On Friday, November 13, 2015, the U.S. Food and Drug Administration (FDA) released its final rule regarding
Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and To Issue Certifications
(“Third-Party Certification Rule”). The rule establishes standards by which FDA will recognize accreditation bodies to accredit third-party certification
bodies that will issue food and facility certifications to foreign food suppliers. The rule also sets forth how FDA may, in limited circumstances, directly
accredit third-party certification bodies.
Along with a rule published the same day requiring importers to verify foreign suppliers (FSVP Rule, discussed here), the Third-Party Certification
Rule attempts to improve the safety of food from foreign sources and will assist FDA in deciding whether to admit food for importation. The release of the
Third-Party Certification Rule and the FSVP Rule continues FDA’s rollout of seven rulemakings under the FDA Food Safety Modernization Act (FSMA). Last
month, FDA finalized its preventive controls for human and animal food (“Preventive Controls Rules,” discussed
here), and a rule related to produce
safety standards (“Produce Safety Rule,” discussed here).
Who Is Covered by the Third-Party Certification Rule?
Three types of entities are covered by the Third-Party Certification Rule: (1) “accreditation bodies” that will be recognized by FDA to accredit
third-party certification bodies; (2) third-party certification bodies that will be accredited by an accreditation body or, in limited circumstances,
directly by FDA, to conduct food safety audits and to issue food and facility certifications; and (3) “eligible entities,” meaning foreign entities
that choose to be subject to a food safety audit by an accredited third-party certification body for the purpose of certifying food or a facility. The rule
excludes alcoholic beverages from certain eligible entities and some prepackaged foods from such entities, as well as certain meat, egg and poultry
products subject to USDA requirements at the time of importation.
What Is the Purpose of the Third-Party Certification Rule?
The Third-Party Certification Rule provides a way for eligible entities, such as foreign food suppliers, to obtain certification that their food or their
facilities meet applicable safety requirements in the Food, Drug, and Cosmetic Act (FD&C Act) and related regulations (including those currently
rolling out under FSMA). Certifications can be useful for three reasons. First, FDA has authority under Section 801(q) of the FD&C Act to make a
risk-based determination to require certification as a condition of admitting food into the United States. Second, in some instances, a U.S.
importer or domestic food facility may need to conduct on-site audits to comply with the supply-chain requirements imposed by the FSVP Rule or the
Preventive Controls Rules; such audits must be conducted by “qualified auditors,” and a third-party certification body accredited under the Third-Party
Certification Rule satisfies this requirement. Finally, certifications may also be used to establish a U.S. importer’s eligibility to participate in
the Voluntary Qualified Importer Program (VQIP). FSMA mandates that FDA establish the VQIP to allow for expedited review and importation of food from
foreign facilities that have been certified pursuant to the Third-Party Certification Rule. (FDA issued
draft guidance on the VQIP and is
soliciting public comments.)
What Requirements Apply to Accreditation Bodies Under the Third-Party Certification Rule?
To be recognized by FDA, an accreditation body must demonstrate that it has legal authority (either because it is a governmental authority, or through
contractual rights) to perform the responsibilities necessary to determine if a third-party certification body should be accredited to conduct food safety
audits. It also must be competent and capable to perform its responsibilities (i.e., have sufficient financial and human resources) and have written plans
regarding conflicts of interest, quality assurance procedures, and recordkeeping requirements. An accreditation body that meets these requirements may be
recognized by FDA for a term not to exceed five years.
Once recognized by FDA, an accreditation body must in turn assess whether third-party certification bodies should be accredited to conduct audits. (Any
foreign government, agency of a foreign government, foreign cooperative, or any other third party may apply for accreditation.) An accreditation body must
conduct reviews or audits of potential third-party certification bodies to ensure they meet the same requirements above regarding legal authority,
competency and capacity, protections from conflicts, quality assurance procedures, and recordkeeping. They must also observe a representative sample of
on-site audits conducted by the third-party certification body and require the third-party certification body to comply with certain notification and
reporting requirements. An accreditation body may accredit a third-party certification body for a term not to exceed four years.
After accrediting a third-party certification body, an accreditation body must conduct “comprehensive” annual assessments of each third-party certification
body that it has accredited. It must also periodically conduct on-site observations of a representative sample of regulatory audits by each third-party
certification body that it has accredited and periodically visit the headquarters of each accredited third-party certification body.
An accreditation body also will be required to submit certain reports and notifications to FDA. For example, an accreditation body must submit copies of
the comprehensive annual reports of each third-party certification body and copies of its own self-assessments (which it must complete annually) within 45
days of completion. In other circumstances, FDA requires immediate notification – e.g., whenever a third-party certification body is accredited; when such
an accreditation is suspended, withdrawn or reduced in scope; or when an accreditation body determines that a third-party certification body has failed to
comply with its obligations in issuing certifications.
What Requirements Apply to Accredited Third-Party Certification Bodies?
An accredited third-party certification body must confirm with an eligible entity the type of audit being requested. (Although heavily incentivized by the
expedited admission provided under the VQIP, audits remain “voluntary.”) Third-party certification bodies will be accredited to conduct both “regulatory
audits” (that will be used to determine if food or a facility is eligible for certification) as well as “consultative” audits (that are for internal
purposes only and cannot be used to obtain certification). For both types of audits, a third-party certification body is required to conduct an
unannounced audit within a scheduled 30-day period, and must notify FDA immediately if during any audit it “discovers a condition that could cause or
contribute to a serious risk to the public health.” Notably, the third-party certification body must make this report prior to notifying the audited
entity of the condition. A third-party certification body also must permit FDA and its accreditation body to observe any audit.
All audits “must include records review prior to the onsite examination.” In addition, environmental monitoring and product sampling may be necessary for
audits and, when they are required for regulatory audits, must be conducted by an approved laboratory. For both regulatory and consultative audits,
the examination must consider compliance with food safety requirements of the FD&C Act and FDA regulations at the time of the audit. For consultative
audits, the examination must also consider “conformance with applicable industry standards and practices,” and a regulatory audit must consider whether the
entity’s practices are likely to remain in compliance for the duration of any certification that is issued (which under the rule can be for a period of up
to 12 months).
Although consultative audit reports must be retained and made available to FDA if requested pursuant to its authority under Section 414 of the FD&C
Act, the rule does not require that such reports routinely be submitted. By contrast, a third-party certification body must submit all regulatory audit
reports to its accreditation body and to FDA no later than 45 days after completing the audit. A third-party certification body must also notify FDA
immediately if it issues any certifications or if it withdraws or suspends any food or facility certification.
When Will FDA Begin Implementing the Third-Party Certification Rule?
The Third-Party Certification Rule is scheduled to be published on November 27, 2015. Before implementing the rule, FDA intends to finalize certain
guidance related to model accreditation standards for third-party certification bodies and to issue a rule regarding how user fees will be collected to
reimburse FDA for administering the third-party certification program. Once these features are in place, accreditation bodies will be able to apply for
recognition immediately and begin to accredit third-party certification bodies to conduct audits of foreign entities.
The food and beverage industry team at McGuire Woods will continue to monitor the rollout of the new FSMA rules. We have extensive experience advising
clients in the food and beverage industry regarding regulatory and litigation matters. We can assist companies who are threatened with potential litigation
or regulatory enforcement and we can provide counsel about how to mitigate such threats and comply with FSMA’s detailed new regulations.