U.S. FDA Proposes New FSMA Food Safety Regulations – Third-Party Auditors (Part 3 of 3)
On July 26, 2013, FDA issued two new proposed regulations in accordance with section 301 of the Food Safety Modernization Act (FSMA): Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals (1) and the Accreditation for Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and To Issue Certifications (2). These new proposed rules follow two proposed rules issued by FDA on January 4, 2013: “Hazard Analysis and Risk-Based Preventive Controls for Human Food and Current Good Manufacturing Practice” and “Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption.” The four proposed rules are designed to work together to strengthen food safety in the United States. Accordingly, the proposed rules will impact almost all companies selling food in the United States. In this article, Registrar Corp discusses how FDA’s Proposed Rule for Third-Party Auditors will likely affect the food and beverage industry.
FDA proposes requirements for third-party auditors/certification bodies choosing to become accredited to conduct food safety audits and to issue food and facility certifications to eligible foreign entities under this FDA program. Food certification applies to most, but not all foods. For example, food certification typically does not apply to alcoholic beverages.
FDA’s proposed rules would allow importers to use a report of a regulatory audit of an eligible foreign supplier to meet the verification requirements under proposed FSVP regulations. The FSVP proposed rule also would require importers to verify that hazards identified as reasonably likely to occur are being adequately controlled. Onsite auditing may be used to meet the requirements of this FSVP proposed rule. Further, facility certifications may be used in the future by FDA to help determine whether a facility is eligible to be a facility from which food may be offered for import under FDA’s proposal for the Voluntary Qualified Importer Program (VQIP).
In the proposed regulation, food certifications will be required as a condition for admitting a food into the United States where necessary based on FDA’s determination of the risk of the food. To do this, FDA will recognize accreditation bodies to accredit third-party auditors/certification bodies (except for limited circumstances in which FDA may directly accredit auditors/certification bodies). These accredited third-party auditors/certification bodies will then conduct food safety audits and to issue food and facility certifications to eligible foreign entities.
An accreditation body seeking recognition from FDA must demonstrate that it has the authority (as a governmental entity or through contractual rights) to perform assessments of a third-party auditor/certification body. A recognized accreditation body must notify FDA upon granting accreditation to an auditor/certification body. FDA may then grant recognition of an accreditation body for a period not to exceed 5 years. FDA will periodically evaluate the performance of each recognized accreditation body to determine its compliance with FDA requirements.
A third-party auditor/certification body seeking accreditation must demonstrate (among other things) that it has:
1) The resources necessary to fully implement its audit and certification program, including:
- Adequate numbers of personnel and other agents with relevant knowledge, skills, and experience to effectively audit and assess compliance with applicable FDA requirements and industry standards and practices and to issue valid and reliable certifications; and
- Adequate financial resources for its operations;
2) The competency and capacity to meet FDA’s requirements and procedures, if accredited.
Once accredited, an auditor/certification body can arrange food safety audits with eligible entities. To do so, the accredited auditor/certification body must ensure it has authority (contractually or otherwise) to:
- 1) Conduct an unannounced audit to verify whether the activities and results comply with the applicable requirements and, for consultative audits, industry standards and practices;
- 2) Access any records and any area of the facility, its process(es), and food of the eligible entity relevant to the scope and purpose of such audit and, where appropriate, to issue food and facility certifications;
- 3) Where FDA requires sampling and analysis, use of validated sampling or analytical methodologies and analysis by a laboratory that is accredited, in accordance with the requirements of the FD&C Act;
- 4) Notify FDA immediately if, at any time during a food safety audit, the accredited auditor/certification body (or its audit agent, where applicable) discovers a condition that could cause or contribute to a serious risk to the public health and provide required information;
- 5) Prepare reports of consultative audits and, for regulatory audits, prepare reports and submit them to FDA and to its accreditation body (where applicable); and
- 6) Allow FDA and the recognized accreditation body that accredited such third-party auditor/certification body, if any, to observe any food safety audit for purposes of evaluating the accredited auditor’s/certification body’s performance or, where appropriate, the recognized accreditation body’s performance.
An accredited auditor/certification body must, no later than 45 days after completing a regulatory audit, prepare and submit electronically, in English, to FDA and to its accreditation body (or, in the case of direct accreditation, only to FDA) a report of such regulatory audit that includes the following information:
- 1) The identity of the audited facility, including:
- The name and address of the facility subject to audit and a unique facility identifier, as required by FDA; and
- Where applicable, the FDA registration number assigned to the facility;
2) The identity of the eligible entity, including the name, address, and unique facility identifier, as required by FDA, of the eligible entity (if different than that of facility);
3) The dates and scope of the regulatory audit;
4) The process(es) and food(s) observed during such audit;
5) The identity of the person(s) responsible for the facility’s compliance with the applicable requirements of the FD&C Act;
6) Any deficiencies observed during the audit that presents a reasonable probability that the use of or exposure to a violative product:
- Will cause serious adverse health consequences or death; or
- May cause temporary or medically reversible adverse health consequences or where the probability of serious adverse health consequences is remote;
7) The corrective action plan for addressing each deficiency identified, unless corrective action was implemented immediately and verified onsite by the accredited auditor/certification body (or its audit agent);
8) Whether any sampling and laboratory analysis (e.g., under a microbiological sampling plan) is used in the facility;
9) Whether the entity has issued a food safety-related recall of an article of food from the facility during the 2 years preceding the audit and, if so, any such article(s) recalled and the reason(s) for the recall(s);
10) Whether the entity has made significant changes to the facility, its process(es), or products during the 2 years preceding the audit; and
11) Any food or facility certifications issued to the entity during the 2 years preceding the audit, including the scope and duration of each such certification.
If, as a result of an observation during a regulatory audit, an eligible entity must implement a corrective action plan to address an observation, an accredited auditor/certification body may not issue a food or facility certification to such entity until after the accredited auditor/certification body verifies that eligible entity has implemented the corrective action plan through onsite observation, except for corrective actions taken to address record keeping deficiencies that may be verified through submission of records or through assurances by the eligible entity. An accredited auditor/certification body must consider each observation and assessment made during a regulatory audit and other activities conducted to determine whether the entity was in compliance with the applicable requirements of the FD&C Act at the time of the audit and whether the entity would be likely to remain in compliance for the duration of a food or facility certification issued under this subpart. A single regulatory audit may result in issuance of one or more food or facility certifications, provided that the requirements of issuance are met as to each such certification. The accredited auditor/certification body must not issue a food or facility certification for a term that is longer than 12 months.
FDA may refuse to accept any food certification or other assurance for food issued by an accredited auditor/certification body if FDA determines that such food certification or assurance was not validly issued or does not reliably demonstrate that the food is in compliance with the applicable requirements.
An accredited auditor/certification body must immediately notify FDA electronically, in English, when any of its audit agents or the accredited auditor/certification body itself, discovers any condition, found during a regulatory or consultative audit of an eligible entity, which could cause or contribute to a serious risk to the public health.
A recognized accreditation body may grant accreditation to a third-party auditor/certification body under this subpart for a period not to exceed 4 years. FDA will periodically evaluate the performance of each auditor/certification body accredited under this subpart to determine whether the accredited auditor/certification body continues to comply with FDA requirements and whether there are deficiencies in the performance of the accredited auditor/certification body that, if not corrected, would warrant withdrawal of its accreditation. FDA will evaluate an accredited auditor/certification body annually evaluated by a recognized accreditation body by not later than 3 years after the date of accreditation for a 4-year term of accreditation, or by no later than the mid-term point for accreditation granted for less than 4 years. FDA may conduct additional performance evaluations of an accredited auditor/certification body at any time.
FDA will place on its website a registry of recognized accreditation bodies and accredited auditors/certification bodies, including the name and contact information for each. The registry may provide information on auditors/certification bodies accredited by recognized accreditation bodies through links to the websites of such accreditation bodies.
Although FDA’s Proposed Rule for Third-Party Auditors addresses only foreign food safety audits, FDA notes that the same principles and standards would hold great merit for audits of domestic food facilities. Accordingly, FDA seeks comment on the value of, and need for, a program established and administered by FDA for the use of accredited auditors/certification bodies to conduct domestic food safety audits.
Registrar Corp will be providing additional information on Third Party Auditors and will alert industry when the final rule is published. Tweet Registrar Corp (@RegistrarCorp) if you have specific questions. Or, for any questions related to U.S. FDA Regulations, please contact Registrar Corp 24/7 at http://www.registrarcorp.com/livehelp or call us at +1-757-224-0177.
Continue Reading this series:
U.S. FDA Proposes New FSMA Food Safety Regulations – Part 1
U.S. FDA Proposes New FSMA Food Safety Regulations: Foreign Supplier Verification Program (FSVP) – Part 2
U.S. FDA Proposes New FSMA Food Safety Regulations: Third Party Auditors – Part 3