The Food and Drug Administration (FDA) recently published its final rule on accrediting third-party certification bodies to conduct food safety audits and issue certifications. The Food Safety Modernization Act (FSMA) specifies two uses for the food and facility certifications issued by accredited third-party certification bodies. First, facility certifications will be used by importers to establish eligibility for Voluntary Qualified Importer Program (VQIP). VQIP offers participating importers expedited review and entry of food.

Second, FDA has the authority to make a risk-based determination to require, as a condition of admissibility, that a food imported or offered for import into the United States be accompanied by a certification or other assurance that the food meets the applicable requirements of the Food, Drug & Cosmetic Act (FDCA). When FDA has determined that a food import is subject to such certification, FDA will require, as a condition of entry, a certification issued either by an accredited third-party certification body under this rule or by an agency or representative of the government of the country from which the food at issue originated.

In addition, facilities and importers may choose to use onsite audits conducted by third-party certification bodies accredited under the program set out in this rule in connection with meeting supplier verification requirements under FDA’s recently-released final rules for Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food and Animal Food, and the Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals. Under those rules, in circumstances where an onsite audit is the appropriate supplier verification activity, such audit must be conducted by a “qualified auditor.” The definitions of “qualified auditor” in those rules make clear that an example of a potential qualified auditor includes, but is not limited to, an audit agent of a certification body that has been accredited in accordance with this.

According to the Executive Summary of the 350+ page rule, the final rule sets requirements for the legal authority, competency, capacity, conflict of interest safeguards, quality assurance, and records procedures that accreditation bodies and third-party certification bodies must demonstrate to be eligible for recognition.

The final rule requires accredited third-party certification bodies to perform unannounced facility audits, to notify FDA upon discovering a condition that could cause or contribute to a serious risk to the public health, and to submit to FDA reports of regulatory audits conducted for certification purposes. The rule includes stringent requirements to prevent conflicts of interest from influencing the decisions of recognized accreditation bodies and accredited third-party certification bodies. The rule does not, however, establish the audit criteria that accredited third-party certification bodies will use in examining eligible entities for compliance with the applicable food safety requirements of the FDCA and FDA regulations, because those criteria appear elsewhere in FDA regulations and the FDCA.

A copy of the final rule can be found here.