On Friday, November 13, 2015, the U.S. Food and Drug Administration (FDA) released its final rule regarding Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and To Issue Certifications (“Third-Party Certification Rule”). The rule establishes standards by which FDA will recognize accreditation bodies to accredit third-party certification bodies that will issue food and facility certifications to foreign food suppliers. The rule also sets forth how FDA may, in limited circumstances, directly accredit third-party certification bodies.
Along with a rule published the same day requiring importers to verify foreign suppliers (FSVP Rule, discussed here), the Third-Party Certification Rule attempts to improve the safety of food from foreign sources and will assist FDA in deciding whether to admit food for importation. The release of the Third-Party Certification Rule and the FSVP Rule continues FDA’s rollout of seven rulemakings under the FDA Food Safety Modernization Act (FSMA). Last month, FDA finalized its preventive controls for human and animal food (“Preventive Controls Rules,” discussed here), and a rule related to produce safety standards (“Produce Safety Rule,” discussed here).
Who Is Covered by the Third-Party Certification Rule?
Three types of entities are covered by the Third-Party Certification Rule: (1) “accreditation bodies” that will be recognized by FDA to accredit third-party certification bodies; (2) third-party certification bodies that will be accredited by an accreditation body or, in limited circumstances, directly by FDA, to conduct food safety audits and to issue food and facility certifications; and (3) “eligible entities,” meaning foreign entities that choose to be subject to a food safety audit by an accredited third-party certification body for the purpose of certifying food or a facility. The rule excludes alcoholic beverages from certain eligible entities and some prepackaged foods from such entities, as well as certain meat, egg and poultry products subject to USDA requirements at the time of importation.
What Is the Purpose of the Third-Party Certification Rule?
The Third-Party Certification Rule provides a way for eligible entities, such as foreign food suppliers, to obtain certification that their food or their facilities meet applicable safety requirements in the Food, Drug, and Cosmetic Act (FD&C Act) and related regulations (including those currently rolling out under FSMA). Certifications can be useful for three reasons. First, FDA has authority under Section 801(q) of the FD&C Act to make a risk-based determination to require certification as a condition of admitting food into the United States. Second, in some instances, a U.S. importer or domestic food facility may need to conduct on-site audits to comply with the supply-chain requirements imposed by the FSVP Rule or the Preventive Controls Rules; such audits must be conducted by “qualified auditors,” and a third-party certification body accredited under the Third-Party Certification Rule satisfies this requirement. Finally, certifications may also be used to establish a U.S. importer’s eligibility to participate in the Voluntary Qualified Importer Program (VQIP). FSMA mandates that FDA establish the VQIP to allow for expedited review and importation of food from foreign facilities that have been certified pursuant to the Third-Party Certification Rule. (FDA issued draft guidance on the VQIP and is soliciting public comments.)
What Requirements Apply to Accreditation Bodies Under the Third-Party Certification Rule?
To be recognized by FDA, an accreditation body must demonstrate that it has legal authority (either because it is a governmental authority, or through contractual rights) to perform the responsibilities necessary to determine if a third-party certification body should be accredited to conduct food safety audits. It also must be competent and capable to perform its responsibilities (i.e., have sufficient financial and human resources) and have written plans regarding conflicts of interest, quality assurance procedures, and recordkeeping requirements. An accreditation body that meets these requirements may be recognized by FDA for a term not to exceed five years.
Once recognized by FDA, an accreditation body must in turn assess whether third-party certification bodies should be accredited to conduct audits. (Any foreign government, agency of a foreign government, foreign cooperative, or any other third party may apply for accreditation.) An accreditation body must conduct reviews or audits of potential third-party certification bodies to ensure they meet the same requirements above regarding legal authority, competency and capacity, protections from conflicts, quality assurance procedures, and recordkeeping. They must also observe a representative sample of on-site audits conducted by the third-party certification body and require the third-party certification body to comply with certain notification and reporting requirements. An accreditation body may accredit a third-party certification body for a term not to exceed four years.
After accrediting a third-party certification body, an accreditation body must conduct “comprehensive” annual assessments of each third-party certification body that it has accredited. It must also periodically conduct on-site observations of a representative sample of regulatory audits by each third-party certification body that it has accredited and periodically visit the headquarters of each accredited third-party certification body.
An accreditation body also will be required to submit certain reports and notifications to FDA. For example, an accreditation body must submit copies of the comprehensive annual reports of each third-party certification body and copies of its own self-assessments (which it must complete annually) within 45 days of completion. In other circumstances, FDA requires immediate notification – e.g., whenever a third-party certification body is accredited; when such an accreditation is suspended, withdrawn or reduced in scope; or when an accreditation body determines that a third-party certification body has failed to comply with its obligations in issuing certifications.
What Requirements Apply to Accredited Third-Party Certification Bodies?
An accredited third-party certification body must confirm with an eligible entity the type of audit being requested. (Although heavily incentivized by the expedited admission provided under the VQIP, audits remain “voluntary.”) Third-party certification bodies will be accredited to conduct both “regulatory audits” (that will be used to determine if food or a facility is eligible for certification) as well as “consultative” audits (that are for internal purposes only and cannot be used to obtain certification). For both types of audits, a third-party certification body is required to conduct an unannounced audit within a scheduled 30-day period, and must notify FDA immediately if during any audit it “discovers a condition that could cause or contribute to a serious risk to the public health.” Notably, the third-party certification body must make this report prior to notifying the audited entity of the condition. A third-party certification body also must permit FDA and its accreditation body to observe any audit.
All audits “must include records review prior to the onsite examination.” In addition, environmental monitoring and product sampling may be necessary for audits and, when they are required for regulatory audits, must be conducted by an approved laboratory. For both regulatory and consultative audits, the examination must consider compliance with food safety requirements of the FD&C Act and FDA regulations at the time of the audit. For consultative audits, the examination must also consider “conformance with applicable industry standards and practices,” and a regulatory audit must consider whether the entity’s practices are likely to remain in compliance for the duration of any certification that is issued (which under the rule can be for a period of up to 12 months).
Although consultative audit reports must be retained and made available to FDA if requested pursuant to its authority under Section 414 of the FD&C Act, the rule does not require that such reports routinely be submitted. By contrast, a third-party certification body must submit all regulatory audit reports to its accreditation body and to FDA no later than 45 days after completing the audit. A third-party certification body must also notify FDA immediately if it issues any certifications or if it withdraws or suspends any food or facility certification.
When Will FDA Begin Implementing the Third-Party Certification Rule?
The Third-Party Certification Rule is scheduled to be published on November 27, 2015. Before implementing the rule, FDA intends to finalize certain guidance related to model accreditation standards for third-party certification bodies and to issue a rule regarding how user fees will be collected to reimburse FDA for administering the third-party certification program. Once these features are in place, accreditation bodies will be able to apply for recognition immediately and begin to accredit third-party certification bodies to conduct audits of foreign entities.
McGuireWoods LLP
The food and beverage industry team at McGuire Woods will continue to monitor the rollout of the new FSMA rules. We have extensive experience advising clients in the food and beverage industry regarding regulatory and litigation matters. We can assist companies who are threatened with potential litigation or regulatory enforcement and we can provide counsel about how to mitigate such threats and comply with FSMA’s detailed new regulations.