign regulatory 
partners. Topics for these meetings included the statutory requirements 
for accreditation of third-party auditors, including FDA's authority to 
directly accredit third-party auditors/certification bodies; \12\ 
voluntary consensus standards and industry practices on accreditation, 
auditing, and certification; and international considerations. 
Additionally, we note that FDA representatives have been invited to 
attend meetings, hosted by stakeholders, which included discussions of 
third-party audits and certifications.
---------------------------------------------------------------------------

    \12\ The docket for this rulemaking contains, as background 
material, a letter from Caroline Smith DeWaal of the Center for 
Science in the Public Interest, which was received after the docket 
for the public meeting closed and before issuance of this proposed 
rule. The letter offers an analysis of FDA's authority for direct 
accreditation.
---------------------------------------------------------------------------

    The input and perspectives gained through each of these 
interactions helped shape this proposed rule. We have identified some 
common themes from these interactions. Most stakeholders expressed 
significant concerns regarding existing capacity of third-party food 
safety auditors/certification bodies and, for some stakeholders, the 
degree of competency demonstrated by the available cadre of auditors/
certification bodies. We recognize that the credibility of the new 
third-party program rests largely on the quality of the auditing and 
certification work performed by accredited third-party auditors/
certification bodies and have attempted to address those concerns in 
this rulemaking.
    In other areas, stakeholders' interests diverged. For example, 
consumer groups expressed a strong interest in transparency of the 
program, including public disclosure of audit reports. Current industry 
practice is to maintain the confidentiality of audit reports except to 
the extent that the audited firm waives confidentiality or where 
otherwise required by law. Industry also has expressed concern about 
the statutory requirement for accredited auditors to notify us of 
conditions in an audited firm that could cause or contribute to a 
serious risk to the public health. Some in industry have taken the 
position that stringent disclosure and transparency requirements may 
dissuade food firms from using third-party auditors/certification 
bodies accredited under our program.
    As an initial matter, we note that we are bound to implement FSMA 
as enacted and to comply with all other applicable disclosure laws 
(e.g., the Freedom of Information Act (FOIA)) (5 U.S.C. 552). Within 
that legal framework, we have balanced the following competing public 
interests: (1) Providing as much information to the public as possible 
about audits of foreign food entities and the performance of accredited 
auditors/certification bodies, so that individuals may assess the 
performance and credibility of the accredited third-party audits and 
certification program; (2) protecting the proprietary interests of food 
entities related to their trade secrets and confidential commercial 
information to the extent allowable by statute, as well concerns about 
public release of sensitive information that would not otherwise be 
publicly available; and (3) protecting the public health by being able 
to attract sufficient numbers of foreign food entities, third-party 
auditors/certification bodies, and accreditation bodies to make the 
program cost-effective and otherwise successful.
    To gain credibility with consumers and address industry views on 
sensitive information, this proposed rule seeks to balance disclosure 
and confidentiality concerns. It reflects our views on how best to 
strike the balance between these and other competing interests. We 
believe this proposal reflects the intent of section 808 of the FD&C 
Act and the purpose of the law, offering a practical, flexible, and 
effective approach to the accredited third-party audits and 
certification program. We seek comment on the framework this proposed 
rule would create for recognition of accreditation bodies and 
accreditation of third-party auditors/certification bodies, how it 
aligns with existing voluntary industry programs, and what expectations 
consumers have for the ability of this program to help us ensure the 
safety of imported food.

[[Page 45790]]

    In addition, we invite comments on possible effects of the creation 
of an FDA program for accredited third-party audits and certification. 
We are particularly interested in receiving comments and data on the 
availability of competent auditors/certification bodies to participate 
in our program or about the likelihood of entities being able to scale-
up their capacity to participate in our program and to serve demand 
outside the scope of our program. We understand from public comments 
and stakeholder meetings that industry and the conformity assessment 
community have concerns about access to sufficient numbers of qualified 
third-party auditors/certification bodies under current conditions. We 
also understand that some industry leaders have developed various 
strategies and plans for increasing auditor capacity. We request 
comments and information on the progress of these efforts and the 
impact the establishment of our program will have on accelerating these 
efforts. Given that this program is for food and facility 
certifications only for purposes of mandatory certification and VQIP 
eligibility under sections 801(q) and 806 of the FD&C Act 
(respectively), what effect, if any, do stakeholders anticipate this 
program will have on current capacity issues?
    We also request stakeholder input on any possible trade impacts of 
the program, once established. What effect might this program have on 
the existing issues with auditor capacity? Will it affect foreign or 
domestic food firms' ability to provide certifications to their 
customers? If so, are foreign and domestic firms likely to be affected 
in the same manner and to the same degree? If not, what are the likely 
impacts to each? Are there particular types of food firms or food 
products, or certain areas of the world in which capacity issues are 
more likely to be prevalent and to what degree? Are there other factors 
impacting the availability of competent auditors? Are there any 
solutions or approaches that might be practical and appropriate for 
FDA, as a regulatory Agency, to use in addressing auditor capacity 
issues within the accredited third-party audits and certification 
program?
    We encourage stakeholders to consider and comment on this proposed 
rule and the various interests at stake in this rulemaking, with 
recommendations about the proper balance of competing interests.

IV. Purpose and Description of the Proposed Rule

    In section 808 of the FD&C Act, Congress directed us to establish 
an accredited third-party audits and certification program that 
leverages the work of existing private sector audit programs and 
efforts, while requiring measures to better ensure audit rigor and 
objectivity. We believe this proposed rule, coupled with our oversight 
of the program, will help ensure the competence and independence of 
third-party auditors/certification bodies who conduct foreign food 
safety audits. It also will help ensure the reliability of 
certifications issued by third-party auditors/certification bodies that 
we may use in making certain decisions relating to imported food.
    Having comprehensive oversight of a credible and reliable program 
for third-party audits and certifications of foreign food facilities 
will help us prevent potentially harmful food from reaching U.S. 
consumers and thereby improve the safety of the U.S. food supply. As 
explained previously, we believe this new program will draw a 
significant number of participants and will be broadly accepted by 
industry. Currently, buyers seeking to import regulated product from a 
foreign food facility often require food safety audits that are 
conducted under varying audit criteria. By establishing a trusted 
program for third-party audits and certification of foreign food 
facilities that operates under public oversight, we expect that the 
number of redundant food safety audits performed to assess compliance 
with the FD&C Act will be reduced, which, in turn, will increase 
efficiency and reduce costs to industry. Our estimates relating to 
reductions in redundant audits are addressed more fully in the 
Preliminary Regulatory Impact Analysis (Ref. 25).
    More broadly, we think that by capitalizing on private sector food 
safety efforts and linking them to the public assurance system, 
accredited third-party certification can help transform the way we 
ensure the safety of globally traded food that is consumed in the 
United States. In our vision of the future, we do not see third-party 
audits replacing public oversight, but rather helping us ensure that we 
make the best, most efficient use of both public and private resources 
to produce a safe food supply.
    We are proposing requirements that would apply to several different 
types of entities--i.e., accreditation bodies, third-party auditors/
certification bodies, and eligible entities--and an option for 
importers as well. We are organizing this proposed rule by those 
categories, with specific requirements for accreditation bodies 
(proposed Sec. Sec.  1.610 through 1.636), third-party auditors/
certification bodies (proposed Sec. Sec.  1.640 through 1.672), 
eligible entities (proposed Sec. Sec.  1.680 and 1.681), and importers 
(proposed Sec.  1.698). Provisions of general applicability appear in 
proposed Sec. Sec.  1.600 and 1.601 (definitions and scope), Sec.  
1.690 (publicly available information), Sec. Sec.  1.691 through 1.693 
(challenges to FDA decisions).
    Accordingly, we are proposing to amend our regulations in parts 1 
and 16 (21 CFR parts 1 and 16) to implement FSMA section 307, which 
adds section 808 to the FD&C Act and is codified at 21 U.S.C. 384d. We 
are proposing to add new subpart M to part 1 and to amend existing part 
16 (21 CFR part 16) as follows:

A. Proposed Revisions to Part 1, New Subpart

1. Definitions and Scope
    a. What definitions apply to this subpart? (Proposed Sec.  1.600). 
Proposed Sec.  1.600 contains definitions of several terms used in this 
rule. Where possible, we propose to rely on existing statutory and 
regulatory definitions. Where necessary to provide clarity to this 
rule, we have developed some additional definitions that align with 
existing law and regulations, as well as current practices of the 
international community, accreditation and certification bodies, and 
the food industry.
    Proposed Sec.  1.600(a) and (b) state that definitions contained in 
section 201 of the FD&C Act (21 U.S.C. 321) will apply to this rule, 
except as those terms are otherwise defined in paragraph (c). Because 
``food'' is defined in section 201(f) of the FD&C Act, but not in 
proposed Sec.  1.600(c), the definition of ``food'' that we propose to 
apply to this rule is the definition of ``food'' appearing in section 
201(f). Examples of ``food'' under this proposed definition would 
include, but not be limited to, fruits, vegetables, fish, dairy 
products, eggs, raw agricultural commodities for use as food or 
components of food, animal feed (including pet food), food and feed 
ingredients and additives (including substances that migrate into food 
from packaging and other articles that contact food), dietary 
supplements and dietary ingredients, infant formula, beverages 
(including bottled water), live food animals, bakery goods, snack 
foods, candy, and canned food. (See, e.g., 21 CFR 1.377. See also the 
discussion of proposed Sec.  1.601(d)

[[Page 45791]]

regarding a limited exemption for alcoholic beverages and prepackaged 
foods from certain facilities.)
    ``Accreditation'' means a determination by a recognized 
accreditation body, or by FDA in the case of direct accreditation, that 
a third-party auditor/certification body is competent to perform the 
activities required of an accredited auditor/certification body for the 
purposes of this rule. In developing this definition, we considered 
international standards on accreditation, including ISO/IEC 17011:2004 
(Ref. 18), which defines accreditation as an attestation ``conveying 
formal demonstration'' of a conformity assessment body's competence to 
carry out specific conformity assessment tasks.
    ``Accreditation body'' means an authority that performs 
accreditation of third-party auditors/certification bodies. This 
definition is already in use in section 808(a) of the FD&C Act and is 
consistent with international standards, such as ISO/IEC 17011:2004 
(Ref. 18), which defines ``accreditation body'' as an ``authoritative 
body'' that conducts accreditation.
    ``Accredited auditor/certification body'' means a third-party 
auditor/certification body that a recognized accreditation body (or, in 
the case of direct accreditation, FDA) has determined meets the 
applicable requirements of this subpart and is authorized to conduct 
food safety audits and to issue food or facility certifications to 
eligible entities. This definition reflects the statutory definitions 
of ``accredited third party auditor'' and ``third party auditor'' and a 
common understanding of the activities to be performed under this 
program.
    ``Audit'' means:
    1. With respect to an accreditation body, the systematic, 
independent, and documented examination (through observation, 
investigation, and records review) by FDA to assess the accreditation 
body's authority, qualifications (including its expertise and training 
programs), and resources; its procedures for quality assurance, 
conflicts of interest, and records; its performance in accreditation 
activities; and its capability to meet the applicable requirements of 
this subpart.
    2. With respect to a third-party auditor/certification body, the 
systematic, independent, and documented examination (through 
observation, investigation, and records review) by a recognized 
accreditation body (or, in the case of direct accreditation, FDA) to 
assess the third-party auditor's/certification body's authority, 
qualifications (including its expertise and training programs), and 
resources; its procedures for quality assurance, conflicts of interest, 
and records; its performance in auditing and certification activities; 
and its capability to meet the applicable requirements of this subpart; 
and
    3. With respect to an eligible entity, the systematic, independent, 
and documented examination (through observation, investigation, records 
review, and as appropriate, sampling and laboratory analysis) by an 
accredited auditor/certification body to assess the entity, its 
facility, system(s), and food for the purpose of determining whether 
the food or facility of the eligible entity is in compliance with the 
FD&C Act (which includes, where applicable, an assessment of the 
entity's preventative controls, sanitation, monitoring, verification, 
corrective actions, and recalls) and, for consultative audits, also 
includes an assessment of compliance with applicable industry standards 
and practices.
    The term describes the nature and scope of activities involved in 
the various types of audits and assessments that will be conducted 
under this program. We incorporated relevant language from the 
definitions of consultative audit and regulatory audit in section 
808(a)(5) and (a)(7) of the FD&C Act and language specific to the 
requirements used in audits and assessments of accreditation bodies, 
third-party auditors/certification bodies, and eligible entities.
    We considered our 2009 guidance (Ref. 5) and the descriptions of 
audit activities under our MFRPS (Ref. 12). We also examined usage in 
international standards, such as the Codex Principles for Food Import 
and Export Certification (CAC/GL 20-1995) (Ref. 26), which define 
``audit'' as a ``systematic and functionally independent examination to 
determine whether activities and related results comply with planned 
objectives.'' Additionally, we looked at ISO/IEC 17000:2004 (Ref. 17), 
which defines ``audit'' as a ``systematic, independent, documented 
process for obtaining records, statements of fact or other relevant 
information and assessing them objectively to determine the extent to 
which specified requirements are fulfilled.''
    ``Audit agent'' means an individual who is an employee or other 
agent of an accredited auditor/certification body who, although not 
individually accredited, is qualified to conduct food safety audits on 
behalf of an accredited auditor/certification body. An audit agent 
includes a contractor of the accredited auditor/certification body.
    The term is based on section 808(a)(1) of the FD&C Act, which 
defines ``audit agent'' as an employee or agent of an accredited 
auditor[/certification body] who is qualified to conduct food safety 
audits on its behalf. In the definition, we clarify that contractors 
who are authorized to act for, and under the direction of, the 
accredited auditor/certification body are allowed to serve as an audit 
agents.
    ``Certification body'' means a foreign government, agency of a 
foreign government, foreign cooperative, or any other third party that 
is eligible to be considered for accreditation to conduct food safety 
audits and to certify that eligible entities meet the requirements of 
the FD&C Act. A certification body may be a single individual or an 
organization. A certification body may use audit agents to conduct food 
safety audits. Certification Body has the same meaning as Third-Party 
Auditor as that term is defined in section 808 of the FD&C Act and in 
this subpart.
    This definition emphasizes the role of ``third-party auditors,'' 
under section 808 of the FD&C Act, in issuing facility certifications 
that importers must use to establish eligibility for VQIP participation 
and food certifications that may be required to satisfy a condition of 
admissibility for an imported food we determine poses a safety risk 
under section 801(q) of the FD&C Act.
    In developing the definition of ``certification body,'' we looked 
at the definition of ``third-party auditor'' in section 808(a)(3) of 
the FD&C Act, as well as terminology used by the international 
community and the food industry. For example, ISO/IEC 17000:2004 (Ref. 
17) explains that a ``certification system'' is a conformity assessment 
system that includes ``selection, determination, review and finally 
certification as the attestation activity'. See also, ISO/IEC Guide 
65:1996 (Ref. 20) and ISO/IEC 17021: 2011 (Ref. 19). The term 
``certification body'' also is used by those in the food industry who 
currently rely on audits and certifications as part of their business 
practices. We believe this proposed language more clearly explains the 
role of accredited auditors/certification bodies and the requirements 
for issuance of certification under this program.
    ``Consultative audit'' means an audit of an eligible entity:
    1. To determine whether such entity is in compliance with 
applicable requirements of the FD&C Act and industry standards and 
practices; and

[[Page 45792]]

    2. The results of which are for internal purposes only and cannot 
be used to determine eligibility for a food or facility certification 
issued under this subpart or in meeting the requirements for an onsite 
audit of a foreign supplier under subpart L of this part.
    This reflects the definition of ``consultative audit'' in section 
808(a)(5) of the FD&C Act and emphasizes that the results of a 
consultative audit cannot be used in lieu of a regulatory audit to meet 
the criteria for issuance of food or facility certification under 
section 808(c)(2)(C) of the FD&C Act. It also incorporates language 
from proposed Sec.  1.698, which would allow only reports of regulatory 
audits to be used by importers in meeting proposed verification 
requirements under the Foreign Supplier Verification Rule (FSVP) (to be 
codified in 21 CFR, part 1, subpart L).
    ``Direct accreditation'' means accreditation of a third-party 
auditor/certification body by FDA and is a term used in section 
808(b)(1)(A)(ii) of the FD&C Act when describing FDA accreditation of 
third-party auditors/certification bodies, without the involvement of a 
recognized accreditation body. The distinction between direct 
accreditation and accreditation by an FDA-recognized accreditation body 
is relevant for some provisions of this rule. For example, under 
proposed Sec.  1.656(b), a directly accredited auditor/certification 
body must send its annual self-assessment reports to FDA, while an 
auditor/certification body accredited by a recognized accreditation 
body must submit its annual self-assessment reports to the 
accreditation body, who is responsible for monitoring and ensuring its 
accredited auditors/certification bodies take timely and effective 
corrective actions, where necessary. FDA will access the accredited 
auditor/certification body self-assessments in monitoring recognized 
accreditation bodies and in conducting the periodic monitoring required 
by section 808(f)(2) of the FD&C Act. This definition will help 
accredited auditors/certification bodies determine which requirements 
apply to them.
    ``Eligible entity'' means a foreign entity that chooses to be 
subject to a food safety audit by an accredited auditor/certification 
body. Eligible entities include foreign facilities subject to the 
registration requirements of 21 CFR part 1, subpart H. The definition 
of ``eligible entity'' corresponds to section 808(a)(6) of the FD&C 
Act, which defines ``eligible entity'' as including (and thus not 
limited to) foreign facilities subject to the registration requirements 
of section 415 of the FD&C Act (21 U.S.C. 350d).
    We seek comment on whether to provide examples of specific types of 
entities that may meet the definition of eligible entity. For example, 
are foreign cooperatives \13\ that aggregate product, such as fruits or 
vegetables, the types of entities that should be able to seek audits 
and certification under this program? We note that the National Organic 
Program (NOP) administered by the U.S. Department of Agriculture's 
(USDA's) Agricultural Marketing Service (AMS), allows producers who are 
located in geographic proximity, who are organized under a single 
management and marketing system and whose farms are ``uniform in most 
ways'' to be certified as a group (Ref. 27).\14\ We seek comment on 
whether these NOP criteria are relevant in determining whether a 
foreign cooperative is an ``eligible entity'' under this proposed rule, 
Are there other types of foreign entities or facilities that should be 
eligible to seek audits and certification under the FDA program?
---------------------------------------------------------------------------

    \13\ Under section 808 of the FD&C Act, foreign cooperatives are 
among the types of groups that are eligible to seek accreditation as 
third-party auditors, provided that they meet the standards and 
requirements for accreditation (e.g., for conflicts of interest).
    \14\ Per USDA, grower group certifications have historically 
been used for the certification of cooperatives located in 
geographical proximity, whose crops are marketed collectively. 
Primary crops produced by grower groups include coffee, cocoa, tea, 
spices, and tropical fruits (Ref. 27).
---------------------------------------------------------------------------

    ``Facility'' means any structure, or structures of an eligible 
entity under one ownership at one general physical location, or, in the 
case of a mobile facility, traveling to multiple locations, that 
manufactures/processes, packs, or holds food for consumption in the 
United States. Transport vehicles are not facilities if they hold food 
only in the usual course of business as carriers. A facility may 
consist of one or more contiguous structures, and a single building may 
house more than one distinct facility if the facilities are under 
separate ownership. The private residence of an individual is not a 
facility. Non-bottled water drinking water collection and distribution 
establishments and their structures are not facilities. This same 
definition of ``facility'' appears in subpart H (21 CFR 1.227(b)(2)).
    ``Facility certification'' means an attestation, issued for 
purposes of section 806 of the FD&C Act by an accredited auditor/
certification body, after conducting a regulatory audit and any other 
activities necessary to establish that a facility meets the applicable 
requirements of the FD&C Act.
    ``Food certification'' means an attestation, issued for purposes of 
section 801(q) of the FD&C Act by an accredited auditor/certification 
body, after conducting a regulatory audit and any other activities 
necessary to establish that a food meets the applicable requirements of 
the FD&C Act.
    These definitions reflect the requirements for, and purpose of, 
certification as described in section 808(c)(2)(B) and (c)(2)(C) of the 
FD&C Act, referencing sections 801(q) (food certification) and 806 
(facility certification) of the FD&C Act. Food and facility 
certifications are the two types of certifications authorized by 
section 808 of the FD&C Act. Further, the food and facility 
certification definitions emphasize that certification is an 
attestation \15\ by the accredited third-party auditor/certification 
body that it has: (1) Conducted a regulatory audit (and any other 
activities necessary to establish compliance); (2) verified that the 
specified criteria have been met; and (3) determined, based on the 
results of those activities, that food or facility certification under 
this program is appropriate.
---------------------------------------------------------------------------

    \15\ We propose to use the word ``attestation'' in Sec.  1.600 
to characterize the nature of the statement that certification 
represents. This is the term used in ISO/IEC 17000:2004 (Ref. 20) 
and also is the term we use when characterizing the nature of our 
export certifications (Ref. 28). We believe that ``attestation'' is 
similar to ``assurance,'' which is the term used in Codex CAC/GL 20-
1995 (Ref. 27).
---------------------------------------------------------------------------

    Codex CAC/GL 20-1995 (Ref. 26) defines ``certification'' as the 
procedure by which certification bodies provide ``written or equivalent 
assurance that foods or food control systems conform to requirements.'' 
ISO/IEC 17000:2004 (Ref. 17) describes certification as an 
``attestation'' related to products, processes, systems, or 
persons.\16\
---------------------------------------------------------------------------

    \16\ We are not defining ``facility certification'' or ``food 
certification'' as an ``approval'' by an accredited auditor/
certification body or by (or on behalf of) FDA, nor do we intend for 
it to be interpreted as such. Among other reasons, we do not have 
preapproval authority for food, except for certain additives that 
are required by law to have our approval prior to marketing. 
Moreover, neither Codex CAC/GL 20-1995 (Ref. 27), nor ISO/IEC 
17000:2004 (Ref. 20) uses the term ``approval'' in defining 
``certification.''
---------------------------------------------------------------------------

    We seek comment on our proposed definitions of ``facility 
certification'' and ``food certification'' and on whether the scope of 
these definitions is sufficiently broad to fulfill the objectives of 
section 808 of the FD&C Act. In addition, we seek comment on whether to 
allow groups meeting the NOP criteria (i.e., having multiple sites 
operating under a single management system and whose

[[Page 45793]]

farms are ``uniform in most ways,'' to be issued (group) food 
certifications, facility certifications, or both.
    ``Food safety audit'' means a regulatory audit or a consultative 
audit by an accredited auditor/certification body under this program. 
This term is used throughout section 808 of the FD&C Act, including in 
the definitions of ``audit agent,'' ``third-party auditor,'' and 
``accredited third-party auditor.'' The definition of ``third-party 
auditor'' in section 808(a)(3) of the FD&C Act in particular, mentions 
regulatory and consultative audits in the context of food safety 
audits. Therefore, we used the definitions of ``consultative audit'' 
and ``regulatory audit'' contained in section 808(a)(5) and (a)(7) of 
the FD&C Act in developing a definition of ``food safety audit.''
    Table 1 describes consultative audits and regulatory audits and the 
distinctions between them.

                Table 1--Types and Characteristics of Food Safety Audits Under the Proposed Rule
----------------------------------------------------------------------------------------------------------------
                                                                  Report submitted to
            Type of audit                      Purpose                    FDA?            Records access by FDA?
----------------------------------------------------------------------------------------------------------------
Regulatory Audit.....................  For certification and    Yes....................  FDA may request
                                        report may be used      Submitted no later than   submission at any
                                        under FSVP.              45 days after the        time.
                                                                 audit..
Consultative Audit...................  Internal purposes......  No.....................  FDA access under
                                                                                          section 414 of the
                                                                                          FD&C Act.
----------------------------------------------------------------------------------------------------------------

    ``Foreign cooperative'' means an entity that aggregates food from 
growers or processors that is intended for export to the United States. 
Section 808 of the FD&C Act does not provide a definition of ``foreign 
cooperative,'' so we relied upon the statutory description of foreign 
cooperatives in section 808(c)(1)(B) of the FD&C Act.
    ``Recognized accreditation body'' means an accreditation body that 
FDA has determined meets the applicable requirements and is authorized 
to accredit third-party auditors/certification bodies under this 
program. This definition is based in part on the definition of 
accreditation body in section 808 of the FD&C Act and incorporates the 
concept of ``recognition'' that also appears there. The term 
``recognition'' is also used in section 422 of the FD&C Act (21 U.S.C. 
350k), as amended by FSMA, to describe the status we will accord to a 
laboratory accreditation body that accredits laboratories for purposes 
of food testing under the FD&C Act.
    We also use the term ``recognition'' in the 2009 guidance (Ref. 5) 
and in other FDA programs. In the 2009 guidance, which predates FSMA, 
we mentioned the possible future ``recognition'' of one or more third-
party certification programs. Though FSMA directs us to structure our 
third-party program differently than we envisioned in 2009, the concept 
of ``recognition'' by FDA is similar.
    ``Regulatory audit'' is defined in the statute and means an audit 
of an eligible entity:
    1. To determine whether such entity is in compliance with the 
provisions of the FD&C Act; and
    2. The results of which are used in determining eligibility for 
food certification under section 801(q) of the FD&C Act or facility 
certification under section 806 of the FD&C Act. This definition 
includes language from proposed Sec.  1.698, which would allow an 
importer to use a regulatory audit report in meeting proposed 
requirements for verification of a foreign supplier under subpart L of 
this part.
    ``Relinquishment'' means:
    1. With respect to an accreditation body, a decision to cede 
voluntarily its authority to accredit third-party auditors/
certification bodies as a recognized accreditation body; and
    2. With respect to a third-party auditor/certification body, a 
decision to cede voluntarily its authority to conduct food safety 
audits and to issue food and facility certifications to eligible 
entities.
    We included a definition of ``relinquishment'' in this proposed 
rule because we recognize that an accreditation body, once recognized, 
or a third-party auditor/certification body, once accredited, may 
decide to leave the program and would need a process to voluntarily 
exit the program. Relinquishment differs from revocation of recognition 
and withdrawal of accreditation, as it occurs on the initiative of the 
accreditation body or third-party auditor/certification body and not as 
a result of our finding good cause to remove its recognition or 
accreditation status. Analogous language on relinquishment of 
accreditation appears in our mammography regulations in 21 CFR 900.3.
    ``Self-assessment'' means a systematic assessment conducted by an 
accreditation body to determine whether it meets the recognition 
requirements in Sec. Sec.  1.610 through 1.625, or by a third-party 
auditor/certification body to determine whether it meets the 
accreditation requirements in Sec. Sec.  1.640 through 1.658. ``Self-
assessment'' is defined in this proposed rule in a manner consistent 
with its use in our MFRPS for State food regulatory programs (Ref. 12). 
The MFRPS require States to conduct periodic self-assessments of their 
manufactured food regulatory programs against each of the 10 program 
standards. These self-assessments are designed to identify the 
strengths and weaknesses of the State program by determining the level 
of conformance with the program standards and are independently 
verified through an audit. The results of the initial self-assessments 
are used to develop an improvement plan, and subsequent self-
assessments are used to track the State's progress toward meeting and 
maintaining conformance with the MFRPS.
    The concept of self-assessment is used in international consensus 
standards as well. For example, ISO/IEC Guide 65:1996 (Ref. 20) 
requires a certification body to conduct periodic internal audits to 
verify that its quality system is implemented and effective, that 
corrective actions are taken in a timely and appropriate manner, and 
that records of such reviews are maintained. Both ISO/IEC 17011:2004 
(Ref. 18) and ISO/IEC 17021:2011 (Ref. 19) require internal audits as 
well. Self-assessments are a valuable component of a continuous 
improvement process under our standards and the voluntary consensus 
standards described in this preamble.
    ``Third-Party Auditor'' means a foreign government, agency of a 
foreign government, foreign cooperative, or any other third party that 
is eligible to be considered for accreditation to conduct food safety 
audits and to certify that eligible entities meet the applicable 
requirements of the FD&C Act. A third-party auditor may be a single 
individual or an organization. A third-party auditor may use audit 
agents to conduct food safety audits. Third-Party Auditor has the same 
meaning as Certification Body as that term is defined in this subpart.

[[Page 45794]]

The definition of ``third-party auditor'' is based on section 808 of 
the FD&C Act and clarifies our role in direct accreditation and the 
relationship between audits and certifications under section 808 of the 
FD&C Act. For the reasons explained in the preamble discussion of the 
definition of ``certification body,'' ``third-party auditor'' will have 
the same meaning as ``certification body'' for purposes of this rule.
    b. Who is subject to this subpart? (Proposed Sec.  1.601). This 
proposed rule would apply to those accreditation bodies, third-party 
auditors/certification bodies, and eligible entities that seek to 
participate in our program for third-party food safety audits and 
certification. Participating is voluntary; however any accreditation 
body wishing to accredit third-party auditors/certification bodies 
under our program would have to comply with the applicable requirements 
of the final rule. Under the FDA program, any third-party auditor/
certification body wishing to conduct food safety audits and issue food 
and facility certifications and any eligible entity that seeks a food 
safety audit or food or facility certification would have to comply 
with the applicable requirements of the final rule.\17\
---------------------------------------------------------------------------

    \17\ The terms, ``third-party auditor/certification body,'' 
``consultative audit,'' ``regulatory audit,'' ``food 
certification,'' ``facility certification,'' and ``eligible entity'' 
are defined under this proposed rule.
---------------------------------------------------------------------------

    This proposed rule would codify a limited exemption created by 
section 116 of FSMA (21 U.S.C. 2206) applicable to certification of 
food under section 801(q) of the FD&C Act. Section 116(a) of FSMA 
states that, except as provided by certain listed sections in the FSMA, 
nothing in FSMA, or the amendments made by FSMA, will be construed to 
apply to a facility that (1) under the Federal Alcohol Administration 
Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal 
Revenue Code of 1986 (26 U.S.C. 5001 et seq.) is required to obtain a 
permit or to register with the Secretary of the Treasury as a condition 
of doing business in the United States; and (2) under section 415 of 
the FD&C Act is required to register as a facility because such 
facility is engaged in manufacturing, processing, packing, or holding 
one or more alcoholic beverages (with respect to the activities of such 
facility that relate to the manufacturing, processing, packing, or 
holding of alcoholic beverages).
    Section 116(b) of FSMA provides that section 116(a) does not apply 
to a facility engaged in the receipt and distribution of any non-
alcohol food, except that section 116(a) does apply to a facility 
described in section 116(a) that receives and distributes non-alcohol 
food, provided such food is received and distributed (1) in a 
prepackaged form that prevents any direct human contact with such food, 
and (2) in amounts that constitute not more than 5 percent of the 
overall sales of such facility, as determined by the Secretary of the 
Treasury.
    Section 116(c) of FSMA provides that, except as provided in section 
116(a) and (b), section 116 cannot be construed to exempt any food, 
other than alcoholic beverages, as defined in section 214 of the 
Federal Alcohol Administration Act (27 U.S.C. 214), from the 
requirements of FSMA (including amendments made by FSMA).
    The Preventive Controls proposed rule includes provisions 
implementing the exemptions provided in section 116 of FSMA to 
establish by regulation the reach of the exemptions. As discussed in 
the preamble to the Preventive Controls proposed rule, FDA tentatively 
concludes the following regarding the reach of the exemptions for the 
purposes of that rule:
     The phrase ``obtain a permit or register'' should be 
interpreted broadly, to include not only facilities that must obtain 
what is technically named a ``permit'' or must ``register'' with 
Treasury, but also those facilities that must adhere to functionally 
similar requirements as a condition of doing business in the United 
States, namely, by submitting a notice or application to Treasury and 
obtaining Treasury approval of that notice or application.
     The exemption would apply not only to domestic facilities 
that are required to secure a permit, registration, or approval from 
Treasury under the relevant statutes, but also to foreign facilities of 
a type that would require such a permit, registration, or approval if 
they were domestic facilities.
     Activities related to alcoholic beverages (including the 
manufacturing, processing, packing, or holding of alcoholic beverages) 
at facilities within the scope of section 116(a) of FSMA would not be 
subject to section 418 of the FD&C Act. Activities related to foods 
other than alcoholic beverages (including the receiving, manufacturing, 
processing, packing, holding, and distributing of such foods) would be 
subject to section 418 even if those activities occur at facilities 
that are otherwise within the scope of section 116(a) (unless they 
qualify for another exemption or are in prepackaged form and constitute 
5 percent or less of the facility's overall sales). (For clarity, we 
use the term ``food other than alcoholic beverages'' rather than ``non-
alcohol food'' in the Preventive Controls proposed rule and in this 
document.)
     Section 418 of the FD&C Act does not apply to the 
manufacturing, processing, packing, or holding of food other than 
alcoholic beverages to the extent that it is physically inseparable 
from the manufacturing, processing, packing, or holding of alcoholic 
beverages.
    Section 116 of FSMA is premised in part upon status as a facility 
required to register under section 415 of the FD&C Act (section 
116(a)(2) of FSMA). As provided in section 808, eligible entities 
include foreign facilities registered under section 415 of the FD&C 
Act.
    Therefore, to implement the exemption in section 116 of FSMA, under 
proposed Sec.  1.601(d)(1), certification of food under section 801(q) 
of the FD&C Act would not apply with respect to alcoholic beverages 
from an eligible entity that is a facility that meets the following two 
conditions:
     Under the Federal Alcohol Administration Act or chapter 51 
of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et 
seq.), the facility is a foreign facility of a type that, if it were a 
domestic facility, would require obtaining a permit from, registering 
with, or obtaining approval of a notice or application from the 
Secretary of the Treasury as a condition of doing business in the 
United States; and
     Under section 415 of the FD&C Act, the facility is 
required to register as a facility because it is engaged in 
manufacturing/processing one or more alcoholic beverages.
    Proposed Sec.  1.601(d)(2) specifies that certification of food 
under section 801(q) of the FD&C Act also would not apply with respect 
to food other than alcoholic beverages from a facility described in 
paragraph (d)(2), provided such food:
     Is in prepackaged form that prevents any direct human 
contact with such food; and
     Constitutes not more than 5 percent of the overall sales 
of the facility, as determined by the Secretary of the Treasury.
    This exemption does not apply to facility certification required by 
section 806 of the FD&C Act.
    We request comment on our proposed exemption of alcoholic beverages 
and food other than alcoholic beverages under the conditions specified 
in proposed Sec.  1.601(d).
    As described in the ``Summary of Major Provisions of the Proposed 
Rule,'' this rule would apply only to entities

[[Page 45795]]

that voluntarily participate in our accredited third-party audits and 
certification program, which would be the following: (1) Accreditation 
bodies seeking recognition, or recognized, under this program; (2) 
third-party auditors/certification bodies (including their audit 
agents) that seek accreditation, or are accredited under this program; 
and (3) eligible entities that seek food safety audits from, or that 
are audited or certified by, accredited auditors/certification bodies 
under this program, except for an eligible entity that meets the 
criteria for exemption under section 116 of FSMA.
    We invite comment on the scope of this proposed rule, including 
comments on its anticipated effects on accreditation bodies and third-
party auditors/certification bodies already performing these 
activities, or that may be interested in doing so. We also seek comment 
on its anticipated effect on foreign food facilities and other eligible 
entities that are currently audited by third-party auditors/
certification bodies.
2. Recognition of Accreditation Bodies
    This rule would establish the following: (1) The eligibility 
requirements for an accreditation body to be authorized 
(``recognized'') by FDA to accredit third-party auditors/certification 
bodies under the accredited third-party audits and certification 
program; (2) requirements on recognized accreditation bodies for 
activities conducted under our program; and (3) procedures FDA and 
accreditation bodies will follow relating to recognition, including 
application, renewal, revocation, voluntary relinquishment, and 
reinstatement of recognition.

         Table 2--Proposed Requirements for Accreditation Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
         Recognition of accreditation bodies under this subpart
------------------------------------------------------------------------
1.610..................  Who is eligible for recognition?
1.611..................  What legal authority must an accreditation body
                          have to qualify for recognition?
1.612..................  What competency and capacity must an
                          accreditation body have to qualify for
                          recognition?
1.613..................  What protections against conflicts of interest
                          must an accreditation body have to qualify for
                          recognition?
1.614..................  What quality assurance procedures must an
                          accreditation body have to qualify for
                          recognition?
1.615..................  What records procedures must an accreditation
                          body have to qualify for recognition?
------------------------------------------------------------------------
   Requirements for recognized accreditation bodies under this subpart
------------------------------------------------------------------------
1.620..................  How must a recognized accreditation body assess
                          third-party auditors/certification bodies
                          seeking accreditation?
1.621..................  How must a recognized accreditation body
                          monitor the performance of auditors/
                          certification bodies it accredits?
1.622..................  How must a recognized accreditation body
                          monitor its own performance?
1.623..................  What reports and notifications must a
                          recognized accreditation body submit to FDA?
1.624..................  How must a recognized accreditation body
                          protect against conflicts of interest?
1.625..................  What records requirements must a recognized
                          accreditation body meet?
------------------------------------------------------------------------
  Procedures for recognition of accreditation bodies under this subpart
------------------------------------------------------------------------
1.630..................  How do I apply to FDA for recognition or
                          renewal of recognition?
1.631..................  How will FDA review applications for
                          recognition and for renewal of recognition?
1.632..................  What is the duration of recognition?
1.633..................  How will FDA monitor recognized accreditation
                          bodies?
1.634..................  When will FDA revoke recognition?
1.635..................  How do I voluntarily relinquish recognition?
1.636..................  How do I request reinstatement of recognition?
------------------------------------------------------------------------

    Section 808 of the FD&C Act directs us to establish a system for 
recognition of accreditation bodies to accredit third-party auditors/
certification bodies and generally describes the roles and 
responsibilities of recognized accreditation bodies under the 
accredited third-party audits and certification program. The statute 
requires each recognized accreditation body to: (1) Ensure that third-
party auditors/certification bodies (and audit agents) meet FDA's model 
accreditation standards; (2) perform such reviews and audits necessary 
to determine that a third-party auditor/certification body meets the 
statutory requirements for accreditation; \18\ (3) require a third-
party auditor/certification body to agree to issue certifications in a 
form required by FDA, as a condition of accreditation; and (4) submit 
to FDA a list of all third-party auditors/certification bodies it 
accredited (and the audit agents of each).
---------------------------------------------------------------------------

    \18\ See section 808(c)(1)(A) and (c)(1)(B) of the FD&C Act.
---------------------------------------------------------------------------

    a. Who is eligible for recognition? (Proposed Sec.  1.610). This 
proposed rule would establish eligibility requirements an accreditation 
body would have to meet to qualify for recognition by FDA under the 
accredited third-party audits and certification program. Proposed Sec.  
1.610 states that an accreditation body is eligible for recognition if 
it can demonstrate that it meets requirements relating to legal 
authority, competency, capacity, conflicts of interest, quality 
assurance, and records in proposed Sec. Sec.  1.611 through 1.615.
    In developing this proposed rule, we considered eligibility 
requirements that would help us ensure that accreditation bodies 
seeking recognition--whether public or private, newly formed or long 
standing--are sufficiently qualified to accredit third-party auditors/
certification bodies under our program. We considered the approach 
taken by NIST in its National Voluntary Conformity Assessment Systems 
Evaluation (NVCASE) Program, which is a voluntary program to evaluate 
and recognize organizations which support conformity assessment 
activities (Ref. 28). The NVCASE program handbook states that ISO/IEC 
17011:2004 (Ref. 18) provides that the basic general criteria

[[Page 45796]]

that an accreditor of certification bodies must satisfy for NVCASE 
recognition (Ref. 28). We have tentatively concluded that key elements 
of ISO/IEC 17011: 2004 (Ref. 18) provide an appropriate basis for these 
requirements.\19\ We also considered our 2009 FDA guidance (Ref. 
5),\20\ which states that conformance to ISO/IEC 17011:2004 (Ref. 18) 
helps provide assurance of the reliability and competence of 
accreditation bodies.
---------------------------------------------------------------------------

    \19\ ISO/IEC 17011:2004 contains requirements that are not 
applicable to our program (e.g., liability arrangements). While an 
accreditation body would not need to conform to ISO/IEC 17011:2004 
to qualify for recognition under our program, an accreditation body 
that satisfies the requirements of ISO/IEC 17011:2004 could use that 
in demonstrating it meets the recognition requirements in this rule.
    \20\ We intend to withdraw the 2009 Guidance upon publication of 
a final rule for accredited third-party audits and certification 
under section 808 of the FD&C Act.
---------------------------------------------------------------------------

    We also considered current food industry practices. For example, 
GFSI requires food safety scheme owners to use accreditation bodies 
that comply with ISO/IEC 17011:2004 (Ref. 18) for GFSI-benchmarked food 
safety schemes (Ref. 29). In stakeholder meetings, some stakeholders 
have suggested that FDA consider requiring accreditation bodies 
participating in the accredited third-party audits and certification 
program to be signatories to a multilateral recognition agreement of 
the International Accreditation Forum (IAF). IAF is an organization for 
accreditors of conformity assessment bodies and is a counterpart to 
International Laboratory Accreditation Cooperation (ILAC), for 
laboratory accreditation bodies.\21\ The IAF multilateral recognition 
arrangement (IAF-MLA) (Ref. 30) requires signatories to conform to ISO/
IEC 17011:2004, among other things.
---------------------------------------------------------------------------

    \21\ The ILAC is an international body, established in 1977, to 
help ensure the competency, independence, rigor, and objectivity of 
accreditation bodies that accredit laboratories against 
international standards. The ILAC-mutual recognition agreement 
requires signatories to conduct their activities in accordance with 
ISO/IEC 17011:2004. FDA laboratory programs have worked with ILAC 
and other ILAC signatories for many years.
---------------------------------------------------------------------------

    Unlike our established history with ILAC and ILAC signatories, our 
food and feed programs lack similar experience with the IAF. We have 
found few examples of Federal agencies that require accreditation 
bodies for conformity assessment bodies to be signatories to the IAF-
MLA (for accreditation of product and management system certification) 
and that use signatory status as the sole criterion for accreditation 
bodies. For example, the Department of Health and Human Services is not 
requiring approved accreditors in its Health Information Technology 
certification program (45 CFR part 170) to be signatories to the IAF-
MLA, although signatory status could be provided in support of an 
applicant's request for approval. By contrast, the Environmental 
Protection Agency's WaterSense program (Ref. 31) requires product 
accreditors to be signatories to the IAF-MLA (Ref. 30). The WaterSense 
program is not a regulatory program; rather, it is a partnership 
program.
    We do not have adequate information at this time to propose to 
require accreditation bodies participating in the accredited third-
party audits and certification regulatory program to be IAF-MLA 
signatories--whether as the sole requirement for recognition under 
Sec.  1.610 or as one of several factors in support of recognition. We 
have, however, tentatively concluded that documented conformance to 
ISO/IEC 17011:2004 (Ref. 18) would be relevant in demonstrating that an 
accreditation body is qualified for recognition. We invite comments and 
examples (in particular, examples from regulatory programs) in support 
of, or opposition to, using an accreditation body's status as a 
signatory to an IAF MLA as the sole criterion for recognition or as a 
factor weighing in favor of an application for recognition under the 
accredited third-party audits and certification program.
    b. What legal authority must an accreditation body have to qualify 
for recognition? (Proposed Sec.  1.611). This proposed rule would 
require accreditation bodies seeking recognition to demonstrate they 
have sufficient legal authority to adequately assess third-party 
auditors/certification bodies for accreditation and in conducting 
oversight of them, once accredited.
    Proposed Sec.  1.611 would allow both governmental bodies, with 
accreditation authority inherent in their roles as public officials, 
and private bodies, who have authority under contracts with third-party 
auditors/certification bodies, to qualify for recognition if they have 
the sufficient authority to conduct accreditation activities. This 
includes adequate authority to access records; to conduct onsite 
performance assessments, reassessments, and surveillance; and to grant, 
modify, and remove accreditation status.
    ISO/IEC 17011:2004 (Ref. 18) contains similar requirements for 
bodies accrediting third-party auditors/certification bodies for 
product and management system certification. Clause 4.1 requires 
accreditation bodies to be registered legal entities and explains that 
governmental accreditation bodies are considered legal entities because 
of their governmental status. Clause 4.2.2 states that accreditation 
bodies must have the authority and responsibility to decide on 
granting, maintaining, extending, reducing, suspending, and withdrawing 
accreditation.\22\
---------------------------------------------------------------------------

    \22\ ISO/IEC 17011:2004 also contains requirements relating to 
documentation of the roles and responsibilities of accreditation 
body management and personnel involved in accreditation activities. 
Matters such as these will be more fully explained in the Model 
Accreditation Standards we plan to issue.
---------------------------------------------------------------------------

    Proposed Sec.  1.611(b) would require an accreditation body to 
demonstrate that it has the adequate legal authority to meet the 
requirements for a recognized accreditation body in proposed Sec. Sec.  
1.611 through 1.615, including assessing third-party auditors/
certification bodies for accreditation, monitoring accredited auditors/
certification bodies, perform self-assessments, submitting reports and 
notifications to FDA, implementing procedures to protect against 
conflicts of interest, establishing and maintaining records, and 
following the applicable procedural requirements of our program.
    We are not proposing to require a newly recognized accreditation 
body to wait a certain period of time before beginning to conduct 
accreditation activities under our program. Its accreditation authority 
goes into effect at the moment of recognition. Therefore, we believe 
that an accreditation body seeking recognition must demonstrate its 
capacity to fulfill the roles and responsibilities of recognition, if 
granted. We believe that an accreditation body could meet this 
requirement by providing documentation of its authority to perform 
activities required by proposed Sec. Sec.  1.611 through 1.615. We 
expect this documentation to be provided primarily in the form of 
standard language for contracts with eligible entities under the FDA 
accredited third-party audits and certification program. However, we 
will accept other types of documents (e.g., Standard Operating 
Procedures) that can (individually or as part of a set of documents) 
demonstrate that the accreditation body has adequate legal authority to 
conduct the activities required by proposed Sec.  1.611 through 1.615.
    We invite comment on our proposal to require accreditation bodies 
to have demonstrable evidence to support a conclusion that they would 
have adequate legal authority to meet our requirements (e.g., authority 
to withdraw accreditation for cause), if recognized. We also seek 
examples of other types of evidence that might

[[Page 45797]]

demonstrate the scope of an applicant's legal authority. For comments 
opposing this requirement, we request comment on what, if any, 
requirements we should put in place to ensure that an accreditation 
body applying to us for recognition would be equipped, upon 
recognition, to perform the obligations required under the program.
    c. What competency and capacity must an accreditation body have to 
qualify for recognition? (Proposed Sec.  1.612). This rule would 
require accreditation bodies seeking recognition to demonstrate 
adequate resources to fully implement its accreditation program. Under 
proposed Sec.  1.612, an accreditation body must have adequate numbers 
of personnel or other agents with relevant knowledge, skills, and 
experience to adequately assess and monitor third-party auditors/
certification bodies. The accreditation body also would have to show it 
has adequate financial resources for its operations. In the guidance, 
we will explain the types of expertise and training we expect to see 
when reviewing accreditation body records and conducting onsite 
performance assessments. We also will explain the types of 
documentation that might be used to demonstrate financial viability.
    ISO/IEC 17011: 2004, clause 6.1 (Ref. 18) requires accreditation 
bodies to have a sufficient number of competent personnel (internal and 
external) with the educational background, technical qualifications, 
training, skills, and experience necessary for the accreditation body's 
activities. Clause 4.5.2 requires accreditation bodies to demonstrate 
they have financial resource required for accreditation activities.\23\
---------------------------------------------------------------------------

    \23\ ISO/IEC 17011:2004 contains some requirements that are not 
applicable to our program. For example, it contains requirements 
relating to liability coverage.
---------------------------------------------------------------------------

    Under proposed Sec.  1.612(b) an accreditation body seeking to 
qualify for recognition must demonstrate that it has the capability to 
adequately assess third-party auditors/certification bodies seeking 
accreditation and to monitor accredited auditors/certification bodies 
through performance assessments. It also must be capable of submitting 
reports and notifications to FDA in the manner we propose and to follow 
the procedural requirements under our program. As previously explained, 
an accreditation body will be authorized to begin accreditation 
activities under our program immediately upon recognition. Therefore, 
we need to have adequate assurance of its ability to meet the 
competency and capacity requirements of a recognized accreditation body 
when deciding whether to grant recognition.
    d. What protections against conflicts of interest must an 
accreditation body have to qualify for recognition? (Proposed Sec.  
1.613). This proposed rule would require accreditation bodies to have 
established programs to safeguard against conflicts of interest that 
might compromise their objectivity and independence from third-party 
auditors/certification bodies. Proposed Sec.  1.613 would require 
accreditation bodies seeking recognition to have written measures to 
safeguard against financial conflicts of interest between the 
accreditation body (and its officers, personnel, and other agents) and 
third-party auditors/certification bodies (and their officers, 
personnel, and other agents). Without these conflict of interest 
requirements, we believe it would be difficult for an accreditation 
body to demonstrate adequate independence in accrediting auditors/
certification bodies, as required under our accredited third-party 
auditing and certification program.
    ISO/IEC 17011: 2004, clause 4.3.4 (Ref. 18) requires accreditation 
bodies to ensure that personnel and committees that could influence the 
accreditation process act objectively and be free from any undue 
commercial pressures that could compromise impartiality.\24\
---------------------------------------------------------------------------

    \24\ ISO/IEC 17011 contains additional requirements relating to 
opportunities for involvement by interested parties and the manner 
in which the accreditation body presents its services. Such matters 
are beyond the scope of our program.
---------------------------------------------------------------------------

    Under proposed Sec.  1.613(b), an accreditation body seeking 
recognition must demonstrate the capability to meet the conflict of 
interest requirements that would apply under Sec.  1.624, upon 
recognition. This measure is necessary to help ensure that any 
accreditation activities conducted after recognition would be 
considered objective and independent under our program.
    e. What quality assurance procedures must an accreditation body 
have to qualify for recognition? (Proposed Sec.  1.614). This proposed 
rule would require accreditation bodies seeking recognition to have 
written quality assurance procedures in place. Proposed Sec.  1.614(a) 
requires an accreditation body seeking recognition to have a program 
for monitoring and assessing the performance of its officers, 
personnel, and other agents and for assessing the effectiveness of its 
accreditation program. The program must include procedures for 
identifying areas for improvement and quickly executing corrective 
actions.
    ISO/IEC 17011 (Ref. 18) requires accreditation bodies to establish 
procedures for internal audits (clause 5.7.1) and to identify 
nonconformities in its operations (clause 5.5), opportunities for 
improvement, and preventive actions to address root causes (clause 
5.6). Clause 5.8 requires periodic management reviews.
    Proposed Sec.  1.614(b) requires the accreditation body to 
demonstrate it has the capability to meet the quality assurance 
requirements of Sec.  1.622, for performing annual self-assessments 
against our requirements and reporting the results of such self-
assessments. The guidance we plan to issue will discuss the elements of 
an effective quality assurance program for accreditation bodies.
    f. What records procedures must an accreditation body have to 
qualify for recognition? (Proposed Sec.  1.615). This proposed rule 
would require accreditation bodies seeking recognition to have written 
records procedures in place. Under proposed Sec.  1.615(a), an 
accreditation body would have to demonstrate that it has written 
procedures for establishing, controlling, and retaining records on its 
accreditation program and activities. While we are not proposing that 
an accreditation body must have retained records for a specified period 
of time prior to its recognition, we believe it is necessary for an 
accreditation body to have maintained records for such length of time 
to allow us to adequately assess its program and performance to 
determine whether it is qualified for recognition. The accreditation 
body also must maintain records as required by its existing legal 
obligations. Our guidance will explain these recordkeeping, document 
control, and retention requirements.
    Clause 5.4.1 of ISO/1EC 17011: 2004 (Ref. 18) requires 
accreditation bodies to establish procedures for identification, 
collection, filing, storage, maintenance, and disposal of records. 
Under clause 5.4.2, records procedures must require records to be 
retained for a period consistent with the accreditation body's 
contractual and legal obligations. The accreditation body must have 
procedures to control internal and external documents relating to its 
activities, under clause 5.3.\25\
---------------------------------------------------------------------------

    \25\ Requiring accreditation bodies to exert control over 
external documents relating to its accreditation activities would be 
inconsistent with our program.
---------------------------------------------------------------------------

    Proposed Sec.  1.615(b) would require an accreditation body seeking 
recognition to demonstrate its capability to meet the requirements of a 
recognized accreditation body. This would include,

[[Page 45798]]

for example, capacity for maintaining records for 5 years, which is the 
maximum length for which recognition could be granted. It also requires 
recognized accreditation bodies to give us access to records on 
activities conducted under our program. Clause 4.4 of ISO/IEC 17011: 
2004 (Ref. 18) requires accreditation bodies to have adequate 
arrangements to maintain the confidentiality of information obtained 
through its accreditation activities. Confidential information about a 
third-party auditor/certification bodies must not be disclosed without 
the written consent of the auditor/certification body unless the law 
requires the information to be disclosed without such consent. 
Accreditation bodies applying for recognition must demonstrate their 
capacity, if recognized, to grant us access to confidential 
information, including information contained in records, without prior 
written consent of the auditor/certification body involved. Having 
access to records relating to accreditation activities (including 
confidential information) under this subpart is necessary to ensure the 
rigor, credibility, and independence of the program.
3. Requirements for Recognized Accreditation Bodies

  Table 3--Proposed Requirements for Accreditation Bodies Recognized by
                                   FDA
------------------------------------------------------------------------
 Proposed Rule Section                        Title
------------------------------------------------------------------------
1.620..................  How must a recognized accreditation body assess
                          third-party auditors/certification bodies
                          seeking accreditation?
1.621..................  How must a recognized accreditation body
                          monitor the performance of auditors/
                          certification bodies it accredits?
1.622..................  How must a recognized accreditation body
                          monitor its own performance?
1.623..................  What reports and notifications must a
                          recognized accreditation body submit to FDA?
1.624..................  How must a recognized accreditation body
                          protect against conflicts of interest?
1.625..................  What records requirements must a recognized
                          accreditation body meet?
------------------------------------------------------------------------

    Proposed Sec. Sec.  1.620 through 1.625 contain the requirements 
that a recognized accreditation body would have to meet when conducting 
activities under our program.
    a. How must a recognized accreditation body assess third-party 
auditors/certification bodies seeking accreditation? (Proposed Sec.  
1.620). This proposed rule would establish criteria and procedures a 
recognized accreditation body must use in assessing third-party 
auditors/certification bodies for accreditation.
    Proposed Sec.  1.620(a)(1) requires a recognized accreditation body 
to assess foreign governments/agencies by evaluating the food safety 
programs, systems, and standards of the government/agency to determine 
that the government/agency meets the eligibility requirements for 
accreditation under Sec.  1.640(b), except where the criteria for 
direct accreditation in proposed Sec.  1.670(a) are met.\26\ Proposed 
Sec.  1.620(a)(2) requires a recognized accreditation body to assess 
the internal systems and the training and qualifications of audit 
agents used by a foreign cooperative or other third party to determine 
that the cooperative/party meets the eligibility requirements for 
accreditation under Sec.  1.640(c).
---------------------------------------------------------------------------

    \26\ Under section 808(b)(1)(A)(ii) of the FD&C Act, we may 
begin to directly accredit third-party auditors/certification bodies 
if we have not identified and recognized an accreditation body to 
meet the requirements of the section within 2 years after 
establishing the system.
---------------------------------------------------------------------------

    Proposed Sec.  1.620(a)(1) and (a)(2) are based on section 
808(c)(1) to (c)(3) of the FD&C Act, which distinguishes between the 
assessments of foreign governments/agencies and the assessments for 
foreign cooperatives/other third parties seeking accreditation. They 
also require a recognized accreditation body to assess any third-party 
auditor/certification body under the model accreditation standards we 
must issue under section 808(b)(2) of the FD&C Act. The model 
accreditation standards will specify the authority, competency, 
capacity, impartiality, quality assurance, and records that a third-
party auditor/certification body must have to qualify for accreditation 
under our program.
    Proposed Sec.  1.620(a)(3) requires recognized accreditation bodies 
to observe a statistically significant number \27\ of onsite food 
safety audits by a third-party auditor/certification body (or its audit 
agents) seeking accreditation. Correspondingly, ISO/IEC 17011: 2004, 
clause 7.7.3 (Ref. 18) requires an accreditation body's assessment team 
to witness the performance of a representative number of staff to 
provide assurance of the auditor's/certification body's competency.
---------------------------------------------------------------------------

    \27\ Generally speaking, we consider ``statistical 
significance'' to be an interpretation of statistical data 
indicating that an occurrence was likely the result of a causative 
factor and not simply a chance result. With observations of a 
statistically significant number of accredited auditors/
certification bodies, recognized accreditation bodies will be able 
to exert an appropriate degree of oversight of its accredited 
auditors/certification bodies, using the data to help determine 
whether its accreditation program and activities are functioning 
appropriately.
---------------------------------------------------------------------------

    Proposed Sec.  1.620(b) requires a recognized accreditation body to 
impose three conditions on any accreditation under this program as 
follows:
     The third-party auditor/certification body must comply 
with the audit reporting requirements contained in proposed Sec.  
1.656, which is drawn from section 808(c)(3) of the FD&C Act (which 
makes it a condition of accreditation to prepare consultative audit 
reports within 45 days after conducting an audit and, for regulatory 
audits, to submit an audit report within 45 days after conducting an 
audit).
     The third-party auditor/certification body must agree to 
submit electronic certifications to FDA, where appropriate based on the 
results of a regulatory audit. Under section 808(c)(2)(A) of the FD&C 
Act, we have tentatively concluded that submission of electronic 
certification (as opposed to paper certification) is appropriate for 
the following reasons:
    [cir] It would be too time-consuming and resource intensive to 
review paper-based facility certifications and might result delays that 
would frustrate the purpose of the VQIP program for expedited review 
and entry of products; and
    [cir] Requiring submission and manual review of paper food and 
facility certifications would undermine to our efforts to use robust, 
integrated databases to replace manual review, analysis, and reporting 
of data.
     A third-party auditor/certification body would have to 
comply with the requirement in section 808(c)(4)(A) of the FD&C Act to 
notify us immediately upon discovering, during a food safety audit, a 
condition that could cause or contribute to a serious risk to the 
public health, as a condition of its accreditation. Having timely 
notification of such risks directly affects our ability to respond 
rapidly to protect the public health. We believe this notification

[[Page 45799]]

requirement is of such a critical nature that, we are proposing to 
require compliance as a condition of accreditation. We seek comment on 
our tentative conclusion to require compliance with section 
808(c)(4)(A) of the FD&C Act a condition of accreditation.
    Proposed Sec.  1.620(c) requires recognized accreditation bodies to 
maintain records relating to its accreditation activities under the 
program. These include records on any denial of accreditation and on 
any withdrawal, suspension, or decision to reduce the scope of an 
accreditation for cause.\28\ Such records must include the name and 
contact information for such certification body, the scope of 
accreditation denied, withdrawn, suspended, or reduced, and the basis 
for the action. Having access to records on denials of accreditation 
and actions taken due to nonconformities will help us in assessing the 
performance of the recognized accreditation body and also will allow us 
to determine whether poorly performing third-party auditors/
certification bodies are attempting to ``shop'' for favorable 
accreditation decisions elsewhere. Both are important for our oversight 
of the program.
---------------------------------------------------------------------------

    \28\ Denial, withdrawal, suspension, and reduction in scope of 
accreditation differ from voluntary relinquishment of accreditation 
under proposed Sec.  1.665, which is an action taken on the 
initiative of the auditor/certification body and is not based on a 
finding of nonconformity by its accreditation body.
---------------------------------------------------------------------------

    In proposed Sec.  1.620(d), we require recognized accreditation 
bodies to have written procedures in place to consider appeals from 
third-party auditors/certification bodies to adverse accreditation 
decisions. The written procedures must offer protections similar to 
those afforded by FDA under proposed Sec. Sec.  1.692 and 1.693 and 
include requirements to make the appeals procedures publicly available, 
have the appeal investigated and decided upon by people different than 
those involved in the subject matter of the appeal, notify the auditor/
certification body of the final decision on the appeal, and maintain 
records on the appeal, the final decision, and the basis for the 
decision. This provision is analogous to clause 7.10.2 of ISO/IEC 
17011:2004 (Ref. 18), which requires accreditation bodies to establish 
similar procedures for handling appeals by auditors/certification 
bodies. We emphasize that we are not proposing to review a decision by 
a recognized accreditation body to deny, withdraw, suspend, or reduce 
an accreditation, nor do we propose to consider appeals from third-
party auditors/certification bodies to such actions by recognized 
accreditation bodies. We have considered the language of section 808 of 
the FD&C Act and tentatively concluded that it does not require us to 
review such decisions. We believe our proposal is appropriate and 
consistent with international standards that identify these as matters 
between the recognized accreditation body and the third-party auditor/
certification body affected by the decision. Comments suggesting 
alternatives should provide the following: (1) A detailed legal 
rationale for us to review and decide on a challenge to an 
accreditation decision of a recognized accreditation body, including 
the authority to compel a recognized accreditation body to grant an 
accreditation and to conduct the ongoing monitoring of the auditor/
certification body required under this FDA program; (2) a description 
of the procedures FDA should follow, including whether to compile an 
administrative record based on documents from the accreditation body 
and the third-party auditor/certification body, whether to accept new 
evidence or conduct its own investigation, and whether to conduct a 
public hearing; and (3) a prioritization of FDA's program activities as 
between, for example, monitoring the performance of accredited 
auditors/certification bodies under section 808(f) of the FD&C Act and 
determining whether a recognized accreditation body correctly denied an 
application for accreditation.
    b. How must a recognized accreditation body monitor the performance 
of auditors/certification bodies it accredits? (Proposed Sec.  1.621). 
This proposed rule describes the type and frequency of monitoring a 
recognized accreditation body would have to perform for third-party 
auditors/certification bodies it accredits under our program.
    Proposed Sec.  1.621 requires a recognized accreditation body to 
annually evaluate each of its accredited auditors/certification bodies 
to determine whether it is complying with the applicable provisions of 
this rule. For each such auditor/certification body, the accreditation 
body must review its self-assessments (including information on 
compliance with the conflict of interest requirements under Sec.  
1.657); its regulatory audit reports and notifications to FDA (and 
supporting documents for each), and any other information reasonably 
available to the accreditation body regarding the compliance history of 
eligible entities the accredited auditor/certification body certified 
or that would otherwise be relevant in determining its compliance with 
this rule.
    The monitoring requirements we propose are consistent with section 
808(f)(2) of the FD&C Act, which requires us to evaluate each 
accredited auditor/certification body by reviewing its regulatory audit 
reports and the compliance history (as available) of eligible entities 
it certified, and to take any other necessary measures. We believe 
these elements are equally important for recognized accreditation 
bodies to use when monitoring accredited auditors/certification bodies 
under our program. We believe that the conflict of interest disclosures 
and public health notifications are of such importance to the 
reliability and credibility of the program that recognized 
accreditation bodies should review them as well. To provide flexibility 
to a recognized accreditation body that is aware of additional 
information relevant to its evaluation, and consistent with the last 
clause in section 808(f)(2) of the FD&C Act, we propose to allow the 
accreditation body to rely on other information relevant to its 
evaluation. We note that accreditation bodies need only consider 
information that is ``reasonably available'' to them. We do not expect 
an accreditation body to launch an investigation of each auditor/
certification body it accredited, absent cause; however, we expect that 
accreditation bodies will actively monitor for public information about 
their accredited auditors/certification bodies and will not ignore 
public information about problems associated with one or more of this 
accredited auditors/certification bodies.
    ISO/IEC 17011:2004, clause 7.11.3 (Ref. 18) requires accreditation 
bodies to plan for reassessment and surveillance of each accredited 
auditor/certification body at frequencies between 1 and 5 years, 
depending on the nature of reassessment and surveillance performed. In 
general, clause 7.11.3 requires these monitoring activities to occur 
every 2 years.
    We have tentatively concluded that the assessments under proposed 
Sec.  1.621 should be performed on an annual basis because formal 
reviews at that frequency, throughout the duration of an accreditation, 
will help the accreditation body determine whether the auditor/
certification body continues to meet the applicable program 
requirements and the conditions of its accreditation. Not only will 
these assessments help ensure that accredited auditors/certification 
bodies individually comply with our requirements, but also can be used 
by

[[Page 45800]]

the recognized accreditation body to identify trends and any 
deficiencies in its own performance or program.
    We seek comment on our proposal and on whether the information we 
describe in Sec.  1.621 will provide an appropriate basis for 
recognized accreditation bodies to use in evaluating auditors/
certification bodies they accredited. Should we require recognized 
accreditation bodies to conduct witness audits or visits to the 
headquarters of each auditor/certification body it accredits under the 
program, or a subset thereof? For comments recommending other methods 
of performance assessment, we are interested in information on the 
potential costs and benefits associated with these alternatives.
    c. How must a recognized accreditation body monitor its own 
performance? (Proposed Sec.  1.622). This proposed rule would require 
recognized accreditation bodies conduct self-assessments on an annual 
basis and as required under proposed Sec.  1.664(g) (following FDA 
withdrawal of accreditation of a third-party auditor/certification body 
it accredited).
    Proposed Sec.  1.622(a) requires a recognized accreditation body to 
evaluate the performance of its officers, employees, and other agents; 
compliance with applicable conflict of interest requirements; and any 
other aspects FDA requests, to determine whether the accreditation body 
meets our program requirements. Proposed Sec.  1.622(b) requires a 
recognized accreditation body to observe onsite regulatory audits 
conducted by a statistically significant number of its accredited 
auditors/certification bodies.\29\
---------------------------------------------------------------------------

    \29\ As described in footnote 26, we generally interpret 
statistically significant numbers as those indicating that an 
occurrence was likely the result of a causative factor and not a 
chance result.
---------------------------------------------------------------------------

    Based on these assessments, proposed Sec.  1.622(c) requires 
recognized accreditation bodies implement corrective actions to address 
any area needing improvement that was identified through its self-
assessment. The requirements in proposed Sec.  1.622(a), (b), and (c) 
build on proposed Sec.  1.614, which requires accreditation bodies to 
have quality assurance programs to qualify for recognition.
    Proposed Sec.  1.622(d) requires the accreditation body to prepare 
a written report of the findings of its self-assessment, including: (1) 
A statement disclosing the extent to which the accreditation body, and 
its officers, employees, and other agents, complied with the conflict 
of interest requirements in Sec.  1.624 and other applicable 
requirements; and (2) identifying any corrective actions taken to 
address identified deficiencies. The timelines for a recognized 
accreditation body to submit its self-assessment reports to FDA appear 
in proposed Sec.  1.623(b).
    ISO/IEC 17011: 2004, clause 6.3.1 (Ref. 18) requires accreditation 
bodies to establish procedures for monitoring the performance of its 
personnel. Clauses 5.5 and 5.6 require accreditation bodies to 
establish procedures to identify nonconformities in its operations and 
any opportunities for improvement and to record the results of any 
corrective or preventive actions taken.
    d. What reports and notifications must a recognized accreditation 
body submit to FDA? (Proposed Sec.  1.623). This proposed rule would 
require recognized accreditation bodies to submit to FDA reports of its 
self-assessments and monitoring, as well as notice of matters affecting 
recognition and accreditation status. The reports and notifications 
described in proposed Sec.  1.623 would have to be submitted 
electronically and in English.
    Here and other places in this proposed rule, we suggest that any 
information for FDA be submitted in English. For applications or 
requests to FDA, we also propose to require that any translation or 
interpretation services necessary for us to process the application or 
request be made available by the submitter. We invite comment on our 
proposal to require submissions in English and to require translation 
or interpretation services as necessary. For comments in opposition, we 
seek input on how FDA might address translation and interpretation 
issues in a manner that is not overly burdensome or infeasible for the 
Agency and for submitters. How can FDA mitigate indirect effects on 
others submitting applications or requests? For example, is there a 
limit on the amount of time or resources FDA should spend translating 
and processing an application submitted in a foreign language? Are 
there other factors we should consider in deciding whether to require 
submissions in English and translation and interpretation services 
where necessary?
    Proposed Sec.  1.623(a) requires recognized accreditation bodies to 
submit reports of their annual assessments of accredited auditors/
certification bodies under proposed Sec.  1.621 within 45 days of 
completion of the assessment. The report must include updated lists of 
any audit agents used by such auditors/certification bodies. We believe 
that the results of such assessments will help us evaluate the 
performance of recognized accreditation bodies in reassessing their 
accredited auditors/certification bodies. The results also will help us 
perform our own monitoring of each accredited auditor/certification 
body. For example, having data about trends in performance deficiencies 
that the recognized accreditation body identified in its assessments, 
and the corrective actions that were implemented to address such 
deficiencies, gives us useful information on the accredited auditor/
certification body and offers insight into how the recognized 
accreditation body oversees its accredited auditors/certification 
bodies.
    Proposed Sec.  1.623(b) requires recognized accreditation bodies to 
submit reports of their self-assessments under proposed Sec.  1.622. 
These too will be useful to us in overseeing the recognized 
accreditation bodies. Annual self-assessments would have to be 
submitted within 45 days after completing the self-assessment. In 
establishing this timeframe, we considered the statutory requirement 
that accredited auditors/certification bodies submit reports of 
regulatory audits within 45 days after completing the audit. We 
tentatively concluded that the reports of formal assessments under 
Sec.  1.621 and self-assessments under Sec.  1.622, though different in 
nature from regulatory audits, are similarly important to our ability 
to ensure the rigor and credibility of the accredited third-party 
audits and certification program and thus should be submitted to us 
under a similar deadline.
    Additionally, proposed Sec.  1.623(b) provides that reports from 
self-assessments required by proposed Sec.  1.664(g)(1) (following 
withdrawal of accreditation of a third-party auditor/certification 
body) would have to be submitted to FDA within 2 months after the date 
of withdrawal.
    Proposed Sec.  1.623(c) requires recognized accreditation bodies to 
immediately notify us when they grant accreditation to an auditor/
certification body or when they withdraw, suspend, or reduce the scope 
of an accreditation under our program. Immediate notice is essential so 
that we can take timely action to begin to accept certifications from 
newly accredited auditors/certification bodies and to refuse to accept 
certifications from auditors/certification bodies no longer authorized 
to issue them. For each such notification, an accreditation body must 
provide contact information for the auditor/certification body, the 
name(s) of one or more of its officers, and the scope of accreditation. 
For withdrawal,

[[Page 45801]]

suspension, or reduction in scope, the recognized accreditation body 
must specify the basis for the decision and must update any other 
previously submitted information about the auditor/certification body. 
A recognized accreditation body also must immediately notify us if it 
has determined that an accredited auditor/certification body failed to 
comply with the requirements for issuance of a food or facility 
certification under Sec.  1.653 and must include the basis for the 
determination and update any other information previously submitted 
about the auditor/certification body. Each type of notification must be 
made electronically and in English.
    This information is essential to our oversight and management of 
the accredited third-party audits and certification program and the 
programs that rely on certifications issued by accredited third-party 
auditors/certification bodies. For example, section 808(c)(6)(A)(ii) of 
the FD&C Act requires us to withdraw accreditation from a certification 
body if we determine that the certification body no longer meets the 
requirements for accreditation. Having information on the reason(s) for 
withdrawal, suspension, or reduction in scope of an accreditation will 
help us in determining whether and how to conduct such evaluation. 
(Concerns regarding the performance of an accredited auditor/
certification body are of a different nature than, for example, 
suspension of accreditation for failure to make timely fee payments.) 
Without information on the reason an accreditation was withdrawn, 
suspended, or reduced, we believe we will need to automatically 
consider withdrawal of accreditation whenever an accreditation is 
withdrawn, suspended, or reduced.
    We request comment on our tentative conclusion that our oversight 
of the program will be enhanced by timely notice of accreditations, 
withdrawals, suspensions, and reductions in scope of accreditation by a 
recognized accreditation body, and of violations of proposed Sec.  
1.653.
    In proposed Sec.  1.623(d)(1), we require a recognized 
accreditation body to notify us within 30 days after denying 
accreditation to an auditor/certification body (in whole or in part) 
and including the basis for such denial. Proposed Sec.  1.623(d)(1) is 
based on the requirement in proposed Sec.  1.620(c), which requires 
recognized accreditation bodies to maintain records on any denial of 
accreditation under this program. We are not proposing to prohibit 
accreditation of an auditor/certification body previously denied 
accreditation, if the auditor/certification body is subject to a 
separate, full assessment and found to have adequately addressed the 
problems that led to the denial.
    Proposed Sec.  1.623(d)(2) requires recognized accreditation bodies 
to notify FDA within 30 days after making any significant change that 
would affect the manner in which it complies with the recognition 
requirements in Sec. Sec.  1.610 to 1.625 and include an explanation 
for the purpose of the change. For example, the merger of two 
accreditation bodies, or the contracting out of assessment services at 
an accreditation body that previously employed in-house assessors, 
would be the types of changes that should be notified to us. The intent 
of this proposed requirement is to help ensure that we obtain timely 
notice of any changes that could affect the basis upon which we 
recognized the accreditation body. We are not seeking prior notice, nor 
are we suggesting that we have a role in approving or denying such 
change. We are, however, required by section 808(b)(1)(C) of the FD&C 
Act to revoke recognition of any accreditation body found not to be in 
compliance with section 808 of the FD&C Act. A significant change that 
prevents or undermines the accreditation body's compliance with this 
rule may result in revocation of recognition under proposed Sec.  
1.636.
    e. How must a recognized accreditation body protect against 
conflicts of interest? (Proposed Sec.  1.624). This proposed rule would 
require a recognized accreditation body to take certain steps to 
safeguard against conflicts of interest, including the requirement to 
implement a written conflict of interest program.
    Section 808 of the FD&C Act requires us to establish the accredited 
third-party audits and certification program through, in large part, 
recognition of accreditation bodies to themselves accredit third-party 
auditors/certification bodies. Various stakeholders have expressed 
concern about possible conflicts of interest between the accreditation 
bodies and the third-party auditors/certification bodies seeking to 
participate in the program we implement. We believe that the 
credibility of the program will rest, in part, on whether we establish 
effective measures to protect against conflicts of interest among the 
program participants.
    We considered ISO/IEC 17011:2004 (Ref. 18), which requires that all 
accreditation body personnel and committees that could influence the 
accreditation act objectively and be free from any undue commercial, 
financial, and other pressures that could compromise impartiality.
    We believe that, in keeping with the purpose of section 808 of the 
FD&C Act, recognized accreditation bodies should be held to conflict of 
interest provisions of similar rigor to those placed on accredited 
third-party auditors/certification bodies under section 808(c)(5) of 
the FD&C Act and this proposed rule. Failure to have documented 
safeguards against conflicts of interest between a recognized 
accreditation body and the third-party auditor/certification body 
seeking its accreditation could undermine the system at its foundation 
by introducing the possibility of bias into the system. We believe that 
nothing short of rigorous safeguards will offer the transparency and 
credibility we believe necessary for our oversight of, and consumer 
confidence in, this accredited third-party audits and certification 
program.
    Proposed Sec.  1.624(a)(1) addresses conflicts involving ownership, 
management, or control of, or financial interests in, an auditor/
certification body (including its officers, personnel, or other agents) 
or any affiliate, parent, or subsidiary of the auditor/certification 
body. We believe proposed Sec.  1.624(a)(1) aligns with the requirement 
in section 808(c)(5)(A)(i) of the FD&C Act, which prevents an 
accredited third-party certification body from being owned, managed, or 
controlled by any person that owns or operates an eligible entity to be 
certified by such certification body. It also aligns with the 
requirement, in section 808(c)(5)(B)(i) of the FD&C Act, that an audit 
agent of an accredited third-party certification body not own or 
operate an eligible entity to be audited by such agent.
    Proposed Sec.  1.624(a)(2) prohibits officers, employees, or other 
agents of a recognized accreditation body from accepting any monies, 
gifts, gratuities, or items of value other than the payment of fees for 
accreditation services, reimbursement of direct costs associated with 
accreditation, and onsite meals, of a de minimis value, provided during 
an audit or assessment. We believe this is consistent with the 
requirements in section 808(c)(5)(A)(ii) and (c)(5)(B)(ii) of the FD&C 
Act, which requires an accredited auditor/certification body and its 
audit agents to have procedures to safeguard against financial 
conflicts of interest between any officer, employee, or audit agent and 
any eligible entity to be audited or certified.
    We have tentatively concluded that onsite meals of a de minimis 
nature are not gifts, gratuities, or items of value

[[Page 45802]]

likely to influence the outcome of an audit or assessment, nor do we 
think they are likely to undermine the credibility of the program. 
Onsite meals may help expedite audits and assessments, because the 
accreditation body's assessors would not have to leave the premises for 
meals. We seek comment on whether to define de minimis value according 
to the limits established for U.S. Government employees for accepting 
gifts or gratuities.
    Proposed Sec.  1.624(b) imputes the financial interests of 
immediate family members to an officer, employee, or other agent of a 
recognized accreditation body. This proposed requirement is based on 
the approach we recommended in the 2009 Guidance with respect to 
conflicts of accredited certification bodies (Ref. 5). We believe that 
imposing a similar requirement on the immediate family of the officers, 
employees, or other agents of a recognized accreditation body will help 
to ensure the credibility of the accredited third-party audits and 
certification program at every level.
    Proposed Sec.  1.624(c) requires transparency in the payment of 
fees or reimbursement of direct costs by an accredited auditor/
certification body to a recognized accreditation body. We have 
considered the types of disclosures that are necessary to help ensure 
the credibility of the program (and are consistent with existing 
disclosure laws). We recognize the amount or manner of payment by a 
third-party auditor/certification body for accreditation services may 
give rise to questions about whether the payment might affect the 
outcome of the accreditation process. Where, for example, a third-party 
auditor/certification body makes multiple payments to an accreditation 
body or makes payments under a different schedule than the 
accreditation body's usual practice, this may spur questions about 
whether those payments are linked to a favorable outcome for the third-
party auditor/certification body.
    We have tentatively concluded that, to maintain confidence in the 
program through transparency, recognized accreditation bodies disclose 
the timing of payments and reimbursement they receive from auditors/
certification bodies, to the extent that such disclosures are 
consistent with existing law. While we do not believe that information 
on timing of payment of fees would be protected from disclosure under 
existing disclosure laws, we seek comment on this matter.
    Proposed Sec.  1.624(c) also requires recognized accreditation 
bodies to maintain on their Web sites an up-to-date list of each 
auditor/certification body accredited under this program, including the 
scope and duration of such each accreditation and date(s) on which the 
auditor/certification body paid any fee or reimbursement associated 
with such accreditation. Information on the timing of payments to 
recognized accreditation bodies for accreditation services is useful 
because it allows for analysis of such data in the aggregate. Unusual 
patterns in payments by one or more auditors/certification bodies may 
trigger a closer evaluation by us to determine whether the independence 
and objectivity of the recognized accreditation body may have been 
compromised by such payments. Requiring the recognized accreditation 
body to make information on the timing of payments available on its Web 
site creates transparency, thereby lending to the credibility of the 
program.
    We seek comment on the tentative conclusions identified here, 
namely that we should require recognized accreditation bodies to: (1) 
Have a written program to safeguard against conflicts of interest; (2) 
include the interest of any affiliate, parent, or subsidiary of a 
third-party auditor/certification body within the scope of interests 
covered by the accreditation body's conflict of interest program; (3) 
impute the interests of immediate family members of an officer, 
employee, or other agent to such officer, employee, or other agent; and 
(4) maintain on its Web site a list of its accredited auditors/
certification bodies, including duration and scope of each such 
accreditation, and information about the timing of payments by each 
such auditor/certification body. For interested parties recommending 
alternative approaches regarding public disclosure of payments, we 
request that such comments be accompanied by any examples or other 
information to describe or support the recommended approaches.
    We also seek comment on whether there are conflicts other than 
financial interests of recognized accreditation bodies that should be 
addressed in these regulations. For any comment recommending that we 
address other types of conflicts, we are seeking recommended measures 
to address such conflicts, any documents or references that are 
available to support the recommendation, and input on whether similar 
measures should apply to accredited auditors/certification bodies under 
this program.
    f. What records requirements must a recognized accreditation body 
meet? (Proposed Sec.  1.625). This proposed rule identifies specific 
types of documents a recognized accreditation body would be required to 
establish, control, and maintain to document compliance with applicable 
requirements. The recognized accreditation body also would be required 
to provide FDA access to such records.
    The records required by proposed Sec.  1.625 include documents and 
data relating to the following: (1) Applications for accreditation and 
for renewal; (2) decisions to grant, deny, or suspend accreditation, or 
to reduce the scope of an accreditation; (3) challenges to adverse 
accreditation decisions; (4) monitoring of accredited auditors/
certification bodies; (5) the accreditation body's self-assessments and 
corrective actions (which includes information on compliance with 
conflict of interest requirements under proposed Sec.  1.624); (6) 
significant changes to the accreditation program that might affect 
compliance with this rule; (7) regulatory audit reports and supporting 
information from its accredited auditors/certification bodies; and (8) 
any other reports or notifications submitted under Sec.  1.623. 
Proposed Sec.  1.625 requires such records to be maintained, 
electronically and in English, for a period of 5 years. Requiring 
recognized accreditation bodies to maintain records in English is 
necessary to allow FDA to conduct timely and rigorous oversight of the 
accreditation bodies the Agency recognizes. We believe these are the 
types of records that accreditation bodies currently maintain and that 
such records are routinely maintained by accreditation bodies for a 
minimum of 5 years. In addition, by requiring recognized accreditation 
bodies to maintain their records for at least 5 years, it will help us 
ensure that we have an adequate basis for monitoring its performance 
and determining whether to renew recognition, which may be granted for 
a period of up to 5 years.
    Proposed Sec.  1.625(b) requires a recognized accreditation body to 
make such records available to us for inspection and copying upon the 
written request of an authorized FDA representative or, if requested by 
us electronically, to submit them electronically, in English, no later 
than 10 business days after the date of the request. Proposed Sec.  
1.625(c) prohibits a recognized accreditation body from preventing or 
interfering with our access to its accredited auditors/certification 
bodies and the records of the auditors/certification bodies.
    We have tentatively concluded that the records identified and the 
records

[[Page 45803]]

maintenance and access requirements in proposed Sec.  1.625 are 
necessary for us to adequately monitor recognized accreditation bodies, 
as directed by section 808(f) of the FD&C Act. We understand that 
accreditation bodies frequently include confidentiality provisions in 
standard contracts with third-party auditors/certification bodies. Many 
of those contract provisions may, in the past, have prevented 
disclosure of these records to us. If so, the requirements of proposed 
Sec.  1.625, would require revisions to such contracts (and perhaps 
other documents) establishing and limiting the scope of an 
accreditation body's authority to grant us records access. We believe 
that such access is necessary for us to conduct the monitoring required 
by section 808(f) of the FD&C Act and to otherwise exercise adequate 
oversight of the accredited third-party audits and certification 
program. We seek comment on this tentative conclusion and on the 
specific requirements we propose in this section.
4. Procedures for Recognition of Accreditation Bodies

          Table 4--Proposed Procedures for Accreditation Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.630..................  How do I apply to FDA for recognition or
                          renewal of recognition?
1.631..................  How will FDA review applications for
                          recognition and for renewal of recognition?
1.632..................  What is the duration of recognition?
1.633..................  How will FDA monitor recognized accreditation
                          bodies?
1.634..................  When will FDA revoke recognition?
1.635..................  How do I voluntarily relinquish recognition?
1.636..................  How do I request reinstatement of recognition?
------------------------------------------------------------------------

    a. How do I apply to FDA for recognition or renewal of recognition? 
(Proposed Sec.  1.630). This proposed rule would establish procedures 
for accreditation bodies to follow when applying to FDA for recognition 
or for renewal of recognition. Under proposed Sec.  1.630(a) (initial 
application) and Sec.  1.630(b) (renewal), the applicant must 
demonstrate that it meets the eligibility requirements for recognition 
in proposed Sec.  1.610. Applications for recognition and for renewal 
are subject to the same requirements for the form and manner of 
submission under proposed Sec.  1.630(c) and (d). The accreditation 
body must submit a signed application, accompanied by any supporting 
documents, electronically and in English. We also propose to require an 
applicant to provide any translation or interpretation services we need 
to process the application. This may include providing translators or 
interpreters for FDA staff conducting onsite audits or assessments of 
the applicant.
    We tentatively conclude that the application procedures in proposed 
Sec.  1.630 are reasonable requirements for accreditation bodies to 
meet. We believe that an accreditation body having the competency and 
capacity to qualify for recognition under the criteria in proposed 
Sec.  1.610 would be similarly capable of meeting the application 
requirements in proposed Sec.  1.630. Requirements for electronic, 
English language communications are necessary for us to make well-
informed and timely decisions on applications and to conduct 
appropriate oversight of accreditation bodies, once recognized. We seek 
comment on these conclusions and the proposed requirements of Sec.  
1.630.
    b. How will FDA review applications for recognition and for renewal 
of recognition? (Proposed Sec.  1.631). This proposed rule would 
establish the procedures we will follow in reviewing and deciding on 
applications for recognition and for renewal of recognition. Under 
proposed Sec.  1.631(a), we will create an application queue, organized 
by the date on which each such application submission is complete. In 
the interest of fairness, we are proposing to order the queue on a 
first in, first out basis. We will inform applicants of deficiencies in 
application documentation. To encourage applicants to supply any 
missing information promptly, we will not place an application in the 
queue until it is complete. Allowing incomplete applications in the 
queue might block applications that are ready for review, but were 
submitted later in time.
    We will inform an applicant once its application has been placed in 
the queue. We will review each recognition or renewal application to 
determine whether the applicant meets the eligibility requirements of 
proposed Sec.  1.630(a) and (b). We anticipate that initial 
applications for recognition will require lengthier review times than 
renewal applications will. We will communicate anticipated processing 
periods to applicants. We are not, however, proposing to include 
specific timeframes for review, for the following reasons: (1) It is 
difficult to project the amount of resources that will be available for 
application review, as the program is authorized to be funded by user 
fees under section 808(c)(8) of the FD&C Act; and (2) we expect to 
become more efficient in processing applications as we gain experience 
but currently lack data to reasonably estimate the effect of efficiency 
gains on review times.
    Proposed Sec.  1.631(b), (c), and (d) describe the basis on which 
we will decide whether to approve a recognition or renewal application 
and explains that we will notify the applicant of our decision in 
writing. We may send the notice electronically.
    If we approve an application, the notice will include any 
conditions we may impose on the recognition. (For example, we may 
adjust the date that an accreditation body's annual self-assessment 
would be due, if the anniversary date of its recognition would 
otherwise require the self-assessment to be submitted on a weekend.) If 
we deny a recognition or renewal application, we will explain the 
reason for our denial and will give the address and procedures for 
requesting that we reconsider.
    Proposed Sec.  1.631(e) applies only to applications for renewal of 
recognition and allows us to extend the length of an existing 
recognition to complete our review of the renewal application. We can 
extend the recognition until a specific date or may extend the 
recognition for as long as necessary for us to decide on the 
application.
    c. What is the duration of recognition? (Proposed Sec.  1.632). 
This proposed rule would allow us to grant recognition to an 
accreditation body for up to 5 years, though we will determine the 
length of recognition on a case-by-case basis.
    In deciding that 5 years is the maximum appropriate length of 
recognition, we considered approaches

[[Page 45804]]

taken in other government programs. Another DHHS operating division, 
the Substance Abuse and Mental Health Services Administration (SAMHSA), 
approves accreditation bodies to accredit programs that use opioid 
agonist treatment medications. SAMHSA may approve an accreditation body 
for a period not to exceed 5 years (42 CFR 8.3). Under the FDA 
mammography program, we may approve accreditation bodies for terms of 
up to 7 years (21 CFR 900.3(g)).
    We are proposing to recognize accreditation bodies for a period of 
up to 5 years, based in part on these examples. We do not expect to 
grant every recognition at the maximum duration. We believe that 
shorter terms of recognition may be appropriate in the early years of 
the program or for accreditation bodies with fewer years of experience 
accrediting auditors/certification bodies for food safety auditing and 
certification. As we gain experience with the program, we may revisit 
this matter.
    We seek comment on proposed Sec.  1.632 and the factors we 
considered in developing it. We do not claim to have compiled an 
exhaustive list of government programs for approving accreditation 
bodies and are interested in comments offering other examples that are 
relevant to the type of program we are establishing. To the extent that 
an alternative term of recognition is suggested, we seek any 
information that can be provided in support of such alternative.
    d. How will FDA monitor recognized accreditation bodies? (Proposed 
Sec.  1.633). This proposed rule would establish the frequency and 
manner for our formal evaluations of recognized accreditation bodies. 
Proposed Sec.  1.633 builds on the self-assessment requirements of 
proposed Sec.  1.622, which are submitted to us under proposed Sec.  
1.623. Section 808(f)(1) of the FD&C Act requires us to reevaluate a 
recognized accreditation body at least once every 4 years to determine 
its compliance with applicable FDA requirements.
    Proposed Sec.  1.633(a) describes the timeframes in which we will 
conduct reevaluations: At least 4 years after the date of accreditation 
for an accreditation body recognized for a 5-year term, and the mid-
term point for recognitions granted for less than 5 years. These 
represent the maximum times that may elapse before we conduct a formal 
reevaluation of a recognized accreditation body. We lack data to set a 
more definitive schedule for reevaluations but may be able to do so as 
we gain experience under the program. Proposed Sec.  1.633(a) explains 
that we may perform additional performance evaluations of recognized 
accreditation bodies at any time.
    Proposed Sec.  1.633(b) describes the types of information we may 
gather as part of a performance evaluation. Section 808(f)(3) of the 
FD&C Act gives us authority to conduct onsite audits of eligible 
entities that have been issued certification by an accredited auditor/
certification body at any time, with or without the accredited auditor/
certification body present, and section 808(f)(4) gives us authority to 
take any other measures we deem necessary. Proposed Sec.  1.633(b) 
explains that we may conduct onsite audits of eligible entities 
certified by the accreditation body's accredited auditors/certification 
bodies, as indicators of the effectiveness of the recognized 
accreditation body's performance, including its assessments and 
decisionmaking. These assessments and audits may be conducted at any 
time, with or without the accredited auditor/certification body 
present. We believe it is necessary for us to have the option to 
conduct onsite audits of certified eligible entities outside the 
presence of a recognized accreditation body with an interest in the 
outcome of FDA's evaluation. Therefore, proposed Sec.  1.633(b) allows 
us to conduct onsite assessments of accredited auditors/certification 
bodies at any time, with or without the recognized accreditation body 
present. We believe that such spot checks are useful in testing the 
program and ensuring compliance, which is the purpose of section 808(f) 
of the FD&C Act.
    e. When will FDA revoke recognition? (Proposed Sec.  1.634). This 
proposed rule would establish the criteria and procedures for 
revocation of recognition of an accreditation body. It also describes 
the effects (if any) of revocation on accreditations and certifications 
occurring prior to the revocation. Section 808(b)(1)(C) of the FD&C Act 
requires us to revoke the recognition of an accreditation body for 
failure to comply with section 808 of the FD&C Act and the implementing 
regulations in this subpart.
    Proposed Sec.  1.634 describes several circumstances that we 
believe each warrant revocation of recognition:
    Under proposed Sec.  1.634(a)(1), we will revoke recognition of any 
accreditation body that refuses to grant us access to records or to 
conduct audits, assessments, or investigations necessary to ensure the 
recognized accreditation body's continued compliance. Denial of access 
to perform our oversight functions would prevent us from meeting our 
statutory responsibilities for monitoring recognized accreditation 
bodies under section 808(f)(1) of the FD&C Act.
    We will revoke recognition under proposed Sec.  1.634(a)(2)(i) for 
failure to take timely and necessary corrective action after we 
withdraw accreditation of one of its accredited auditors/certification 
bodies for unjustifiably certifying a facility or food that was linked 
to an outbreak with a reasonable probability of causing serious adverse 
health consequences or death in humans or animals. When we withdraw the 
accreditation of an auditor/certification body, we believe its 
accreditor should promptly conduct an internal review to identify 
whether any problems in its accreditation program or performance may 
have caused or contributed to the circumstances leading to withdrawal 
and to effectively address any problems found. For example, we expect 
such an accreditation body to review its monitoring program to 
determine whether it should conduct more frequent onsite assessments of 
the auditors/certification bodies it accredited under our program.
    We also will revoke recognition under proposed Sec.  
1.634(a)(2)(ii) for failure to take timely and necessary corrective 
action when the results of the accreditation body's self-assessment or 
the self-assessments or monitoring of one or more of its accredited 
auditors/certification bodies identify a significant problem with the 
accreditation body's performance. This provision focuses on significant 
problems the accreditation body knew or should have known it needed to 
address through prompt and effective corrective actions. For example, 
we believe it appropriate to revoke the recognition of an accreditation 
body that ignores obvious, significant problems in its performance yet 
chooses to take no corrective action to address the problems.
    In addition, we will revoke recognition under proposed Sec.  
1.634(a)(2)(iii) when a recognized accreditation body fails to promptly 
implement corrective actions we direct to bring the accreditation body 
into compliance. This provision is based on the requirement of section 
808(b)(1)(C) of the FD&C Act to promptly revoke the recognition of an 
accreditation body found not to be in compliance with section 808 of 
the FD&C Act.
    Proposed Sec.  1.634(a)(3) allows us to revoke recognition when we 
determine that a recognized accreditation body has committed fraud or 
submitted material false statements to us. Fraud and falsehood 
undermine the credibility of the program and our ability to rely on

[[Page 45805]]

the certifications issued by auditors/certification bodies it 
accredited.
    Proposed Sec.  1.634(a)(4) describes circumstances that we believe 
warrant revocation but do not fit into the categories in proposed Sec.  
1.634(a)(1), (a)(2), and (a)(3), such as a lack of objectivity 
(demonstrated bias) in its activities or failure to adequately support 
one or more of its accreditation decisions. There may be unforeseen 
circumstances that we determine provide good cause for revocation of 
recognition for failure to comply with applicable requirements. 
Proposed Sec.  1.634(a)(4) gives accreditation bodies notice of our 
intention to revoke recognition where we find good cause.
    Proposed Sec.  1.634(b) specifies that we may request records from 
the accreditation body or one or more of its accredited auditors/
certification bodies to assist us in deciding whether to revoke 
recognition.
    Proposed Sec.  1.634(c)(1) establishes the procedures for us to 
notify the accreditation body of revocation of recognition and its 
opportunity to challenge the revocation in an informal hearing 
conducted under part 16 of our regulations. Part 16 hearings are used 
for, among other things, approval, reapproval, or withdrawal of 
approval of mammography accreditation bodies under 21 CFR 900.7. We 
believe part 16 hearings provide adequate process for accreditation 
bodies subject to revocation of recognition under this proposed rule. 
The notice of revocation also will identify the procedures for 
requesting reinstatement of recognition under proposed Sec.  
1.634(c)(1). Regardless of whether the accreditation body challenges 
its revocation or seeks reinstatement, under proposed Sec.  
1.634(c)(2), it must notify us of the location where the records 
required by proposed Sec.  1.625 will be maintained.
    Proposed Sec.  1.634(d) addresses the possible effects of 
revocation of recognition on an auditor/certification body accredited 
prior to the revocation. Under proposed Sec.  1.634(d)(1), FDA would 
notify any auditor/certification body accredited by an accreditation 
body whose recognition was revoked. The auditor's/certification body's 
accreditation will remain in effect provided that it conducts a self-
assessment under proposed Sec.  1.655 and reports its results to FDA 
within 2 months of the revocation under proposed Sec.  1.656(b). We 
believe the accredited auditor/certification body that complies with 
these requirements should not face adverse consequences when its 
accreditation body fails to meet its obligations as a recognized 
accreditation body. Requiring the accredited auditor/certification body 
to verify that it is in compliance with the applicable requirements 
through self-assessment and reporting would help provide confidence 
that the auditor's/certification body's program is under control during 
the time it is transitioning from one accreditation body to another. 
The auditor/certification body would have 1 year after the revocation 
of its accreditation body's recognition to become reaccredited, under 
proposed Sec.  1.634(d)(1)(ii). We believe this gives the auditor/
certification body sufficient time to find a new recognized 
accreditation body and to go through its accreditation process, but 
would not allow a prolonged period of auditing and certification 
activity without the immediate oversight of an accrediting body. 
Proposed Sec.  1.634(d)(2) explains that FDA may withdraw accreditation 
of an auditor/certification body whenever FDA finds good cause under 
proposed Sec.  1.664. Where an accredited auditor/certification body 
fails to comply with the requirements of proposed Sec.  1.634(d)(1)(i) 
or (d)(1)(ii), we may withdraw the accreditation for cause under 
proposed Sec.  1.664. Our decision to withdraw accreditation will be 
based on the circumstances associated with the auditor/certification 
body. Revocation of the recognition of its accrediting body does not, 
by itself, provide cause for withdrawal of the accreditation of an 
auditor/certification body that is in compliance with this rule. If 
evidence from a revocation proceeding reveals problems with the 
auditor/certification body, then we may pursue withdrawal of 
accreditation under proposed Sec.  1.664 based on evidence associated 
with the auditor/certification body--not because of the revocation of 
recognition of its accrediting body.
    Under proposed Sec.  1.634(e), certifications issued by an auditor/
certification accredited by an accreditation body whose recognition is 
subsequently revoked will remain in effect until the certifications 
terminate by expiration. We believe that eligible entities should not 
face adverse consequences solely because of the failure of an 
accreditation body selected by its auditor/certification body. However, 
we retain the authority, under section 801(q) of the FD&C Act, to 
refuse to accept a food certification, offered for admissibility 
purposes, if we reasonably believe the certification is not valid or 
reliable. Revocation of the recognition of its accrediting body does 
not, by itself, provide the basis for refusing a certification under 
section 801(q) of the FD&C Act. We will look to circumstances bearing 
on the issuance of a food certification to an eligible entity and 
submission by an accredited auditor/certification body in determining 
its validity or reliability. For example, if an investigation of fraud 
by an accreditation body also reveals evidence of fraud by the eligible 
entity or by the auditor/certification body, we may determine that the 
food certification is not valid or reliable.
    Proposed Sec.  1.634(f) explains that we will provide notice on our 
public Web site when we revoke the recognition of an accreditation 
body. We believe that public notice of matters such as revocation are 
necessary to help ensure the credibility of the program.
    We solicit comment on our tentative conclusions regarding possible 
grounds for revocation, particularly revocation for cause. We seek 
examples that commenters believe do or do not represent good cause for 
revocation. We also solicit input on our proposal to use the informal 
hearing procedures set out in part 16 for challenges to a revocation 
decision.
    f. How do I voluntarily relinquish recognition? (Proposed Sec.  
1.635). This proposed rule would offer an accreditation body a 
mechanism for voluntarily relinquishing its recognition before it 
terminates by expiration. Relinquishment on the initiative of the 
accreditation body is distinct from FDA revocation of recognition for 
good cause.
    Proposed Sec.  1.635 describes the procedures that an accreditation 
body must follow when it intends to relinquish its recognition. Current 
mammography regulations in 21 CFR 900.3 offer accreditation bodies the 
opportunity to voluntarily relinquish their authority to grant 
accreditation. We believe that accreditation bodies operating under our 
accredited third-party audits and certification program should likewise 
have the option to voluntarily relinquish their recognition. We are 
proposing certain procedural requirements--similar to those in the 
mammography regulations--that accreditation bodies must follow in 
relinquishing recognition. We believe these procedures are necessary to 
ensure an orderly transition for auditors/certification bodies 
accredited by an accreditation body that is relinquishing its 
recognition and for us to make necessary adjustments in the program, 
such as preparing to review self-assessments from any auditor/
certification body accredited by such accreditation body. Proposed 
Sec.  1.635(a) requires accreditation bodies to notify us at least 6 
months before relinquishing recognition. The notifications must be 
submitted electronically and in English.

[[Page 45806]]

It is essential that we have the ability to maintain adequate oversight 
of the program, and particularly accredited auditors/certifications 
bodies that will no longer be under the oversight of a recognized 
accreditation body. Therefore, we are proposing to require an 
accreditation body relinquishing its recognition to identify the 
location where the records required by proposed Sec.  1.625 will be 
maintained.
    The decision to relinquish recognition is made solely by the 
accreditation body, without FDA involvement. Therefore, in 
relinquishing recognition under proposed Sec.  1.635(a), the 
accreditation body would waive its rights to appeal, because there is 
no FDA action to serve as the basis for appeal.
    Proposed Sec.  1.635(b) requires the accreditation body to notify 
any third-party auditor/accreditation body, currently accredited, of 
the date on which it intends to relinquish recognition. An accredited 
auditor/certification body needs timely notice of its accreditation 
body's intent to relinquish recognition so that the auditor/
certification body can begin to seek accreditation from another 
recognized accreditation body.
    Proposed Sec.  1.635(c) explains that an accreditation granted by a 
recognized accreditation body prior to relinquishing its recognition 
will remain in effect until it expires, except where we determine there 
is good cause for withdrawal under proposed Sec.  1.664. In general, we 
believe an accredited auditor/certification body should not face 
adverse consequences from its accreditation body's decision to withdraw 
from our program and upon expiration of its accreditation would apply 
for accreditation from a different accreditation body under proposed 
Sec.  1.660. If however we determine that there are grounds for us to 
withdraw the accreditation of the auditor/certification body, the 
auditor/certification body would have to seek reaccreditation under 
proposed Sec.  1.666.
    Proposed Sec.  1.635(d) explains that an accreditation granted by 
an accreditation body that voluntarily relinquished recognition will 
not affect certifications issued by auditors/certification bodies 
accredited prior to its voluntary relinquishment, except that we may 
refuse to consider such certification in determining the admissibility 
of an article of food under section 801(q) of the FD&C Act if we 
determine the certification is not valid or reliable. Such 
certifications generally will remain in effect until they terminate by 
expiration. In considering the impact of relinquishment of recognition 
on certifications, we were mindful that eligible entities would not 
have input into the accreditation body's decision to relinquish 
recognition and that voluntary relinquishment likely would have no 
bearing on the performance of its accredited auditors/certification 
bodies and the validity or reliability of certifications they issue.
    Proposed Sec.  1.635(e) states that we will provide notice on our 
public Web site of the voluntary relinquishment of recognition by an 
accreditation body. To provide notice to program participants and to 
provide certainty to the markets, we also will post information on the 
status of accreditations and certifications as described under proposed 
Sec.  1.635(c) and (d).
    g. How do I request reinstatement of recognition? (Proposed Sec.  
1.636). This proposed rule describes the procedures that an 
accreditation body would have to follow when seeking reinstatement of 
its recognition. Under proposed Sec.  1.636(a), an accreditation body 
that has had its recognition revoked may seek reinstatement by 
submitting a new application for recognition if it did not seek a 
regulatory hearing on the merits of the revocation of its recognition 
under proposed Sec.  1.634 or if required to do so by a decision 
following a regulatory hearing. Proposed Sec.  1.636(b) requires such 
application to be supported by evidence demonstrating that the grounds 
for revocation have been resolved and are unlikely to recur.
    We believe that a new application would be an appropriate 
requirement for an accreditation body that had been previously shown 
not to be in compliance with the requirements of this rule, and any 
conditions we imposed on its recognition. We seek comment on this 
tentative conclusion and on the requirements we propose in Sec.  1.636 
for reinstatement of recognition.
5. Accreditation of Third-Party Auditors/Certification Bodies
    This proposed rule would establish: (1) The eligibility 
requirements for an auditor/certification body to be authorized 
(``accredited'') by a recognized accreditation body or by FDA (``direct 
accreditation'') under the accredited third-party audits and 
certification program; (2) requirements for accredited auditors/
certification bodies, including auditing, reporting, certification, and 
assessments; and (3) procedures FDA and third-party auditors/
certification bodies will follow under the program.

  Table 5--Proposed Requirements for Third-Party Auditors/Certification
                                 Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
  Accreditation of third-party auditors/certification bodies under this
                                 subpart
------------------------------------------------------------------------
1.640..................  Who is eligible to seek accreditation?
1.641..................  What legal authority must a third-party auditor/
                          certification body have to qualify for
                          accreditation?
1.642..................  What competency and capacity must a third-party
                          auditor/certification body have to qualify for
                          accreditation?
1.643..................  What protections against conflict of interest
                          must a third-party auditor/certification body
                          have to qualify for accreditation?
1.644..................  What quality assurance procedures must a third-
                          party auditor/certification body have to
                          qualify for accreditation?
1.645..................  What records procedures must a third-party
                          auditor/certification body have to qualify for
                          accreditation?
------------------------------------------------------------------------
  Requirements for accredited auditors/certification bodies under this
                                 subpart
------------------------------------------------------------------------
1.650..................  How must an accredited auditor/certification
                          body ensure its audit agents are competent and
                          objective?
1.651..................  How must an accredited auditor/certification
                          body conduct a food safety audit of an
                          eligible entity?
1.652..................  What must an accredited auditor/certification
                          body include in food safety audit reports?
1.653..................  What must an accredited auditor/certification
                          body do when issuing food or facility
                          certification?
1.654..................  When must an accredited auditor/certification
                          body monitor an eligible entity with food or
                          facility certification?
1.655..................  How must an accredited auditor/certification
                          body monitor its own performance?
1.656..................  What reports and notifications must an
                          accredited auditor/certification body submit?
1.657..................  How must an accredited auditor/certification
                          body protect against conflicts of interest?

[[Page 45807]]

 
1.658..................  What records requirements must an accredited
                          auditor/certification body meet?
------------------------------------------------------------------------
   Procedures for accreditation of third-party auditors/certification
                        bodies under this subpart
------------------------------------------------------------------------
1.660..................  Where do I apply for accreditation or renewal
                          of accreditation from a recognized
                          accreditation body?
1.661..................  What is the duration of accreditation?
1.662..................  How will FDA monitor accredited auditors/
                          certification bodies?
1.663..................  How do I request an FDA waiver or waiver
                          extension for the 13-month limit for audit
                          agents conducting regulatory audits?
1.664..................  When can FDA withdraw accreditation?
1.665..................  How do I voluntarily relinquish accreditation?
1.666..................  How do I request reaccreditation?
------------------------------------------------------------------------
 Additional procedures for direct accreditation of third-party auditors/
                 certification bodies under this subpart
------------------------------------------------------------------------
1.670..................  How do I apply to FDA for direct accreditation
                          or renewal of direct accreditation?
1.671..................  How will FDA review applications for direct
                          accreditation and for renewal of direct
                          accreditation?
1.672..................  What is the duration of direct accreditation?
------------------------------------------------------------------------

    Section 808 of the FD&C Act directs us to establish a voluntary 
program for accreditation of third-party auditors/certification bodies 
to conduct food safety audits and to issue certifications to eligible 
foreign entities. Sections 808(b)(2) and (c)(5)(C) of the FD&C Act 
require us to issue model accreditation standards to qualify third-
party auditors/certification bodies as accredited auditors/
certification bodies and to issue implementing regulations for the 
program.
    The statute requires accredited auditors/certification bodies to: 
(1) Issue a written (and, as appropriate, electronic) food or facility 
certification after conducting a regulatory audit and such other 
activities necessary to determine compliance with the FD&C Act; (2) 
submit regulatory audit reports within 45 days; (3) complete reports of 
consultative audits within 45 days; (4) maintain onsite audit reports 
and other audit documents in its records; (5) immediately notify us of 
a condition that could cause or contribute to a serious risk to the 
public health; (6) prevent an audit agent from conducting a regulatory 
audit of an eligible entity for which the agent conducted a 
consultative or regulatory audit within the preceding 13 months, unless 
waived by FDA; and (7) comply with conflict of interest requirements.
    a. Who is eligible for accreditation? (Proposed Sec.  1.640). This 
proposed rule would establish the eligibility requirements for a third-
party auditor/certification body to be qualified for accreditation by a 
recognized accreditation body or for direct accreditation by FDA. Under 
section 808(a)(3) of the FD&C Act, a third-party auditor can be a 
foreign government, an agency of a foreign government, a foreign 
cooperative, or any other third party, as FDA determines appropriate 
according to the Agency model accreditation standards. Section 
808(c)(1)(A) of the FD&C Act requires a foreign government/agency 
seeking accreditation to demonstrate that its food safety programs, 
systems, and standards are capable of adequately ensuring that eligible 
entities or foods it certified meet applicable FDA requirements for 
food manufactured, processed, packed, or held for import into the 
United States. Section 808(c)(1)(B) of the FD&C Act requires a foreign 
cooperative or other third party seeking accreditation to demonstrate 
that each eligible entity it certified has systems and standards in use 
to ensure that the entity or food meets the applicable requirements of 
the FD&C Act. The statute requires us to issue model accreditation 
standards under section 808(b)(2) of the FD&C Act to qualify third-
party auditors/certification bodies for accreditation.\30\
---------------------------------------------------------------------------

    \30\ Section 808(b)(2) of the FD&C Act directs us to include 
requirements for regulatory audit reports in the model accreditation 
standards. Because such reports are prepared by accredited third-
party auditors/certification bodies, we have included requirements 
for regulatory audit reports in the proposed requirements for 
accredited auditors/certification bodies in this subpart.
---------------------------------------------------------------------------

    Proposed Sec.  1.640(a) aligns with the definition of third-party 
auditor in section 808(a)(3) of the FD&C Act, describing the types of 
organizations that may be eligible for accreditation under our program: 
Foreign governments and agencies of foreign governments, foreign 
cooperatives, and other third parties. Proposed Sec.  1.640(b) reflects 
the requirements of section 808(b) and (c)(1)(A) of the FD&C Act, 
stating that a foreign government or agency of a foreign government is 
eligible for accreditation if it meets the requirements of Sec. Sec.  
1.641 through 1.645, as specified in FDA model standards on 
qualifications for accreditation, including legal authority, 
competency, capacity, conflicts of interest, quality assurance, and 
records. We believe the scope of the review of a foreign government/
agency's food safety programs, systems, and standards for accreditation 
purposes should focus on the program, systems, and standards relevant 
to the scope of accreditation sought. Under proposed Sec.  1.640(c), a 
foreign cooperative or other third party is eligible for accreditation 
if it can demonstrate that the training and qualifications of its audit 
agents and its internal systems and standards meet the requirements of 
Sec. Sec.  1.641 through 1.645, as explained in FDA model standards on 
qualifications for accreditation, including legal authority, 
competency, capacity, conflicts of interest, quality assurance, and 
records.
    These proposed eligibility requirements build on the language in 
section 808 of the FD&C Act, using the approach we described in our 
2009 guidance on voluntary certification for food and feed (Ref. 5), 
which contained recommendations relating to authority, competency, 
capacity, conflicts of interest, quality assurance, and recordkeeping. 
We also considered the FDA MFRPS (Ref. 12) and draft ICAT (Ref. 14) for 
similar standards that could help assure the maximum degree of 
consistency across domestic and international foods programs. Looking 
externally, we considered the GFSI Guidance version 6 (Ref. 23), which 
requires food safety scheme owners to use third-party auditors/
certification bodies that comply with either ISO/IEC Guide 65:1996 
(Ref. 20) for product

[[Page 45808]]

certification or ISO/IEC 17021:2006 (revised in 2011) (Ref. 19) coupled 
with ISO TS 22003:2007 (Ref. 21) for management systems certification.
    b. What legal authority must a third-party auditor/certification 
body have to qualify for accreditation? (Proposed Sec.  1.641). This 
proposed rule would require third-party auditors/certification bodies 
seeking accreditation to demonstrate that they have sufficient legal 
authority, which may include authority established by contract, to 
adequately audit food facilities and to certify them for compliance 
with food safety requirements, once accredited.
    Proposed Sec.  1.641(a) would allow governmental bodies, with 
auditing and certification authority inherent in their roles as public 
officials, and private bodies, who have authority under contracts with 
food facilities, to qualify for accreditation if they have sufficient 
authority to conduct auditing and certification activities. This 
includes adequate authority to access records; conduct onsite audits; 
and to grant, suspend or withdraw certification. Clause 4.2(d) of ISO/
IEC Guide 65:1996 (Ref. 20) requires auditors/certification bodies to 
be legal entities. Clause 5 of ISO/IEC 22003:2007 (Ref. 21), by cross 
reference to ISO/IEC 17021:2011 (Ref. 19), clause 5, requires auditors/
certification bodies to be legal entities, or defined parts of a legal 
entity that can be held legally responsible for its certification 
activities. Clause 5.1.3 requires auditors/certification bodies to 
retain authority for their certification decisions, including granting, 
maintaining, renewing, extending, reducing, suspending, and withdrawing 
certification.
    Proposed Sec.  1.641(b) would require a third-party auditor/
certification body to demonstrate that it has adequate legal authority 
to meet the requirements for an accredited auditor/certification body 
in proposed Sec. Sec.  1.650 through 1.658, including conducting food 
safety audits using FDA requirements and industry standards and 
practices as audit criteria, preparing audit reports, issuing 
certifications, submitting reports and notification to us, implementing 
procedures to protect against conflicts of interest, maintaining 
records, conducting monitoring when necessary, and following the 
procedural requirements of our program.
    Consistent with our procedures for recognition of accreditation 
bodies, we are not proposing to require a newly accredited auditor/
certification body to wait a certain length of time before beginning to 
conduct foods safety audits and issue certifications under our program. 
Its certification authority goes into effect at the moment of 
accreditation. Therefore, we believe a third-party auditor seeking 
accreditation must demonstrate its capacity to fulfill the roles and 
responsibilities of an accredited auditor/certification body, if 
granted.
    We seek comment on this tentative conclusion and our proposal to 
require third-party auditors/certification bodies to have demonstrable 
evidence to support a conclusion that they would be capable of meeting 
our requirements, if accredited. For comments opposing this 
requirement, we seek comment on what, if any, requirements we should 
put in place to ensure that a third-party auditor/certification body 
seeking accreditation would be equipped, upon accreditation, to perform 
the obligations required under the program.
    c. What competency and capacity must a third-party auditor/
certification body have to qualify for accreditation? (Proposed Sec.  
1.642). This proposed rule would require third-party auditors/
certification bodies seeking accreditation to demonstrate adequate 
resources to fully implement their auditing and certification programs. 
Under proposed Sec.  1.642(a), a third-party auditor/certification body 
must have adequate numbers of personnel and other agents with relevant 
knowledge, skills, and experience to effectively audit for compliance 
with applicable FDA requirements and industry standards and practices 
and to issue valid and reliable certifications. The third-party 
auditor/certification body would have to show it has adequate financial 
resources for its operations. In the model accreditation standards, we 
will explain the types of expertise and training we expect third-party 
auditors/certification bodies to demonstrate. We also will explain the 
types of documentation that might be used to demonstrate financial 
viability.
    Standards associated with auditor competency are critical to 
international standards for certification bodies and are an area of 
focus for GFSI and other stakeholders. Audit agents and other personnel 
that lack the necessary knowledge, skills, and abilities will be unable 
to perform credible audits and may result in flawed certification 
decisions. ISO/IEC 17021:2011 (Ref. 19), clauses 7.2.1 and 7.2.2, 
requires certification bodies to have personnel with sufficient 
competence to manage their audit and certification work and to employ, 
or have access to, sufficient numbers of auditors and technical experts 
to cover the volume and types of its activities.
    Under proposed Sec.  1.642(b), a third-party auditor/certification 
body seeking to qualify for recognition must demonstrate that it has 
the competency and capacity to adequately audit eligible foreign 
entities to determine if they are in compliance with applicable FDA 
requirements and, for consultative audits, industry standards and 
practices. It also must be capable of making certification decisions 
that are valid and reliable, submitting reports and notifications to 
FDA in the manner we propose, and following the procedural requirements 
of our program. As previously explained, a third-party auditor/
certification body will be authorized to begin auditing and 
certification under our program immediately upon accreditation. 
Therefore, it needs to sufficiently demonstrate its ability to meet the 
competency and capacity requirements of an accredited auditor/
certification body in its application for accreditation.
    d. What protections against conflicts of interest must a third-
party auditor/certification body have to qualify for accreditation? 
(Proposed Sec.  1.643). This proposed rule would require third-party 
auditors/certification bodies to have established programs to safeguard 
against conflicts of interest that might compromise their objectivity 
and independence from food facilities they audit and certify. Proposed 
Sec.  1.643(a) would require accreditation bodies seeking recognition 
to have written measures to safeguard against financial conflicts of 
interest between the third-party auditor/certification body (and its 
officers, personnel, and other agents) and food facilities (and owners 
and operators). Without these conflict of interest requirements, we 
believe it would be difficult for a third-party auditor/certification 
body to demonstrate it has adequate independence, as a third party, in 
auditing and certifying food facilities. The model accreditation 
standards will describe appropriate measures to protect against 
conflicts of interest.
    ISO/IEC 17021: 2011 (Ref. 19), clause 4.2.2, recognizes that 
payment for certification services can be a potential threat to 
impartiality. Clause 5.2.2 requires auditors/certification bodies to 
identify, analyze, and document the possibilities for conflicts of 
interest and how it eliminates or minimizes such threats.
    Under proposed Sec.  1.643(b), a third-party auditor/certification 
body seeking accreditation must demonstrate its capability to meet the 
conflict of interest requirements that would apply under Sec.  1.657, 
upon accreditation. This measure is necessary to help ensure that any 
auditing and certification activities conducted after accreditation 
would be

[[Page 45809]]

considered objective and independent under our program.
    e. What quality assurance procedures must a third-party auditor/
certification body have to qualify for accreditation? (Proposed Sec.  
1.644). This proposed rule would require third-party auditors/
certification bodies seeking accreditation to have quality assurance 
procedures in place. Proposed Sec.  1.614(a) requires a third-party 
auditor/certification body seeking accreditation to have a written 
program for monitoring and assessing the performance of its officers, 
personnel, and other agents. The program must include procedures for 
identifying areas for improvement and quickly executing corrective 
actions. The model accreditation standards will describe types of 
quality assurance measures that may be used to qualify for 
accreditation.
    We considered both international and domestic standards in 
developing proposed Sec.  1.644. ISO/IEC Guide 65: 1996 (Ref. 20), 
clause 4.7.1, requires auditors/certification bodies to conduct 
periodic internal audits to verify that their quality systems are 
implemented and effective, to take timely and appropriate corrective 
actions, and to document results. The MFPRS (Ref. 12), which apply 
domestically, also include requirements for quality assurance/internal 
audit programs that involve assessment, corrective action, and 
continuous improvement.
    Proposed Sec.  1.644(b) requires the third-party auditor/
certification body to demonstrate it has the capability to meet the 
quality assurance requirements of Sec.  1.655, for performing annual 
self-assessments against our requirements and reporting the results of 
such self-assessments.
    f. What records procedures must a third-party auditor/certification 
body have to qualify for accreditation? (Proposed Sec.  1.645). This 
proposed rule would require third-party auditors/certification bodies 
seeking accreditation to have written records procedures in place. 
Under proposed Sec.  1.645(a), a third-party auditor/certification body 
would have to demonstrate that it has written procedures for 
establishing, controlling, and retaining records on its auditing and 
certification program and activities. While we are not proposing that a 
third-party auditor/certification body must have retained records for a 
specified period of time prior to its accreditation, we believe it is 
necessary for a third-party auditor/certification body to have 
maintained records for such length of time to allow for its program and 
performance to be adequately assessed in determining whether it is 
qualified for accreditation. The third-party auditor/certification body 
also must maintain records as required by its existing legal 
obligations. The model accreditation standards will explain these 
recordkeeping, document control, and retention requirements.
    In developing proposed Sec.  1.645(a), we considered the records 
requirements in ISO/IEC 17021:2011 (Ref. 19), clause 9.9.1, which 
requires auditors/certification bodies to maintain records on audits 
and other certification activities for all clients, including all 
organizations submitting applications and all organizations audited, 
certified, or with suspended or withdrawn certifications. Clause 9.9.4 
requires auditors/certification bodies to have documented records 
policies and procedures for retaining records for the current cycle and 
an additional certification cycle, noting that records may need to be 
retained for a longer period, where required by law.
    Proposed Sec.  1.645(b) would require a third-party auditor/
certification body seeking accreditation to demonstrate its capability 
to meet the requirements of an accredited auditor/certification body, 
if accredited. This would include, for example, capacity for 
maintaining records for 4 years, which is the maximum length for which 
accreditation could be granted. It also requires accredited auditors/
certification bodies to give us routine access to records of regulatory 
audits and, for consultative audits, access to records in specific 
circumstances. We realize that existing third-party auditors/
certification bodies might need to modify the confidentiality 
provisions in their standard contracts with food facilities. Third-
party auditors/certification bodies applying for accreditation under 
this voluntary program must demonstrate their capacity to grant us 
access to relevant records, upon accreditation, because records are 
necessary to ensure the rigor, credibility, and independence of the 
accredited third-party audits and certification program.
6. Requirements for Accredited Auditors/Certification Bodies

  Table 6--Proposed Requirements for Third-Party Auditors/Certification
     Bodies Accredited by Recognized Accreditation Bodies or by FDA
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.650..................  How must an accredited auditor/certification
                          body ensure its audit agents are competent and
                          objective?
1.651..................  How must an accredited auditor/certification
                          body conduct a food safety audit of an
                          eligible entity?
1.652..................  What must an accredited auditor/certification
                          body include in food safety audit reports?
1.653..................  What must an accredited auditor/certification
                          body do when issuing food or facility
                          certifications?
1.654..................  When must an accredited auditor/certification
                          body monitor an eligible entity with food or
                          facility certification?
1.655..................  How must an accredited auditor/certification
                          body monitor its own performance?
1.656..................  What reports and notifications must an
                          accredited auditor/certification body submit?
1.657..................  How must an accredited auditor/certification
                          body protect against conflicts of interest?
1.658..................  What records requirements must an accredited
                          auditor/certification body meet?
------------------------------------------------------------------------

    a. How must an accredited auditor/certification body ensure its 
audit agents are competent and objective? (Proposed Sec.  1.650). This 
proposed rule would require an accredited auditor/certification body to 
ensure that any audit agents it uses are competent and objective. 
(Where an accredited auditor/certification body is an individual, the 
determination of whether such auditor/certification body is competent 
and objective will be made as part of the accreditation decision.)
    Proposed Sec.  1.650(a)(1) and (a)(2) require an accredited 
auditor/certification body to use audit agents that have knowledge and 
experience to conduct food safety audits within the scope of its 
accreditation. We believe that competency and independence cannot be 
demonstrated solely by records or by an interview. We have tentatively 
concluded that a determination of competency must be based in part on 
observations of the audit agent conducting food safety audits that use 
the requirements of the

[[Page 45810]]

FD&C Act as the standard against which eligible entities are audited.
    We recognize that many audit agents currently are being assessed 
for their performance in conducting audits under private food safety 
schemes. However, section 808(a)(7) of the FD&C Act clearly states that 
regulatory audits performed under this system must assess firms for 
compliance with the FD&C Act and the results of such audits are to be 
used to determine whether certification may be issued. Even 
consultative audits for internal purposes must include assessments of 
compliance with the FD&C Act, although they also include audits on 
industry standards and practices. For these reasons, we are proposing 
to require that audit agents be qualified through observation of audits 
assessing compliance with the FD&C Act.
    ISO/IEC Guide 65:1996 (Ref. 20), clauses 5.1.1 and 5.2.1, require 
auditors/certification bodies to establish minimum criteria for 
competence to ensure that personnel are competent for the functions 
they perform and that auditors'/certification bodies' evaluations and 
certifications are carried out effectively and uniformly. ISO/IEC 
17021:2011 (Ref. 19), clause 7.1.3, requires auditors/certification 
bodies to have documented processes for initial competency evaluations 
and ongoing monitoring of personnel performance and competency. Clauses 
7.2.11 and 7.2.12 state that the documented monitoring procedures for 
auditors/certification bodies must include onsite observation at a 
frequency based on need determined from all monitoring information 
available (e.g., review of audit reports and client feedback).
    Proposed Sec.  1.650(a)(3) requires audit agents to participate in 
annual food safety training. ISO/IEC 17021:2011 (Ref. 19), clause 
7.2.8, requires auditors/certification bodies to identify training 
needs and to offer or provide access to specific training to ensure 
competency of its auditors, technical experts, and personnel. The FDA 
MFRPS (Ref. 12), Standard Two, requires each State inspector to receive 
36 contact hours of classroom training and participate in at least two 
joint or audit inspections with a qualified trainer, every 3 years.
    Proposed Sec.  1.650(a)(4) requires the accredited auditor/
certification body to ensure that its audit agents have no conflicts of 
interest with the eligible entity to be audited and is in compliance 
with the conflicts of interest requirements of Sec.  1.657. Section 
808(c)(5)(B) of the FD&C Act prohibits audit agents from owning or 
operating an eligible entity to be audited by such agent. Accredited 
certification bodies also are required to have procedures to ensure 
against using any of its officers or employees that has a financial 
conflict of interest regarding an eligible entity to be certified by 
the certification body under section 808(c)(5)(A) of the FD&C Act. We 
believe that proposed paragraph (a)(4) is an appropriate way to 
implement these requirements.
    The language in proposed Sec.  1.650(a)(4) also is consistent with 
existing international standards, including ISO/IEC Guide 65:1996 (Ref. 
20), clause 5.2.2, which requires personnel to agree to comply with the 
auditor's/certification body's conflict of interest rules and to 
declare any prior or present association with a supplier or designer of 
products they are to be assigned to audit or certify. ISO/IEC 
17021:2011 (Ref. 19), clause 5.2.12, states that certification body 
personnel who could influence certification activities must act 
impartially and must not allow commercial, financial, or other 
pressures to compromise impartiality.
    Proposed Sec.  1.650(a)(5) requires audit agents to agree to notify 
their certification bodies immediately upon discovering, during a food 
safety audit, any condition that could cause or contribute to a serious 
risk to the public health, cross-referencing proposed Sec.  1.656(c), 
which requires the accredited auditor/certification body to immediately 
notify FDA of such condition. Proposed Sec.  1.650(a)(5) reflects the 
language of section 808(c)(4)(A) and (c)(4)(B) of the FD&C Act, which 
require notification based on conditions found during an audit and 
identifies ``audits'' as both consultative and regulatory audits. To 
ensure that roles and responsibilities of the audit agent and 
accredited auditor/certification body are clearly delineated, proposed 
Sec.  1.650(a)(3) places the audit agent under an obligation to report 
to its auditor/certification body immediately upon discovering a 
notifiable condition. (Having been informed by its agent, the 
accredited auditor/certification body must immediately notify FDA, 
under proposed Sec.  1.656(c).)
    ISO/IEC Guide 65: 1996 (Ref. 20), clause 5.2.2, requires auditor/
certification body personnel to sign a contract or other commitment by 
which they agree to comply with the certification body rules, which 
often include confidentiality requirements. The legal obligation to 
alert FDA, as a regulator, of a notifiable condition is a new 
requirement. Voluntary notification is not a common practice of third-
party auditors/certification bodies. We believe the statutory 
notification requirement is of such importance to our program that an 
individual serving as an audit agent should agree to notify its 
accredited auditor/certification body upon finding any condition 
meeting the notification criteria of section 808(c)(4)(A) of the FD&C 
Act. We believe this will help ensure that audit agents and accredited 
auditors/certification bodies are aware of the notification 
requirements for food safety audits conducted under the FDA program.
    Proposed Sec.  1.650(b) contains additional requirements that the 
accredited auditor/certification body must meet before assigning any 
individual acting as its audit agent to conduct an audit of a 
particular eligible entity. This requirement is intended to ensure that 
each food safety audit assigned to an audit agent is conducted by a 
qualified audit agent. Put another way, in order to meet proposed Sec.  
1.650(b), an accredited third-party certification body would have to 
ensure not only that a food safety audit is within the scope of its 
accreditation but also that the audit is within the scope of 
qualifications of any audit agent the certification body assigns to 
conduct it.
    Clauses 7.1.1 and 7.1.2 of ISO/IEC 17021: 2011 (Ref. 19) require 
auditors/certification bodies to ensure that their personnel have 
appropriate relevant knowledge and set competence criteria of required 
knowledge and skills necessary to effectively perform audit and 
certification tasks to achieve the intended results. Clause 7.2.7 
requires the auditor/certification body to use auditors and technical 
experts only for those certification activities (including audits) 
where they have demonstrated competence. Similarly, ISO/IEC Guide 
65:1996 (Ref. 20), clause 5.1.1, requires auditors'/certification 
bodies' personnel to be competent for the functions they perform.
    Proposed Sec.  1.650(c) imposes additional statutory restrictions 
on audit agents conducting regulatory audits. Under section 
808(c)(4)(C) of the FD&C Act, an audit agent may not conduct a 
regulatory audit of an eligible entity if such agent conducted a 
consultative or regulatory audit for the same eligible entity in the 
preceding 13 months (except that such limitation may be waived under 
proposed Sec.  1.663 if the accredited auditor/certification body 
demonstrates there is insufficient access to accredited certification 
bodies in the country or region where the eligible entity is located.)
    We seek comment on the requirements we propose to ensure that audit 
agents as competent and objective and on any other requirements 
necessary to achieve this objective. In

[[Page 45811]]

particular, we seek input on whether we should place other requirements 
or limitations to help ensure auditor competency. Any recommendations 
that are based on common industry standards or practices should be so 
identified.
    b. How must an accredited auditor/certification body conduct a food 
safety audit of an eligible entity? (Proposed Sec.  1.651). This 
proposed rule would establish requirements for the conduct of 
consultative and regulatory audits by accredited auditors/certification 
bodies. Proposed Sec.  1.651 implements section 808(c)(3) of the FD&C 
Act regarding audit reports and sets out requirements we believe are 
necessary for planning and conducting audits in a manner that fulfills 
the purposes of section 808 of the FD&C Act, including ensuring that 
audits are of sufficient rigor to allow us to rely on the 
certifications that issue based on the results of such audits.
    Proposed Sec.  1.651(a) requires accredited auditors/certification 
bodies to obtain basic information from the eligible entity about the 
type and nature of the requested audit, which will allow the accredited 
auditor/certification body to determine whether: (1) The requested 
audit is within the scope of its accreditation and which of its audit 
agents would be qualified to conduct the audit; (2) whether any 
conflicts of interest prevent it from conducting an audit; or (3) 
whether any other limitations apply, such as the 13-month limit 
described in proposed Sec.  1.650(c). ISO/IEC Guide 65:1996 (Ref. 20), 
clause 8.2.1, is similar, requiring auditors/certification bodies to 
ensure that their clients complete a signed application that describes 
the scope of the desired certification and to provide information on 
the products to be certified, the certification system, and the 
certification standards, if known. The information we propose to 
require under Sec.  1.651(a) is essential for ensuring that the 
accredited auditor/certification body (and any audit agent assigned) 
has the appropriate qualifications to conduct the food safety audit.
    Proposed Sec.  1.651(a) also requires the auditor/certification 
body to obtain the eligible entity's operating schedule for a 30-day 
window, including information relevant to the scope and purposes of the 
audit. This information will help accredited auditors/certification 
bodies in meeting the requirements of section 808(c)(5)(C)(i) of the 
FD&C Act for ``unannounced'' food safety audits. Having the facility's 
operating schedule for a certain period of time will allow the auditor/
certification body to determine when to appear at the facility to 
conduct a food safety audit under proposed Sec.  1.651(b). ISO/IEC 
17021:2011 (Ref. 19) has several provisions on audit planning, such as 
clause 9.1.2.1, which requires them to establish an audit plan for each 
audit. The requirement to provide a production schedule to enable audit 
planning also is a feature of the British Retail Consortium's Global 
Standard for Food Safety (BRC scheme) (Ref. 32). In advance of an 
audit, a facility subject to audit under the BRC scheme (Ref. 32) may 
be asked to provide, among other things, a production schedule and 
typical shift pattern to allow planning to cover relevant 
processes.\31\
---------------------------------------------------------------------------

    \31\ Section III, Part I, Clause 7.2 states that a certification 
body may request ``production schedules, to allow audits to cover 
relevant processes, for example night-time manufacture or where 
production processes are not carried out each day'' and ``typical 
shift patterns.''
---------------------------------------------------------------------------

    Proposed Sec.  1.651(b) would require accredited auditors/
certification bodies to develop contracts or other arrangements 
granting them adequate authority to conduct unannounced audits, access 
records and any area in the facility relevant to the scope of the 
audit, use an accredited laboratory for analytical results, notify FDA 
of a condition that could cause or contribute to a serious risk to the 
public health, prepare and submit audit reports, as appropriate, and 
allow FDA to observe any food safety audit it conducts. This provision 
is intended to help ensure that the auditor/certification body has such 
access to areas within the facility and records maintained by the 
eligible entity as is necessary to conduct a rigorous food safety 
audit. Proposed Sec.  1.651(b) also ensures that that auditor/
certification body has authority to use a laboratory accredited under 
section 422 of the FD&C Act to perform analytical work, and authority 
to provide any reports and the notifications that must be submitted to 
us under this subpart.
    Under clause 8.6.1(d)(2) of ISO/IEC 17021:2011 (Ref. 19), auditors/
certification bodies must require prospective clients to make all 
necessary arrangements for the conduct of the audits, including for 
examining records and access to all processes, areas, records, and 
personnel. An application for certification must include a statement 
that the applicant agrees to supply any information needed for 
evaluation of the products to be certified, under clause 8.2.1(b) of 
ISO/IEC Guide 65:1996 (Ref. 20).
    Proposed Sec.  1.651(c) addresses the protocols for food safety 
audits under this rule. The audit must be conducted in a manner 
consistent with the identified scope and purpose of the audit, on an 
unannounced basis as required by section 808(c)(5)(C)(i) of the FD&C 
Act, and must be sufficiently rigorous to give confidence in the 
reliability and validity of the audit outcomes.
    ISO/IEC 17021:2011 (Ref. 19), clause 9.1.9.5.1, requires that 
information relevant to the audit objectives, scope, and criteria be 
collected by appropriate sampling and verified to become audit 
evidence. Information may be collected through observation, records 
review, and interviews. Under clause 9.1.9.6, audit findings, 
summarizing conformity and detailing nonconformity and its supporting 
audit evidence must be recorded and reported to enable an informed 
certification decision.
    Proposed Sec.  1.651(c) requires the facility audit portion of the 
food safety audit to be conducted at an appropriate time within the 30 
days covered by the operating schedule provided by the eligible entity 
under proposed Sec.  1.651(a)(1)(ii).
    Though most private food safety audit standards rely on announced 
audits, the BRC scheme (Ref. 32) has protocols for both announced and 
unannounced audits.\32\ An unannounced audit under the BRC scheme may 
be conducted in 2 parts, with the ``Good Manufacturing Practices-type 
audit'' unannounced and occurring prior to a records review, which may 
be a planned visit.
---------------------------------------------------------------------------

    \32\ The BRC scheme (Ref. 32) only allows facilities that have 
achieved sufficiently high scores on announced audits to be audited 
under the unannounced protocol.
---------------------------------------------------------------------------

    We considered several factors in developing the audit protocols in 
proposed Sec.  1.651(c), including the 2-part BRC unannounced audit 
protocol. We have tentatively concluded that it is reasonable and 
appropriate to interpret the ``unannounced audit'' requirement of 
section 808(c)(5)(C)(i) of the FD&C Act to apply to the onsite facility 
assessment portion of a food safety audit. We have further concluded 
that an accredited auditor/certification body, equipped with a 30-day 
facility operating schedule, would have adequate opportunity to plan 
and conduct an unannounced facility audit. We anticipate that an 
eligible entity seeking a food safety audit would sign a contract with 
an accredited auditor/certification body at eligible entity (e.g., its 
headquarters), where some or all of the relevant records of the entity 
would be maintained. We think it is appropriate and efficient to allow 
an auditor/certification body to review records maintained at the 
eligible entity on the same day that the contract is signed, even 
though the signing of the contract is a planned event.

[[Page 45812]]

    We propose to sequence our audit protocol different than that of 
the BRC, in that we would allow the planned records review to occur 
prior to the unannounced onsite facility audit. We believe it will be 
important for accredited auditors/certification bodies to gather 
information about the facility before going onsite to audit it. 
(Unannounced audits under the BRC scheme occur only after an announced 
audit has been conducted, which allows the auditors/certification 
bodies to become familiar with the facility and its records before 
conducting an unannounced audit.) Accredited auditors/certification 
bodies operating under the FDA program would have a limited 
opportunity, if any, to gain knowledge about a facility prior to 
conducting an unannounced audit. For this reason, we believe that 
accredited auditors/certification bodies under the FDA program should 
sequence the unannounced audit differently than the 2-part BRC 
unannounced audit. We propose to require accredited auditors/
certification bodies to first review an eligible entity's management 
systems (e.g., records) before conducting an onsite food safety audit 
at the facility.
    We believe that the requirement for unannounced audits will help 
provide confidence in our program. It helps ensure that food facilities 
will remain ``audit ready.'' It also reinforces the independence of the 
accredited auditor/certification body.
    We seek comment on our proposed approach for ``unannounced'' 
audits, including whether it is feasible and appropriate. We also 
request information on current industry practice on arranging audits--
e.g., does industry commonly provide an auditor/certification body 
information about its operating schedule? If not, what other means are 
used to ensure that the auditor/certification body visits a facility at 
the appropriate time to conduct the requested activities? For comments 
suggesting other approaches, we request information on the practical 
implications of the recommended alternate approach(es).
    c. What must an accredited auditor/certification body include in 
food safety audit reports? (Proposed Sec.  1.652). This proposed rule 
would implement the audit reporting requirements of section 808 of the 
FD&C Act and describes the elements of consultative and regulatory 
audit reports that we believe would be appropriate.
    As required by section 808(c)(3) of the FD&C Act, proposed Sec.  
1.652(a) requires a report of a consultative audit be prepared not 
later than 45 days after the audit was completed. Proposed Sec.  
1.652(a) also sets requirements for the content of reports of 
consultative audits, based on the content required by section 
808(c)(3)(A)(i) through (c)(3)(A)(iv) of the FD&C Act: (1) The identity 
of the persons at the eligible entity responsible for compliance with 
food safety requirements; (2) the dates and scope of the audit; and (3) 
any other information we require that relates to or may influence an 
assessment of compliance with the FD&C Act.
    ISO/IEC 17021:2011 (Ref. 19), clause 9.1.10.2, requires audit 
reports to provide an accurate, concise, and clear record of the audit 
to allow for informed certification decisions and include or refer to 
the name and address of the client, the type of audit, the audit scope, 
the dates and places where audit activities were conducted, audit 
findings, evidence, and conclusions, consistent with the requirements 
of the type of audit, and any unresolved issues, if defined.
    Under proposed Sec.  1.652(a)(1) and (a)(2), we propose to require 
that the following identifying information for the facility and the 
eligible entity (if it differs from the facility) that chooses to 
participate in the voluntary third-party certification program be 
included in the consultative audit report: Name, address, and a unique 
facility identifier (UFI), as required by FDA.
    We are proposing to require this information to help ensure that we 
have comprehensive, accurate, and up-to-date on eligible entities and 
audited facilities that chose to participate in the program, which will 
allow us to conduct efficient and effective oversight of the program. 
Firm name and address alone may not provide sufficient information to 
allow us to correctly identify an eligible foreign entity, such as a 
farm that is not subject to the FDA facility registration requirements 
and that may be located in a remote area in the foreign country. An UFI 
could help us with eligible entities and facilities that would 
otherwise be difficult to identify or locate.
    After considering the types of information available, we have 
tentatively concluded that an UFI should include two elements: (1) A 
common business identifier, and (2) information on the firm's 
geographic location. For the business identifier, we believe the Data 
Universal Numbering System (D-U-N-S[supreg]) numbers system is 
appropriate because it is a commonly used international business entity 
listing system under which a company can obtain, at no charge, a unique 
identification number for its business. D-U-N-S[supreg] numbers are 
distinct, site-specific, 9-digit numbers that would allow us to 
identify and verify certain business information, e.g., its trade 
names, the name of each corporate officer and director, and additional 
ownership information that may be useful in determining possible 
conflicts of interest between eligible entities and accredited 
auditors/certification bodies.\33\ The use of D-U-N-S[supreg] numbers, 
as a unique numerical identification system, is less prone to mistake 
or ambiguity than the use of an eligible entity's or facility's name 
and address. Similarly, geographic information, such as Global 
Positioning System (GPS) coordinates, would identify precisely where a 
facility or eligible entity (if different) is located. We believe this 
is a necessary element of a UFI, particularly for facilities such as 
farms that are not required to register with us under Sec. Sec.  1.225 
through 1.243 and that may be difficult to locate by street address. We 
expect that accredited auditors/certification bodies that are qualified 
to participate in our program likely would already own GPS units or 
would be adequately resourced to purchase them.
---------------------------------------------------------------------------

    \33\ D-U-N-S[supreg] numbers are assigned by Dun & Bradstreet 
and maintained in their database of D-U-N-S[supreg] numbers. If the 
D-U-N-S[supreg] Number for a location has not been assigned, a 
business may obtain one for no cost directly from Dun & Bradstreet 
(https://www.dnb.com).
---------------------------------------------------------------------------

    Proposed Sec.  1.652(a)(3) and (a)(4) requires reports of 
consultative audits to include the contact information for the 
person(s) responsible for food safety compliance, the dates and scope 
of the consultative audit, both of which are statutory requirements.
    Proposed Sec.  1.652(a)(5) requires information on any deficiencies 
observed during the audit that require corrective action and the date 
on which such corrective actions were completed. ISO/IEC 17021:2011 
(Ref. 19), clause 9.1.11, states that [audit/]certification bodies must 
require their clients to analyze the cause of nonconformities and the 
corrective actions to address such nonconformities within a defined 
time. [Auditors/]certification bodies must verify and document the 
effectiveness of the corrective actions based on document review or, 
where necessary, onsite verification or additional audits under clauses 
9.1.12 and 9.1.13. Proposed Sec.  1.652(a)(5) would require such 
documentation be included in the consultative audit report.
    Proposed Sec.  1.652(b) requires an accredited auditor/
certification body to prepare a report of a regulatory audit and submit 
it to us electronically, in English, within 45 days after conducting 
such audit, as mandated by section 808(c)(3) of the FD&C Act. We have

[[Page 45813]]

tentatively concluded that electronic submission of regulatory audit 
reports, written in English, will help ensure we have ready access to 
information needed for monitoring and oversight of the program. 
Proposed Sec.  1.652(b) also requires auditors/certification bodies 
accredited by recognized accreditation bodies to submit each regulatory 
audit report to the accrediting body in the same timeframe and manner 
as it is submitted to us. We believe that this information is important 
to recognized accreditation bodies in conducting monitoring and 
oversight of the auditors/certification bodies they accredit, including 
monitoring required by proposed Sec.  1.621, and in assessing its own 
performance of accreditation activities under proposed Sec.  1.622.
    The report of a regulatory audit must contain all of the data 
elements required for reports of consultative audits under proposed 
Sec.  1.652(a). Proposed Sec.  1.652(b) requires that regulatory audit 
reports contain the following additional data elements: (1) The FDA 
registration number assigned to the facility, where applicable; (2) the 
process(es), food(s), and facility observed during the audit; and (3) 
information on sampling and laboratory analysis, recent food recalls, 
recent significant changes at the facility, and any food or facility 
certifications recently issued to the entity. We discuss each of these 
additional data elements.
    FDA Registration Number: Having an audited facility's FDA 
registration number, where required, will allow us to verify (and to 
correct, where necessary) registration information in our database. 
This will help us in overseeing this program and in risk-based planning 
for FDA foreign inspections.
    Process(es) and food(s) observed during a regulatory audit: In 
proposed Sec.  1.652(b)(4) we require a description of the process(es) 
and food(s) observed during the audit, because we believe that, 
otherwise, the description of the scope of the audit may not provide 
sufficient information to allow the accredited auditor/certification 
body, its recognized accreditation body, or us to determine whether the 
certification matches the scope of the audit stated and, furthermore, 
whether the stated scope of the audit matches the scope of auditor's/
certification body's accreditation. In sum, the description of the 
process(es) and food(s) subject to regulatory audit help to verify the 
validity of any food or facility certifications issued as a result of 
the regulatory audit.
    Sampling and analysis: Proposed Sec.  1.652(b)(8) requires 
information on whether the entity uses sampling and laboratory analysis 
(e.g., under a microbiological sampling plan) as part of the facility's 
preventive control plan. We are not proposing to require the accredited 
auditor/certification body to include the results of such sampling and 
analysis in the regulatory audit report. Information on whether a 
facility uses sampling and laboratory analysis helps identify how the 
facility has chosen to verify its preventive controls.
    Recalls during the preceding 2 years: Proposed Sec.  1.652(b)(9) 
requires information on whether the entity issued a food-safety related 
recall of an article of food from the facility during the 2 years 
preceding the audit and, if so, any such article(s) recalled and the 
reason(s) for the recall(s). We believe this is an important element of 
a regulatory audit for certification purposes, because it may be 
relevant in helping us to determine whether to accept a certification 
or other assurance by an accredited auditor/certification body for 
purposes of admitting a food into the United States under section 
801(q) of the FD&C Act. Recent food safety-related recalls might call 
into question the reliability of any food certifications issued to the 
facility. Recall information also may be relevant to the risk factors 
used to determine VQIP eligibility.
    Recent significant changes: Proposed Sec.  1.652(b)(10) requires 
submission of information regarding whether, during the 2 years 
preceding the audit, the entity made a significant change in the 
activities conducted at the facility, if such change creates a 
reasonable potential for a new hazard or a significant increase in a 
previously identified hazard. For example, a new hazard might arise if 
a facility began to process a different type of commodity or began to 
package an existing product in a different way (e.g., going from a 
canned product to a vacuum-packed ready-to-eat product).
    We developed this criterion based on the language in section 418(i) 
of the FD&C Act, regarding conditions that trigger a requirement to 
reanalyze hazards under section 418(b) of the FD&C Act (21 U.S.C. 
350g(b) and (i)), as described in the Preventive Controls proposed 
rule. While the types of facilities that may be audited are not limited 
to facilities subject to the proposed preventive controls regulations, 
we nonetheless believe the language set out in the statute sets the 
appropriate boundaries for proposed Sec.  1.652(b)(9). We have 
tentatively concluded that the type of information that has relevance 
for reanalysis of hazards in a facility under the Preventive Controls 
proposed rule is the same type of information that has relevance for 
the conduct of a regulatory audit of a facility under this rule. We 
invite comment on this tentative conclusion. For comments that oppose 
this criterion, we seek comment on whether any other information on 
facility changes has relevance for our oversight and, if so, we seek 
alternative language for proposed Sec.  1.652(b)(9).
    Prior certifications: Proposed Sec.  1.652(b)(11) requires 
regulatory audit reports to contain information on any food or facility 
certifications issued to the entity during the 2 years preceding the 
audit, where available. The information must include the scope and 
duration of each such certification. This information is a helpful in 
verifying certifications submitted to us by importers for purposes of 
VQIP eligibility or as required to accompany food for which 
certification is a condition of admission under section 801(q) of the 
FD&C Act. It also verifies the activities of an accredited auditor/
certification body under this program, which should be documented in 
the records of the accredited auditor/certification body under proposed 
Sec.  1.658.
    Proposed Sec.  1.652(c) explains that an accredited auditor/
certification body must submit a report, as required by paragraph (b), 
for each regulatory audit it conducts, regardless of whether 
certification issued as a result. This requirement is consistent with 
section 808(c)(3)(A) of the FD&C Act, which requires all regulatory 
audit reports to be submitted. That statutory provision is not limited 
to reports of regulatory audits where certifications were issued.
    Proposed Sec.  1.652(d) requires accredited certification bodies to 
implement written procedures for receiving and addressing challenges 
from eligible entities contesting adverse regulatory audit results and 
requires them to maintain records of such challenges under Sec.  1.658. 
ISO/IEC 17021:2011 (Ref. 19) requires auditors/certification bodies to 
have a documented process to receive, evaluate, and make decisions on 
complaints relating to certification activities under clause 9.8.4., as 
well as a documented process for handling appeals under clause 9.7.1.
    d. What must accredited auditor/certification body do when issuing 
food or facility certifications? (Proposed Sec.  1.653). This proposed 
rule describes the activities that an accredited auditor/certification 
body would have to perform when issuing food and facility 
certifications. It is based on the language in section 808(c)(2)(C) 
(requiring a regulatory audit and such other

[[Page 45814]]

necessary activities) and (c)(5)(C)(i) (requiring unannounced audits) 
of the FD&C Act.
    Proposed Sec.  1.653(a) specifies that the certification body must 
have conducted a regulatory audit meeting the requirements of proposed 
Sec.  1.651, including verification of corrective actions and using an 
accredited laboratory, subject to the requirements of the laboratory 
accreditation program we implement under that provision (21 U.S.C. 
350k).
    ISO/IEC 17021:2011 (Ref. 19) requires auditors/certification bodies 
to use certain information in considering certification decisions: 
Audit reports; comments on nonconformities and corrective actions (if 
any); verified application information; and the audit agent's 
recommendation on certification, including any conditions or 
observations. The auditor's/certification body's decision must be based 
on an evaluation of the audit findings and conclusions and any other 
relevant information, such as public information and the client's 
comments on the audit report.
    Proposed Sec.  1.653(b) sets out the requirements for issuance of 
certification. As with other submissions under this rule, we propose to 
require certifications to be submitted electronically and in English. 
Proposed paragraph (b)(2) describes the minimum elements of a 
certification: Identifying information for the accredited auditor/
certification body, the eligible entity to which certification was 
issued (including its unique facility identifier), and the facility (if 
different from the eligible entity); the scope and date(s) of the 
regulatory audit and the name of the audit agent conducting it, where 
applicable; and the scope of the certification, its date of issuance, 
and its date of expiration. These are the minimum elements we believe 
necessary for us to link the certification to an importer in the VQIP 
program under section 806 of the FD&C Act or to a food subject to 
mandatory certification under section 801(q) of the FD&C Act. Moreover, 
these data elements will help us determine whether the certification is 
valid and reliable or should be refused under section 801(q)(4)(B) of 
the FD&C Act.
    e. When must an accredited auditor/certification body monitor an 
eligible entity with food or facility certification? (Proposed Sec.  
1.654). This proposed rule would require accredited auditors/
certification bodies to monitor eligible entities in certain 
circumstances. Under proposed Sec.  1.654, an accredited auditor/
certification body is required to conduct monitoring of an eligible 
entity if the auditor/certification body has reason to believe that an 
eligible entity to which it issued a certification may no longer be in 
compliance with the FD&C Act.
    In developing proposed Sec.  1.654, we considered international 
standards. ISO/IEC Guide 65: 1996 (Ref. 20), clause 13.1, requires 
auditors/certification bodies to have documented procedures for 
surveillance under applicable criteria. Under clause 13.2, auditors/
certification bodies must determine whether changes, such as a client's 
intended changes in manufacturing processes, require further 
investigation. ISO/IEC 17021:2011 (Ref. 19), clause 9.3, requires 
auditors/certification bodies to develop their surveillance activities 
so that representative areas and functions are regularly monitored. 
Surveillance may include onsite audits. While we are not proposing to 
require regular surveillance of certified eligible entities, we believe 
requiring an accredited auditor/certification body to conduct 
monitoring when it has ``reason to believe'' that the entity is no 
longer in compliance with the FD&C Act strikes an appropriate balance.
    Proposed Sec.  1.654 requires the accredited auditor/certification 
body to immediately notify us under proposed Sec.  1.656(d) if it 
determines that the entity to which it issued certification is out of 
compliance with the FD&C Act. We believe that such notification is 
necessary to ensure the protection of the public health and to maintain 
the credibility of the program, particularly in light of the use of 
such certifications: To allow admission of a food subject to mandatory 
certification based on a determination of safety risk, under section 
801(q) of the FD&C Act, and to allow importers to participate in a 
program giving them expedited review and entry of product from a 
certified facility, under section 806 of the FD&C Act.
    f. How must an accredited auditor/certification body monitor its 
own performance? (Proposed Sec.  1.655). This proposed rule would 
require accredited auditors/certification bodies to conduct self-
assessments annually and following revocation of the recognition of its 
accreditation body. Proposed Sec.  1.655(a) requires an accredited 
auditor/certification body prepare a report of the results of each 
self-assessment. The report must address the performance of its 
officers, employees, or other agents in activities under this subpart. 
For audit agents in particular, the accredited auditor/certification 
body must report on whether its audit agents, during food safety 
audits, focused on the elements of production, manufacturing, 
processing, packing, and holding of food that pose the most significant 
risks to human and/or animal health.
    Under proposed Sec.  1.655(a), the self-assessment report must 
evaluate the degree of consistency among its officers, employees, or 
other agents in performing activities under this subpart. (With audit 
agents, this is frequently called ``auditor correlation.'') In 
addition, the report must assess compliance with the conflict of 
interest requirements of Sec.  1.657, actions taken based on 
assessments by FDA or its recognized accreditation body, and must 
address any other aspects of performance relevant to a determination of 
compliance, if requested by FDA.
    Proposed Sec.  1.655(b) states that, in conducting its self-
assessment, an accredited auditor/certification body may assess the 
compliance of one or more of the eligible entities it certified, as a 
means to evaluate its performance. Under proposed Sec.  1.655(c), the 
auditor/certification body must quickly execute appropriate corrective 
actions when problems are identified during a self-assessment under 
paragraphs (a) or (b) and must maintain records documenting the 
completion of such actions under proposed Sec.  1.658. In addition, 
proposed Sec.  1.655(d) describes the contents of the written reports 
of its self-assessments, including describing any corrective actions 
taken based on its self-assessments and stating the extent of its 
compliance with conflict of interest requirements and other applicable 
requirements of this rule.
    ISO/IEC Guide 65:1996 (Ref. 20), clause 4.7.1, requires auditors/
certification bodies to conduct periodic internal audits covering all 
of its procedures and to ensure that personnel responsible for the area 
audited are informed of the audit outcome, timely and appropriate 
corrective actions are taken, and audit results are documented. 
Additionally, clause 4.7.2 requires the management with executive 
responsibility to review its quality systems at sufficiently short 
intervals to ensure its continuing suitability and effectiveness.
    The FDA MFRPS (Ref. 12) have elements requiring States to conduct 
periodic self-assessments of its manufactured food regulatory program 
against the criteria we established. These self-assessments are 
designed to identify the strengths and weaknesses of the State program 
by determining the level of conformance with the program standards and 
are independently verified through an audit. Records documenting the 
results of the self-assessment must be maintained. We have tentatively 
concluded that self-assessments would serve a similarly

[[Page 45815]]

important role for accredited auditors/certification bodies under our 
accredited third-party audits and certification program.
    g. What reports and notifications must an accredited auditor/
certification body submit? (Proposed Sec.  1.656). This proposed rule 
would establish requirements for various reports and notifications that 
accredited auditors/certification bodies would have to submit to FDA. 
Proposed Sec.  1.656(a) requires accredited auditors/certification 
bodies to submit regulatory audit reports no later than 45 days after 
completing such audit. This requirement is based on section 
808(c)(3)(A) of the FD&C Act, which requires submission of regulatory 
audit reports as a condition of accreditation. The regulatory audit 
report must be submitted electronically, in English, contain the 
information required by proposed Sec.  1.652(b). The requirement for 
electronic submissions, in English language, is required consistently 
throughout this rule, for the reasons explained in section IV.3.c and 
IV.3.d.
    Under proposed Sec.  1.656(b), an accredited auditor/certification 
body must submit its annual self-assessment report to its accreditation 
body (or, in the case of direct accreditation, to us) no later than 45 
days after the anniversary date of its accreditation under this program 
and, for reports required following revocation of its accreditation 
body's recognition, within 2 months of the revocation. The self-
assessment report, which is required by Sec.  1.655, must be submitted 
electronically, in English, and must include an up-to-date list of any 
audit agents the certification body uses to conduct audits under this 
subpart. As explained in the discussion of proposed Sec.  1.621, we 
believe that the results of such assessments will be helpful to us in 
performing our monitoring of not only the accredited auditor/
certification body itself, but also the recognized accreditation body 
that accredited it, where applicable. Monitoring of recognized 
accreditation bodies and accredited third-party auditors/certification 
bodies is required by section 808(f)(2) of the FD&C Act.
    Having information about deficiencies the accredited auditor/
certification body identified in its own performance and program, 
together with the corrective actions that were implemented to address 
such deficiencies helps us target our monitoring activities. Moreover, 
the results of self-assessments across a number of accredited auditors/
certification bodies will help us identify trends in program 
performance and may offer an early signal of potential issues for the 
Agency to address at the program level.
    Proposed Sec.  1.656(c) requires an accredited auditor/
certification body to immediately notify us when any audit agent or the 
auditor/certification body itself, discovers during an audit any 
condition that could cause or contribute to a serious risk to the 
public health. This notification is required by section 808(c)(4) of 
the FD&C Act, which identifies certain information that must be 
contained in the notification.
    Based on that requirement and the authority granted to us to issue 
regulations for the efficient enforcement of its authority, under 
section 701(a) of the FD&C Act, proposed Sec.  1.656(c) requires such 
notification to include the following: (1) The name and address of the 
facility where the condition was discovered; (2) the FDA registration 
number assigned to the facility, where applicable; (3) the name and 
address of the eligible entity, if different from that of the facility; 
and (4) the condition that could cause or contribute to a serious risk 
to the public health and for which notification is required.
    Information on the identity of the entity and the notifiable 
condition is required by section 808(c)(4) of the FD&C Act. The other 
data elements we propose to require are essential for us to take 
immediate and necessary steps to protect the public health. In the 
event that the facility where the condition was discovered is different 
than the eligible entity, or is at a different location, we need to 
know the name and address of the facility so that we can interact 
directly with the facility. Knowing the facility's FDA registration 
number (where required) helps us quickly assemble relevant information 
we possess, including information from our foreign regulatory partners. 
The data elements required for notification under Sec.  1.656(c)(1), 
(c)(2), and (c)(3) offer the minimum information we believe necessary 
to allow the Agency to determine the appropriate course of action with 
respect to the situation.
    We note that section 808 of the FD&C Act does not define ``serious 
risk to the public health,'' nor does it give examples of 
``condition[s] that could cause or contribute to a serious risk to the 
public health.'' The statutory description of notifiable conditions--as 
ones that ``could'' cause or contribute to a serious risk to public 
health--suggests to us that the scope of this provision is broad. In 
developing these proposed implementing regulations, we looked for the 
precise phrase, ``cause or contribute to a serious risk to the public 
health'' elsewhere in the FD&C Act, but did not find it there (21 
U.S.C. 301 et seq.). In considering section 808 of the FD&C Act as a 
whole, we noted that the provision giving us access to records 
associated with consultative audits cross-references section 414 of the 
FD&C Act (21 U.S.C. 350c). Section 414 of the FD&C Act, among other 
things, gives us access to records if we have a reasonable belief that 
an article of food, and any other article of food that we reasonably 
believe is likely to be affected in a similar manner, is adulterated 
and presents a threat of serious adverse health consequences or death 
to humans or animals (SAHCODHA) (21 U.S.C. 350c(a)). Although Congress 
chose to incorporate SAHCODHA by referencing section 414 of the FD&C 
Act as authority for us to access records of consultative audits under 
section 808(c)(3)(C) of the FD&C Act, Congress did not use the SAHCODHA 
standard in describing the types of conditions that could cause or 
contribute to a serious risk to the public health and that must be 
reported to FDA under section 808(c)(4)(A) of the FD&C Act. We believe 
Congress intended the standard for notification to be a different 
standard than SAHCODHA.
    We invite comment from interested parties interpreting the 
notification standard in section 808(c)(4)(A) of the FD&C Act and 
providing examples of circumstances that stakeholders believe do and do 
not rise to the level of a ``condition that could cause or contribute 
to a serious risk to the public health.'' We are particularly 
interested in receiving input on whether our existing Class I and Class 
II recall standards (Ref. 33), taken together, might adequately address 
any condition covered by section 808(c)(4)(A) of the FD&C Act. An FDA 
Class I recall occurs in a situation in which there is a reasonable 
probability that the use of or exposure to a violative product will 
cause serious adverse health consequences or death. An FDA Class II 
recall occurs in a situation in which use of or exposure to a violative 
product may cause temporary or medically reversible adverse health 
consequences or where the probability of serious adverse health 
consequences is remote.
    We also note that international standards for [auditors/
]certification bodies have exceptions to confidentiality agreements 
where disclosure is required by law. For example, ISO/IEC Guide 
17021:2011 (Ref. 19), clause 8.5.3, requires an auditor/certification 
body that is required by law to release confidential information to a 
third party, to notify the client before providing such information to 
a third party, ``unless regulated by law.'' Based on section 
808(c)(4)(A) of the FD&C Act, which

[[Page 45816]]

requires that the accredited third-party certification body 
``immediately'' notify us, proposed Sec.  1.656(c) requires an 
accredited auditor/certification body to notify us of a serious risk to 
public health prior to notifying its client, the eligible entity. We 
recommend that accredited auditors/certification bodies include a 
provision explaining this notification requirement in their contracts 
with eligible entities. We believe this will help ensure that eligible 
entities are aware of the notification requirement and will help 
emphasize to the accredited auditors/certification bodies their 
obligation to notify FDA of such condition.
    Proposed Sec.  1.656(d) requires an accredited auditor/
certification body to immediately notify us electronically, in English, 
upon withdrawing or suspending the food or facility certification of an 
eligible entity. The notice must describe the basis for withdrawal or 
suspension. We believe immediate notification of suspension or 
withdrawal of certifications is necessary because of how we use these 
certifications: As a condition of granting admission to a food subject 
to an risk determination under section 801(q) of the FD&C Act and as a 
criteria for an importer's eligibility to participate in VQIP under 
section 806 of the FD&C Act. We realize that certification bodies 
currently withdraw and suspend certifications for a number of reasons, 
some of which relate to payment of fees and others relate to food 
safety matters. Therefore, having information on the fact that a 
certification has been withdrawn or suspended, as well as the reason(s) 
for the action, allows us to determine the effect of suspension or 
withdrawal on our use of the certifications under sections 801(a) and 
806 of the FD&C Act. Depending on the reasons for suspension or 
withdrawal of certification, we may conduct an inspection or take other 
action.
    Under proposed Sec.  1.656(e)(1), an accredited auditor/
certification body that notifies us under proposed Sec.  1.656(c) must 
immediately thereafter notify the eligible entity where the condition 
was discovered. Proposed Sec.  1.656(e)(2) requires an accredited 
auditor/certification body to notify its accreditation body (or, in the 
case of direct accreditation, to us) electronically, in English, within 
30 days after making any significant change that may affect its 
compliance with the requirements of Sec. Sec.  1.640 through 1.658. The 
notice must describe the purpose of the change and an explanation for 
whether and how the change might affect its accreditation under this 
program. In that proposed Sec.  1.640 requires auditors/certification 
bodies to maintain compliance with the requirements of this rule as a 
condition of their accreditation, this notification is necessary for 
our program oversight. We will use this information in monitoring the 
certification body as required by section 808(f)(2) of the FD&C Act and 
may use the notification (or the failure to notify under proposed Sec.  
1.656(e)(2)) in determining whether to withdraw accreditation under 
section 808(c)(6) of the FD&C Act.
    h. How must an accredited auditor/certification body protect 
against conflicts of interest? (Proposed Sec.  1.657). This proposed 
rule would require accredited auditors/certification bodies to have 
procedures to ensure against financial conflicts of interest and to 
make annual financial disclosure statements available to us, as 
required by section 808(c)(5)(A) and (c)(5)(B) of the FD&C Act. 
Additionally, section 808(c)(5)(C) of the FD&C Act directs us to issue 
implementing regulations including requirements for unannounced audits, 
a structure to decrease the potential for conflicts of interest 
(including requirements for timing and public disclosure of fee 
payments), and appropriate limits on financial affiliations between 
certification bodies (and their audit agents) and eligible entities to 
be certified.
    Proposed Sec.  1.657 sets out the elements of a conflict of 
interest program we believe are appropriate to implement this mandate 
and to ensure the objectivity and independence of accredited auditors/
certification bodies necessary for to maintain the credibility of the 
program. Proposed Sec.  1.657(a) requires the accredited auditor/
certification body to have written program that covers the 
certification body itself and any of its officers, employees, or other 
agents (e.g., audit agents) conducting audits or certification 
activities under this program.
    Based in large part on section 808(c)(5)(A)(i) of the FD&C Act, 
proposed Sec.  1.657(a)(1) prohibits an accredited auditor/
certification body and its officers, personnel, and other agents 
(except for audit agents subject to paragraph (a)(2)) from owning, 
controlling, managing, or otherwise having a financial interest in an 
eligible entity, or an affiliate, parent, or subsidiary of such entity, 
to be certified by the auditor/certification body . The effect of the 
language in proposed Sec.  1.657(a)(1) would be to prevent a foreign 
food firm with its own audit team from conducting regulatory audits and 
issuing certifications for its own facilities, processes, or products 
(i.e., first-party audits) or for an affiliate or for its parent or 
subsidiary (i.e., second-party audits). Given the multinational nature 
and multiple corporate interests of many food companies, we have 
tentatively concluded it is important to extend the conflict of 
interest safeguards in proposed Sec.  1.657 to subsidiaries, 
affiliates, and parent organizations. We seek comment on this tentative 
conclusion.
    Proposed Sec.  1.657(a)(2) prohibits an audit agent of an 
accredited auditor/certification body from conducting a food safety 
audit of an eligible entity, or an affiliate, parent, or subsidiary of 
such entity, that the agent owns or operates. This provision is largely 
based on the section 808(c)(5)(B)(i) of the FD&C Act, which prohibits 
an audit agent from owning or operating an eligible entity to be 
audited by the agent, coupled with language covering financial 
interests associated with an affiliate, parent, or subsidiary of the 
eligible entity, for the reasons previously described.
    To be clear, proposed Sec.  1.657(a)(2) does not go so far as to 
prohibit audit agents from having any financial interest in any food 
company; rather, it prevents an audit agent from conducting a 
consultative or regulatory audit of an eligible entity or an affiliate, 
parent, or subsidiary of such entity, owned or operated by such agent. 
We believe that requiring any audit agent conducting audits under this 
program to divest all interests in FDA-regulated food firms might 
unnecessarily limit the pool of qualified audit agents.
    We seek comment on these tentative conclusions and on the approach 
we propose in Sec.  1.657(a)(2), including whether this approach might 
unnecessarily limit the availability of competent audit agents to 
conduct audits under this program and whether removing the restriction 
relating to interests in affiliates, parents, or subsidiaries might 
create, or create the appearance of, bias.
    Proposed Sec.  1.657(a)(3) prohibits officers, employees, or other 
agents of an accredited auditor/certification body from accepting any 
gift, gratuity, or item of value from the entity subject to audit. A 
gift, gratuity, or item of value would not include meals of a de 
minimis value provided on the premises where the audit or assessment is 
being conducted, recognizing that some facilities may be remotely 
located and allowing onsite meals is appropriate in the interest of 
efficiency. We seek comment on whether to interpret de minimis value 
according to the limits for gifts or items of value applicable to U.S. 
Government employees. Proposed Sec.  1.657(a)(3) also

[[Page 45817]]

allows for authorized officials, employees, or agents to accept 
payments of fees for the audit and certification, as described in 
proposed Sec.  1.657(b).
    Proposed Sec.  1.657(b) addresses the requirement, in section 
808(c)(5)(C) of the FD&C Act, to issue implementing regulations that 
include a structure to decrease the potential for conflicts of 
interest, including timing and public disclosure, for fees paid by 
eligible entities to accredited third-party certification bodies. After 
considering this statutory provision, we have tentatively concluded 
that an appropriate structure to decrease the potential for conflicts 
of interests between an eligible entity and an accredited auditor/
certification body would be one in which there was public disclosure of 
the point at which the entity paid fees for audit and certification 
services. Proposed Sec.  1.657(b) provides that that payment of such 
fees does not constitute a covered financial conflict of interest.
    Proposed Sec.  1.657(c) imputes to an officer, employee, or other 
agent of an accredited auditor/certification body the financial 
interests of his or her spouse and minor children, if any. This 
proposed requirement is based on the approach we recommended in the 
2009 Guidance that no auditor acting for the [auditor/]certification 
body (or spouse or minor children) should have any significant 
ownership or other financial interest regarding any product of the type 
it certifies (Ref. 5). As another example, FDA regulations on conflicts 
of interest of experts serving on panels for unapproved new animal 
drugs imputes the financial interests and arrangements of an expert's 
spouse and minor children to the expert him- or herself (21 CFR 
516.141(g)).
    We believe that imposing a similar requirement on the immediate 
family of the officers, employees, or other agents of an accredited 
auditor/certification body will help to ensure the credibility of the 
accredited third-party audits and certification program at every level. 
We seek comment on this tentative conclusion.
    Proposed Sec.  1.657(d) requires accredited certification bodies to 
maintain on their Web sites an up-to-date list of eligible entities to 
which they issued certifications under this subpart, the duration and 
scope of each such certifications, and the date on which the eligible 
entity paid any fee or reimbursement under proposed Sec.  1.657(c). 
Information on timing of fee payments is required by section 
808(b)(5)(C)(iii) of the FD&C Act and is necessary, we believe, in the 
interest of transparency.
    We seek comment on the tentative conclusions identified here--
namely, we should require accredited certification bodies to: (1) Have 
a written program to safeguard against conflicts of interest; (2) 
include the interest of any affiliate, parent, or subsidiary of a 
certification body within the scope of interests covered by its 
conflict of interest program; (3) impute the interests of immediate 
family members of an officer, employee, or other agent to such officer, 
employee, or other agent; and (4) to maintain on its Web site a list of 
its certified eligible entities, including duration and scope of each 
such certification, and disclosure of the date(s) on which an eligible 
entity paid the accredited auditor/certification body any fee or 
reimbursement associated with an audit or certification under this 
program.
    i. What records requirements must an accredited auditor/
certification body meet? (Proposed Sec.  1.658). This proposed rule 
would establish requirements for accredited auditors/certification 
bodies to establish, control, and retain records relating to their 
auditing and certification activities under our program.
    Proposed Sec.  1.658 requires accredited auditors/certification 
bodies to maintain certain documents and data electronically, in 
English, for 4 years, to document compliance with this rule.\34\ These 
records include: (1) Requests for regulatory audits; (2) audit reports 
and other documents resulting from a consultative or regulatory audit; 
(3) any notification of a condition under proposed Sec.  1.650(a)(5) or 
by the accredited auditor/certification body to FDA under proposedSec.  
1.656(c); (4) any food or facility certification issued under this 
program; (5) any challenge to an adverse regulatory audit decision and 
its disposition; (6) any monitoring it conducted of a certified 
eligible entity; (7) the auditor's/certification body's self-
assessments and corrective actions; and (8) any significant change to 
the auditing and certification program that might affect compliance 
with this rule.
---------------------------------------------------------------------------

    \34\ We are proposing records be maintained for 4 years, which 
aligns with the maximum length of time for which accreditation may 
be granted. This will be particularly useful in decisionmaking on an 
application to renew accreditation, because the accrediting body 
will have access to data and information on activities conducted at 
any time during its current accreditation. We used a similar 
rationale in proposing to require recognized accreditation bodies to 
maintain their records for 5 years, which is the maximum length of 
time for which recognition may be granted.
---------------------------------------------------------------------------

    Maintenance of records on requests for regulatory audits under 
proposed Sec.  1.658(a)(1) is one means to verify the adequacy of audit 
planning under proposed Sec.  1.651(a). Records associated with audits, 
certifications, challenges to auditor/certification body decisions, 
internal reviews, significant changes, and monitoring (also known as 
surveillance) of eligible entities are among the records commonly 
required to be maintained by international standards. We believe it 
appropriate to require maintenance of similar records for purposes of 
this rule.
    We propose to require accredited auditors/certification bodies 
choosing to participate in this program to maintain their program 
records in English. We believe this English-language records 
requirement is necessary for our oversight based on, among other 
things, our experience with the shrimp pilot (Ref. 6). During the pilot 
project, we faced costly delays and logistical hurdles in attempting to 
assess third-party [auditors/]certification bodies, because we needed 
English-language translations of their records to be able to conduct 
performance audits. Based on that experience, we believe that having 
real-time access to English-language records is necessary for 
conducting efficient and effective assessments to the fullest extent of 
our authority.
    We solicit comment on the English-language records requirement in 
proposed Sec.  1.658 and on whether other approaches might be similarly 
efficient and effective. For example, should we allow an accredited 
auditor/certification body to maintain its records in a language other 
than English, if the auditor/certification body would be required to 
make an English translation of its records available ``promptly'' upon 
a written FDA request? What should ``promptly'' mean in this context 
(e.g., 2 business days of the written request)? Would such an approach 
be as efficient and effective as the proposed English-language records 
requirement would be? For comments offering other approaches, we 
request a detailed description of the alternative, an analysis of the 
impacts of the alternative on our ability to ensure the compliance of 
accredited auditors/certification bodies with applicable FDA 
requirements.
    Based on section 808(c)(3)(B) of the FD&C Act, proposed Sec.  
1.658(b) and (c) require an accredited auditor/certification body to 
provide FDA access to records upon request of an officer or employee we 
designate, except that reports or other documents of a consultative 
audit must be made available to us only in accordance with the 
requirements of subpart J (records access under section 414 of the FD&C 
Act). Proposed Sec.  1.658(b) reflects section 808(c)(3)(C) of the FD&C 
Act, which

[[Page 45818]]

states that reports or other documents resulting from a consultative 
audit are accessible to us only under circumstances that meet the 
threshold for records access under section 414 of the FD&C Act (21 
U.S.C. 350c). Based on these statutory requirements, we can access such 
documents from consultative audits in either of the following 
circumstances: If we have a reasonable belief that an article of food, 
and any other article of food that we reasonably believe is likely to 
be affected in a similar manner, is adulterated and presents a threat 
of SAHCODHA; or if we believe that there is a reasonable probability 
that the use of or exposure to an article of food, and any other 
article of food that we reasonably believe is likely to be affected in 
a similar manner, will cause SAHCODHA, as described in Sec.  1.361 of 
this part.
    We have tentatively concluded that the records identified and the 
records maintenance and access requirements in proposed Sec.  1.658 are 
necessary to monitor and evaluate accredited certification bodies, as 
directed by section 808(f)(2) of the FD&C Act. We believe it is 
reasonable to require accredited auditors/certification bodies to 
maintain such records for the maximum length of accreditation, 4 years. 
We acknowledge that the requirements of proposed Sec.  1.658 may 
require revisions to contracts and perhaps other documents establishing 
and limiting the scope of an auditor's/certification body's authority 
with respect to granting records access. We nonetheless have 
tentatively concluded that such access is necessary to help ensure the 
credibility of the program. We seek comment on this tentative 
conclusion and on the specific records requirements we propose.
7. Procedures for Accreditation of Third-Party Auditors/Certification 
Bodies

   Table 7--Proposed Procedures for Third-Party Auditors/Certification
                                 Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.660..................  Where do I apply for accreditation or renewal
                          of accreditation by a recognized accreditation
                          body?
1.661..................  What is the duration of accreditation?
1.662..................  How will FDA monitor accredited auditors/
                          certification bodies?
1.663..................  How do I request an FDA waiver or waiver
                          extension for the 13-month limit for audit
                          agents conducting regulatory audits?
1.664..................  When can FDA withdraw accreditation?
1.665..................  How do I voluntarily relinquish accreditation?
1.666..................  How do I request reaccreditation?
------------------------------------------------------------------------

    a. Where do I apply to obtain accreditation from a recognized 
accreditation body? (Proposed Sec.  1.660). This proposed rule explains 
where interested third-party auditors/certification bodies could apply 
for accreditation under our accredited third-party audits and 
certification program.
    Proposed Sec.  1.660 informs third-party auditors/certification 
bodies that they must apply directly to a recognized accreditation body 
for accreditation, except for those circumstances meeting the 
requirements of proposed Sec.  1.670 for direct accreditation.
    b. What is the duration of accreditation? (Proposed Sec.  1.661). 
Proposed Sec.  1.661 states that accreditation of a third-party 
auditor/certification body may be granted for a period up to 4 years. 
This applies both to accreditations granted by recognized accreditation 
bodies and to direct accreditations that we grant under proposed Sec.  
1.672. We have tentatively concluded that 4 years is an appropriate 
duration for an accreditation, because we believe the rigor and 
credibility of this new program rests, in part, on the extent of 
oversight of accredited third-party auditors/certification bodies to 
conduct audits and to certify eligible foreign entities.
    The process for renewal of accreditation provides an opportunity 
for recognized accreditation bodies (and us, for directly accredited 
auditors/certification bodies) to look closely at all aspects of the 
auditor's/certification body's program and performance and to decide 
anew whether the auditor/certification body meets the eligibility 
requirements.
    We note proposed Sec.  1.661 set the duration of accreditation in 
the new accredited third-party auditor/certification body program for a 
shorter period than the duration of accreditation we allow in the 
mammography program under 21 CFR part 900, which is a time-tested 
program. As we and the recognized accreditation bodies participating in 
the accredited third-party audits and certification program for food 
gain experience with the program, we may revisit this matter. For these 
reasons, we have tentatively concluded that accreditation should be 
granted for a period of no longer than 4 years. We seek comment on this 
tentative conclusion.
    c. How will FDA monitor accredited auditors/certification bodies? 
(Proposed Sec.  1.662). This proposed rule would establish requirements 
for our evaluation of the performance of accredited auditors/
certification bodies, based on section 808(f)(2) of the FD&C Act, which 
requires us to monitor accredited auditors/certification bodies 
periodically, or at least once every 4 years.
    The statute makes no distinction between the frequency of our 
monitoring necessary for auditors/certification bodies accredited by 
recognized accreditation bodies and for auditors/certification bodies 
that we directly accredit. However, we are proposing, in Sec.  1.621, 
to require a recognized accreditation body to conduct annual 
assessments of the performance of each third-party auditor/
certification body it accredited under this program. Under proposed 
Sec.  1.662(a) we will perform our own performance evaluations of 
auditors/certification bodies accredited by recognized accreditation 
bodies at least once every 3 years for auditors/certifications bodies 
accredited for 4 year terms, and at the mid-term point for auditors/
certification bodies accredited for less than 4 years. Proposed Sec.  
1.662(a) also establishes requirements for our monitoring of directly 
accredited auditors/certification bodies. In these circumstances, we 
act in the role of a recognized accreditation body and will perform 
annual monitoring. Not only would annual monitoring by us provide 
oversight similar to the annual monitoring requirements of proposed 
Sec.  1.621, but also it would satisfy the monitoring requirement of 
section 808(f)(2) of the FD&C Act with respect to monitoring of 
directly accredited auditors/certification bodies.

[[Page 45819]]

    Proposed Sec.  1.662(b) identifies the types of information we may 
review in conducting our evaluations of accredited auditors/
certification bodies. Proposed Sec.  1.662(c) makes clear that we can 
conduct our evaluation of an auditor/certification body through onsite 
observations of performance during the conduct of food safety audits 
and through document review.
    For both directly accredited auditors/certification bodies and 
those accredited by recognized accreditation bodies, we will evaluate 
performance based on whether the auditor/certification body continues 
to comply with the requirements of Sec. Sec.  1.640 through 1.658 and 
whether there are performance deficiencies that would warrant 
withdrawal of accreditation under this rule. We seek comment on whether 
the criteria in proposed Sec.  1.662(a) and (b) are appropriate for 
evaluating accredited auditors/certification bodies under this program. 
Additionally, we seek recommendations for possible approaches we might 
use to monitor performance, such as conducting our inspections of a 
certain number of eligible entities, shortly after the accredited 
auditor/certification body conducted a food safety audit of an eligible 
entity. For each such recommendation, we seek comment on the how the 
approach might affect: (1) The incentives for auditors/certification 
bodies to seek accreditation under our program, and (2) the degree of 
oversight needed to meet the objectives of section 808 of the FD&C Act.
    d. How do I request a waiver or waiver extension for the 13-month 
limit for audit agents conducting regulatory audits? (Proposed Sec.  
1.663). This proposed rule would allow accredited auditors/
certification bodies to seek an FDA waiver of the limit on audit agents 
conducting regulatory audits of an eligible entity where they conducted 
a regulatory or consultative audit in the preceding 13 months. Under 
section 808(c)(4)(C)(ii) of the FD&C Act, we may waive the limit, which 
appears in proposed Sec.  1.650(c), where there is insufficient access 
to accredited certification bodies in the country or region where an 
eligible entity is located. Proposed Sec.  1.663(a) establishes the 
requirements for a waiver or waiver extension and proposed Sec.  
1.663(b) to (f) describes the procedural requirements for a waiver or 
waiver extension request, including electronic submission, in English. 
Under proposed Sec.  1.663(g), we explain that an accredited auditor/
certification body should not use an audit agent subject to the 13-
month limit in proposed Sec.  1.650 unless we have granted the request 
or the 13-month limit has elapsed. The procedural requirements in 
proposed Sec.  1.663 mirror the procedural requirements for other 
applications submitted to us.
    e. When can FDA withdraw accreditation? (Proposed Sec.  1.664). 
This proposed rule would establish the conditions under which we could 
withdraw accreditation from an auditor/certification body, regardless 
of whether it was directly accredited or accredited by a recognized 
accreditation body.
    Proposed Sec.  1.664(a) describes criteria for mandatory withdrawal 
that reflect section 808(c)(6)(A) of the FD&C Act, which requires us to 
withdraw accreditation in certain outbreak situations, whenever we find 
that an accredited auditor/certification body is no longer meeting the 
requirements for accreditation, or following a refusal to allow U.S. 
officials to conduct audits and investigations to ensure compliance 
with these requirements. The statute directs us to withdraw 
accreditation if a food or facility certified by an accredited auditor/
certification body under our program is linked to an outbreak of 
foodborne illness that has a reasonable probability of causing serious 
adverse health consequences or death in human or animals, except under 
section 808(c)(6)(C) of the FD&C Act, if we conduct an investigation of 
the material facts of the outbreak, review the steps and actions taken 
by the auditor/certification body, and determine that the accredited 
auditor/certification body satisfied the requirements for issuance of 
certification under this rule. The exception is set out in proposed 
Sec.  1.664(b).
    Section 808(c)(6)(B) of the FD&C Act allows us to withdraw 
accreditation from an accredited auditor/certification body whose 
accrediting body had its recognition revoked, if we determine there is 
good cause for withdrawal. This statutory provision is reflected in 
Sec.  1.664(c), which also provides two examples of circumstances we 
believe provide good cause for withdrawal, including bias or lack of 
objectivity and performance calling into question the validity or 
reliability of its food safety audits and certifications.
    In proposed Sec.  1.664(d) we provide for records access when 
considering possible withdrawal of accreditation. In proposed Sec.  
1.664(e) we provide for notice of withdrawal of accreditation and 
describe the processes to challenge such withdrawal.
    Proposed Sec.  1.665(f) describes the effect of withdrawal on 
eligible entities. In general, a food or facility certification issued 
by an accredited auditor/certification prior to withdrawal of 
accreditation will remain in effect until it terminates by expiration, 
except if we have reason to believe a certification issued for purposes 
of section 801(q) of the FD&C Act is not valid or reliable, we can 
refuse to accept the certification.
    Proposed Sec.  1.664(g)(1) explains that FDA will notify the 
recognized accreditation body that accredited the third-party auditor/
certification body whose accreditation was withdrawn by FDA. In such 
circumstances, proposed Sec.  1.664(g)(1) requires the recognized 
accreditation body to conduct a self-assessment, as described in Sec.  
1.622, and report the results of such self-assessment to FDA within 2 
months after withdrawal, as required by Sec.  1.623(b). Proposed Sec.  
1.664(g)(2) explains that FDA may revoke recognition of an 
accreditation body whenever FDA determines there is good cause for 
revocation under proposed Sec.  1.634.
    Proposed Sec.  1.664(h) provides for public notice of withdrawal of 
accreditation on FDA's Web site. We believe this information is 
necessary in the interest of transparency.
    f. How do I voluntarily relinquish accreditation? (Proposed Sec.  
1.665). This proposed rule would allow accredited auditors/
certification bodies to voluntarily relinquish their accreditations 
before they expire and without having them withdrawn by FDA.
    Proposed Sec.  1.665 offers the mechanism for voluntarily 
relinquishment before it terminates by expiration. Relinquishment on 
the initiative of the auditor/certification body is distinct from 
withdrawal of accreditation for cause.
    The mammography regulations in 21 CFR 900.3 offer accreditation 
bodies the opportunity to voluntarily relinquish their authority to 
grant accreditation. We believe that auditors/certification bodies 
operating under our accredited third-party audits and certification 
program should have the option to voluntarily relinquish their 
accreditation for their business reasons. We are proposing certain 
procedural requirements--similar to those contained in the mammography 
regulations--which auditors/certification bodies must follow in 
relinquishing accreditation. We believe these measures are necessary to 
ensure an orderly transition for eligible entities certified by the 
auditor/certification body that is relinquishing its accreditation, and 
for us to make the necessary adjustments in the program.
    Proposed Sec.  1.665(a) requires auditors/certification bodies to 
notify us and to

[[Page 45820]]

notify their accreditation body (where applicable) at least 6 months 
before relinquishing accreditation. We propose to require such 
notifications to be submitted electronically and in English. To ensure 
that we have the ability to maintain adequate oversight of the program, 
including through access the records of the auditor/certification body, 
the notice required under proposed Sec.  1.665(a) must identify the 
location where the records required by proposed Sec.  1.658 will be 
maintained.
    The decision to relinquish accreditation is made solely by the 
third-party auditor/certification body, without FDA involvement. 
Therefore, in relinquishing accreditation under proposed Sec.  
1.665(a), the auditor/certification body would waive its rights to 
appeal, because there is no FDA action to serve as the basis for 
appeal.
    Proposed Sec.  1.665(b) requires the accreditation body to notify 
any eligible entity to which it issued a food or facility certification 
no later than 15 business days after notifying FDA of its intent to 
voluntarily relinquish accreditation.
    Proposed Sec.  1.665(c) describes the effects of relinquishment of 
accreditation on certification issued by an auditor/certification body 
prior to relinquishing its accreditation. In considering the impact of 
relinquishment on eligible entities, we were mindful that such entities 
would likely have little, if any, opportunity to provide input on a 
decision by its auditor/certification body whether or not to relinquish 
accreditation. We believe that, under most circumstances, the fact that 
an auditor/certification body decided to relinquish its accreditation 
is likely to have no bearing on the validity or reliability of 
certifications it issued. Therefore, we have tentatively concluded that 
the certification of an eligible entity whose auditor/certification 
body voluntarily relinquished its accreditation under proposed Sec.  
1.665 will remain in effect (subject to recertification under proposed 
Sec.  1.681), except that we may refuse to consider a certification 
issued for purposes of section 801(q) of the FD&C Act, if we have 
reason to believe the certification is not valid or reliable.
    Proposed Sec.  1.665(d) provides for public notice on our Web site 
of the voluntary relinquishment of accreditation by an auditor/
certification body.
    g. How do I request reaccreditation? (Proposed Sec.  1.666). This 
proposed rule would allow a third-party auditor/certification body to 
become reaccredited after withdrawal or relinquishment of its 
accreditation.
    Section 808(c)(7) of the FD&C Act requires us to establish 
procedures to reinstate the accreditation of an auditor/certification 
body for which we have withdrawn accreditation. Under proposed Sec.  
1.666(a), we will reinstate accreditation if the auditor/certification 
body can demonstrate that the grounds for withdrawal no longer exist, 
or if the withdrawal was prompted by the revocation of recognition of 
its accreditation body and the auditor/certification body finds a new 
recognized accreditation body, becomes directly accredited, or 
otherwise meets conditions we impose in the withdrawal. Under proposed 
Sec.  1.666(b), an auditor/certification body that voluntarily 
relinquished its accreditation may become reaccredited by submitting a 
new application for accreditation under proposed Sec.  1.660 or Sec.  
1.670 (where the criteria for direct accreditation are met).
8. Additional Procedures for Direct Accreditation of a Third-Party 
Auditors/Certification Bodies

   Table 8--Additional Procedures Proposed for Direct Accreditation of
                Third-Party Auditors/Certification Bodies
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.670..................  How do I apply to FDA for direct accreditation
                          or renewal of direct accreditation?
1.671..................  How will FDA review applications for direct
                          accreditation and for renewal of direct
                          accreditation?
1.672..................  What is the duration of direct accreditation?
------------------------------------------------------------------------

    a. How do I apply to FDA for direct accreditation or renewal of 
direct accreditation? (Proposed Sec.  1.670). This proposed rule 
describes the circumstances and procedures that would apply for direct 
accreditation and renewal of direct accreditation.
    Proposed Sec.  1.670 describes the conditions under which we will 
accept applications for direct accreditation, reflecting the statutory 
language in section 808(b)(1)(A)(ii) of the FD&C Act, which allows us 
to directly accredit auditors/certification bodies if we have not 
identified and recognized an accreditation body to meet the 
requirements of section 808 of the FD&C Act within 2 years after 
establishing our program. Proposed Sec.  1.670(a)(1) identifies certain 
circumstances and criteria that we have tentatively concluded are 
relevant for determining whether we have not identified and recognized 
an accreditation body to meet the requirements of section 808 of the 
FD&C Act. Proposed Sec.  1.670(a)(2) specifies conditions under which 
we may revoke or modify such a determination. Proposed Sec.  
1.670(a)(3) provides for public notice of such determination or its 
revocation or revision.
    Proposed Sec.  1.670(b) sets out the procedures for applying for 
direct accreditation or renewal of direct accreditation. This mirrors 
the procedures for applications established elsewhere under this rule.
    b. How will FDA review applications for direct accreditation and 
for renewal of direct accreditation? (Proposed Sec.  1.671). This 
proposed rule would establish procedures for processing applications 
for direct accreditation and for renewal of direct accreditation.
    Proposed Sec.  1.671 describes a process for reviewing and deciding 
on applications for direct accreditation and renewal that is consistent 
with the procedures for reviewing and deciding on applications under 
other provisions in this rule. For example, we propose to establish a 
queue for direct accreditation and renewal applications based on the 
date on which an application was completed, and we will review 
applications on a first in, first out basis. We will inform applicants 
of deficiencies in application documentation. To encourage applicants 
to supply any missing information promptly, we will not place an 
application in the queue until it is complete. Allowing incomplete 
applications in the queue might block applications that are ready for 
review, but were submitted later in time.
    We will inform an applicant once its application has been placed in 
the queue. We will review each application for direct accreditation or 
renewal of direct accreditation to determine

[[Page 45821]]

whether the applicant meets the eligibility requirements of proposed 
Sec.  1.640. We will communicate anticipated processing periods to 
applicants. We are not proposing to include specific timeframes for 
review in the regulation, for the following reasons: (1) It is 
difficult to project, at this time, the amount of resources that will 
be available to us for this program, which under section 808(c)(8) of 
the FD&C Act, is funded through user fees established by regulation; 
and (2) we anticipate that, as we gain experience in reviewing 
applications and in overall administration of the program, we will 
become more efficient in processing applications but currently lack 
data that would allow us to reasonably estimate the effect of 
efficiency gains on review times.
    Under proposed Sec.  1.671(c), (d), and (e), we will notify an 
applicant, in writing, whether the application has been approved or 
denied. If approved, the notice will describe any conditions imposed on 
the direct accreditation. If denied, the notice will state the basis 
for the denial and will describe procedures for requesting 
reconsideration of the decision. We believe this provision offers 
necessary protections for applicants. We seek comment on the process 
and procedures required by proposed Sec.  1.671.
    c. What is the duration of direct accreditation? (Proposed Sec.  
1.672). This proposed rule would establish the duration of 
accreditation.
    Proposed Sec.  1.672 states that direct accreditation of a third-
party auditor/certification body may be granted for a period up to 4 
years. Similarly, proposed Sec.  1.661 allows a recognized 
accreditation body to grant accreditation for a period of up to 4 
years. We have tentatively concluded that 4 years is an appropriate 
duration for an accreditation--whether granted by a recognized 
accreditation body or by us--because we believe the rigor and 
credibility of this new program rests, in part, on the extent of 
oversight of accredited third-party auditors/certification bodies to 
conduct audits and to certify eligible foreign entities. The process 
for renewal of accreditation provides an opportunity for us to look 
closely at all aspects of the auditor's/certification body's program 
and performance and to decide anew whether the auditor/certification 
body meets the eligibility requirements for accreditation.
    We are proposing to set the duration of accreditation under this 
new program for a shorter period than the duration of accreditation we 
allow under 21 CFR part 900, which is the mammography program 
established several years ago. As we gain experience with accredited 
auditors/certification bodies in the food and feed programs, we may 
revisit this matter. For these reasons, we have tentatively concluded 
that accreditation should be granted for a period of no longer than 4 
years. We seek comment on this tentative conclusion.
9. Requirements for Eligible Entities

          Table 9--Proposed Requirements for Eligible Entities
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.680..................  How and when will FDA monitor eligible
                          entities?
1.681..................  How frequently must eligible entities be
                          recertified?
------------------------------------------------------------------------

    a. How and when will FDA monitor eligible entities? (Proposed Sec.  
1.680). This proposed rule would provide for FDA monitoring of eligible 
entities that choose to be audited under our program.
    Proposed Sec.  1.680(a) states that we may conduct an onsite audit 
of an eligible entity that has received certification under this 
program, as allowed under section 808(f)(3) of the FD&C Act, which 
specifies that we may conduct an onsite audit of a certified entity at 
any time, with or without the accredited auditor/certification body 
present. Proposed Sec.  1.680(b) reflects section 808(h)(1) of the FD&C 
Act, explaining that a food safety audit conducted under this program 
is not considered an inspection under section 704 of the FD&C Act.
    b. How frequently must eligible entities be recertified? (Proposed 
Sec.  1.681). This proposed rule would require eligible entities to be 
recertified annually.
    Section 808(d) of the FD&C Act requires eligible entities to apply 
for annual certification for food required to have certification under 
section 801(q) of the FD&C Act or for its facility, if it intends the 
certification to be used by an importer in establishing eligibility to 
participate in VQIP under section 806 of the FD&C Act. This statutory 
requirement is reflected in proposed Sec.  1.681(a). Proposed Sec.  
1.681(b) states that FDA may require renewal of a food certification at 
any time FDA determines appropriate under section 801(q)(4)(A) of the 
FD&C Act.
10. General Requirements

                 Table 10--Proposed General Requirements
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.690..................  How will FDA make information about recognized
                          accreditation bodies and accredited auditors/
                          certification bodies available to the public?
1.691..................  How do I request reconsideration of a denial by
                          FDA of an application or a waiver request?
1.692..................  How do I request internal agency review of a
                          denial of an application or waiver request
                          upon reconsideration?
1.693..................  How do I request a regulatory hearing on a
                          revocation of recognition or withdrawal of
                          accreditation?
------------------------------------------------------------------------

    a. How will FDA make information about recognized accreditation 
bodies and accredited auditors/certification bodies available to the 
public? (Proposed Sec.  1.690). This proposed rule explains how and 
where we would make information on the accredited third-party audits 
and certification program public. Section 808(g) of the FD&C Act 
requires us to establish a publicly available registry of recognized 
accreditation bodies and accredited auditors/certification bodies, 
including their names and contact information.
    Proposed Sec.  1.690 provides that we will post on our Web site a 
registry of recognized accreditation bodies and of accredited auditors/
certification bodies

[[Page 45822]]

and explains that we may meet the obligation with respect to accredited 
auditors/certification bodies by establishing links on our Web site to 
the Web sites of recognized accreditation bodies, who are required to 
maintain this information for auditors/certification bodies they 
accredit under this program. As appropriate based on available 
resources, we may use such links in the interest of minimizing the 
administrative burden on us and in acknowledgement that some 
accreditation bodies currently maintain such information on their Web 
sites. We are seeking comment on our proposed public registry.
    b. How do I request reconsideration of a denial by FDA of an 
application or a waiver request? (Proposed Sec.  1.691). This proposed 
rule would establish procedures for an applicant or requestor to seek 
reconsideration of a denial. Under proposed Sec.  1.691, accreditation 
bodies and certification bodies may ask us to reconsider an application 
or waiver request we previously denied. The types of applications and 
requests that may be reconsidered are: (1) Denial of an application for 
recognition or for renewal of recognition; (2) denial of an application 
submitted to reinstate recognition; or (3) denial of a request for a 
waiver of the 13-month limit on audit agents or for a waiver extension; 
(4) denial of an application for direct accreditation or for renewal of 
direct accreditation; and (5) denial of an application for 
reaccreditation.
    The procedures described in proposed Sec.  1.691 require submission 
of the request for reconsideration within 10 business days of the date 
of such decision, in accordance with the procedures described in the 
notice of denial, including requirements relating to submission of 
supporting information. Within a reasonable time after completing its 
review and evaluation of the request for reconsideration and the 
supporting information (if any) submitted, we will notify the 
requestor, in writing, of our decision to grant the application or 
waiver request upon reconsideration, or our decision to deny upon 
reconsideration the application or waiver request.
    c. How do I request internal Agency review of a denial of an 
application or waiver request upon reconsideration? (Proposed Sec.  
1.692). This proposed rule would offer additional process for 
applicants or requestors whose request for reconsideration was denied.
    Proposed Sec.  1.692 states that the requestor who received a 
denial upon reconsideration may seek internal Agency review of such 
denial under 21 CFR 10.75(c)(1), which is a currently established 
process for review but different than the initial review process under 
proposed Sec.  1.691. The request for internal Agency review must be 
submitted within 10 business days of the date of denial upon 
reconsideration, in accordance with procedures described in the denial 
upon reconsideration and must be signed by the accreditation body or 
certification body, as appropriate, or by an individual authorized to 
act on its behalf. Internal Agency review of the denial upon 
reconsideration must be based on the information in the administrative 
file, which will include any supporting information submitted under 
proposed Sec.  1.691(c). Within a reasonable time after completing the 
review and evaluation of the administrative file, we will notify the 
requestor, in writing, of our decision to overturn the denial and grant 
the application or waiver request or to affirm the denial. Affirmation 
of a denial constitutes final Agency action for purposes of 5 U.S.C. 
702.
    d. How do I request a regulatory hearing on a revocation of 
recognition or withdrawal of accreditation? (Proposed Sec.  1.693). 
This proposed rule explains the procedures that would be used for 
challenges to revocation of recognition or withdrawal of accreditation.
    Under proposed Sec.  1.693(a) an accreditation body whose 
recognition was revoked (or an individual authorized to act on its 
behalf) may submit a request for a regulatory hearing, under part 16, 
on the revocation. The request must be submitted within 10 business 
days of the date of revocation. Similarly, under proposed Sec.  
1.693(b) a certification body whose accreditation was withdrawn by FDA 
may submit a request for a part 16 regulatory hearing on the 
withdrawal. Such request must be submitted within 10 business days of 
the date of withdrawal. Written notices of revocation and of withdrawal 
will contain all of the elements required by Sec.  16.22 of this 
chapter and will thereby constitute the notice of an opportunity for 
hearing under part 16 of this chapter.
    Under proposed Sec.  1.693(c), the request for a regulatory hearing 
under paragraph (a) or (b) of this section must be submitted with a 
written appeal that responds to the bases for our decision described in 
the written notice of revocation or withdrawal, as appropriate, 
together with any supporting information upon which the requestor is 
relying. The request, appeal, and supporting information must be 
submitted in accordance with the procedures described in the notice.
    Proposed Sec.  1.693 makes clear that the submission of a request 
for a regulatory hearing under this subpart will not operate to delay 
or stay the effect of our decision to revoke recognition of an 
accreditation body or to withdraw accreditation of a certification body 
unless we determine that delay or a stay is in the public interest.
    Under proposed Sec.  1.693(e) and (f), the presiding officer for a 
regulatory hearing under this subpart will be designated after a 
request for a regulatory hearing is submitted to us. The presiding 
officer may deny a request for regulatory hearing under this subpart 
pursuant to Sec.  16.26(a) of this chapter.
    Proposed Sec.  1.693(g) states that if a hearing request is 
granted, the hearing will be held within 10 business days after the 
date the request was filed or, if applicable, within a time frame 
agreed upon in writing by requestor and the presiding officer. The 
presiding officer may require that a hearing conducted under this 
subpart be completed within 1 business day, as appropriate.
    The presiding officer must conduct the hearing under part 16 of 
this chapter, except that, under Sec.  16.5(b) of this chapter, the 
procedures for a regulatory hearing described in part 16 of this 
chapter apply only to the extent that such procedures are supplementary 
and not in conflict with the procedures specified for the conduct of 
regulatory hearings under this subpart. Based on Sec.  16.5(b), the 
following requirements of part 16 of this chapter are inapplicable to 
regulatory hearings conducted under this subpart: The requirements of 
Sec.  16.22 (Initiation of a regulatory hearing), Sec.  16.24(e) 
(Timing) and (f) (Contents of notice), Sec.  16.40 (Commissioner), 
Sec.  16.95(b) (Administrative decision and record for decision), and 
Sec.  16.119 (Reconsideration and stay of action).
    Proposed Sec.  1.693(g)(4) states that a decision by the presiding 
officer to affirm the revocation of recognition or the withdrawal of 
accreditation that served as the basis for the request for a regulatory 
hearing is considered a final Agency action for purposes of 5 U.S.C. 
702.
11. Audits for Other Purposes

[[Page 45823]]



   Table 11--Proposed Use of Regulatory Audit Reports Under Subpart L
------------------------------------------------------------------------
 Proposed rule section                        Title
------------------------------------------------------------------------
1.698..................  May importers use reports of regulatory audits
                          by accredited auditors/certification bodies
                          for purposes of subpart L of this part?
------------------------------------------------------------------------

    May importers use reports of regulatory audits by accredited 
auditors/certification bodies for purposes of subpart L of this part? 
(Proposed Sec.  1.698). This proposed rule would allow importers to use 
certain information from accredited auditors/certification bodies in 
meeting the Foreign Supplier Verification Program (FSVP) requirements.
    Proposed Sec.  1.698 allows an importer, as defined in the proposed 
regulations for the FSVP published elsewhere in this edition of the 
Federal Register, to use a report of a regulatory audit of a foreign 
supplier (which is an eligible entity), in meeting the verification 
requirements under the proposed FSVP regulations.
    The FSVP proposed rule would require importers to verify that 
hazards identified as reasonably likely to occur are being adequately 
controlled. Onsite auditing may be used under the FSVP proposed rule. 
While the FSVP proposed rule would not require use of accredited 
auditors/certification bodies, we believe accredited auditor/
certification body program we are establishing under section 808 of the 
FD&C Act will help ensure the rigor and objectivity of audits performed 
by auditors/certification bodies accredited under our program.
    Proposed Sec.  1.698 allows an importer required (or having the 
option) to perform onsite auditing of its foreign supplier to comply 
with the FSVP proposed rule to use the results of a regulatory audit in 
meeting such requirement. The regulatory audit report of the foreign 
supplier would be the documentation of such verification activity. (We 
have tentatively concluded that the report of a consultative audit 
would not be appropriate documentation for purposes of the proposed 
FSVP rule. Among other things, consultative audits are defined as being 
conducted for internal purposes only and are conducted against industry 
standards as well as the requirements of the FD&C Act.)
    We see significant value in having the food industry use competent 
and impartial auditors/certification bodies to conduct food safety 
audits of their facilities and are aware that many leaders in the food 
industry are working to assure those objectives are achieved. We 
believe that the accredited third-party audits and certification 
program we are establishing to implement section 808 of the FD&C Act 
offers a credible system to help ensure that the audits conducted by 
auditors/certification bodies accredited under our program and the 
certifications they issue based on the results of those audits are 
valid and reliable not only to us, but also to companies throughout the 
supply chain of the audited facility. We further believe that our 
involvement, as the regulator responsible with oversight of these 
facilities, offers an added level of assurance to consumers in the 
validity of these third-party audits--a confidence they otherwise might 
not gain from private audit systems.
    It is our intent that the program we establish for foreign food 
safety audits be solidly grounded in the key principles set out in the 
statute and in the international standards and best practices that are 
currently used by leaders at the forefront of efforts to ensure auditor 
competency and objectivity. We realize that the same principles and 
standards that are features of a rigorous and credible program for 
audits of foreign firms would likewise hold great merit for audits of 
domestic food facilities.
    We seek comment on the value of, and need for, a program 
established and administered by FDA for the use of accredited auditors/
certification bodies to conduct domestic food safety audits. We seek 
input on whether accreditation bodies, auditors/certification bodies, 
and domestic food facilities might be interested in such a program and 
the incentives we might offer to encourage participation.

B. Proposed Revisions to Part 16

    We are proposing a conforming change to the section of the CFR that 
describes procedures for regulatory hearings that would add revocation 
of recognition of an accreditation body and withdrawal of accreditation 
of a third-party auditor/certification body to the list of actions for 
which a hearing under this part may be held. The affected section in 
title 21 of the CFR is 16.1.

V. Analysis of Environmental Impact

    We have carefully considered the potential environmental effects of 
this action. We have concluded, under 21 CFR 25.30(h), that this action 
is of a type that does not individually or cumulatively have a 
significant effect on the human environment. Therefore, neither an 
environmental assessment nor an environmental impact statement is 
required (Ref. 34).

VI. Federalism

    We have analyzed this proposed rule in accordance with the 
principles set forth in Executive Order 13132. We have determined that 
the proposed rule does not contain policies that have substantial 
direct effects on the States, on the relationship between the National 
Government and the States, or on the distribution of power and 
responsibilities among the various levels of government. Accordingly, 
we have concluded that the proposed rule does not contain policies that 
have federalism implications as defined in the Executive order and, 
consequently, a federalism summary impact statement is not required.

VII. Comments

    Interested persons may submit either electronic comments regarding 
this document to https://www.regulations.gov or written comments to the 
Division of Dockets Management (see ADDRESSES). It is only necessary to 
send one set of comments. Identify comments with the docket number 
found in brackets in the heading of this document. Received comments 
may be seen in the Division of Dockets Management between 9 a.m. and 4 
p.m., Monday through Friday, and will be posted to the docket at https://www.regulations.gov.

VIII. References

    The following references have been placed on display in the 
Division of Dockets Management (see ADDRESSES) and may be seen by 
interested persons between 9 a.m. and 4 p.m., Monday through Friday. 
(FDA has verified all the Web site addresses in this References 
section, but FDA is not responsible for any subsequent changes to the 
Web sites after this document publishes in the Federal Register).

1. Centers for Disease Control and Prevention. ``CDC research shows 
outbreaks linked to imported foods increasing.'' https://www.cdc.gov/media/releases/2012/p0314_foodborne.html. Accessed April 23, 2013.

[[Page 45824]]

2. ``Notification to the World Trade Organization (G/SPS/N/USA/
2156).'' Food and Drug Administration, 2011. https://docs.wto.org/imrd/directdoc.asp?DDFDocuments/t/G/SPS/NUSA2156.DOC.
3. International Organization for Standardization/CASCO. ``Building 
Trust: The Conformity Assessment Toolbox,'' 2009. https://www.iso.org/iso/casco_building-trust.pdf. Accessed April 23, 2013.
4. U.S. Agency for International Development. ``The Relationship of 
Third-Party Certification (TPC) to Sanitary/Phytosanitary (SPS) 
Measures and the International Agri-Food Trade: Final Report,'' 
2005. https://cs3.msu.edu/d/pubs/
The%20Relationship%20of%20TPC%20to%20SPS%20Measures--
Final%20Report%20+%20Annexes.pdf. Accessed April 23, 2013.
5. ``Guidance for Industry--Voluntary Third-Party Certification 
Program for Foods and Feeds,'' 2009. Food and Drug Administration. 
https://www.fda.gov/regulatoryinformation/guidances/ucm125431.html.
6. ``Assessment of the Third-Party Certification Program for 
Aquacultured Shrimp,'' 2011. Food and Drug Administration. https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/Seafood/ucm265934.htm.
7. ``Mammography Quality Standards Act and Program, Facility 
Certification and Inspection (MQSA).'' Food and Drug Administration. 
https://www.fda.gov/Radiation-EmittingProducts/MammographyQualityStandardsActandProgram/AbouttheMammographyProgram/default.htm. Accessed on April 23, 2013. Last Modified 2012.
8. ``Import Alert 28-20 Detention Without Physical Examination of 
Indian Pepper.'' https://www.accessdata.fda.gov/cms_ia/importalert_90.html. Accessed April 23, 2013. Last Modified 2011.
9. ``Memorandum of Understanding Between the Food and Drug 
Administration, Department of Health and Human Services, United 
States of America and the Ministry of Agriculture of the Republic of 
France Covering Caseins, Caseinates, and Mixtures Thereof Exported 
to the United States of America.'' Food and Drug Administration. 
https://www.fda.gov/InternationalPrograms/Agreements/MemorandaofUnderstanding/ucm107563.htm. Accessed on April 23, 2013. 
Last Modified 1987. ``Cooperative Arrangement with the Department of 
Agriculture, Fisheries, and Food of Ireland Concerning Certification 
Requirements for Caseins, Caseinates, and Mixtures Thereof Exported 
from Ireland to the United States of America.'' Food and Drug 
Administration. https://www.fda.gov/InternationalPrograms/Agreements/MemorandaofUnderstanding/ucm107596.htm. Accessed on April 23, 2013. 
Last Modified 2010. ``Memorandum of Understanding Between the Food 
and Drug Administration and the Royal Norwegian Ministry of 
Agriculture Covering Rennet Casein Exported to the United States of 
America.'' Food and Drug Administration. https://www.fda.gov/InternationalPrograms/Agreements/MemorandaofUnderstanding/ucm107618.htm. Accessed on April 23, 2013. Last Modified 1982.
10. Government Accountability Office. ``Food Safety: FDA Can Better 
Oversee Food Imports by Assessing and Leveraging Other Countries' 
Oversight Resources (GAO-12-933),'' 2012. https://www.gao.gov/assets/650/649010.pdf.
11. National Academies Press. ``Enhancing Food Safety: The Role of 
the Food and Drug Administration,'' 2010. https://www.iom.edu/Reports/2010/Enhancing-Food-Safety-The-Role-of-the-Food-and-Drug-Administration.aspx.
12. ``Manufactured Foods Regulatory Program Standards.'' Food and 
Drug Administration. https://www.fda.gov/downloads/RegulatoryInformation/Guidances/UCM125448.pdf. Accessed on April 23, 
2013. Last Modified 2007.
13. ``Ensuring the Safety of Imported Foods and Animal Feed: 
Comparability of Food Safety Systems and Import Practices of Foreign 
Countries; Notice of Public Hearing; Request for Comments, 2011.'' 
Food and Drug Administration. https://www.fda.gov/Food/NewsEvents/WorkshopsMeetingsConferences/ucm243781.htm. Accessed on April 23, 
2013.
14. ``Draft International Comparability Assessment Tool, 2010.'' 
Food and Drug Administration. https://www.fda.gov/downloads/Food/InternationalInteragencyCoordination/UCM331177.pdf. Accessed on 
April 23, 2013.
15. ``Circular A-119 Federal Participation in the Development and 
Use of Voluntary Consensus Standards and in Conformity Assessment 
Activities, 1998.'' Office of Management and Budget. https://www.whitehouse.gov/omb/circulars_a119. Accessed on April 23, 2013.
16. ``Federal Participation in the Development and Use of Voluntary 
Consensus Standards and in Conformity Assessment Activities; Request 
for Information and Notice of Public Workshop, 2012.'' Office of 
Management and Budget. https://www.regulations.gov/#!documentDetail;D=OMB-2012-0003-0001. Accessed on April 23, 2013.
17. ``ISO/IEC 17000:2004 Conformity assessment--Vocabulary and 
General Principles.'' International Organization for 
Standardization/International Electrotechnical Commission. Accessed 
on April 23, 2013. Copies are available from the International 
Organization for Standardization, 1, rue de Varembe, Case postale 
56, CH-1211 Geneve 20, Switzerland, or on the Internet at https://www.iso.org/iso/catalogue_detail.htm?csnumber=29316 or may be 
examined at the Division of Dockets Management (see ADDRESSES) (Ref. 
Docket No. FDA-2011-N-0146 and/or RIN 0910-AG66).
18. ``ISO/IEC 17011:2004 Conformity assessment--General requirements 
for accreditation bodies accrediting conformity assessment bodies.'' 
International Organization for Standardization/International 
Electrotechnical Commission. Accessed on April 23, 2013. Copies are 
available from the International Organization for Standardization, 
1, rue de Varembe, Case postale 56, CH-1211 Geneve 20, Switzerland, 
or on the Internet at https://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=29332 or may be examined at the 
Division of Dockets Management (see ADDRESSES) (Ref. Docket No. FDA-
2011-N-0146 and/or RIN 0910-AG66).
19. ``ISO/IEC 17021: 2006/2011 Conformity assessment--Requirements 
for bodies providing audit and certification of management 
systems.'' International Organization for Standardization/
International Electrotechnical Commission. Accessed on April 23, 
2013. Last Modified 2011. Copies are available from the 
International Organization for Standardization, 1, rue de Varembe, 
Case postale 56, CH-1211 Geneve 20, Switzerland, or on the Internet 
at https://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=46568 or may be examined at the Division of 
Dockets Management (see ADDRESSES) (Ref. Docket No. FDA-2011-N-0146 
and/or RIN 0910-AG66).
20. ``ISO/IEC Guide 65:1996 General requirements for bodies 
operating product certification systems.'' International 
Organization for Standardization/International Electrotechnical 
Commission. Accessed on February 27, 2013. Copies are available from 
the International Electrotechnical Commission, 3, rue de Varembe, 
P.O. Box 131, CH-1211 Geneva 20--Switzerland, or on the Internet at 
https://webstore.iec.ch/webstore/webstore.nsf/Artnum_PK/40140, or 
may be examined at the Division of Dockets Management (see 
ADDRESSES) (Ref. Docket No. FDA-2011-N-0146 and/or RIN 0910-AG66). 
``ISO/IEC 17065:2012 Conformity assessment--Requirements for bodies 
certifying products, processes and services.'' International 
Organization for Standardization/International Electrotechnical 
Commission. Accessed on April 23, 2013. Copies are available from 
the International Organization for Standardization, 1, rue de 
Varembe, Case postale 56, CH-1211 Geneve 20, Switzerland, or on the 
Internet at https://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=46568 or may be examined at the 
Division of Dockets Management (see ADDRESSES) (Ref. Docket No. FDA-
2011-N-0146 and/or RIN 0910-AG66).
21. ``ISO/TS 22003:2007 Food safety management systems--Requirements 
for bodies providing audit and certification of food safety 
management systems.'' International Organization for 
Standardization/International Electrotechnical Commission. Accessed 
on April 23, 2013. Copies are available from the International 
Organization for

[[Page 45825]]

Standardization, 1, rue de Varembe, Case postale 56, CH-1211 Geneve 
20, Switzerland, or on the Internet at https://www.iso.org/iso/home/store/cataloguetc/catalogue_detail.htm?csnumber=39834 or may be 
examined at the Division of Dockets Management (see ADDRESSES) (Ref. 
Docket No. FDA-2011-N-0146 and/or RIN 0910-AG66).
22. ``Enhancing Food Safety Through Third-Party Certification.'' 
Global Food Safety Initiative. https://www.mygfsi.com/technical-resources/global-regulatory-affairs-working-group.html. Accessed on 
April 23, 2013. Last Modified 2011.
23. ``GFSI Guidance Document Sixth Edition, Version 6.2.'' Global 
Food Safety Initiative. https://www.mygfsi.com/gfsifiles/GFSI_Guidance_Document_Sixth_Edition_Version_6.2.pdf. Accessed on 
April 23, 2013. Last Modified 2012.
24. ``Accreditation Services,'' 2013. American National Standards 
Institute. https://www.ansica.org/wwwversion2/outside/PROsectorprograms.asp?menuID=1. Accessed on April 23, 2013.
25. Food and Drug Administration. Analysis to examine the impacts of 
the proposed rules for the Foreign Supplier Verification Program and 
the Accreditation of Third-Party Auditors/Certification Bodies to 
Conduct Food Safety Audits and to Issue Certifications under 
Executive Order 12866, Executive Order 13563, the Regulatory 
Flexibility Act (5 U.S.C. 601-612), the Unfunded Mandates Reform Act 
of 1995 (Pub. L. 104-4), and the Paperwork Reduction Act of 1995 (44 
U.S.C. 3501-3520), 2013. https://www.fda.gov/AboutFDA/ReportsManualsForms/Reports/EconomicAnalyses/default.htm. Accessed 
on July 22, 2013.
26. Codex Alimentarius Commission. Principles for Food Import and 
Export Inspection and Certification (CAC/GL 20-1995). 
www.codexalimentarius.org/input/download/standards/37/CXG_020e.pdf. 
Accessed on April 23, 2013.
27. ``Policy Memorandum, Certification of Grower Groups,'' 2011. 
U.S. Department of Agriculture Agricultural Marketing Service 
National Organic Program. https://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5088955. Accessed on April 23, 2013.
28. ``NVCASE Program Handbook: Procedures for Obtaining NIST 
Recognition as an Accreditor (NISTIR 6440),'' 2004. National 
Institute for Standards and Technology. https://gsi.nist.gov/global/docs/NVCASE_Handbook.pdf. Accessed on April 23, 2013.
29. ``GFSI Requirements on the Application of ISO/IEC 17011:2004,'' 
2009. Global Food Safety Initiative. https://www.mygfsi.com/gfsifiles/GFSI_ISO_17011_Requirements_190209_Final_IAF.pdf. 
Accessed April 23, 2013.
30. ``Multilateral Recognition Arrangement Documents (ML Series).'' 
International Accreditation Forum. https://www.iaf.nu/articles/MRA_Documents/39. Accessed April 23, 2013.
31. ``Letter to Interested Parties re: Draft WaterSense[supreg] 
Program,'' 2007. Environmental Protection Agency. https://www.epa.gov/watersense/docs/cert_scheme_cover_letter508.pdf. 
Accessed on April 23, 2013. ``WaterSense[supreg] Program, Product 
Certification System, Version 2.0,'' 2011. Environmental Protection 
Agency. https://www.epa.gov/watersense/docs/cert_system_508.pdf. 
Accessed on April 23, 2013.
32. ``Global Standard for Food Safety, Issue 6,'' 2012. British 
Retail Consortium. Copies are available from the British Retail 
Consortium, Second Floor, 21 Dartmouth Street, London SW1H 9BP, or 
on the Internet at https://www.brcglobalstandards.com/GlobalStandards/Standards/Food.aspx or may be examined at the 
Division of Dockets Management (see ADDRESSES) (Ref. Docket No. FDA-
2011-N-0146 and/or RIN 0910-AG66).
33. ``Recalls Background and Definitions.'' Food and Drug 
Administration. https://www.fda.gov/Safety/Recalls/IndustryGuidance/ucm129337.htm. Accessed on April 23, 2013. Last Modified 2009.
34. McCarthy, A. and Food and Drug Administration. ``Memorandum: 
Establishment of regulation to accredit third-party auditors and 
laboratories as required by the Food Safety Modernization Act of 
2011.''

List of Subjects

21 CFR Part 1

    Cosmetics, Drugs, Exports, Food labeling, Imports, Labeling, 
Reporting and recordkeeping requirements.

21 CFR Part 16

    Administrative practice and procedure.

    Therefore, under the Federal Food, Drug, and Cosmetic Act and under 
authority delegated to the Commissioner of Food and Drugs, it is 
proposed that 21 CFR parts 1 and 16 be amended as follows:

PART 1--GENERAL ENFORCEMENT REGULATIONS

0
1. The authority citation for 21 CFR part 1 is revised to read as 
follows:

    Authority: 15 U.S.C. 1453, 1454, 1455; 19 U.S.C. 1490, 1491; 21 
U.S.C. 321, 331, 332, 333, 334, 335a, 343, 350c, 350d, 350k, 352, 
355, 360b, 362, 371, 374, 381, 382, 384a, 384b, 384d, 393, 42 U.S.C. 
216, 241, 243, 262, 264.

0
2. Add subpart M, consisting of Sec. Sec.  1.600 through 1.698, to read 
as follows:
Subpart M--Accredited Third-Party Food Safety Audits and Food or 
Facility Certification
1.600 What definitions apply to this subpart?
1.601 Who is subject to this subpart?

Recognition of Accreditation Bodies Under This Subpart

1.610 Who is eligible for recognition?
1.611 What legal authority must an accreditation body have to 
qualify for recognition?
1.612 What competency and capacity must an accreditation body have 
to qualify for recognition?
1.613 What protections against conflicts of interest must an 
accreditation body have to qualify for recognition?
1.614 What quality assurance procedures must an accreditation body 
have to qualify for recognition?
1.615 What records procedures must an accreditation body have to 
qualify for recognition?

Requirements for Recognized Accreditation Bodies Under This Subpart

1.620 How must a recognized accreditation body assess third-party 
auditors/certification bodies seeking accreditation?
1.621 How must a recognized accreditation body monitor the 
performance of third-party auditors/certification bodies it 
accredits?
1.622 How must a recognized accreditation body monitor its own 
performance?
1.623 What reports and notifications must a recognized accreditation 
body submit to FDA?
1.624 How must a recognized accreditation body protect against 
conflicts of interest?
1.625 What records requirements must a recognized accreditation body 
meet?

Procedures for Recognition of Accreditation Bodies Under This Subpart

1.630 How do I apply to FDA for recognition or renewal of 
recognition?
1.631 How will FDA review applications for recognition and for 
renewal of recognition?
1.632 What is the duration of recognition?
1.633 How will FDA monitor recognized accreditation bodies?
1.634 When will FDA revoke recognition?
1.635 How do I voluntarily relinquish recognition?
1.636 How do I request reinstatement of recognition?

Accreditation of Third-Party Auditors/Certification Bodies Under This 
Subpart

1.640 Who is eligible for accreditation?
1.641 What legal authority must a third-party auditor/certification 
body have to qualify for accreditation?
1.642 What competency and capacity must a third-party auditor/
certification body have to qualify for accreditation?
1.643 What protections against conflicts of interest must a third-
party auditor/certification body have to qualify for accreditation?
1.644 What quality assurance procedures must a third-party auditor/
certification body have to qualify for accreditation?
1.645 What records procedures must a third-party auditor/
certification body have to qualify for accreditation?

[[Page 45826]]

Requirements for Accredited Auditors/Certification Bodies Under This 
Subpart

1.650 How must an accredited auditor/certification body ensure its 
audit agents are competent and objective?
1.651 How must an accredited auditor/certification body conduct a 
food safety audit of an eligible entity?
1.652 What must an accredited auditor/certification body include in 
food safety audit reports?
1.653 What must an accredited auditor/certification body do when 
issuing food or facility certifications?
1.654 When must an accredited auditor/certification body monitor an 
eligible entity with food or facility certification?
1.655 How must an accredited auditor/certification body monitor its 
own performance?
1.656 What reports and notifications must an accredited auditor/
certification body submit?
1.657 How must an accredited auditor/certification body protect 
against conflicts of interest?
1.658 What records requirements must an accredited auditor/
certification body meet?

Procedures for Accreditation of Third-Party Auditors/Certification 
Bodies Under This Subpart

1.660 Where do I apply for accreditation or renewal of accreditation 
by a recognized accreditation body?
1.661 What is the duration of accreditation?
1.662 How will FDA monitor accredited auditors/certification bodies?
1.663 How do I request an FDA waiver or waiver extension for the 13-
month limit for audit agents conducting regulatory audits?
1.664 When can FDA withdraw accreditation?
1.665 How do I voluntarily relinquish accreditation?
1.666 How do I request reaccreditation?

Additional Procedures for Direct Accreditation of Third-Party Auditors/
Certification Bodies Under This Subpart

1.670 How do I apply to FDA for direct accreditation or renewal of 
direct accreditation?
1.671 How will FDA review applications for direct accreditation and 
for renewal of direct accreditation?
1.672 What is the duration of direct accreditation?

Requirements for Eligible Entities Under This Subpart

1.680 How and when will FDA monitor eligible entities?
1.681 How frequently must eligible entities be recertified?

General Requirements of This Subpart

1.690 How will FDA make information about recognized accreditation 
bodies and accredited auditors/certification bodies available to the 
public?
1.691 How do I request reconsideration of a denial by FDA of an 
application or a waiver request?
1.692 How do I request internal agency review of a denial of an 
application or waiver request upon reconsideration?
1.693 How do I request a regulatory hearing on a revocation of 
recognition or withdrawal of accreditation?

Audits for Other Purposes

1.698 May importers use reports of regulatory audits by accredited 
auditors/certification bodies for purposes of subpart L of this 
part?

Subpart M--Accredited Third-Party Food Safety Audits and Food or 
Facility Certification

    Authority: 15 U.S.C. 1453, 1454, 1455; 19 U.S.C. 1490, 1491; 21 
U.S.C. 321, 331, 332, 333, 334, 335a, 343, 350c, 350d, 350k, 352, 
355, 360b, 362, 371, 374, 381, 382, 384a, 384b, 384d, 393, 42 U.S.C. 
216, 241, 243, 262, 264.


Sec.  1.600  What definitions apply to this subpart?

    (a) The FD&C Act means the Federal Food, Drug, and Cosmetic Act.
    (b) Except as otherwise defined in paragraph (c) of this section, 
the definitions of terms in section 201 of the FD&C Act apply when the 
terms are used in this subpart.
    (c) In addition, for the purposes of this subpart:
    Accreditation means a determination by a recognized accreditation 
body (or, in the case of direct accreditation, by FDA) that a third-
party auditor/certification body meets the applicable requirements of 
this subpart, including the model accreditation standards.
    Accreditation body means an authority that performs accreditation 
of third-party auditors/certification bodies.
    Accredited auditor/certification body means a third-party auditor/
certification body that a recognized accreditation body (or, in the 
case of direct accreditation, FDA) has determined meets the applicable 
requirements of this subpart and is authorized to conduct food safety 
audits and to issue food or facility certifications to eligible 
entities.
    Audit means:
    (1) With respect to an accreditation body, the systematic, 
independent, and documented examination (through observation, 
investigation, and records review) by FDA to assess the accreditation 
body's authority, qualifications (including its expertise and training 
program), and resources; its procedures for quality assurance, 
conflicts of interest, and records; its performance in accreditation 
activities; and its capability to meet the applicable requirements of 
this subpart.
    (2) With respect to a third-party auditor/certification body, the 
systematic, independent, and documented examination (through 
observation, investigation, and records review) by a recognized 
accreditation body (or, in the case of direct accreditation, by FDA) to 
assess the third-party auditor's/certification body's authority, 
qualifications (including its expertise and training program), and 
resources; its procedures for quality assurance, conflicts of interest, 
and records; its performance in auditing and certification activities; 
and its capability to meet the applicable requirements of this subpart; 
and
    (3) With respect to an eligible entity, the systematic, 
independent, and documented examination (through observation, 
investigation, records review, and as appropriate, sampling and 
laboratory analysis) by an accredited auditor/certification body to 
assess the entity, its facility, system(s), and food using audit 
criteria for consultative or regulatory audits, including compliance 
with any applicable requirements for preventative controls, sanitation, 
monitoring, verification, corrective actions, and recalls, and, for 
consultative audits, also includes an assessment of compliance with 
applicable industry standards and practices.
    Audit agent means an individual who is an employee or other agent 
of an accredited auditor/certification body who, although not 
individually accredited, is qualified to conduct food safety audits on 
behalf of an accredited auditor/certification body. An audit agent 
includes a contractor of the accredited auditor/certification body.
    Certification body means a foreign government, agency of a foreign 
government, foreign cooperative, or any other third party that is 
eligible to be considered for accreditation to conduct food safety 
audits and to certify that eligible entities meet applicable 
requirements of the FD&C Act. A certification body may be a single 
individual or an organization. A certification body may use audit 
agents to conduct food safety audits. Certification body has the same 
meaning as Third-party auditor as that term is defined in section 808 
of the FD&C Act and in this subpart.
    Consultative audit means an audit of an eligible entity:
    (1) To determine whether such entity is in compliance with 
applicable requirements of the FD&C Act and industry standards and 
practices; and
    (2) The results of which are for internal purposes only and cannot 
be used to determine eligibility for a food or facility certification 
issued under this subpart or in meeting the requirements

[[Page 45827]]

for an onsite audit of a foreign supplier under subpart L of this part.
    Direct accreditation means accreditation of a third-party auditor/
certification body by FDA.
    Eligible entity means a foreign entity that chooses to be subject 
to a food safety audit by an accredited auditor/certification body. 
Eligible entities include foreign facilities subject to the 
registration requirements of subpart H of this part.
    Facility means any structure, or structures of an eligible entity 
under one ownership at one general physical location, or, in the case 
of a mobile facility, traveling to multiple locations, that 
manufactures/processes, packs, or holds food for consumption in the 
United States. Transport vehicles are not facilities if they hold food 
only in the usual course of business as carriers. A facility may 
consist of one or more contiguous structures, and a single building may 
house more than one distinct facility if the facilities are under 
separate ownership. The private residence of an individual is not a 
facility. Non-bottled water drinking water collection and distribution 
establishments and their structures are not facilities.
    Facility certification means an attestation, issued for purposes of 
section 806 of the FD&C Act by an accredited auditor/certification 
body, after conducting a regulatory audit and any other activities 
necessary to establish that a facility meets the applicable 
requirements of the FD&C Act.
    Food certification means an attestation, issued for purposes of 
section 801(q) of the FD&C Act by an accredited auditor/certification 
body, after conducting a regulatory audit and any other activities 
necessary to establish that a food meets the applicable requirements of 
the FD&C Act.
    Food safety audit means a regulatory audit or a consultative audit.
    Foreign cooperative means an entity that aggregates food from 
growers or processors that is intended for export to the United States.
    Recognized accreditation body means an accreditation body that FDA 
has determined meets the applicable requirements of this subpart and is 
authorized to accredit third-party auditors/certification bodies under 
this subpart.
    Regulatory audit means an audit of an eligible entity:
    (1) To determine whether such entity is in compliance with the 
provisions of the FD&C Act; and
    (2) The results of which are used in determining eligibility for 
food certification under section 801(q) of the FD&C Act or facility 
certification under section 806 of the FD&C Act, and may be used by an 
importer in meeting the requirements for an onsite audit of a foreign 
supplier under subpart L of this part.
    Relinquishment means:
    (1) With respect to an accreditation body, a decision to cede 
voluntarily its authority to accredit third-party auditors/
certification bodies as a recognized accreditation body; and
    (2) With respect to a third-party auditor/certification body, a 
decision to cede voluntarily its authority to conduct food safety 
audits and to issue food and facility certifications to eligible 
entities.
    Self-assessment means a systematic assessment conducted by an 
accreditation body or by a third-party auditor/certification body to 
determine whether it meets the applicable requirements of this subpart.
    Third-party auditor means a foreign government, agency of a foreign 
government, foreign cooperative, or any other third party that is 
eligible to be considered for accreditation to conduct food safety 
audits and to certify that eligible entities meet the applicable 
requirements of the FD&C Act. A third-party auditor may be a single 
individual or an organization. A third-party auditor may use audit 
agents to conduct food safety audits. Third-party auditor has the same 
meaning as Certification body as that term is defined in this subpart.


Sec.  1.601  Who is subject to this subpart?

    (a) Accreditation bodies. Any accreditation body seeking 
recognition from FDA to accredit third-party auditor/certification 
bodies for conducting food safety audits and for issuing food and 
facility certifications to eligible entities.
    (b) Third-party auditors/certification bodies. Any third-party 
auditor/certification body seeking accreditation from a recognized 
accreditation body or direct accreditation by FDA for:
    (1) Conducting food safety audits; and
    (2) Issuing food and facility certifications that may be used in 
satisfying a condition of admissibility of an article of food under 
section 801(q) of the FD&C Act; or in meeting the eligibility 
requirements for the Voluntary Qualified Importer Program under section 
806 of the FD&C Act.
    (c) Eligible entities. Any eligible entity seeking a food safety 
audit or a food or facility certification from an accredited auditor/
certification body, except as provided in paragraph (d) of this 
section.
    (d) Limited exemptions from section 801(q) of the FD&C Act. (1) The 
certification of food under section 801(q) of the FD&C Act does not 
apply with respect to alcoholic beverages from an eligible entity that 
is a facility that meets the following two conditions:
    (i) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et 
seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 
(26 U.S.C. 5001 et seq.), the facility is a foreign facility of a type 
that, if it were a domestic facility, would require obtaining a permit 
from, registering with, or obtaining approval of a notice or 
application from the Secretary of the Treasury as a condition of doing 
business in the United States; and
    (ii) Under section 415 of the FD&C Act, the facility is required to 
register as a facility because it is engaged in manufacturing/
processing one or more alcoholic beverages.
    (2) Certification of food under section 801(q) of the FD&C Act does 
not apply with respect to food other than alcoholic beverages that is 
from a facility described in paragraph (d)(1) of this section, provided 
such food:
    (i) Is in prepackaged form that prevents any direct human contact 
with such food; and
    (ii) Constitutes not more than 5 percent of the overall sales of 
the facility, as determined by the Secretary of the Treasury.

Recognition of Accreditation Bodies Under This Subpart


Sec.  1.610  Who is eligible for recognition?

    An accreditation body is eligible for recognition by FDA if it can 
demonstrate that it meets the requirements of Sec. Sec.  1.611 to 
1.615.


Sec.  1.611  What legal authority must an accreditation body have to 
qualify for recognition?

    (a) An accreditation body seeking recognition must demonstrate that 
it has the authority (as a governmental entity or through contractual 
rights) to perform such assessments of a third-party auditor/
certification body as are necessary to determine its capability to 
audit and certify food facilities and food, including authority to:
    (1) Review any relevant records;
    (2) Conduct onsite assessments of the performance of third-party 
auditors/certification bodies, such as by witnessing the performance of 
a statistically significant number of personnel and other agents 
conducting assessments;
    (3) Perform any reassessments or surveillance necessary to monitor

[[Page 45828]]

compliance of accredited auditors/certification bodies; and
    (4) Suspend, withdraw, or reduce the scope of accreditation for 
failure to comply with the requirements of accreditation.
    (b) An accreditation body seeking recognition must demonstrate that 
it is capable of exerting any authority necessary to meet the 
requirements of recognition in Sec. Sec.  1.620 to 1.625 and the 
procedures in Sec. Sec.  1.630, 1.635, and 1.636, if recognized.


Sec.  1.612  What competency and capacity must an accreditation body 
have to qualify for recognition?

    An accreditation body seeking recognition must demonstrate that it 
has:
    (a) The resources required to adequately implement its 
accreditation program, including:
    (1) Adequate numbers of personnel and other agents with relevant 
knowledge, skills, and experience to effectively assess the 
qualifications of third-party auditors/certification bodies seeking 
accreditation and to effectively monitor the performance of third-party 
auditors/certification bodies; and
    (2) Adequate financial resources for its operations; and
    (b) The capability to meet the assessment and monitoring 
requirements of Sec. Sec.  1.620 and 1.621, the reporting and 
notification requirements of Sec.  1.623, and the procedures in 
Sec. Sec.  1.630, 1.631, 1.635, and 1.636, if recognized.


Sec.  1.613  What protections against conflicts of interest must an 
accreditation body have to qualify for recognition?

    An accreditation body must demonstrate that it has:
    (a) Implemented written measures to protect against conflicts of 
interest between the accreditation body (and its officers, personnel, 
and other agents) and third-party auditors/certification bodies (and 
their officers, personnel, and other agents) seeking accreditation 
from, or accredited by, such accreditation body; and
    (b) The capability to meet the conflict of interest requirements in 
Sec.  1.624, if recognized.


Sec.  1.614  What quality assurance procedures must an accreditation 
body have to qualify for recognition?

    An accreditation body seeking recognition must demonstrate that it 
has:
    (a) Implemented a written program for monitoring and assessing the 
performance of its officers, personnel and other agents and its 
accreditation program, including procedures to:
    (1) Identify areas in its accreditation program or performance that 
need improvement; and
    (2) Quickly execute appropriate corrective actions when problems 
are found; and
    (b) The capability to meet the quality assurance requirements of 
Sec.  1.622, if recognized.


Sec.  1.615  What records procedures must an accreditation body have to 
qualify for recognition?

    An accreditation body seeking recognition must demonstrate that it 
has:
    (a) Implemented written procedures to establish, control, and 
retain records (including documents and data) for the period of time 
necessary to meet its contractual and legal obligations and to provide 
an adequate basis for assessing its program and performance; and
    (b) Is capable of meeting the reporting and notification 
requirements of Sec.  1.623 and the records requirements of Sec.  
1.625, if recognized.

Requirements for Recognized Accreditation Bodies Under This Subpart


Sec.  1.620  How must a recognized accreditation body assess third-
party auditors/certification bodies seeking accreditation?

    (a) Prior to accrediting a third-party auditor/certification body 
under this subpart, a recognized accreditation body must perform, at a 
minimum, the following:
    (1) In the case of a foreign government or an agency of a foreign 
government, such reviews and audits of its food safety programs, 
systems, and standards as are necessary to determine that it meets the 
eligibility requirements of Sec.  1.640(b) and any requirements 
specified in FDA model accreditation standards regarding qualifications 
for accreditation, including legal authority, competency, capacity, 
conflicts of interest, quality assurance, and records.
    (2) In the case of a foreign cooperative that aggregates the 
products of growers or processor or any other third-party seeking 
accreditation as a third-party auditor/certification body, such reviews 
and audits of the training and qualifications of audit agents used by 
such cooperative or other third party and such reviews of internal 
systems and any other investigation of the cooperative or other third 
party necessary to determine that it meets the eligibility requirements 
of Sec.  1.640(c) and any requirements specified in FDA model 
accreditation standards regarding qualifications for accreditation, 
including legal authority, competency, capacity, conflicts of interest, 
quality assurance, and records.
    (3) In conducting a review and audit under paragraph (a)(1) or 
(a)(2) of this section, observe a statistically significant number of 
onsite audits conducted by the third-party auditor/certification body 
(or its audit agents) to assess compliance with the applicable 
requirements of the FD&C Act.
    (b) A recognized accreditation body must require a third-party 
auditor/certification body, as a condition of accreditation under this 
subpart, to comply with the reports and notification requirements of 
Sec. Sec.  1.652 and 1.656 and to agree to submit electronic food and 
facility certifications, in English, to FDA for purposes of sections 
801(q) and 806 of the FD&C Act.
    (c) A recognized accreditation body must maintain records on any 
denial of accreditation (in whole or in part) and on any withdrawal, 
suspension, or reduction in scope of accreditation of a third-party 
auditor/certification body under this subpart. The records must include 
the name and contact information for the third-party auditor/
certification body; the scope of accreditation denied, withdrawn, 
suspended, or reduced; and the basis for such action.
    (d) A recognized accreditation body must implement written 
procedures for receiving and addressing appeals from any third-party 
auditor/certification body challenging an adverse decision associated 
with accreditation under this subpart and for investigating and 
deciding on appeals in a fair and meaningful manner. The appeals 
procedures must provide similar protections to those offered by FDA 
under Sec. Sec.  1.692 and 1.693, including requirements to:
    (1) Make the appeals procedures publicly available;
    (2) Use competent, independent persons to investigate and decide 
appeals;
    (3) Advise third-party auditors/certification bodies of the final 
decisions on their appeals; and
    (4) Maintain records under Sec.  1.625 of appeals, final decisions 
on appeals, and the bases for such decisions.


Sec.  1.621  How must a recognized accreditation body monitor the 
performance of third-party auditors/certification bodies it accredits?

    A recognized accreditation body must annually conduct a 
comprehensive assessment of the performance of each auditor/
certification body it accredited under this subpart by reviewing the 
auditor's/certification body's self-assessments (including information 
on

[[Page 45829]]

compliance with the conflict of interest requirements of Sec. Sec.  
1.643 and 1.657); its regulatory audit reports and notifications 
submitted to FDA under Sec.  1.656; and any other information 
reasonably available to the accreditation body:
    (a) Regarding the compliance history of eligible entities it 
certified; or
    (b) That is otherwise relevant to a determination whether the 
accredited auditor/certification body is in compliance with this 
subpart.


Sec.  1.622  How must a recognized accreditation body monitor its own 
performance?

    (a) A recognized accreditation body must annually, and as required 
under Sec.  1.664(g), conduct a self-assessment that includes 
evaluation of:
    (1) The performance of its officers, personnel, or other agents in 
activities under this subpart and the degree of consistency among such 
performances;
    (2) The compliance of the accreditation body and its officers, 
personnel, and other agents, with the conflict of interest requirements 
of Sec.  1.624; and
    (3) If requested by FDA, any other aspects of its performance 
relevant to a determination whether the accreditation body is in 
compliance with this subpart.
    (b) As a means to evaluate the accreditation body's performance, 
the self-assessment must include onsite observation of regulatory 
audits by a statistically significant number of third-party auditors/
certification bodies it accredited under this subpart.
    (c) Based on the evaluations conducted under paragraphs (a) and (b) 
of this section, the accreditation body must:
    (1) Identify any area(s) needing improvement;
    (2) Quickly implement effective corrective action(s) to address 
those area(s); and
    (3) Establish and maintain records of such corrective action(s) 
under Sec.  1.625.
    (d) The accreditation body must prepare, and as required by Sec.  
1.623(b) submit, a written report of the results of its self-assessment 
that includes:
    (1) A description of any corrective actions taken under paragraph 
(c) of this section;
    (2) A statement disclosing the extent to which the accreditation 
body, and its officers, personnel, and other agents, complied with the 
conflict of interest requirements in Sec.  1.624; and
    (3) A statement attesting to the extent to which the accreditation 
body complied with applicable requirements of this subpart.


Sec.  1.623  What reports and notifications must a recognized 
accreditation body submit to FDA?

    (a) Reporting results of assessments of certification body 
performance. A recognized accreditation body must submit to FDA 
electronically, in English, a report of the results of any assessment 
conducted under Sec.  1.621, no later than 45 days after completing 
such assessment. The report must include an up-to-date list of any 
audit agent used by the accredited auditor/certification body to 
conduct food safety audits under this subpart.
    (b) Reporting results of accreditation body self-assessments. A 
recognized accreditation body must submit to FDA electronically, in 
English, a report of the results of an annual self-assessment required 
under Sec.  1.622, no later than 45 days after completing such self-
assessment and, for a recognized accreditation body subject to Sec.  
1.664(g)(1), must submit a report of such self-assessment to FDA within 
2 months.
    (c) Immediate notification to FDA. A recognized accreditation body 
must notify FDA electronically, in English, immediately upon:
    (1) Granting accreditation to an auditor/certification body under 
this subpart, and include:
    (i) The name, address, and telephone number of the auditor/
certification body;
    (ii) The name of one or more officers of the auditor/certification 
body;
    (iii) A list of the auditor's/certification body's audit agents; 
and
    (iv) The scope of accreditation and the date on which it was 
granted.
    (2) Withdrawing, suspending, or reducing the scope of an 
accreditation under this subpart, and include:
    (i) The basis for such action; and
    (ii) Any additional changes to accreditation information previously 
submitted to FDA under paragraph (c)(1) of this section.
    (3) Determining that an auditor/certification body it accredited 
failed to comply with Sec.  1.653 in issuing a food or facility 
certification under this subpart, and include:
    (i) The basis for such determination; and
    (ii) Any changes to accreditation information previously submitted 
to FDA under paragraph (c)(1) of this section.
    (d) Other notification to FDA. A recognized accreditation body must 
notify FDA electronically, in English, within 30 days after:
    (1) Denying accreditation (in whole or in part) under this subpart 
and include:
    (i) The name, address, and telephone number of the auditor/
certification body;
    (ii) The name of one or more officers of the auditor/certification 
body;
    (iii) The scope of accreditation requested; and
    (iv) The basis for such denial.
    (2) Making any significant change that would affect the manner in 
which it complies with the requirements in Sec. Sec.  1.610 to 1.625 
and include:
    (i) A description of the change; and
    (ii) An explanation for the purpose of the change.


Sec.  1.624  How must a recognized accreditation body protect against 
conflicts of interest?

    (a) A recognized accreditation body must implement a written 
program to protect against conflicts of interest between the 
accreditation body (and its officers, personnel, and other agents) and 
a third-party auditor/certification body (and its officers, personnel, 
and other agents) seeking accreditation from, or accredited by, such 
accreditation body, including the following:
    (1) Ensuring that the accreditation body (and its officers, 
personnel, or other agents) do not own or have a financial interest in, 
manage, or otherwise control the third-party auditor/certification body 
(or any affiliate, parent, or subsidiary); and
    (2) Prohibiting officers, personnel, or other agents of the 
accreditation body from accepting any money, gift, gratuity, or item of 
value from the third-party auditor/certification body.
    (3) The items specified in paragraph (a)(2) of this section do not 
include:
    (i) Money representing payment of fees for accreditation services 
and reimbursement of direct costs associated with an onsite audit or 
assessment of the third-party auditor/certification body; or
    (ii) Meals, of de minimis value, provided on the premises where the 
audit or assessment is conducted.
    (b) The financial interests of the spouses and children younger 
than 18 years of age of officers, personnel, and other agents of a 
recognized accreditation body will be considered the financial 
interests of such officers, personnel, and other agents of the 
accreditation body.
    (c) A recognized accreditation body must maintain on its Web site 
an up-to-date list of the auditors/certification bodies it accredited 
under this subpart and must identify the duration and scope of each 
accreditation and date(s) on each the accredited auditor/certification 
body paid any fee or reimbursement associated with such accreditation.

[[Page 45830]]

Sec.  1.625  What records requirements must a recognized accreditation 
body meet?

    (a) A recognized accreditation body must maintain electronically 
for 5 years records (including documents and data), in English, 
demonstrating its compliance with this subpart, including records 
relating to:
    (1) Applications for accreditation and renewal of accreditation 
under Sec.  1.660;
    (2) Decisions to grant, deny, suspend, withdraw, or reduce the 
scope of an accreditation;
    (3) Challenges to adverse accreditation decisions under Sec.  
1.620(c);
    (4) Its monitoring of accredited auditors/certification bodies 
under Sec.  1.621;
    (5) Self-assessments and corrective actions under Sec.  1.622;
    (6) Regulatory audit reports, including any supporting information, 
that an accredited auditor/certification body may have submitted; and
    (7) Any reports or notifications to FDA under Sec.  1.623, 
including any supporting information.
    (b) A recognized accreditation body must make records required by 
paragraph (a) of this section available for inspection and copying 
promptly upon written request of an authorized FDA officer or employee 
at the place of business of the accreditation body or at a reasonably 
accessible location. If the records required by paragraph (a) of this 
section are requested by FDA electronically, the records must be 
submitted to FDA electronically, in English, not later than 10 business 
days after the date of the request.
    (c) A recognized accreditation body must not prevent or interfere 
with FDA's access to its accredited auditors/certification bodies and 
the auditor/certification body records required by Sec.  1.658.

Procedures for Recognition of Accreditation Bodies Under This Subpart


Sec.  1.630  How do I apply to FDA for recognition or renewal of 
recognition?

    (a) Applicant for recognition. An accreditation body seeking 
recognition must submit an application demonstrating that it meets the 
eligibility requirements in Sec.  1.610.
    (b) Applicant for renewal of recognition. An accreditation body 
seeking renewal of its accreditation must submit a renewal application 
demonstrating that it continues to meet the eligibility requirements in 
Sec.  1.610.
    (c) Submission. Recognition and renewal applications and any 
documents provided as part of the application process must be submitted 
electronically, in English. An applicant must provide any translation 
and interpretation services needed by FDA to process the application, 
including during onsite audits or assessments of the applicant by FDA.
    (d) Signature. Recognition and renewal applications must be signed 
by the applicant or by any individual authorized to act on behalf of 
the applicant for purposes of seeking recognition or renewal of 
recognition.


Sec.  1.631  How will FDA review applications for recognition and for 
renewal of recognition?

    (a) FDA will review a recognition or renewal application on a first 
in, first out basis according to the date on which the application was 
submitted in complete form.
    (b) FDA will evaluate any completed recognition or renewal 
application to determine whether the applicant meets the eligibility 
requirements in Sec.  1.610 and will notify the applicant, in writing, 
whether the application has been approved or denied. FDA may make such 
notification electronically.
    (c) When FDA notifies an applicant that its recognition or renewal 
application has been approved, the notification will list any 
conditions associated with the recognition.
    (d) If FDA denies a recognition or renewal application, the 
notification will state the basis for such denial and will provide the 
address and procedures for requesting reconsideration of the 
application under Sec.  1.691.
    (e) If FDA does not reach a final decision on a renewal application 
before an accreditation body's recognition terminates by expiration, 
FDA may extend such recognition for a specified period of time or until 
the agency reaches a final decision on the renewal application.


Sec.  1.632  What is the duration of recognition?

    FDA may grant recognition of an accreditation body for a period not 
to exceed 5 years.


Sec.  1.633  How will FDA monitor recognized accreditation bodies?

    (a) FDA will periodically evaluate the performance of each 
recognized accreditation body to determine its compliance with the 
applicable requirements of this subpart. Such evaluation must occur by 
at least 4 years after the date of accreditation for a 5-year term of 
recognition, or by no later than mid-term point for recognition granted 
for less than 5 years. FDA may conduct additional performance 
evaluations of a recognized accreditation body at any time.
    (b) An FDA performance evaluation may include onsite assessments of 
statistically significant numbers of auditors/certification bodies the 
recognized accreditation body accredited and onsite audits of eligible 
entities such auditors/certification bodies certified. These may be 
conducted at any time, with or without the accreditation body or 
auditor/certification body present.


Sec.  1.634  When will FDA revoke recognition?

    (a) Grounds for revocation of recognition. FDA will revoke the 
recognition of an accreditation body for any one or more of the 
following:
    (1) Refusal to allow FDA to access records required by Sec.  1.625, 
or to conduct an audit, assessment, or investigation of the 
accreditation body or of a third-party auditor/certification body it 
accredited to ensure the accreditation body's continued compliance with 
the requirements of this subpart.
    (2) Failure to take timely and necessary corrective action when:
    (i) The accreditation of an auditor/certification body it 
accredited is withdrawn by FDA under Sec.  1.664(a);
    (ii) A significant problem with the accreditation body is 
identified through self-assessment under Sec.  1.622, monitoring under 
Sec.  1.621, or self-assessment by one or more of its accredited 
auditors/certification bodies under Sec.  1.655; or
    (iii) Directed by FDA to ensure compliance with this subpart.
    (3) A determination by FDA that the accreditation body has 
committed fraud or has submitted material false statements to the 
agency.
    (4) A determination by FDA that there is otherwise good cause for 
revocation, including:
    (i) Demonstrated bias or lack of objectivity when conducting 
activities under this subpart; or
    (ii) Failure to adequately support one or more decisions to grant 
accreditation under this subpart.
    (b) Records request associated with revocation. To assist in 
determining whether revocation is warranted under paragraph (a) of this 
section, FDA may request records of the accreditation body required by 
Sec.  1.625 or the records, required by Sec.  1.658, of one or more of 
the auditors/certification bodies it accredited under this subpart.
    (c) Notice to the accreditation body of revocation of recognition. 
(1) Upon revocation, FDA will notify the accreditation body 
electronically, in English, stating the grounds for revocation, the 
procedures for requesting a regulatory hearing under

[[Page 45831]]

Sec.  1.693 on the revocation, and the procedures for requesting 
reinstatement of recognition under Sec.  1.636.
    (2) Within 10 business days of the date of revocation, the 
accreditation body must notify FDA electronically, in English, of the 
location where the records required by Sec.  1.625 will be maintained.
    (d) Effect of revocation of recognition on accredited auditors/
certification bodies. (1) FDA will notify an accredited auditor/
certification body, electronically and in English, if the recognition 
of its accreditation body is revoked. Such auditor's/certification 
body's accreditation will remain in effect if the auditor/certification 
body:
    (i) No later than 2 months after the revocation, conducts a self-
assessment under Sec.  1.655 and reports the results of the self-
assessment to FDA under Sec.  1.656(b); and
    (ii) No later than 1 year after the revocation, becomes accredited 
by a recognized accreditation body or by FDA through direct 
accreditation.
    (2) FDA may withdraw the accreditation of a third-party auditor/
certification body whenever FDA determines there is good cause for 
withdrawal of accreditation under Sec.  1.664.
    (e) Effect of revocation of recognition on food or facility 
certifications issued to eligible entities. A food or facility 
certification issued by an auditor/certification body accredited by an 
accreditation body prior to revocation of recognition will remain in 
effect until the certificate terminates by expiration. If FDA has 
reason to believe that a food certification issued for purposes of 
section 801(q) of the FD&C Act is not valid or reliable, FDA may refuse 
to consider the certification in determining the admissibility of the 
article of food for which the certification was offered.
    (f) Public notice of revocation and the status of accreditations 
and food and facility certifications. FDA will provide notice on the 
Web site described in Sec.  1.690 of the revocation of recognition of 
an accreditation body under this subpart.


Sec.  1.635  How do I voluntarily relinquish recognition?

    (a) An accreditation body that decides to relinquish recognition 
before it terminates by expiration must notify FDA electronically, in 
English, at least 6 months before relinquishing such authority and must 
identify the location where the records required by Sec.  1.625 will be 
maintained. An accreditation body waives the right to a hearing when 
relinquishing its recognition under this subpart.
    (b) No later than 15 business days after notifying FDA, the 
accreditation body must notify any third-party auditor/accreditation 
body currently accredited that it intends to relinquish its 
recognition, specify the date on which it will occur. The accreditation 
body must establish and maintain records of such notification under 
Sec.  1.625.
    (c) An accreditation granted by an accreditation body prior to 
relinquishing its recognition will remain in effect, subject to 
reaccreditation under Sec.  1.665, except where FDA determines that 
there is good cause for withdrawal of accreditation under Sec.  1.664.
    (d) A food certification issued by such accredited auditor/
certification body will remain in effect until it terminates by 
expiration, unless FDA requires renewal of the certification under 
section 801(q)(4)(A) of the FD&C Act prior to its expiration. If FDA 
has reason to believe that a certification issued for purposes of 
section 801(q) of the FD&C Act is not valid or reliable, FDA may refuse 
to consider the certification in determining the admissibility of the 
article of food for which the certification was offered.
    (e) FDA will provide notice on the Web site described in Sec.  
1.690 of the voluntary relinquishment of recognition of an 
accreditation body. The notice will describe the effect, if any, on any 
third-party auditor/certification body it accredited and on any food or 
facility certifications such auditor/certification body issued under 
this subpart.


Sec.  1.636  How do I request reinstatement of recognition?

    (a) Application following revocation. An accreditation body that 
has had its recognition revoked may seek reinstatement by submitting a 
new application for recognition under Sec.  1.630, or may be required 
to submit such application after a determination in a regulatory 
hearing under Sec.  1.693 that revocation was appropriate. The 
accreditation body must submit evidence that the grounds for revocation 
have been resolved, including evidence addressing the cause or 
conditions that were the basis for revocation and identifying measures 
that have been implemented to help ensure that such cause(s) or 
condition(s) are unlikely to recur.
    (b) Application following relinquishment. An accreditation body 
that previously relinquished its recognition under Sec.  1.635 may seek 
recognition by submitting a new application for recognition under Sec.  
1.630.

Accreditation of Third-Party Auditors/Certification Bodies Under This 
Subpart


Sec.  1.640  Who is eligible for accreditation?

    (a) A foreign government, agency of a foreign government, foreign 
cooperative, or any other third party may seek accreditation from a 
recognized accreditation body (or, where direct accreditation is 
appropriate, FDA) to conduct food safety audits and to issue food and 
facility certifications to eligible entities under this subpart.
    (b) A foreign government or an agency of a foreign government is 
eligible for accreditation if it can demonstrate that its food safety 
programs, systems, and standards meet the requirements of Sec. Sec.  
1.641 to 1.645, as specified in FDA model standards on qualifications 
for accreditation, including legal authority, competency, capacity, 
conflicts of interest, quality assurance, and records.
    (c) A foreign cooperative or other third party is eligible for 
accreditation if it can demonstrate that the training and 
qualifications of its audit agents and its internal systems and 
standards meet the requirements of Sec. Sec.  1.641 to 1.645, as 
specified in FDA model standards on qualifications for accreditation, 
including legal authority, competency, capacity, conflicts of interest, 
quality assurance, and records.


Sec.  1.641  What legal authority must a third-party auditor/
certification body have to qualify for accreditation?

    (a) A third-party auditor/certification body seeking accreditation 
from a recognized accreditation body or from FDA must demonstrate that 
it has the authority (as a governmental entity or through contractual 
rights) to perform such assessments of facilities, their process(es), 
and food(s) as are necessary to determine compliance with the FD&C Act 
and with industry standards and practices and to issue certifications 
where appropriate based on a review of the findings of such 
assessments. This includes authority to:
    (1) Review any relevant records;
    (2) Conduct onsite audits of the eligible entity, such as 
witnessing the performance of a statistically significant number of 
personnel and other agents conducting audits of food facilities; and
    (3) Suspend or withdraw certification for failure to comply with 
applicable requirements.
    (b) A third-party auditor/certification body seeking accreditation 
must demonstrate that it is capable of exerting any authority necessary 
to meet the requirements of accreditation in Sec. Sec.  1.650 to 1.658 
and the procedures in Sec. Sec.  1.660, 1.663, 1.665, 1.666, and 1.670, 
if accredited.

[[Page 45832]]

Sec.  1.642  What competency and capacity must a third-party auditor/
certification body have to qualify for accreditation?

    A third-party auditor/certification body seeking accreditation must 
demonstrate that it has:
    (a) The resources necessary to fully implement its audit and 
certification program, including:
    (1) Adequate numbers of personnel and other agents with relevant 
knowledge, skills, and experience to effectively audit and assess 
compliance with applicable FDA requirements and industry standards and 
practices and to issue valid and reliable certifications; and
    (2) Adequate financial resources for its operations; and
    (b) The competency and capacity to meet the requirements of 
Sec. Sec.  1.650 to 1.658 and the procedures in Sec. Sec.  1.660, 
1.663, 1.665, 1.666, and 1.670, if accredited.


Sec.  1.643  What protections against conflicts of interest must a 
third-party auditor/certification body have to qualify for 
accreditation?

    A third-party auditor/certification body must demonstrate that it 
has:
    (a) Implemented written measures to protect against conflicts of 
interest between the auditor/certification body (and its officers, 
personnel, and other agents) and eligible entities (and their owners 
and operators) seeking assessment and certification from, or assessed 
and certified by, such auditor/certification body; and
    (b) The capability to meet the conflict of interest requirements in 
Sec.  1.657, if accredited.


Sec.  1.644  What quality assurance procedures must a third-party 
auditor/certification body have to qualify for accreditation?

    A third-party auditor/certification body seeking accreditation must 
demonstrate that it has:
    (a) Implemented a written program for monitoring and assessing the 
performance of its officers, personnel, and other agents involved in 
auditing and certification activities, including procedures to:
    (1) Identify areas in its auditing and certification program or 
performance that need improvement; and
    (2) Quickly execute appropriate corrective actions when problems 
are found; and
    (b) The capability to meet the quality assurance requirements of 
Sec.  1.655, if accredited.


Sec.  1.645  What records procedures must a third-party auditor/
certification body have to qualify for accreditation?

    A third-party auditor/certification body seeking accreditation must 
demonstrate that it:
    (a) Implemented written procedures to establish, control, and 
retain records (including documents and data) for a period of time 
necessary to meet its contractual and legal obligations and to provide 
an adequate basis for assessing its program and performance; and
    (b) Is capable of meeting the reporting and notification 
requirements of Sec.  1.656 and the records requirements of Sec.  
1.658, if accredited.

Requirements for Accredited Auditors/Certification Bodies Under This 
Subpart


Sec.  1.650  How must an accredited auditor/certification body ensure 
its audit agents are competent and objective?

    (a) An accredited auditor/certification body that uses audit agents 
to conduct food safety audits must ensure that each such agent meets 
the following requirements with respect to the scope of its 
accreditation under this subpart:
    (1) Has relevant knowledge and experience that provides an adequate 
basis for the agent to assess compliance with the FD&C Act and, for 
consultative audits, industry standards and practices;
    (2) Has been determined by the accredited auditor/certification 
body, through observations of a representative number of audits, to be 
competent to conduct food safety audits under this subpart;
    (3) Participates in annual food safety training under the 
accredited auditor's/certification body's training plan;
    (4) Is in compliance with the conflict of interest requirements of 
Sec.  1.657 and has no other conflicts of interest with the eligible 
entity to be audited that might impair the agent's objectivity; and
    (5) Agrees to notify its accredited auditor/certification body 
immediately upon discovering, during a food safety audit, any condition 
that could cause or contribute to a serious risk to the public health.
    (b) In assigning an audit agent to conduct a food safety audit at a 
particular eligible entity, an accredited auditor/certification body 
must determine that the agent is qualified to conduct such audit under 
the criteria established in paragraph (a) of this section and based on 
the scope and purpose of the audit and the type of facility, its 
process(es), and food.
    (c) An accredited auditor/certification body cannot use an audit 
agent to conduct a regulatory audit at an eligible entity if such agent 
conducted a consultative audit or regulatory audit for the same 
eligible entity in the preceding 13 months, except that such limitation 
may be waived if the accredited auditor/certification body demonstrates 
to FDA, under Sec.  1.663, there is insufficient access to accredited 
auditors/certification bodies in the country or region where the 
eligible entity is located or in the country of export.


Sec.  1.651  How must an accredited auditor/certification body conduct 
a food safety audit of an eligible entity?

    (a) Audit planning. Before beginning to conduct a food safety audit 
under this subpart, an accredited auditor/certification body must:
    (1) Require the entity seeking an audit to:
    (i) Identify the scope and purpose of the food safety audit, 
including the facility, process(es), or food to be audited; whether the 
audit is to be conducted as a consultative or regulatory audit, and if 
a regulatory audit, the type(s) of certification(s) sought; and
    (ii) Provide a 30-day operating schedule for such facility that 
includes information relevant to the scope and purpose of the audit; 
and
    (2) Determine whether the requested audit is within its scope of 
accreditation.
    (b) Authority to audit. In arranging a food safety audit with an 
eligible entity, an accredited auditor/certification body must ensure 
it has authority, whether contractual or otherwise, to:
    (1) Conduct an unannounced audit to verify whether the activities 
and results of the eligible entity (within the scope of the audit) 
comply with the applicable requirements of the FD&C Act and, for 
consultative audits, industry standards and practices;
    (2) Access any records and any area of the facility, its 
process(es), and food of the eligible entity relevant to the scope and 
purpose of such audit and, where appropriate, to issue food and 
facility certifications;
    (3) Where FDA requires sampling and analysis, use of validated 
sampling or analytical methodologies and analysis by a laboratory that 
is accredited, in accordance with the requirements of section 422 of 
the FD&C Act;
    (4) Notify FDA immediately if, at any time during a food safety 
audit, the accredited auditor/certification body (or its audit agent, 
where applicable) discovers a condition that could cause or contribute 
to a serious risk to the public health and provide information required 
by Sec.  1.656(c);
    (5) Prepare reports of consultative audits that contain the 
elements

[[Page 45833]]

specified in Sec.  1.652(a) and, for regulatory audits, prepare reports 
that contain the elements specified in Sec.  1.652(b) and submit them 
to FDA and to its accreditation body (where applicable) under Sec.  
1.656(a); and
    (6) Allow FDA and the recognized accreditation body that accredited 
such third-party auditor/certification body, if any, to observe any 
food safety audit for purposes of evaluating the accredited auditor's/
certification body's performance under Sec. Sec.  1.621 and 1.662 or, 
where appropriate, the recognized accreditation body's performance 
under Sec. Sec.  1.622 and 1.633.
    (c) Audit protocols. An accredited auditor/certification body (or 
its audit agent, where applicable) must conduct a food safety audit in 
a manner consistent with the identified scope and purpose of the audit 
and within the scope of its accreditation.
    (1) The audit must be conducted without announcement during the 30-
day timeframe identified under paragraph (a)(1)(ii) of this section and 
must be focused on the highest food safety risk(s) associated with the 
facility, its process(es), and food within the scope of the audit.
    (2) The audit must include records review; an onsite assessment of 
the facility, its process(es), and the food that results from such 
process(es); and where appropriate, environmental or product sampling 
and analysis, using validated procedures (including sample integrity 
procedures) and analysis performed by a laboratory accredited in 
accordance with the requirements of section 422 of the FD&C Act. The 
audit may include any other activities necessary to establish 
compliance with the FD&C Act.
    (3) The audit must be sufficiently rigorous to allow the accredited 
auditor/certification body to determine whether the entity is in 
compliance with the FD&C Act at the time of the audit; and for a 
regulatory audit, whether the entity would be likely to remain in 
compliance with the applicable requirements of the FD&C Act for at 
least 12 months following the audit, provided that the facility and its 
process(es) are properly maintained and implemented.
    (4) Audit observations and assessments, including corrective 
actions, must be documented and must be used to support the findings 
contained in the audit report required by Sec.  1.652 and maintained as 
a record of the accredited auditor/certification body under Sec.  
1.658.


Sec.  1.652  What must an accredited auditor/certification body include 
in food safety audit reports?

    (a) Consultative audits. An accredited auditor/certification body 
must prepare a report of a consultative audit, in English, not later 
than 45 days after completing such audit and must maintain such report 
under Sec.  1.658. A consultative audit report must include:
    (1) The name and address of the facility subject to audit and the 
name and address of the eligible entity, if different from the 
facility;
    (2) A unique facility identifier, as required by FDA, for the 
facility and for the eligible entity, if different from the facility;
    (3) The names and telephone numbers of the persons responsible for 
food safety compliance at the facility;
    (4) The dates and scope of the audit; and
    (5) Any deficiencies observed that require corrective action, the 
corrective action plan, and the date on which such corrective actions 
were completed. Such audit report must be maintained as a record under 
Sec.  1.658 and must be made available to FDA under Sec.  1.361.
    (b) Regulatory audits. An accredited auditor/certification body 
must, no later than 45 days after completing a regulatory audit, 
prepare and submit electronically, in English, to FDA and to its 
accreditation body (or, in the case of direct accreditation, only to 
FDA) a report of such regulatory audit that includes the following 
information:
    (1) The identity of the audited facility, including:
    (i) The name and address of the facility subject to audit and a 
unique facility identifier, as required by FDA; and
    (ii) Where applicable, the FDA registration number assigned to the 
facility under subpart H of this part;
    (2) The identity of the eligible entity, including the name, 
address, and unique facility identifier, as required by FDA, of the 
eligible entity (if different than that of facility);
    (3) The dates and scope of the regulatory audit;
    (4) The process(es) and food(s) observed during such audit;
    (5) The identity of the person(s) responsible for the facility's 
compliance with the applicable requirements of the FD&C Act;
    (6) Any deficiencies observed during the audit that present a 
reasonable probability that the use of or exposure to a violative 
product:
    (i) Will cause serious adverse health consequences or death; or
    (ii) May cause temporary or medically reversible adverse health 
consequences or where the probability of serious adverse health 
consequences is remote;
    (7) The corrective action plan for addressing each deficiency 
identified under paragraph (b)(6) of this section, unless corrective 
action was implemented immediately and verified onsite by the 
accredited auditor/certification body (or its audit agent);
    (8) Whether any sampling and laboratory analysis (e.g., under a 
microbiological sampling plan) is used in the facility;
    (9) Whether the entity has issued a food safety-related recall of 
an article of food from the facility during the 2 years preceding the 
audit and, if so, any such article(s) recalled and the reason(s) for 
the recall(s);
    (10) Whether the entity has made significant changes to the 
facility, its process(es), or products during the 2 years preceding the 
audit; and
    (11) Any food or facility certifications issued to the entity 
during the 2 years preceding the audit, including the scope and 
duration of each such certification.
    (c) Submission of regulatory audit report. An accredited auditor/
certification body must submit a completed regulatory audit report as 
required by paragraph (b) of this section, regardless of whether the 
food or facility certification was issued under this subpart.
    (d) Appeals of adverse regulatory audit results. An accredited 
auditor/certification body must implement written procedures for 
receiving and addressing appeals from eligible entities challenging 
adverse regulatory audit results and for investigating and deciding on 
appeals in a fair and meaningful manner. The appeals procedures must 
provide similar protections to those offered by FDA under Sec. Sec.  
1.692 and 1.693, including requirements to:
    (1) Make the appeals procedures publicly available;
    (2) Use qualified persons, different from those involved in the 
subject of the appeal, to investigate and decide on an appeal;
    (3) Advise the eligible entity of the final decision on its appeal; 
and
    (4) Maintain records under Sec.  1.658 of the appeal, the final 
decision, and the basis for such decision.


Sec.  1.653  What must accredited auditor/certification body do when 
issuing food or facility certifications?

    (a) Basis for issuance of a food or facility certification. (1) 
Prior to issuing a food or facility certification to an eligible 
entity, an accredited auditor/certification body (or an audit agent on 
its behalf) must complete a regulatory

[[Page 45834]]

audit that meets the requirements of Sec.  1.651 and any other 
activities that may be necessary to establish compliance with 
applicable requirements of the FD&C Act.
    (2) If, as a result of an observation during a regulatory audit, an 
eligible entity must implement a corrective action plan to address an 
observation, an accredited auditor/certification body may not issue a 
food or facility certification to such entity until after the 
accredited auditor/certification body verifies that eligible entity has 
implemented the corrective action plan through onsite observation, 
except for corrective actions taken to address recordkeeping 
deficiencies that may be verified through submission of records or 
through assurances by the eligible entity.
    (3) An accredited auditor/certification body must consider each 
observation and assessment made during a regulatory audit and other 
activities conducted under Sec.  1.651 to determine whether the entity 
was in compliance with the applicable requirements of the FD&C Act at 
the time of the audit and whether the entity would be likely to remain 
in compliance for the duration of a food or facility certification 
issued under this subpart.
    (4) A single regulatory audit may result in issuance of one or more 
food or facility certifications under this subpart, provided that the 
requirements of issuance are met as to each such certification.
    (5) Where an accredited auditor/certification body uses an audit 
agent to conduct a regulatory audit of an eligible entity under this 
subpart, the accredited auditor/certification body (and not the audit 
agent) must make the determination whether to issue a food or facility 
certification based on the results of such regulatory audit.
    (b) Issuance of a food or facility certification and submission to 
FDA. (1) For purposes of submission to FDA under this subpart, an 
accredited auditor/certification body must issue a food or facility 
certification electronically and in English. The accredited auditor/
certification body must not issue a food or facility certification 
under this subpart for a term that is longer than 12 months.
    (2) A food or facility certification must contain, at a minimum, 
the following elements:
    (i) The name and address of the accredited auditor/certification 
body and the scope and date of its accreditation under this subpart;
    (ii) The name, address, and unique facility identifier, as required 
by FDA, of the eligible entity to which the food or facility 
certification was issued;
    (iii) The name, address, and unique facility identifier, as 
required by FDA, of the facility where the audit was conducted, if 
different than the eligible entity;
    (iv) The scope and date(s) of the audit;
    (v) The name of the audit agent(s) (where applicable) conducting 
the audit;
    (vi) The scope of the food or facility certification, date of 
issuance, and date of expiration.
    (3) FDA may refuse to accept any food certification or other 
assurance for food issued by an accredited auditor/certification body 
for purposes of section 801(q) of the FD&C Act, if FDA determines, 
under section 801(q)(4)(B), that such food certification or assurance 
was not validly issued or does not reliably demonstrate that the food 
is in compliance with the applicable requirements of the FD&C Act, 
including the following:
    (i) That the food certification or assurance is offered in support 
of the admissibility of a food that was not within the scope of the 
certification or assurance; and
    (ii) That the food certification was issued by an accredited 
auditor/certification body acting outside the scope of its 
accreditation under this subpart.


Sec.  1.654  When must an accredited auditor/certification body monitor 
an eligible entity with food or facility certification?

    If an accredited auditor/certification body has reason to believe 
that an eligible entity to which it issued a food or facility 
certification may no longer be in compliance with the applicable 
requirements of the FD&C Act, the accredited auditor/certification body 
must conduct any monitoring (including an onsite assessment) of such 
eligible entity necessary to determine whether the entity is in 
compliance. The accredited auditor/certification body must immediately 
notify FDA, under Sec.  1.656(d), if it determines the entity is no 
longer in compliance with the applicable requirements of the FD&C Act. 
The accredited auditor/certification body must maintain records of such 
monitoring under Sec.  1.658.


Sec.  1.655  How must an accredited auditor/certification body monitor 
its own performance?

    (a) An accredited auditor/certification body must annually, and as 
required under Sec.  1.634(d)(1)(i) or upon FDA request made for cause, 
conduct a self-assessment that includes evaluation of:
    (1) The performance of its officers, personnel, or other agents in 
activities under this subpart, including assessing whether its audit 
agents focused on the most significant risks to human and/or animal 
health when conducting food safety audits of facilities involved in the 
production, manufacturing, processing, packing, or holding of food;
    (2) The degree of consistency among its officers, personnel, or 
other agents in performing activities under this subpart, including 
assessing whether its audit agents interpreted audit protocols in a 
consistent manner;
    (3) The compliance of the accredited auditor/certification body and 
its officers, personnel, and other agents, with the conflict of 
interest requirements of Sec.  1.657;
    (4) Actions taken in response to the results of any assessments 
conducted by FDA or, where applicable, the recognized accreditation 
body under Sec.  1.621; and
    (5) As requested by FDA, any other aspects of its performance 
relevant to a determination whether the accredited auditor/
certification body is in compliance with this subpart.
    (b) As a means to evaluate its performance, the accredited auditor/
certification body may evaluate the compliance of one or more of 
eligible entities to which food or facility certification was issued 
under this subpart.
    (c) Based on the evaluations conducted under paragraphs (a) and (b) 
of this section, the accredited auditor/certification body must:
    (1) Identify any area(s) needing improvement;
    (2) Quickly implement effective corrective action(s) to address 
those area(s); and
    (3) Under Sec.  1.658, establish and maintain records of such 
corrective action(s).
    (d) The accredited auditor/certification body must prepare a 
written report, in English, of the results of its self-assessment that 
includes:
    (1) A description of any corrective action(s) taken under paragraph 
(c) of this section;
    (2) A statement disclosing the extent to which the accredited 
auditor/certification body, and its officers, personnel, and other 
agents complied with the conflict of interest requirements in Sec.  
1.657; and
    (3) A statement attesting to the extent to which the accredited 
auditor/certification body complied with the applicable requirements of 
this subpart.


Sec.  1.656  What reports and notifications must an accredited auditor/
certification body submit?

    (a) Reporting results of regulatory audits. An accredited auditor/

[[Page 45835]]

certification body must submit a regulatory audit report, as described 
in Sec.  1.652(b), electronically, in English, to FDA and to the 
accreditation body that granted its accreditation (where applicable), 
no later than 45 days after completing such audit.
    (b) Reporting results of accredited auditor/certification body 
self-assessments. An accredited auditor/certification body must submit 
the report of its annual self-assessment required by Sec.  1.655 
electronically to its accreditation body (or, in the case of direct 
accreditation, FDA), within 45 days of the anniversary date of its 
accreditation under this subpart and, for an accredited auditor/
certification body subject to Sec.  1.634(d)(1)(i) or an FDA request 
for cause, must submit the report of its self-assessment to FDA within 
2 months. Such report must include an up-to-date list of any audit 
agents it uses to conduct audits under this subpart.
    (c) Notification to FDA of a serious risk to public health. An 
accredited auditor/certification body must immediately notify FDA 
electronically, in English, when any of its audit agents or the 
accredited auditor/certification body itself, discovers any condition, 
found during a regulatory or consultative audit of an eligible entity, 
which could cause or contribute to a serious risk to the public health, 
providing the following information:
    (1) The name and address of the eligible entity subject to the 
audit;
    (2) The name and address of the facility where the condition was 
discovered (if different from that of the eligible entity) and, where 
applicable, the FDA registration number assigned to the facility under 
subpart H of this part; and
    (3) The condition for which notification is submitted.
    (d) Immediate notification to FDA of withdrawal or suspension of 
food or facility certification. An accredited auditor/certification 
body must notify FDA electronically, in English, immediately upon 
withdrawing or suspending the food or facility certification of an 
eligible entity and the basis for such action.
    (e) Notification to its accreditation body or an eligible entity. 
(1) After notifying FDA under paragraph (c) of this section, an 
accredited auditor/certification body must immediately notify the 
eligible entity of such condition and must immediately thereafter 
notify the accreditation body that granted its accreditation, except 
for auditors/certification bodies directly accredited by FDA.
    (2) An accredited auditor/certification body must notify its 
accreditation body (or, in the case of direct accreditation, FDA) 
electronically, in English, within 30 days after making any significant 
change that would affect the manner in which it complies with the 
requirements of Sec. Sec.  1.640 to 1.658, and must include with such 
notification the following information:
    (i) A description of the change; and
    (ii) An explanation for the purpose of the change.


Sec.  1.657  How must an accredited auditor/certification body protect 
against conflicts of interest?

    (a) An accredited auditor/certification body must implement a 
written program to protect against conflicts of interest between the 
accredited auditor/certification body (and its officers, personnel, and 
agents) and an eligible entity seeking a food safety audit or food or 
facility certification from, or audited or certified by, such 
accredited auditor/certification body, including the following:
    (1) Ensuring that the accredited auditor/certification body and its 
officers, personnel, or agents (other than audit agents subject to 
paragraph (a)(2) of this section) do not own or have a financial 
interest in, manage, or otherwise control an eligible entity to be 
certified, or any affiliate, parent, or subsidiary of the entity;
    (2) Ensuring that an audit agent of the accredited auditor/
certification body does not own or operate an eligible entity, or any 
affiliate, parent, or subsidiary of the entity, to be subject to 
consultative or regulatory audit by such agent; and
    (3) Prohibiting an officer, employee, or other agent of the 
accredited auditor/certification body from accepting any money, gift, 
gratuity, or item of value from the eligible entity to be audited or 
certified under this subpart.
    (4) The items specified in paragraph (a)(3) of this section do not 
include:
    (i) Money representing payment of fees for accreditation services 
and reimbursement of direct costs associated with an onsite audit or 
assessment of the third-party auditor/certification body; or
    (ii) Meals, of de minimis value, provided on the premises where the 
audit or assessment is conducted.
    (b) An accredited auditor/certification body may accept the payment 
of fees for auditing and certification services and the reimbursement 
of direct costs associated with an audit of an eligible entity only 
after the date on which the report of such audit was completed or the 
date a food or facility certification was issued, whichever is later. 
Such payment is not considered a conflict of interest for purposes of 
paragraph (a) of this section.
    (c) The financial interests of the spouses and children younger 
than 18 years of age of officers, personnel, and other agents of an 
accredited auditor/certification body will be considered the financial 
interests of such officers, personnel, and other agents of the 
accredited auditor/certification body for purposes of this subpart.
    (d) An accredited auditor/certification body must maintain on its 
Web site an up-to-date list of the eligible entities to which it has 
issued food or facility certifications under this subpart. For each 
such eligible entity, the Web site also must identify the duration and 
scope of the food or facility certification and date(s) on which the 
eligible entity paid the accredited auditor/certification body any fee 
or reimbursement associated with such audit or certification.


Sec.  1.658  What records requirements must an accredited auditor/
certification body meet?

    (a) An accredited auditor/certification body must maintain 
electronically for 4 years records (including documents and data), in 
English, that document compliance with this subpart, including:
    (1) Any audit report and other documents resulting from a 
consultative audit conducted under this subpart, including the audit 
agent's observations, laboratory testing records and results (as 
applicable), correspondence with the eligible entity, and corrective 
actions to address deficiencies identified during the audit;
    (2) Any request for a regulatory audit from an eligible entity;
    (3) Any audit report and other documents resulting from a 
regulatory audit conducted under this subpart, including the audit 
agent's observations, laboratory testing records and results (as 
applicable), correspondence with the eligible entity, and corrective 
actions to address deficiencies identified during the audit;
    (4) Any notification submitted by an audit agent to the accredited 
auditor/certification body under Sec.  1.650(a)(5) or by the accredited 
auditor/certification body to FDA under Sec.  1.656(c);
    (5) Any food or facility certification issued under this subpart;
    (6) Any challenge to an adverse regulatory audit decision and the 
disposition of the challenge;
    (7) Any monitoring it conducted of an eligible entity to which food 
or facility certification was issued;

[[Page 45836]]

    (8) Its self-assessments and corrective actions taken as a result; 
and
    (9) Significant changes to the auditing or certification program 
that might affect compliance with this subpart.
    (b) An accredited auditor/certification body must make the records 
of a consultative audit required by paragraph (a)(1) of this section 
available to FDA in accordance with the requirements of subpart J of 
this chapter.
    (c) An accredited auditor/certification body must make the records 
required by paragraphs (a)(2) to (a)(9) of this section available for 
inspection and copying promptly upon written request of an authorized 
FDA officer or employee at the place of business of the auditor/
certification body or at a reasonably accessible location. If such 
records are requested by FDA electronically, the records must be 
submitted electronically, in English, not later than 10 business days 
after the date of the request.

Procedures for Accreditation of Third-Party Auditors/Certification 
Bodies Under This Subpart


Sec.  1.660  Where do I apply for accreditation or renewal of 
accreditation by a recognized accreditation body?

    Except as allowed under Sec.  1.670, a third-party auditor/
certification body seeking accreditation must submit its request for 
accreditation or renewal of accreditation to an accreditation body 
recognized by FDA under this subpart and identified on the Web site 
described in Sec.  1.690.


Sec.  1.661  What is the duration of accreditation?

    A recognized accreditation body may grant accreditation to a third-
party auditor/certification body under this subpart for a period not to 
exceed 4 years.


Sec.  1.662  How will FDA monitor accredited auditors/certification 
bodies?

    (a) FDA will periodically evaluate the performance of each auditor/
certification body accredited under this subpart to determine whether 
the accredited auditor/certification body continues to comply with the 
requirements of Sec. Sec.  1.640 to 1.658 and whether there are 
deficiencies in the performance of the accredited auditor/certification 
body that, if not corrected, would warrant withdrawal of its 
accreditation under this subpart. FDA will evaluate each directly 
accredited auditor/certification body annually. FDA will evaluate an 
accredited auditor/certification body annually evaluated by a 
recognized accreditation body under Sec.  1.621 by not later than 3 
years after the date of accreditation for a 4-year term of 
accreditation, or by no later than the mid-term point for accreditation 
granted for less than 4 years. FDA may conduct additional performance 
evaluations of an accredited auditor/certification body at any time.
    (b) In evaluating the performance of an accredited auditor/
certification body under paragraph (a) of this section, FDA may review 
any one or more of the following:
    (1) Regulatory audit reports and food and facility certifications;
    (2) The accredited auditor's/certification body's annual self-
assessments under Sec.  1.655;
    (3) Reports of assessments by a recognized accreditation body under 
Sec.  1.621, where applicable;
    (4) Documents and other information regarding the accredited 
auditor's/certification body's authority, qualifications (including the 
expertise and training of its audit agents), conflict of interest 
program, internal quality assurance program, and monitoring by its 
accreditation body (or, in the case of direct accreditation, FDA); and
    (5) Information obtained by FDA, including during inspections, 
audits, onsite observations, or investigations, of one or more eligible 
entities to which food or facility certification was issued by such 
accredited auditor/certification body.
    (c) FDA may conduct its evaluation of an accredited auditor/
certification body through onsite observations of performance during a 
food safety audit of an eligible entity or through document review.


Sec.  1.663  How do I request an FDA waiver or waiver extension for the 
13-month limit for audit agents conducting regulatory audits?

    (a) An accredited auditor/certification body may submit a request 
to FDA to waive the requirements of Sec.  1.650(c) preventing an audit 
agent from conducting a regulatory audit of an eligible entity if the 
agent has conducted a food safety audit of such entity during the 
previous 13 months. The auditor/certification body seeking a waiver or 
waiver extension must demonstrate there is insufficient access to 
accredited auditors/certification bodies in the country or region where 
the eligible entity is located.
    (b) Requests for a waiver or waiver extension and all documents 
provided in support of the request must be submitted to FDA 
electronically, in English. The requestor must provide such translation 
and interpretation services as are needed by FDA to process the 
request.
    (c) The request must be signed by the requestor or by any 
individual authorized to act on behalf of the requestor for purposes of 
seeking such waiver or waiver extension.
    (d) FDA will review requests for waivers and waiver extensions on a 
first in, first out basis according to the date on which the submission 
was completed. FDA will evaluate any completed waiver request to 
determine whether the criteria for waiver have been met.
    (e) FDA will notify the requestor, in writing, whether the request 
for a waiver or waiver extension is approved or denied. Such 
notification may be made electronically.
    (f) If FDA approves the request, the notification will state the 
duration of the waiver and list any conditions associated with it. If 
FDA denies the request, the notification will state the basis for 
denial and will provide the address and procedures for requesting 
reconsideration of the request under Sec.  1.691.
    (g) Unless FDA notifies a requestor that its waiver request has 
been approved, an accredited auditor/certification body must not use 
the agent to conduct a regulatory audit of such eligible entity until 
the 13-month limit in Sec.  1.650(a) has elapsed.


Sec.  1.664  When can FDA withdraw accreditation?

    (a) Mandatory withdrawal. FDA will withdraw accreditation from an 
auditor/certification body:
    (1) Except as provided in paragraph (b) of this section, if the 
food or facility certified under this subpart is linked to an outbreak 
of foodborne illness that has a reasonable probability of causing 
serious adverse health consequences or death in humans or animals;
    (2) Following an evaluation and finding by FDA that the auditor/
certification body no longer meets the requirements for accreditation; 
or
    (3) Following its refusal to allow FDA to access records under 
Sec.  1.658 or to conduct an audit, assessment, or investigation 
necessary to ensure continued compliance with this subpart.
    (b) Exception. FDA may waive mandatory withdrawal under paragraph 
(a)(1) of this section, if FDA:
    (1) Conducts an investigation of the material facts related to the 
outbreak of human or animal illness;
    (2) Reviews the steps or actions taken by the accredited auditor/
certification body to justify the food or facility certification; and
    (3) Determines that the accredited auditor/certification body 
satisfied the

[[Page 45837]]

requirements for issuance of certification under sections 801(q) or 806 
of the FD&C Act, as applicable, and under this subpart.
    (c) Discretionary withdrawal. FDA may withdraw accreditation from 
an auditor/certification body when such auditor/certification body is 
accredited by an accreditation body for which recognition is revoked 
under Sec.  1.634, if FDA determines there is good cause for 
withdrawal, including:
    (1) Demonstrated bias or lack of objectivity when conducting 
activities under this subpart; or
    (2) Performance that calls into question the validity or 
reliability of its food safety audits and food and facility 
certifications.
    (d) Records access. FDA may request records of the accredited 
auditor/certification body under Sec.  1.658 and, where applicable, may 
request records of the recognized accreditation body under Sec.  1.625, 
when considering withdrawal under paragraphs (a)(1), (a)(2), or (c) of 
this section.
    (e) Notice to the auditor/certification body of withdrawal of 
accreditation. (1) FDA will notify the auditor/certification body of 
the withdrawal electronically, in English, stating the grounds for 
withdrawal, the procedures for requesting a regulatory hearing under 
Sec.  1.693 on the withdrawal, and the procedures for requesting 
reaccreditation under Sec.  1.666.
    (2) Within 10 business days of the date of withdrawal, the auditor/
certification body must notify FDA electronically, in English, of the 
location where the records will be maintained as required by Sec.  
1.658.
    (f) Effect of withdrawal of accreditation on eligible entities. A 
food or facility certification issued by third-party auditor/
certification body prior to withdrawal will remain in effect until the 
certification terminates by expiration. If FDA has reason to believe 
that a food certification issued for purposes of section 801(q) of the 
FD&C Act is not valid or reliable, FDA may refuse to consider the 
certification in determining the admissibility of the article of food 
for which the certification was offered.
    (g) Effect of withdrawal of accreditation on recognized 
accreditation bodies. (1) FDA will notify a recognized accreditation 
body, electronically and in English, if the accreditation of one of its 
auditors/certification bodies is withdrawn. Such accreditation body's 
recognition will remain in effect if, no later than 2 months after 
withdrawal, the accreditation body conducts a self-assessment under 
Sec.  1.622 and reports the results of the self-assessment to FDA as 
required by Sec.  1.623(b).
    (2) FDA may revoke the recognition of such accreditation body 
whenever FDA determines there is good cause for revocation of 
recognition under Sec.  1.634.
    (h) Public notice of withdrawal and the status of recognition and 
food and facility certifications. FDA will provide notice on the Web 
site described in Sec.  1.690 of its withdrawal of accreditation of an 
auditor/certification body under this subpart.


Sec.  1.665  How do I voluntarily relinquish accreditation?

    (a) An accredited auditor/certification body that decides to 
relinquish accreditation before it terminates by expiration must notify 
the accreditation body (where applicable) and must notify FDA 
electronically, in English, at least 6 months before relinquishing such 
authority. The notice must identify the location where the records will 
be maintained as required by Sec.  1.658. A third-party auditor/
certification body waives the right to a hearing when relinquishing its 
accreditation under this subpart.
    (b) No later than 15 business days after notifying FDA under 
paragraph (a) of this section, the accredited auditor/certification 
body must notify any eligible entity to which it issued food or 
facility certification under this subpart.
    (c) A food or facility certification issued by an accredited 
auditor/certification body prior to relinquishing its accreditation 
will remain in effect until terminated by expiration. If FDA has reason 
to believe that a certification issued for purposes of section 801(q) 
of the FD&C Act is not valid or reliable, FDA may refuse to consider 
the certification in determining the admissibility of the article of 
food for which the certification was offered.
    (d) FDA will provide notice on the Web site described in Sec.  
1.690 of the voluntary relinquishment of accreditation by an auditor/
certification body.


Sec.  1.666  How do I request reaccreditation?

    (a) Application following withdrawal. FDA will reinstate the 
accreditation of an auditor/certification body for which it has 
withdrawn accreditation:
    (1) If, in the case of direct accreditation, FDA determines, based 
on evidence presented by the auditor/certification body, that the 
auditor/certification body satisfies the requirements for accreditation 
and adequate grounds for withdrawal no longer exist; or
    (2) In the case of an auditor/certification body accredited by an 
accreditation body for which recognition has been revoked under Sec.  
1.634:
    (i) If the auditor/certification body becomes accredited by a 
recognized accreditation body or by FDA through direct accreditation 
not later than 1 year after withdrawal of accreditation; or
    (ii) Under such conditions as FDA may impose in withdrawing 
accreditation.
    (b) Application following relinquishment. An auditor/certification 
body that previously relinquished its accreditation under Sec.  1.665 
may seek accreditation by submitting a new application for 
accreditation under Sec.  1.660 or, where applicable, Sec.  1.670.

Additional Procedures for Direct Accreditation of Third-Party Auditors/
Certification Bodies Under This Subpart


Sec.  1.670  How do I apply to FDA for direct accreditation or renewal 
of direct accreditation?

    (a) Eligibility. (1) FDA will accept applications from third-party 
auditors/certification bodies for direct accreditation or renewal of 
direct accreditation only if FDA determines that it has not identified 
and recognized an accreditation body to meet the requirements of 
section 808 of the FD&C Act within 2 years after establishing the 
accredited third-party audits and certification program. Such FDA 
determination may apply, as appropriate, to specific types of auditor/
certification bodies, types of expertise, or geographic location; or 
through identification by FDA of any requirements of section 808 of the 
FD&C Act not otherwise met by previously recognized accreditation 
bodies. FDA will only accept applications for direct accreditation and 
renewal applications that are within the scope of the determination.
    (2) FDA may revoke or modify a determination under paragraph (a)(1) 
of this section if FDA subsequently identifies and recognizes an 
accreditation body that affects such determination.
    (3) FDA will provide notice on the Web site described in Sec.  
1.690 of a determination under paragraph (a)(1) of this section and of 
a revocation or modification of the determination under paragraph 
(a)(2) of this section.
    (b) Application for direct accreditation or renewal of direct 
accreditation. (1) An auditor/certification body seeking direct 
accreditation or renewal of direct accreditation must submit an 
application to FDA, demonstrating that it is within the scope of the

[[Page 45838]]

determination issued under paragraph (a) of this section, and it meets 
the eligibility requirements of Sec.  1.640.
    (2) Applications and all documents provided as part of the 
application process must be submitted electronically, in English. An 
applicant must provide such translation and interpretation services as 
are needed by FDA to process the application, including during an 
onsite audit of the applicant.
    (3) The application must be signed by the applicant or by any 
individual authorized to act on behalf of the applicant for purposes of 
seeking or renewing direct accreditation.


Sec.  1.671  How will FDA review applications for direct accreditation 
and for renewal of direct accreditation?

    (a) FDA will review applications for direct accreditation and for 
renewal of direct accreditation on a first in, first out basis 
according to the date the submission was completed.
    (b) FDA will evaluate any completed application to determine 
whether the applicant meets the requirements for direct accreditation 
under this subpart.
    (c) FDA will notify the applicant in writing whether the 
application has been approved or denied. FDA may provide such 
notification electronically.
    (d) If an application has been approved, the notification will list 
any conditions associated with the accreditation.
    (e) If FDA denies an application, the notification will state the 
basis of denial and will provide the address and procedures for 
requesting reconsideration of the application under Sec.  1.691.
    (f) If FDA does not reach a final decision on a renewal application 
before the expiration of its direct accreditation, FDA may extend the 
duration of such direct accreditation for a specified period of time or 
until the agency reaches a final decision on the renewal application.


Sec.  1.672  What is the duration of direct accreditation?

    FDA will grant direct accreditation of a third-party auditor/
certification body for a period not to exceed 4 years.

Requirements for Eligible Entities Under This Subpart


Sec.  1.680  How and when will FDA monitor eligible entities?

    (a) FDA may, at any time, conduct an onsite audit of an eligible 
entity that has received food or facility certification from an 
accredited auditor/certification body under this subpart. The audit may 
be conducted with or without the accredited auditor/certification body 
or the recognized accreditation body (where applicable) present.
    (b) A food safety audit conducted by an accredited auditor/
certification body under this subpart is not considered an inspection 
under section 704 of the FD&C Act.


Sec.  1.681  How frequently must eligible entities be recertified?

    (a) An eligible entity seeking to maintain facility certification 
under this subpart must seek recertification prior to expiration of its 
certification. To obtain recertification, the eligible entity must 
demonstrate its continuing compliance with the applicable requirements 
of the FD&C Act.
    (b) FDA may require an eligible entity to renew a food 
certification at any time FDA determines appropriate under section 
801(q)(4)(A) of the FD&C Act.

General Requirements of This Subpart


Sec.  1.690  How will FDA make information about recognized 
accreditation bodies and accredited auditors/certification bodies 
available to the public?

    FDA will place on its Web site a registry of recognized 
accreditation bodies and accredited auditors/certification bodies, 
including the name and contact information for each. The registry may 
provide information on auditors/certification bodies accredited by 
recognized accreditation bodies through links to the Web sites of such 
accreditation bodies.


Sec.  1.691  How do I request reconsideration of a denial by FDA of an 
application or a waiver request?

    (a) An accreditation body may seek reconsideration of the denial of 
an application for recognition, renewal of recognition, or 
reinstatement of recognition no later than 10 business days after the 
date of such decision.
    (b) A third-party auditor/certification body may seek 
reconsideration of the denial of an application for direct 
accreditation, renewal of direct accreditation, reinstatement of direct 
accreditation, a request for a waiver of the conflict of interest 
requirement in Sec.  1.650(b), or a waiver extension no later than 10 
business days after the date of such decision.
    (c) A request to reconsider an application or waiver request under 
paragraph (a) or (b) of this section must be signed by the requestor or 
by an individual authorized to act on its behalf in submitting the 
request for reconsideration. The request must be submitted in English 
to the address specified in the notice of denial and must comply with 
the procedures it describes.
    (d) After completing its review and evaluation of the request for 
reconsideration, FDA will notify the requestor, in writing, of its 
decision to grant the application or waiver request upon 
reconsideration, or its decision to deny the application or waiver 
request upon reconsideration.


Sec.  1.692  How do I request internal agency review of a denial of an 
application or waiver request upon reconsideration?

    (a) No later than 10 business days after the date FDA issued a 
denial of an application or waiver request upon reconsideration under 
Sec.  1.691, the requestor may seek internal agency review of such 
denial under Sec.  10.75(c)(1) of this chapter.
    (b) The request for internal agency review under paragraph (a) of 
this section must be signed by the requestor or by an individual 
authorized to act on its behalf in submitting the request for internal 
review. The request must be submitted in English to the address 
specified in the letter of denial upon reconsideration and must comply 
with procedures it describes.
    (c) Under Sec.  10.75(d) of this chapter, internal agency review of 
such denial must be based on the information in the administrative 
file, which will include any supporting information submitted under 
Sec.  1.691(c).
    (d) After completing the review and evaluation of the 
administrative file, FDA will notify the requestor, electronically, of 
its decision to overturn the denial and grant the application or waiver 
request or to affirm the denial of the application or waiver request 
upon reconsideration.
    (e) Affirmation by FDA of a denial of an application or waiver 
request upon reconsideration constitutes final agency action under 5 
U.S.C. 702.


Sec.  1.693  How do I request a regulatory hearing on a revocation of 
recognition or withdrawal of accreditation?

    (a) Request for hearing on revocation. No later than 10 business 
days after the date FDA issued a revocation of recognition of an 
accreditation body under Sec.  1.634, the accreditation body or an 
individual authorized to act on its behalf may submit a request for a 
regulatory hearing on the revocation under part 16 of this chapter. The 
written notice of revocation issued under Sec.  1.634 will contain all 
of the elements required by Sec.  16.22 of this chapter and will 
thereby constitute the notice of an opportunity for hearing under part 
16 of this chapter.
    (b) Request for hearing on withdrawal. No later than 10 business 
days after the date FDA issued a withdrawal of

[[Page 45839]]

accreditation of a third-party auditor/certification body under Sec.  
1.664, the auditor/certification body or an individual authorized to 
act on its behalf may submit a request for a regulatory hearing on the 
withdrawal under part 16 of this chapter. The written notice of 
withdrawal under Sec.  1.664 will contain all of the elements required 
by Sec.  16.22 of this chapter and will thereby constitute the notice 
of opportunity of hearing under part 16 of this chapter.
    (c) Submission of request for regulatory hearing. The request for a 
regulatory hearing under paragraph (a) or (b) of this section must be 
submitted with a written appeal that responds to the basis for the FDA 
decision, as described in the written notice of revocation or 
withdrawal, as appropriate, and includes any supporting information 
upon which the requestor is relying. The request, appeal, and 
supporting information must be submitted in English to the address 
specified in the notice and must comply with the procedures it 
describes.
    (d) Effect of submission of request on FDA decision. The submission 
of a request for a regulatory hearing under paragraph (a) or (b) of 
this section will not operate to delay or stay the effect of a decision 
by FDA to revoke recognition of an accreditation body or to withdraw 
accreditation of an auditor/certification body unless FDA determines 
that a delay or a stay is in the public interest.
    (e) Presiding officer. The presiding officer for a regulatory 
hearing for a revocation or withdrawal under this subpart will be 
designated after a request for a regulatory hearing is submitted to 
FDA.
    (f) Denial of a request for regulatory hearing. The presiding 
officer may deny a request for regulatory hearing for a revocation or 
withdrawal under Sec.  16.26(a) of this chapter.
    (g) Conduct of regulatory hearing. (1) If the presiding officer 
grants a request for a regulatory hearing for a revocation or 
withdrawal, the hearing will be held within 10 business days after the 
date the request was filed or, if applicable, within a timeframe agreed 
upon in writing by requestor, the presiding officer, and FDA.
    (2) The presiding officer may require that a regulatory hearing for 
a revocation or withdrawal be completed within 1 business day, as 
appropriate.
    (3) The presiding officer must conduct the regulatory hearing for 
revocation or withdrawal under part 16 of this chapter, except that, 
under Sec.  16.5 of this chapter, such procedures apply only to the 
extent that the procedures are supplementary and do not conflict with 
the procedures specified for regulatory hearings under this subpart. 
Accordingly, the following requirements are inapplicable to regulatory 
hearings under this subpart: The requirements of Sec.  16.22 
(Initiation of a regulatory hearing); Sec.  16.24(e) (timing) and (f) 
(contents of notice); Sec.  16.40 (Commissioner); Sec.  16.95(b) 
(administrative decision and record for decision) and Sec.  16.119 
(Reconsideration and stay of action) of this chapter.
    (4) A decision by the presiding officer to affirm the revocation of 
recognition or the withdrawal of accreditation is considered a final 
agency action under 5 U.S.C. 702.

Audits for Other Purposes


Sec.  1.698  May importers use reports of regulatory audits by 
accredited auditors/certification bodies for purposes of subpart L of 
this part?

    An importer, as defined in Sec.  1.500 of this part, may use a 
regulatory audit of an eligible entity, documented in a regulatory 
audit report, in meeting requirements for an onsite audit of a foreign 
supplier under subpart L of this part.

PART 16--REGULATORY HEARING BEFORE THE FOOD AND DRUG ADMINISTRATION

0
3. The authority citation for 21 CFR part 16 continues to read as 
follows:

    Authority: 15 U.S.C. 1451-1461; 21 U.S.C. 141-149, 321-394, 
467f, 679, 821, 1034; 28 U.S.C. 2112; 42 U.S.C. 201-262, 263b, 364.

0
4. Section 16.1 is amended by numerically adding the following entry in 
paragraph (b)(2) to read as follows:


Sec.  16.1  Scope.

* * * * *
    (b) * * *
    (2) * * *
    Sec. Sec.  1.634 and 1.664, relating to revocation of recognition 
of an accreditation body and withdrawal of accreditation of auditors/
certification bodies that conduct food safety audits of eligible 
entities in the food import supply chain and issue food and facility 
certifications.
* * * * *

    Dated: July 23, 2013.
Leslie Kux,
Assistant Commissioner for Policy.
[FR Doc. 2013-17994 Filed 7-26-13; 8:45 am]
BILLING CODE 4160-01-P