CFR Subpart M

in effect

21 C.F.R. § 1.630 How do I apply to FDA for recognition or renewal of recognition?

(a) Applicant for recognition. An accreditation body seeking recognition must submit an application demonstrating that it meets the eligibility requirements in § 1.610. (b) Applicant for renewal of recognition. An accreditation body seeking renewal of its accreditation must submit a renewal application demonstrating that it continues to meet the requirements of this subpart. (c) Submission. Recognition and renewal applications and any documents provided as part of the application process must be submitted electronically, in English. An applicant must provide any translation and interpretation services needed by FDA during the processing of the application, including during onsite assessments of the applicant by FDA. (d) Signature. Recognition and renewal applications must be signed in the manner designated by FDA, by an individual authorized to act on behalf of the applicant for purposes of seeking recognition or renewal of recognition.

21 C.F.R. § 1.631 How will FDA review my application for recognition or renewal of recognition and what happens once FDA decides on my application?

(a) Review of recognition or renewal application. FDA will examine an accreditation body's recognition or renewal application for completeness and notify the applicant of any deficiencies. FDA will review an accreditation body's recognition or renewal application on a first in, first out basis according to the date on which the completed application was submitted; however, FDA may prioritize the review of specific applications to meet the needs of the program. (b) Evaluation of recognition or renewal. FDA will evaluate any completed recognition or renewal application to determine whether the applicant meets the applicable requirements of this subpart. Such evaluation may include an onsite assessment of the accreditation body. FDA will notify the applicant, in writing, regarding whether the application has been approved or denied. FDA may make such notification electronically. If FDA does not reach a final decision on a renewal application before an accreditation body's recognition terminates by expiration, FDA may extend such recognition for a specified period of time or until the Agency reaches a final decision on the renewal application. (c) Issuance of recognition. FDA will notify an applicant that its recognition or renewal application has been approved through issuance of recognition that will list any limitations associated with the recognition. (d) Issuance of denial of recognition or renewal application. FDA will notify an applicant that its recognition or renewal application has been denied through issuance of a denial of recognition or denial of a renewal application that will state the basis for such denial and provide the procedures for requesting reconsideration of the application under § 1.691. (e) Notice of records custodian after denial of an application for renewal of recognition. An applicant whose renewal application was denied must notify FDA electronically, in English, within 10 business days of the date of issuance of a denial of a renewal application, of the name and contact information of the custodian who will maintain the records required by § 1.625(a) and make them available to FDA as required by § 1.625(b). The contact information for the custodian must include, at a minimum, an email address and the physical address where the records required by § 1.625(a) will be located. (f) Effect of denial of an application for renewal of recognition of an accreditation body on accredited third-party certification bodies. (1) FDA will issue a notice of the denial of a recognition renewal to any third-party certification bodies accredited by the accreditation body whose renewal application was denied. The third-party certification body's accreditation will remain in effect so long as the third-party certification body: (i) No later than 60 days after FDA's issuance of the notice of the denial of recognition renewal, conducts a self-assessment under § 1.655 and reports the results of the self-assessment to FDA under § 1.656(b); and (ii) No later than 1 year after issuance of the notice of denial of recognition renewal or the original date of the expiration of the accreditation, whichever comes first, becomes accredited by another recognized accreditation body or by FDA through direct accreditation. (2) FDA may withdraw the accreditation of a third-party certification body whenever FDA determines there is good cause for withdrawal of accreditation under § 1.664(c). (g) Effect of denial of an application for renewal of recognition of an accreditation body on food or facility certifications issued to eligible entities. A food or facility certification issued by a third-party certification body accredited by a recognized accreditation body prior to issuance of a denial of the renewal application will remain in effect until the certification expires. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in the voluntary qualified importer program (VQIP). (h) Public notice of denial of an application for renewal of recognition of an accreditation body. FDA will provide notice on the Web site described in § 1.690 of the date of issuance of a denial of a renewal application and will describe the basis for the denial.

21 C.F.R. § 1.632 What is the duration of recognition?

FDA may grant recognition of an accreditation body for a period not to exceed 5 years from the date of recognition.

21 C.F.R. § 1.633 How will FDA monitor recognized accreditation bodies?

(a) FDA will evaluate the performance of each recognized accreditation body to determine its compliance with the applicable requirements of this subpart. Such assessment must occur by at least 4 years after the date of recognition for a 5-year recognition period, or by no later than the mid-term point for a recognition period of less than 5 years. FDA may conduct additional assessments of a recognized accreditation body at any time. (b) An FDA assessment of a recognized accreditation body may include onsite assessments of a representative sample of third-party certification bodies the recognized accreditation body accredited and onsite audits of a representative sample of eligible entities certified by such third-party certification bodies under this subpart. These may be conducted at any time and, as FDA determines necessary or appropriate, may occur without the recognized accreditation body or, in the case of an audit of an eligible entity, the accredited third-party certification body present.

21 C.F.R. § 1.634 When will FDA revoke recognition?

(a) Grounds for revocation of recognition. FDA will revoke the recognition of an accreditation body found not to be in compliance with the requirements of this subpart, including for any one or more of the following: (1) Refusal by the accreditation body to allow FDA to access records required by § 1.625, or to conduct an assessment or investigation of the accreditation body or of a third-party certification body it accredited to ensure the accreditation body's continued compliance with the requirements of this subpart. (2) Failure to take timely and necessary corrective action when: (i) The accreditation of a third-party certification body it accredited is withdrawn by FDA under § 1.664(a); (ii) A significant deficiency is identified through self-assessment under § 1.622, monitoring under § 1.621, or self-assessment by one or more of its accredited third-party certification bodies under § 1.655; or (iii) Directed to do so by FDA to ensure compliance with this subpart. (3) A determination by FDA that the accreditation body has committed fraud or has submitted material false statements to the Agency. (4) A determination by FDA that there is otherwise good cause for revocation, including: (i) Demonstrated bias or lack of objectivity when conducting activities under this subpart; or (ii) Failure to adequately support one or more decisions to grant accreditation under this subpart. (iii) Failure to pay the annual user fee within 90 days of the payment due date, as specified in § 1.725(b)(3). (b) Records request associated with revocation. To assist in determining whether revocation is warranted under paragraph (a) of this section, FDA may request records of the accreditation body required by § 1.625 or the records, required by § 1.658, of one or more of the third-party certification bodies it accredited under this subpart. (c) Issuance of revocation of recognition. (1) FDA will notify an accreditation body that its recognition has been revoked through issuance of a revocation that will state the grounds for revocation, the procedures for requesting a regulatory hearing under § 1.693 on the revocation, and the procedures for requesting reinstatement of recognition under § 1.636. (2) Within 10 business days of the date of issuance of the revocation, the accreditation body must notify FDA electronically, in English, of the name of the custodian who will maintain the records and make them available to FDA as required by § 1.625. The contact information for the custodian must provide, at a minimum, an email address and the physical address where the records will be located. (d) Effect of revocation of recognition of an accreditation body on accredited third-party certification bodies. (1) FDA will issue a notice of the revocation of recognition to any accredited third-party certification body accredited by the accreditation body whose recognition was revoked. The third-party certification body's accreditation will remain in effect if the third-party certification body: (i) No later than 60 days after FDA's issuance of the notice of revocation, conducts a self-assessment under § 1.655 and reports the results of the self-assessment to FDA under § 1.656(b); and (ii) No later than 1 year after issuance of the notice of the revocation, or the original date of expiration of the accreditation, whichever comes first, becomes accredited by another recognized accreditation body or by FDA through direct accreditation. (2) FDA may withdraw the accreditation of a third-party certification body whenever FDA determines there is good cause for withdrawal of accreditation under § 1.664(c). (e) Effect of revocation of recognition of an accreditation body on food or facility certifications issued to eligible entities. A food or facility certification issued by a third-party certification body accredited by a recognized accreditation body prior to issuance of the revocation of recognition will remain in effect until the certificate terminates by expiration. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (f) Public notice of revocation of recognition. FDA will provide notice on the Web site described in § 1.690 of the issuance of the revocation of recognition of an accreditation body and will describe the basis for revocation.

21 C.F.R. § 1.635 What if I want to voluntarily relinquish recognition or do not want to renew recognition?

(a) Notice to FDA of intent to relinquish or not to renew recognition. A recognized accreditation body must notify FDA electronically, in English, at least 60 days before voluntarily relinquishing recognition or before allowing recognition to expire without seeking renewal. The recognized accreditation body must provide the name and contact information of the custodian who will maintain the records required under § 1.625(a) after the date of relinquishment or the date recognition expires, as applicable, and make them available to FDA as required by § 1.625(b). The contact information for the custodian must include, at a minimum, an email address and the physical address where the records required by § 1.625(a) will be located. (b) Notice to accredited third-party certification bodies of intent to relinquish or not to renew recognition. No later than 15 business days after notifying FDA under paragraph (a) of this section, the recognized accreditation body must notify any currently accredited third-party certification body that it intends to relinquish recognition or to allow its recognition to expire, specifying the date on which relinquishment or expiration will occur. The recognized accreditation body must establish and maintain records of such notification under § 1.625. (c)(1) Effect of voluntary relinquishment or expiration of recognition on third-party certification bodies. The accreditation of a third-party certification body issued prior to the relinquishment or expiration of its accreditation body's recognition will remain in effect, so long as the third-party certification body: (i) No later than 60 days after the date of relinquishment or the date of expiration of the recognition, conducts a self-assessment under § 1.655 and reports the results of the self-assessment to FDA under § 1.656(b); and (ii) No later than 1 year after the date of relinquishment or the date of expiration of recognition, or the original date of the expiration of the accreditation, whichever comes first, becomes accredited by another recognized accreditation body or by FDA through direct accreditation. (2) FDA may withdraw the accreditation of a third-party certification body whenever FDA determines there is good cause for withdrawal of accreditation under § 1.664(c). (d) Effect of voluntary relinquishment or expiration of recognition of an accreditation body on food or facility certifications issued to eligible entities. A food or facility certification issued by a third-party certification body accredited by a recognized accreditation body prior to relinquishment or expiration of its recognition will remain in effect until the certification expires. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (e) Public notice of voluntary relinquishment or expiration of recognition. FDA will provide notice on the Web site described in § 1.690 of the voluntary relinquishment or expiration of recognition of an accreditation body under this subpart.

21 C.F.R. § 1.636 How do I request reinstatement of recognition?

(a) Application following revocation. An accreditation body that has had its recognition revoked may seek reinstatement by submitting a new application for recognition under § 1.630. The accreditation body must submit evidence that the grounds for revocation have been resolved, including evidence addressing the cause or conditions that were the basis for revocation and identifying measures that have been implemented to help ensure that such cause(s) or condition(s) are unlikely to recur. (b) Application following relinquishment. An accreditation body that previously relinquished its recognition under § 1.635 may seek recognition by submitting a new application for recognition under § 1.630.

21 C.F.R. § 1.620 How must a recognized accreditation body evaluate third-party certification bodies seeking accreditation?

(a) Prior to accrediting a third-party certification body under this subpart, a recognized accreditation body must perform, at a minimum, the following: (1) In the case of a foreign government or an agency of a foreign government, such reviews and audits of the government's or agency's food safety programs, systems, and standards as are necessary to determine that it meets the eligibility requirements of § 1.640(b). (2) In the case of a foreign cooperative or any other third-party seeking accreditation as a third-party certification body, such reviews and audits of the training and qualifications of agents conducting audits for such cooperative or other third party (or in the case of a third-party certification body that is an individual, such individual) and such reviews of internal systems and any other investigation of the cooperative or other third party necessary to determine that it meets the eligibility requirements of § 1.640(c). (3) In conducting a review and audit under paragraph (a)(1) or (2) of this section, an observation of a representative sample of onsite audits examining compliance with the applicable food safety requirements of the FD&C Act and FDA regulations as conducted by the third-party certification body or its agents (or, in the case of a third-party certification body that is an individual, such individual). (b) A recognized accreditation body must require a third-party certification body, as a condition of accreditation under this subpart, to comply with the reports and notification requirements of §§ 1.652 and 1.656 and to agree to submit to FDA, electronically and in English, any food or facility certifications it issues for purposes of sections 801(q) or 806 of the FD&C Act. (c) A recognized accreditation body must maintain records on any denial of accreditation (in whole or in part) and on any withdrawal, suspension, or reduction in scope of accreditation of a third-party certification body under this subpart. The records must include the name and contact information for the third-party certification body; the date of the action; the scope of accreditation denied, withdrawn, suspended, or reduced; and the basis for such action. (d) A recognized accreditation body must notify any third-party certification body of an adverse decision associated with its accreditation under this subpart, including denial of accreditation or the withdrawal, suspension, or reduction in the scope of its accreditation. The recognized accreditation body must establish and implement written procedures for receiving and addressing appeals from any third-party certification body challenging such an adverse decision and for investigating and deciding on appeals in a fair and meaningful manner. The appeals procedures must provide similar protections to those offered by FDA under §§ 1.692 and 1.693, and include requirements to: (1) Make the appeals procedures publicly available; (2) Use competent persons, who may or may not be external to the recognized accreditation body, who are free from bias or prejudice and have not participated in the accreditation decision or be subordinate to a person who has participated in the accreditation decision to investigate and decide appeals; (3) Advise third-party certification bodies of the final decisions on their appeals; and (4) Maintain records under § 1.625 of appeals, final decisions on appeals, and the bases for such decisions.

21 C.F.R. § 1.621 How must a recognized accreditation body monitor the performance of third-party certification bodies it accredited?

(a) A recognized accreditation body must annually conduct a comprehensive assessment of the performance of each third-party certification body it accredited under this subpart by reviewing the accredited third-party certification body's self-assessments (including information on compliance with the conflict of interest requirements of §§ 1.643 and 1.657); its regulatory audit reports and notifications submitted to FDA under § 1.656; and any other information reasonably available to the recognized accreditation body regarding the compliance history of eligible entities the accredited third-party certification body certified under this subpart; or that is otherwise relevant to a determination whether the accredited third-party certification body is in compliance with this subpart. (b) No later than 1 year after the initial date of accreditation of the third-party certification body and every 2 years thereafter for duration of its accreditation under this subpart, a recognized accreditation body must conduct onsite observations of a representative sample of regulatory audits performed by the third-party certification body (or its audit agents) (or, in the case of a third-party certification body that is an individual, such individual) accredited under this subpart and must visit the accredited third-party certification body's headquarters (or other location that manages audit agents conducting food safety audits under this subpart, if different than its headquarters). The recognized accreditation body will consider the results of such observations and visits in the annual assessment of the accredited third-party certification body required by paragraph (a) of this section.

21 C.F.R. § 1.622 How must a recognized accreditation body monitor its own performance?

(a) A recognized accreditation body must annually, and as required under § 1.664(g), conduct a self-assessment that includes evaluation of compliance with this subpart, including: (1) The performance of its officers, employees, or other agents involved in accreditation activities and the degree of consistency in conducting accreditation activities; (2) The compliance of the recognized accreditation body and its officers, employees, and other agents involved in accreditation activities, with the conflict of interest requirements of § 1.624; and (3) If requested by FDA, any other aspects of its performance relevant to a determination whether the recognized accreditation body is in compliance with this subpart. (b) As a means to evaluate the recognized accreditation body's performance, the self-assessment must include onsite observation of regulatory audits of a representative sample of third-party certification bodies it accredited under this subpart. In meeting this requirement, the recognized accreditation body may use the results of onsite observations performed under § 1.621(b). (c) Based on the evaluations conducted under paragraphs (a) and (b) of this section, the recognized accreditation body must: (1) Identify any area(s) where deficiencies exist; (2) Quickly implement corrective action(s) that effectively address those deficiencies; and (3) Establish and maintain records of any such corrective action(s) under § 1.625. (d) The recognized accreditation body must prepare, and as required by § 1.623(b) submit, a written report of the results of its self-assessment that includes the following elements. Documentation of conformance to ISO/IEC 17011:2004 may be used, supplemented as necessary, in meeting the requirements of this paragraph. (1) A description of any corrective actions taken under paragraph (c) of this section; (2) A statement disclosing the extent to which the recognized accreditation body, and its officers, employees, and other agents involved in accreditation activities, complied with the conflict of interest requirements in § 1.624; and (3) A statement attesting to the extent to which the recognized accreditation body complied with applicable requirements of this subpart.

21 C.F.R. § 1.623 What reports and notifications must a recognized accreditation body submit to FDA?

(a) Reporting results of assessments of accredited third-party certification body performance. A recognized accreditation body must submit to FDA electronically, in English, a report of the results of any assessment conducted under § 1.621, no later than 45 days after completing such assessment. The report must include an up-to-date list of any audit agents used by the accredited third-party certification body to conduct food safety audits under this subpart. (b) Reporting results of recognized accreditation body self-assessments. A recognized accreditation body must submit to FDA electronically, in English: (1) A report of the results of an annual self-assessment required under § 1.622, no later than 45 days after completing such self-assessment; and (2) For a recognized accreditation body subject to § 1.664(g)(1), a report of such self-assessment to FDA within 60 days of the third-party certification body's withdrawal. A recognized accreditation body may use a report prepared for conformance to ISO/IEC 17011:2004, supplemented as necessary, in meeting the requirements this section. (c) Immediate notification to FDA. A recognized accreditation body must notify FDA electronically, in English, immediately upon: (1) Granting (including expanding the scope of) accreditation to a third-party certification body under this subpart, and include: (i) The name, address, telephone number, and email address of the accredited third-party certification body; (ii) The name of one or more officers of the accredited third-party certification body; (iii) A list of the accredited third-party certification body's audit agents; and (iv) The scope of accreditation, the date on which it was granted, and its expiration date. (2) Withdrawing, suspending, or reducing the scope of an accreditation under this subpart, and include: (i) The basis for such action; and (ii) Any additional changes to accreditation information previously submitted to FDA under paragraph (c)(1) of this section. (3) Determining that a third-party certification body it accredited failed to comply with § 1.653 in issuing a food or facility certification under this subpart, and include: (i) The basis for such determination; and (ii) Any changes to accreditation information previously submitted to FDA under paragraph (c)(1) of this section. (d) Other notification to FDA. A recognized accreditation body must notify FDA electronically, in English, within 30 days after: (1) Denying accreditation (in whole or in part) under this subpart and include: (i) The name, address, telephone number, and email address of the third-party certification body; (ii) The name of one or more officers of the third-party certification body; (iii) The scope of accreditation requested; and (iv) The scope and basis for such denial. (2) Making any significant change that would affect the manner in which it complies with the applicable requirements of this subpart and include: (i) A description of the change; and (ii) An explanation for the purpose of the change.

21 C.F.R. § 1.624 How must a recognized accreditation body protect against conflicts of interest?

(a) A recognized accreditation body must implement a written program to protect against conflicts of interest between the recognized accreditation body (and its officers, employees, and other agents involved in accreditation activities) and any third-party certification body (and its officers, employees, and other agents involved in auditing and certification activities) seeking accreditation from, or accredited by, such recognized accreditation body, including the following: (1) Ensuring that the recognized accreditation body (and its officers, employees, or other agents involved in accreditation activities) does not own or have a financial interest in, manage, or otherwise control the third-party certification body (or any affiliate, parent, or subsidiary); and (2) Prohibiting officers, employees, or other agents involved in accreditation activities of the recognized accreditation body from accepting any money, gift, gratuity, or item of value from the third-party certification body. (3) The items specified in paragraph (a)(2) of this section do not include: (i) Money representing payment of fees for accreditation services and reimbursement of direct costs associated with an onsite assessment of the third-party certification body; or (ii) Lunch of de minimis value provided during the course of an assessment and on the premises where the assessment is conducted, if necessary to facilitate the efficient conduct of the assessment. (b) A recognized accreditation body may accept the payment of fees for accreditation services and the reimbursement of direct costs associated with assessment of a certification body only after the date on which the report of such assessment was completed or the date of which the accreditation was issued, whichever comes later. Such payment is not considered a conflict of interest for purposes of paragraph (a) of this section. (c) The financial interests of the spouses and children younger than 18 years of age of a recognized accreditation body's officers, employees, and other agents involved in accreditation activities will be considered the financial interests of such officers, employees, and other agents involved in accreditation activities. (d) A recognized accreditation body must maintain on its Web site an up-to-date list of the third-party certification bodies it accredited under this subpart and must identify the duration and scope of each accreditation and the date(s) on which the accredited third-party certification body paid any fee or reimbursement associated with such accreditation. If the accreditation of a certification body is suspended, withdrawn, or reduced in scope, this list must also include the date of suspension, withdrawal, or reduction in scope and maintain that information for the duration of accreditation or until the suspension is lifted, the certification body is reaccredited, or the scope of accreditation is reinstated, whichever comes first.

21 C.F.R. § 1.625 What records requirements must an accreditation body that has been recognized meet?

(a) An accreditation body that has been recognized must maintain electronically for 5 years records created while it is recognized (including documents and data) demonstrating its compliance with this subpart, including records relating to: (1) Applications for accreditation and renewal of accreditation under § 1.660; (2) Decisions to grant, deny, suspend, withdraw, or expand or reduce the scope of an accreditation; (3) Challenges to adverse accreditation decisions under § 1.620(c); (4) Its monitoring of accredited third-party certification bodies under § 1.621; (5) Self-assessments and corrective actions under § 1.622; (6) Regulatory audit reports, including any supporting information, that an accredited third-party certification body may have submitted; (7) Any reports or notifications to FDA under § 1.623, including any supporting information; and (8) Records of fee payments and reimbursement of direct costs. (b) An accreditation body that has been recognized must make records required by paragraph (a) of this section available for inspection and copying promptly upon written request of an authorized FDA officer or employee at the place of business of the accreditation body or at a reasonably accessible location. If the records required by paragraph (a) of this section are requested by FDA electronically, the records must be submitted to FDA electronically not later than 10 business days after the date of the request. Additionally, if the requested records are maintained in a language other than English, the accreditation body must electronically submit an English translation within a reasonable time. (c) An accreditation body that has been recognized must not prevent or interfere with FDA's access to its accredited third-party certification bodies and the accredited third-party certification body records required by § 1.658.

21 C.F.R. § 1.640 Who is eligible to seek accreditation?

(a) A foreign government, agency of a foreign government, foreign cooperative, or any other third party may seek accreditation from a recognized accreditation body (or, where direct accreditation is appropriate, FDA) to conduct food safety audits and to issue food and facility certifications to eligible entities under this subpart. An accredited third-party certification body may use documentation of conformance with ISO/IEC 17021: 2011 or ISO/IEC 17065: 2012, supplemented as necessary, in meeting the applicable requirements of this subpart. (b) A foreign government or an agency of a foreign government is eligible for accreditation if it can demonstrate that its food safety programs, systems, and standards meet the requirements of §§ 1.641 through 1.645. (c) A foreign cooperative or other third party is eligible for accreditation if it can demonstrate that the training and qualifications of its agents used to conduct audits (or, in the case of a third-party certification body that is an individual, such individual) and its internal systems and standards meet the requirements of §§ 1.641 through 1.645.

21 C.F.R. § 1.641 What legal authority must a third-party certification body have to qualify for accreditation?

(a) A third-party certification body seeking accreditation from a recognized accreditation body or from FDA must demonstrate that it has the authority (as a governmental entity or as a legal entity with contractual rights) to perform such examinations of facilities, their process(es), and food(s) as are necessary to determine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, and conformance with applicable industry standards and practices and to issue certifications where appropriate based on a review of the findings of such examinations. This includes authority to: (1) Review any relevant records; (2) Conduct onsite audits of an eligible entity; and (3) Suspend or withdraw certification for failure to comply with applicable requirements. (b) A third-party certification body seeking accreditation must demonstrate that it is capable of exerting the authority (as a governmental entity or as legal entity with contractual rights) necessary to meet the applicable requirements of accreditation under this subpart if accredited.

21 C.F.R. § 1.642 What competency and capacity must a third-party certification body have to qualify for accreditation?

A third-party certification body seeking accreditation must demonstrate that it has: (a) The resources necessary to fully implement its certification program, including: (1) Adequate numbers of employees and other agents with relevant knowledge, skills, and experience to effectively examine for compliance with applicable FDA food safety requirements of the FD&C Act and FDA regulations, conformance with applicable industry standards and practices, and issuance of valid and reliable certifications; and (2) Adequate financial resources for its operations; and (b) The competency and capacity to meet the applicable requirements of this subpart, if accredited.

21 C.F.R. § 1.643 What protections against conflicts of interest must a third-party certification body have to qualify for accreditation?

A third-party certification body must demonstrate that it has: (a) Implemented written measures to protect against conflicts of interest between the third-party certification body (and its officers, employees, and other agents involved in auditing and certification activities) and clients seeking examinations or certification from, or audited or certified by, such third-party certification body; and (b) The capability to meet the conflict of interest requirements in § 1.657, if accredited.

21 C.F.R. § 1.644 What quality assurance procedures must a third-party certification body have to qualify for accreditation?

A third-party certification body seeking accreditation must demonstrate that it has: (a) Implemented a written program for monitoring and evaluating the performance of its officers, employees, and other agents involved in auditing and certification activities, including procedures to: (1) Identify deficiencies in its auditing and certification program or performance; and (2) Quickly execute corrective actions that effectively address any identified deficiencies; and (b) The capability to meet the quality assurance requirements of § 1.655, if accredited.

21 C.F.R. § 1.645 What records procedures must a third-party certification body have to qualify for accreditation?

A third-party certification body seeking accreditation must demonstrate that it: (a) Implemented written procedures to establish, control, and retain records (including documents and data) for a period of time necessary to meet its contractual and legal obligations and to provide an adequate basis for evaluating its program and performance; and (b) Is capable of meeting the reporting, notification, and records requirements of this subpart, if accredited.

21 C.F.R. § 1.660 Where do I apply for accreditation or renewal of accreditation by a recognized accreditation body and what happens once the recognized accreditation body decides on my application?

(a) Submission of accreditation or renewal application to a recognized accreditation body. A third-party certification body seeking accreditation must submit its request for accreditation or renewal of accreditation by a recognized accreditation body identified on the Web site described in § 1.690. (b) Notice of records custodian after denial of application for renewal of accreditation. An applicant whose renewal application was denied by a recognized accreditation body must notify FDA electronically, in English, within 10 business days of the date of issuance of a denial of accreditation or denial of the renewal application, of the name and contact information of the custodian who will maintain the records required by § 1.658(a) and make them available to FDA as required by § 1.658(b) and (c). The contact information for the custodian must include, at a minimum, an email address and the physical address where the records required by § 1.658(a) will be located. (c) Effect of denial of an application for renewal of accreditation on food or facility certifications issued to eligible entities. A food or facility certification issued by an accredited third-party certification body prior to issuance of the denial of its renewal application l will remain in effect until the certification expires. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (d) Public notice of denial of an application for renewal of accreditation. FDA will provide notice on the Web site described in § 1.690 of the date of issuance of a denial of renewal of accreditation of a third-party certification body that had previous been accredited.

21 C.F.R. § 1.661 What is the duration of accreditation by a recognized accreditation body?

A recognized accreditation body may grant accreditation to a third-party certification body under this subpart for a period not to exceed 4 years.

21 C.F.R. § 1.662 How will FDA monitor accredited third-party certification bodies?

(a) FDA will periodically evaluate the performance of each accredited third-party certification body to determine whether the accredited third-party certification body continues to comply with the applicable requirements of this subpart and whether there are deficiencies in the performance of the accredited third-party certification body that, if not corrected, would warrant withdrawal of its accreditation under § 1.664. FDA will evaluate each directly accredited third-party certification body annually. For a third-party certification body accredited by a recognized accreditation body, FDA will evaluate an accredited third-party certification body not later than 3 years after the date of accreditation for a 4-year term of accreditation, or by no later than the mid-term point for accreditation granted for less than 4 years. FDA may conduct additional performance assessments of an accredited third-party certification body at any time. (b) In evaluating the performance of an accredited third-party certification body under paragraph (a) of this section, FDA may review any one or more of the following: (1) Regulatory audit reports and food and facility certifications; (2) The accredited third-party certification body's self-assessments under § 1.655; (3) Reports of assessments by a recognized accreditation body under § 1.621; (4) Documents and other information relevant to a determination of the accredited third-party certification body's compliance with the applicable requirements of this subpart; and (5) Information obtained by FDA, including during inspections, audits, onsite observations, or investigations, of one or more eligible entities to which a food or facility certification was issued by such accredited third-party certification body. (c) FDA may conduct its evaluation of an accredited third-party certification body through a site visit to an accredited third-party certification body's headquarters (or other location that manages audit agents conducting food safety audits under this subpart, if different than its headquarters), through onsite observation of an accredited third party certification body's performance during a food safety audit of an eligible entity, or through document review.

21 C.F.R. § 1.663 How do I request an FDA waiver or waiver extension for the 13-month limit for audit agents conducting regulatory audits?

(a) An accredited third-party certification body may submit a request to FDA to waive the requirements of § 1.650(c) preventing an audit agent from conducting a regulatory audit of an eligible entity if the audit agent (or, in the case that the third-party certification body is an individual, the third-party certification body) has conducted a food safety audit of such entity during the previous 13 months. The accredited third-party certification body seeking a waiver or waiver extension must demonstrate there is insufficient access to audit agents and any third-party certification bodies that are comprised of an individual in the country or region where the eligible entity is located. (b) Requests for a waiver or waiver extension and all documents provided in support of the request must be submitted to FDA electronically, in English. The requestor must provide such translation and interpretation services as are needed by FDA to process the request. (c) The request must be signed by the requestor or by any individual authorized to act on behalf of the requestor for purposes of seeking such waiver or waiver extension. (d) FDA will review requests for waivers and waiver extensions on a first in, first out basis according to the date on which the completed submission is received; however, FDA may prioritize the review of specific requests to meet the needs of the program. FDA will evaluate any completed waiver request to determine whether the criteria for waiver have been met. (e) FDA will notify the requestor whether the request for a waiver or waiver extension is approved or denied. (f) If FDA approves the request, issuance of the waiver will state the duration of the waiver and list any limitations associated with it. If FDA denies the request, the issuance of a denial of a waiver request will state the basis for denial and will provide the address and procedures for requesting reconsideration of the request under § 1.691. (g) Unless FDA notifies a requestor that its waiver request has been approved, an accredited third-party certification body must not use the audit agent to conduct a regulatory audit of such eligible entity until the 13-month limit in § 1.650(c) has elapsed.

21 C.F.R. § 1.664 When would FDA withdraw accreditation?

(a) Mandatory withdrawal. FDA will withdraw accreditation from a third-party certification body: (1) Except as provided in paragraph (b) of this section, if the food or facility certified under this subpart is linked to an outbreak of foodborne illness or chemical or physical hazard that has a reasonable probability of causing serious adverse health consequences or death in humans or animals; (2) Following an evaluation and finding by FDA that the third-party certification body no longer complies with the applicable requirements of this subpart; or (3) Following its refusal to allow FDA to access records under § 1.658 or to conduct an audit, assessment, or investigation necessary to ensure continued compliance with this subpart. (4) If payment of the third-party certification body's annual fee is not received within 90 days of the payment due date, as specified in § 1.725(c)(3). (b) Exception. FDA may waive mandatory withdrawal under paragraph (a)(1) of this section, if FDA: (1) Conducts an investigation of the material facts related to the outbreak of human or animal illness; (2) Reviews the relevant audit records and the actions taken by the accredited third-party certification body in support of its decision to certify; and (3) Determines that the accredited third-party certification body satisfied the requirements for issuance of certification under this subpart. (c) Discretionary withdrawal. FDA may withdraw accreditation, in whole or in part, from a third-party certification body when such third-party certification body is accredited by an accreditation body for which recognition is revoked under § 1.634, if FDA determines there is good cause for withdrawal, including: (1) Demonstrated bias or lack of objectivity when conducting activities under this subpart; or (2) Performance that calls into question the validity or reliability of its food safety audits or certifications. (d) Records access. FDA may request records of the accredited third-party certification body under § 1.658 and, where applicable, may request records under § 1.625 of an accreditation body that has been recognized under § 1.625, when considering withdrawal under paragraph (a)(1), (a)(2), or (c) of this section. (e) Notice to the third-party certification body of withdrawal of accreditation. (1) FDA will notify a third-party certification body of the withdrawal of its accreditation through issuance of a withdrawal that will state the grounds for withdrawal, the procedures for requesting a regulatory hearing under § 1.693 on the withdrawal, and the procedures for requesting reaccreditation under § 1.666. (2) Within 10 business days of the date of issuance of the withdrawal, the third-party certification body must notify FDA electronically, in English, of the name of the custodian who will maintain the records required by § 1.658, and provide contact information for the custodian, which will at least include an email address, and the street address where the records will be located. (f) Effect of withdrawal of accreditation on eligible entities. A food or facility certification issued by a third-party certification body prior to withdrawal will remain in effect until the certification terminates by expiration. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (g) Effect of withdrawal of accreditation on recognized accreditation bodies. (1) FDA will notify a recognized accreditation body if the accreditation of a third-party certification body it accredited is withdrawn by FDA. Such accreditation body's recognition will remain in effect if, no later than 60 days after withdrawal, the accreditation body conducts a self-assessment under § 1.622 and reports the results of the self-assessment to FDA as required by § 1.623(b). (2) FDA may revoke the recognition of an accreditation body whenever FDA determines there is good cause for revocation of recognition under § 1.634. (h) Public notice of withdrawal accreditation. FDA will provide notice on the Web site described in § 1.690 of its withdrawal of accreditation of a third-party certification body and provide a description of the basis for withdrawal.

21 C.F.R. § 1.665 What if I want to voluntarily relinquish accreditation or do not want to renew accreditation?

(a) Notice to FDA of intent to relinquish or not to renew accreditation. A third-party certification body must notify FDA electronically, in English, at least 60 days before voluntarily relinquishing accreditation or before allowing accreditation to expire without seeking renewal. The certification body must provide the name and contact information of the custodian who will maintain the records required under § 1.658(a) after the date of relinquishment or the date accreditation expires, as applicable, and make them available to FDA as required by § 1.658(b) and (c). The contact information for the custodian must include, at a minimum, an email address and the physical address where the records required by § 1.658(a) will be located. (b) Notice to recognized accreditation body and eligible entities of intent to relinquish or not to renew accreditation. No later than 15 business days after notifying FDA under paragraph (a) of this section, the certification body must notify its recognized accreditation body and any eligible entity with current certifications that it intends to relinquish accreditation or to allow its accreditation to expire, specifying the date on which relinquishment or expiration will occur. The recognized accreditation body must establish and maintain records of such notification under § 1.625(a). (c) Effect of voluntary relinquishment or expiration of accreditation on food or facility certifications issued to eligible entities. A food or facility certification issued by a third-party certification body prior to relinquishment or expiration of its accreditation will remain in effect until the certification expires. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (d) Public notice of voluntary relinquishment or expiration of accreditation. FDA will provide notice on the Web site described in § 1.690 of the voluntary relinquishment or expiration of accreditation of a certification body under this subpart.

21 C.F.R. § 1.666 How do I request reaccreditation?

(a) Application following withdrawal. FDA will reinstate the accreditation of a third-party certification body for which it has withdrawn accreditation: (1) If, in the case of direct accreditation, FDA determines, based on evidence presented by the third-party certification body, that the third-party certification body satisfies the applicable requirements of this subpart and adequate grounds for withdrawal no longer exist; or (2) In the case of a third-party certification body accredited by an accreditation body for which recognition has been revoked under § 1.634: (i) If the third-party certification body becomes accredited by another recognized accreditation body or by FDA through direct accreditation no later than 1 year after withdrawal of accreditation, or the original date of the expiration of accreditation, whichever comes first; or (ii) Under such conditions as FDA may impose in withdrawing accreditation. (b) Application following voluntary relinquishment. A third-party certification body that previously relinquished its accreditation under § 1.665 may seek accreditation by submitting a new application for accreditation under § 1.660 or, where applicable, § 1.670.

21 C.F.R. § 1.670 How do I apply to FDA for direct accreditation or renewal of direct accreditation?

(a) Eligibility. (1) FDA will accept applications from third-party certification bodies for direct accreditation or renewal of direct accreditation only if FDA determines that it has not identified and recognized an accreditation body to meet the requirements of section 808 of the FD&C Act within 2 years after establishing the accredited third-party audits and certification program. Such FDA determination may apply, as appropriate, to specific types of third-party certification bodies, types of expertise, or geographic location; or through identification by FDA of any requirements of section 808 of the FD&C Act not otherwise met by previously recognized accreditation bodies. FDA will only accept applications for direct accreditation and renewal applications that are within the scope of the determination. (2) FDA may revoke or modify a determination under paragraph (a)(1) of this section if FDA subsequently identifies and recognizes an accreditation body that affects such determination. (3) FDA will provide notice on the Web site described in § 1.690 of a determination under paragraph (a)(1) of this section and of a revocation or modification of the determination under paragraph (a)(1) of this section, as described in paragraph (a)(2) of this section. (b) Application for direct accreditation or renewal of direct accreditation. (1) A third-party certification body seeking direct accreditation or renewal of direct accreditation must submit an application to FDA, demonstrating that it is within the scope of the determination issued under paragraph (a)(1) of this section, and it meets the eligibility requirements of § 1.640. (2) Applications and all documents provided as part of the application process must be submitted electronically, in English. An applicant must provide such translation and interpretation services as are needed by FDA to process the application, including during an onsite audit of the applicant. (3) The application must be signed in the manner designated by FDA by an individual authorized to act on behalf of the applicant for purposes of seeking or renewing direct accreditation.

21 C.F.R. § 1.671 How will FDA review my application for direct accreditation or renewal of direct accreditation and what happens once FDA decides on my application?

(a) Review of a direct accreditation or renewal application. FDA will examine a third-party certification body's direct accreditation or renewal application for completeness and notify the applicant of any deficiencies. FDA will review applications for direct accreditation and for renewal of direct accreditation on a first in, first out basis according to the date the completed submission is received; however, FDA may prioritize the review of specific applications to meet the needs of the program. (b) Evaluation of a direct accreditation or renewal application. FDA will evaluate any completed application to determine whether the applicant meets the requirements for direct accreditation under this subpart. If FDA does not reach a final decision on a renewal application before the expiration of the direct accreditation, FDA may extend the duration of such direct accreditation for a specified period of time or until the Agency reaches a final decision on the renewal application. (c) Notice of approval or denial. FDA will notify the applicant that its direct accreditation or renewal application has been approved through issuance of or denied. (d) Issuance of direct accreditation. If an application has been approved, the issuance of the direct accreditation that will list any limitations associated with the accreditation. (e) Issuance of denial of direct accreditation. If FDA issues a denial of direct accreditation or denial of a renewal application, the issuance of the denial of direct accreditation will state the basis for such denial and provide the procedures for requesting reconsideration of the application under § 1.691. (f) Notice of records custodian after denial of application for renewal of direct accreditation. An applicant whose renewal application was denied must notify FDA electronically, in English, within 10 business days of the date of issuance of a denial of a renewal application, of the name and contact information of the custodian who will maintain the records required by § 1.658(a) and make them available to FDA as required by § 1.658(b) and (c). The contact information for the custodian must include, at a minimum, an email address and the physical address where the records required by § 1.658(b) will be located. (g) Effect of denial of renewal of direct accreditation on food or facility certifications issued to eligible entities. A food or facility certification issued by an accredited third-party certification body prior to issuance of the denial of its renewal application will remain in effect until the certification expires. If FDA has reason to believe that a certification issued for purposes of section 801(q) or 806 of the FD&C Act is not valid or reliable, FDA may refuse to consider the certification in determining the admissibility of the article of food for which the certification was offered or in determining the importer's eligibility for participation in VQIP. (h) Public notice of denial of renewal of direct accreditation. FDA will provide notice on the Web site described in § 1.690 of the issuance of a denial of renewal application for direct accreditation under this subpart.

21 C.F.R. § 1.672 What is the duration of direct accreditation?

FDA will grant direct accreditation of a third-party certification body for a period not to exceed 4 years.

21 C.F.R. § 1.680 How and when will FDA monitor eligible entities?

FDA may, at any time, conduct an onsite audit of an eligible entity that has received food or facility certification from an accredited third-party certification body under this subpart. Where FDA determines necessary or appropriate, the unannounced audit may be conducted with or without the accredited third-party certification body or the recognized accreditation body (where applicable) present. An FDA audit conducted under this section will be conducted on an unannounced basis and may be preceded by a request for a 30-day operating schedule.

21 C.F.R. § 1.681 How frequently must eligible entities be recertified?

An eligible entity seeking recertification of a food or facility certification under this subpart must apply for recertification prior to the expiration of its certification. For certifications used in meeting the requirements of section 801(q) or 806 of the FD&C Act, FDA may require an eligible entity to apply for recertification at any time FDA determines appropriate under such section.

21 C.F.R. § 1.690 How will FDA make information about recognized accreditation bodies and accredited third-party certification bodies available to the public?

FDA will place on its Web site a registry of recognized accreditation bodies and accredited third-party certification bodies, including the name, contact information, and scope and duration of recognition or accreditation. The registry may provide information on third-party certification bodies accredited by recognized accreditation bodies through links to the Web sites of such recognized accreditation bodies. FDA will also place on its Web site a list of accreditation bodies for which it has denied renewal of recognition, for which FDA has revoked recognition, and that have relinquished their recognition or have allowed their recognition to expire. FDA will also place in its Web site a list of certification bodies whose renewal of accreditation has been denied, for which FDA has withdrawn accreditation, and that have relinquished their accreditations or have allowed their accreditations to expire. FDA will place on its Web site determinations under § 1.670(a)(1) and modifications of such determinations under § 1.670(a)(2).

21 C.F.R. § 1.691 How do I request reconsideration of a denial by FDA of an application or a waiver request?

(a) An accreditation body may seek reconsideration of the denial of an application for recognition, renewal of recognition, or reinstatement of recognition no later than 10 business days after the date of the issuance of such denial. (b) A third-party certification body may seek reconsideration of the denial of an application for direct accreditation, renewal of direct accreditation, reaccreditation of directly accredited third-party certification body, a request for a waiver of the conflict of interest requirement in § 1.650(b), or a waiver extension no later than 10 business days after the date of the issuance of such denial. (c) A request to reconsider an application or waiver request under paragraph (a) or (b) of this section must be signed by the requestor or by an individual authorized to act on its behalf in submitting the request for reconsideration. The request must be submitted electronically in English and must comply with the procedures described in the notice. (d) After completing its review and evaluation of the request for reconsideration, FDA will notify the requestor through the issuance of the recognition, direct accreditation, or waiver upon reconsideration or through the issuance of a denial of the application or waiver request under paragraph (a) or (b) of this section upon reconsideration.

21 C.F.R. § 1.692 How do I request internal agency review of a denial of an application or waiver request upon reconsideration?

(a) No later than 10 business days after the date of issuance of a denial of an application or waiver request upon reconsideration under § 1.691, the requestor may seek internal agency review of such denial under § 10.75(c)(1) of this chapter. (b) The request for internal agency review under paragraph (a) of this section must be signed by the requestor or by an individual authorized to act on its behalf in submitting the request for internal review. The request must be submitted electronically in English to the address specified in the denial upon reconsideration and must comply with procedures it describes. (c) Under § 10.75(d) of this chapter, internal agency review of such denial must be based on the information in the administrative file, which will include any supporting information submitted under § 1.691(c). (d) After completing the review and evaluation of the administrative file, FDA will notify the requestor of its decision to overturn the denial and grant the application or waiver request through issuance of an application or waiver request upon reconsideration or to affirm the denial of the application or waiver request upon reconsideration through issuance of a denial of an application or waiver request upon reconsideration. (e) Issuance by FDA of a denial of an application or waiver request upon reconsideration constitutes final agency action under 5 U.S.C. 702.

21 C.F.R. § 1.693 How do I request a regulatory hearing on a revocation of recognition or withdrawal of accreditation?

(a) Request for hearing on revocation. No later than 10 business days after the date of issuance of a revocation of recognition of an accreditation body under § 1.634, an individual authorized to act on the accreditation body's behalf may submit a request for a regulatory hearing on the revocation under part 16 of this chapter. The issuance of revocation issued under § 1.634 will contain all of the elements required by § 16.22 of this chapter and will thereby constitute the notice of an opportunity for hearing under part 16 of this chapter. (b) Request for hearing on withdrawal. No later than 10 business days after the date of issuance of a withdrawal of accreditation of a third-party certification body under § 1.664, an individual authorized to act on the third-party certification body's behalf may submit a request for a regulatory hearing on the withdrawal under part 16 of this chapter. The issuance of withdrawal under § 1.664 will contain all of the elements required by § 16.22 of this chapter and will thereby constitute the notice of opportunity of hearing under part 16 of this chapter. (c) Submission of request for regulatory hearing. The request for a regulatory hearing under paragraph (a) or (b) of this section must be submitted with a written appeal that responds to the basis for the FDA decision, as described in the issuance of revocation or withdrawal, as appropriate, and includes any supporting information upon which the requestor is relying. The request, appeal, and supporting information must be submitted in English to the address specified in the notice and must comply with the procedures it describes. (d) Effect of submission of request on FDA decision. The submission of a request for a regulatory hearing under paragraph (a) or (b) of this section will not operate to delay or stay the effect of a decision by FDA to revoke recognition of an accreditation body or to withdraw accreditation of a third-party certification body unless FDA determines that a delay or a stay is in the public interest. (e) Presiding officer. The presiding officer for a regulatory hearing for a revocation or withdrawal under this subpart will be designated after a request for a regulatory hearing is submitted to FDA. (f) Denial of a request for regulatory hearing. The presiding officer may deny a request for regulatory hearing for a revocation or withdrawal under § 16.26(a) of this chapter when no genuine or substantial issue of fact has been raised. (g) Conduct of regulatory hearing. (1) If the presiding officer grants a request for a regulatory hearing for a revocation or withdrawal, the hearing will be held within 10 business days after the date the request was filed or, if applicable, within a timeframe agreed upon in writing by requestor, the presiding officer, and FDA. (2) The presiding officer must conduct the regulatory hearing for revocation or withdrawal under part 16 of this chapter, except that, under § 16.5(b) of this chapter, such procedures apply only to the extent that the procedures are supplementary and do not conflict with the procedures specified for regulatory hearings under this subpart. Accordingly, the following requirements of part 16 are inapplicable to regulatory hearings under this subpart: § 16.22 (Initiation of a regulatory hearing); § 16.24(e) (timing) and (f) (contents of notice); § 16.40 (Commissioner); § 16.60(a) (public process); § 16.95(b) (administrative decision and record for decision); and § 16.119 (Reconsideration and stay of action). (3) A decision by the presiding officer to affirm the revocation of recognition or the withdrawal of accreditation is considered a final agency action under 5 U.S.C. 702.

21 C.F.R. § 1.694 Are electronic records created under this subpart subject to the electronic records requirements of part 11 of this chapter?

Records that are established or maintained to satisfy the requirements of this subpart and that meet the definition of electronic records in § 11.3(b)(6) of this chapter are exempt from the requirements of part 11 of this chapter. Records that satisfy the requirements of this subpart, but that also are required under other applicable statutory provisions or regulations, remain subject to part 11 of this chapter.

21 C.F.R. § 1.695 Are the records obtained by FDA under this subpart subject to public disclosure?

Records obtained by FDA under this subpart are subject to the disclosure requirements under part 20 of this chapter.

21 C.F.R. § 1.700 Who is subject to a user fee under this subpart?

(a) Accreditation bodies submitting applications or renewal applications for recognition in the third-party certification program; (b) Recognized accreditation bodies participating in the third-party certification program; (c) Third-party certification bodies submitting applications or renewal applications for direct accreditation; and (d) Accredited third-party certification bodies (whether accredited by recognized accreditation bodies or by FDA through direct accreditation) participating in the third-party certification program.

21 C.F.R. § 1.705 What user fees are established under this subpart?

(a) The following application fees: (1) Accreditation bodies applying for recognition are subject to an application fee for the estimated average cost of the work FDA performs in reviewing and evaluating applications for recognition of accreditation bodies. (2) Recognized accreditation bodies submitting renewal applications are subject to a renewal application fee for the estimated average cost of the work FDA performs in reviewing and evaluating renewal applications for recognition of accreditation bodies. (3) Third-party certification bodies applying for direct accreditation are subject to an application fee for the estimated average cost of the work FDA performs in reviewing and evaluating applications for direct accreditation. (4) Accredited third-party certification bodies applying for renewal of direct accreditation are subject to an application fee for the estimated average cost of the work FDA performs in reviewing and evaluating renewal applications for direct accreditation. (b) The following annual fees: (1) Recognized accreditation bodies are subject to an annual fee for the estimated average cost of the work FDA performs to monitor performance of recognized accreditation bodies under § 1.633. (2) Third-party certification bodies directly accredited by FDA are subject to an annual fee for the estimated average cost of the work FDA performs to monitor directly accredited third-party certification bodies under § 1.662. (3) Third-party certification bodies accredited by recognized accreditation bodies are subject to an annual fee for the estimated average cost of the work FDA performs to monitor third-party certification bodies that are accredited by a recognized accreditation body under § 1.662.

21 C.F.R. § 1.710 How will FDA notify the public about the fee schedule?

FDA will notify the public of the fee schedule annually. The fee notice will be made publicly available prior to the beginning of the fiscal year for which the fees apply, except for the first fiscal year in which this regulation is effective. Each new fee schedule will be adjusted for inflation and improvements in the estimates of the cost to FDA of performing relevant work for the upcoming year.

21 C.F.R. § 1.715 When must a user fee required by this subpart be submitted?

(a) Accreditation bodies applying for recognition and third-party certification bodies applying for direct accreditation must submit a fee concurrently with submitting an application or a renewal application. (b) Accreditation bodies and third-party certification bodies subject to an annual fee must submit payment within 30 days of receiving billing for the fee.

21 C.F.R. § 1.720 Are user fees under this subpart refundable?

User fees accompanying completed applications and annual fees under this subpart are not refundable.

21 C.F.R. § 1.725 What are the consequences of not paying a user fee under this subpart on time?

(a) An application for recognition or renewal of recognition will not be considered complete for the purposes of § 1.631(a) until the date that FDA receives the application fee. An application for direct accreditation or for renewal of direct accreditation will not be considered complete for the purposes of § 1.671(a) until FDA receives the application fee. (b) A recognized accreditation body that fails to submit its annual user fee within 30 days of the due date will have its recognition suspended. (1) FDA will notify the accreditation body electronically that its recognition is suspended. FDA will notify the public of the suspension on the Web site described in § 1.690. (2) While an accreditation body's recognition is suspended, the accreditation body will not be able to accredit additional third-party certification bodies. The accreditation of third-party certification bodies that occurred prior to an accreditation body's suspension, as well as food or facility certifications issued by such third-party certification bodies, would remain in effect. (3) If payment is not received within 90 days of the payment due date, FDA will revoke the accreditation body's recognition under § 1.634(a)(4)(iii), and provide notice of such revocation in accordance with § 1.634. (c) An accredited third-party certification body that fails to submit its annual fee within 30 days of the due date will have its accreditation suspended. (1) FDA will notify the third-party certification body that its accreditation is suspended, electronically and in English. FDA will notify a recognized accreditation body, electronically and in English, if the accreditation of one if its third-party certification bodies is suspended. FDA will notify the public of the suspension on the Web site described in § 1.690. (2) While a third-party certification body's accreditation is suspended, the third-party certification body will not be able to issue food or facility certifications. A food or facility certification issued by a third-party certification body prior to the suspension of the auditor/certification body accreditation will remain in effect. (3) If payment is not received within 90 days of the payment due date, FDA will withdraw the third-party certification body's accreditation under § 1.664(a)(4), and provide notice of such withdrawal in accordance with § 1.664.

21 C.F.R. § 1.610 Who is eligible to seek recognition?

An accreditation body is eligible to seek recognition by FDA if it can demonstrate that it meets the requirements of §§ 1.611 through 1.615. The accreditation body may use documentation of conformance with International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17011:2004, supplemented as necessary, in meeting the applicable requirements of this subpart.

21 C.F.R. § 1.611 What legal authority must an accreditation body have to qualify for recognition?

(a) An accreditation body seeking recognition must demonstrate that it has the authority (as a governmental entity or as a legal entity with contractual rights) to perform assessments of a third-party certification body as are necessary to determine its capability to conduct audits and certify food facilities and food, including authority to: (1) Review any relevant records; (2) Conduct onsite assessments of the performance of third-party certification bodies, such as by witnessing the performance of a representative sample of its agents (or, in the case of a third-party certification body that is an individual, such individual) conducting a representative sample of audits; (3) Perform any reassessments or surveillance necessary to monitor compliance of accredited third-party certification bodies; and (4) Suspend, withdraw, or reduce the scope of accreditation for failure to comply with the requirements of accreditation. (b) An accreditation body seeking recognition must demonstrate that it is capable of exerting the authority (as a governmental entity or as a legal entity with contractual rights) necessary to meet the applicable requirements of this subpart, if recognized.

21 C.F.R. § 1.612 What competency and capacity must an accreditation body have to qualify for recognition?

An accreditation body seeking recognition must demonstrate that it has: (a) The resources required to adequately implement its accreditation program, including: (1) Adequate numbers of employees and other agents with relevant knowledge, skills, and experience to effectively evaluate the qualifications of third-party certification bodies seeking accreditation and to effectively monitor the performance of accredited third-party certification bodies; and (2) Adequate financial resources for its operations; and (b) The capability to meet the applicable assessment and monitoring requirements, the reporting and notification requirements, and the procedures of this subpart, if recognized.

21 C.F.R. § 1.613 What protections against conflicts of interest must an accreditation body have to qualify for recognition?

An accreditation body must demonstrate that it has: (a) Implemented written measures to protect against conflicts of interest between the accreditation body (and its officers, employees, and other agents involved in accreditation activities) and any third-party certification body (and its officers, employees, and other agents involved in auditing and certification activities) seeking accreditation from, or accredited by, such accreditation body; and (b) The capability to meet the applicable conflict of interest requirements of this subpart, if recognized.

21 C.F.R. § 1.614 What quality assurance procedures must an accreditation body have to qualify for recognition?

An accreditation body seeking recognition must demonstrate that it has: (a) Implemented a written program for monitoring and evaluating the performance of its officers, employees, and other agents and its accreditation program, including procedures to: (1) Identify areas in its accreditation program or performance where deficiencies exist; and (2) Quickly execute corrective actions that effectively address deficiencies when identified; and (b) The capability to meet the applicable quality assurance requirements of this subpart, if recognized.

21 C.F.R. § 1.615 What records procedures must an accreditation body have to qualify for recognition?

An accreditation body seeking recognition must demonstrate that it has: (a) Implemented written procedures to establish, control, and retain records (including documents and data) for the period of time necessary to meet its contractual and legal obligations pertaining to this subpart and to provide an adequate basis for evaluating its program and performance; and (b) The capability to meet the applicable reporting and notification requirements of this subpart, if recognized.

21 C.F.R. § 1.650 How must an accredited third-party certification body ensure its audit agents are competent and objective?

(a) An accredited third-party certification body that uses audit agents to conduct food safety audits must ensure that each such audit agent meets the following requirements with respect to the scope of its accreditation under this subpart. If the accredited third-party certification body is an individual, that individual is also subject to the following requirements, as applicable: (1) Has relevant knowledge and experience that provides an adequate basis for the audit agent to evaluate compliance with applicable food safety requirements of the FD&C Act and FDA regulations and, for consultative audits, also includes conformance with applicable industry standards and practices; (2) Has been determined by the accredited third-party certification body, through observations of a representative sample of audits, to be competent to conduct food safety audits under this subpart relevant to the audits they will be assigned to perform; (3) Has completed annual food safety training that is relevant to activities conducted under this subpart; (4) Is in compliance with the conflict of interest requirements of § 1.657 and has no other conflicts of interest with the eligible entity to be audited that might impair the audit agent's objectivity; and (5) Agrees to notify its accredited third-party certification body immediately upon discovering, during a food safety audit, any condition that could cause or contribute to a serious risk to the public health. (b) In assigning an audit agent to conduct a food safety audit at a particular eligible entity, an accredited third-party certification body must determine that the audit agent is qualified to conduct such audit under the criteria established in paragraph (a) of this section and based on the scope and purpose of the audit and the type of facility, its process(es), and food. (c) An accredited third-party certification body cannot use an audit agent to conduct a regulatory audit at an eligible entity if such audit agent conducted a consultative audit or regulatory audit for the same eligible entity in the preceding 13 months, except that such limitation may be waived if the accredited third-party certification body demonstrates to FDA, under § 1.663, there is insufficient access to audit agents in the country or region where the eligible entity is located. If the accredited third-party certification body is an individual, that individual is also subject to such limitations.

21 C.F.R. § 1.651 How must an accredited third-party certification body conduct a food safety audit of an eligible entity?

(a) Audit planning. Before beginning to conduct a food safety audit under this subpart, an accredited third-party certification body must: (1) Require the eligible entity seeking a food safety audit to: (i) Identify the scope and purpose of the food safety audit, including the facility, process(es), or food to be audited; whether the food safety audit is to be conducted as a consultative or regulatory audit subject to the requirements of this subpart, and if a regulatory audit, the type(s) of certification(s) sought; and (ii) Provide a 30-day operating schedule for such facility that includes information relevant to the scope and purpose of the audit; and (2) Determine whether the requested audit is within its scope of accreditation. (b) Authority to audit. In arranging a food safety audit with an eligible entity under this subpart, an accredited third-party certification body must ensure it has authority, whether contractual or otherwise, to: (1) Conduct an unannounced audit to determine whether the facility, process(es), and food of the eligible entity (within the scope of the audit) comply with the applicable food safety requirements of the FD&C Act and FDA regulations and, for consultative audits, also includes conformance with applicable industry standards and practices; (2) Access any records and any area of the facility, process(es), and food of the eligible entity relevant to the scope and purpose of such audit; (3) When, for a regulatory audit, sampling and analysis is conducted, the accredited third-party certification body must use a laboratory that is accredited in accordance with ISO/IEC 17025:2017 to perform the analysis. (4) Notify FDA immediately if, at any time during a food safety audit, the accredited third-party certification body (or its audit agent, where applicable) discovers a condition that could cause or contribute to a serious risk to the public health and provide information required by § 1.656(c); (5) Prepare reports of audits conducted under this subpart as follows: (i) For consultative audits, prepare reports that contain the elements specified in § 1.652(a) and maintain such records, subject to FDA access in accordance with section 414 of the FD&C Act; and (ii) For regulatory audits, prepare reports that contain the elements specified in § 1.652(b) and submit them to FDA and to its recognized accreditation body (where applicable) under § 1.656(a); and (6) Allow FDA and the recognized accreditation body that accredited such third-party certification body, if any, to observe any food safety audit conducted under this subpart for purposes of evaluating the accredited third-party certification body's performance under §§ 1.621 and 1.662 or, where appropriate, the recognized accreditation body's performance under §§ 1.622 and 1.633. (c) Audit protocols. An accredited third-party certification body (or its audit agent, where applicable) must conduct a food safety audit in a manner consistent with the identified scope and purpose of the audit and within the scope of its accreditation. (1) With the exception of records review, which may be scheduled, the audit must be conducted without announcement during the 30-day timeframe identified under paragraph (a)(1)(ii) of this section and must be focused on determining whether the facility, its process(es), and food are in compliance with applicable food safety requirements of the FD&C Act and FDA regulations, and, for consultative audits, also includes conformance with applicable industry standards and practices that are within the scope of the audit. (2) The audit must include records review prior to the onsite examination; an onsite examination of the facility, its process(es), and the food that results from such process(es); and where appropriate or when required by FDA, environmental or product sampling and analysis. When, for a regulatory audit, sampling and analysis is conducted, the accredited third-party certification body must use a laboratory that is accredited in accordance with paragraph (b)(3) of this section to conduct the analysis. The audit may include any other activities necessary to determine compliance with applicable food safety requirements of the FD&C Act and FDA regulations, and, for consultative audits, also includes conformance with applicable industry standards and practices. (3) The audit must be sufficiently rigorous to allow the accredited third-party certification body to determine whether the eligible entity is in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, and for consultative audits, also includes conformance with applicable industry standards and practices, at the time of the audit; and for a regulatory audit, whether the eligible entity, given its food safety system and practices would be likely to remain in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations for the duration of any certification issued under this subpart. An accredited third-party certification body (or its audit agent, where applicable) that identifies a deficiency requiring corrective action may verify the effectiveness of a corrective action once implemented by the eligible entity but must not recommend or provide input to the eligible entity in identifying, selecting, or implementing the corrective action. (4) Audit observations and other data and information from the examination, including information on corrective actions, must be documented and must be used to support the findings contained in the audit report required by § 1.652 and maintained as a record under § 1.658.

21 C.F.R. § 1.652 What must an accredited third-party certification body include in food safety audit reports?

(a) Consultative audits. An accredited third-party certification body must prepare a report of a consultative audit not later than 45 days after completing such audit and must provide a copy of such report to the eligible entity and must maintain such report under § 1.658, subject to FDA access in accordance with the requirements of section 414 of the FD&C Act. A consultative audit report must include: (1) The identity of the site or location where the consultative audit was conducted, including: (i) The name, address and the FDA Establishment Identifier of the facility subject to the consultative audit and a unique facility identifier, if designated by FDA; and (ii) Where applicable, the FDA registration number assigned to the facility under subpart H of this part; (2) The identity of the eligible entity, if different from the facility, including the name, address, the FDA Establishment Identifier and unique facility identifier, if designated by FDA, and, where applicable, registration number under subpart H of this part; (3) The name(s) and telephone number(s) of the person(s) responsible for compliance with the applicable food safety requirements of the FD&C Act and FDA regulations (4) The dates and scope of the consultative audit; (5) The process(es) and food(s) observed during such consultative audit; and (6) Any deficiencies observed that relate to or may influence a determination of compliance with the applicable food safety requirements of the FD&C Act and FDA regulations that require corrective action, the corrective action plan, and the date on which such corrective actions were completed. Such consultative audit report must be maintained as a record under § 1.658 and must be made available to FDA in accordance with section 414 of the FD&C Act. (b) Regulatory audits. An accredited third-party certification body must, no later than 45 days after completing a regulatory audit, prepare and submit electronically, in English, to FDA and to its recognized accreditation body (or, in the case of direct accreditation, only to FDA) and must provide to the eligible entity a report of such regulatory audit that includes the following information: (1) The identity of the site or location where the regulatory audit was conducted, including: (i) The name, address, and FDA Establishment Identifier of the facility subject to the regulatory audit and a unique facility identifier, if designated by FDA; and (ii) Where applicable, the FDA registration number assigned to the facility under subpart H of this part; (2) The identity of the eligible entity, if different from the facility, including the name, address, FDA Establishment Identifier, and unique facility identifier, if designated by FDA, and, where applicable, registration number under subpart H of this part; (3) The dates and scope of the regulatory audit; (4) The process(es) and food(s) observed during such regulatory audit; (5) The name(s) and telephone number(s) of the person(s) responsible for the facility's compliance with the applicable food safety requirements of the FD&C Act and FDA regulations; (6) Any deficiencies observed during the regulatory audit that present a reasonable probability that the use of or exposure to a violative product: (i) Will cause serious adverse health consequences or death to humans and animals; or (ii) May cause temporary or medically reversible adverse health consequences or where the probability of serious adverse health consequences or death to humans or animals is remote; (7) The corrective action plan for addressing each deficiency identified under paragraph (b)(6) of this section, unless corrective action was implemented immediately and verified onsite by the accredited third-party certification body (or its audit agent, where applicable); (8) Whether any sampling and laboratory analysis (e.g., under a microbiological sampling plan) is performed in or used by the facility; and (9) Whether the eligible entity has made significant changes to the facility, its process(es), or food products during the 2 years preceding the regulatory audit. (c) Submission of regulatory audit report. An accredited third-party certification body must submit a completed regulatory audit report as required by paragraph (b) of this section, regardless of whether the certification body issued a food or facility certification to the eligible entity. (d) Notice and appeals of adverse regulatory audit results. An accredited third-party certification body must notify an eligible entity of a denial of certification and must establish and implement written procedures for receiving and addressing appeals from eligible entities challenging such adverse regulatory audit results and for investigating and deciding on appeals in a fair and meaningful manner. The appeals procedures must provide similar protections to those offered by FDA under §§ 1.692 and 1.693, including requirements to: (1) Make the appeals procedures publicly available; (2) Use competent persons, who may or may not be external to the accredited third-party certification body, who are free from bias or prejudice and have not participated in the certification decision or be subordinate to a person who has participated in the certification decision, to investigate and decide appeals; (3) Advise the eligible entity of the final decision on its appeal; and (4) Maintain records under § 1.658 of the appeal, the final decision, and the basis for such decision.

21 C.F.R. § 1.653 What must an accredited third-party certification body do when issuing food or facility certifications?

(a) Basis for issuance of a food or facility certification. (1) Prior to issuing a food or facility certification to an eligible entity, an accredited third-party certification body (or, where applicable, an audit agent on its behalf) must complete a regulatory audit that meets the requirements of § 1.651 and any other activities that may be necessary to determine compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. (2) If, as a result of an observation during a regulatory audit, an eligible entity must implement a corrective action plan to address a deficiency, an accredited third-party certification body may not issue a food or facility certification to such entity until after the accredited third-party certification body verifies that eligible entity has implemented the corrective action plan through methods that reliably verify the corrective action was taken and as a result the identified deficiency is unlikely to recur, except onsite verification is required for corrective actions required to address deficiencies that are the subject of a notification under § 1.656(c). (3) An accredited third-party certification body must consider each observation and the data and other information from a regulatory audit and other activities conducted under § 1.651 to determine whether the entity was in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations at the time of the audit and whether the eligible entity, given its food safety system and practices, would be likely to remain in compliance for the duration of any certification issued under this subpart. (4) A single regulatory audit may result in issuance of one or more food or facility certifications under this subpart, provided that the requirements of issuance are met as to each such certification. (5) Where an accredited third-party certification body uses an audit agent to conduct a regulatory audit of an eligible entity under this subpart, the accredited third-party certification body (and not the audit agent) must make the determination whether to issue a food or facility certification based on the results of such regulatory audit. (b) Issuance of a food or facility certification and submission to FDA. (1) Any food or facility certification issued under this subpart must be submitted to FDA electronically and in English. The accredited third-party certification body may issue a food or facility certification under this subpart for a term of up to 12 months. (2) A food or facility certification must contain, at a minimum, the following elements: (i) The name and address of the accredited third-party certification body and the scope and date of its accreditation under this subpart; (ii) The name, address, FDA Establishment Identifier, and unique facility identifier, if designated by FDA, of the eligible entity to which the food or facility certification was issued; (iii) The name, address, FDA Establishment Identifier, and unique facility identifier, if designated by FDA, of the facility where the regulatory audit was conducted, if different than the eligible entity; (iv) The scope and date(s) of the regulatory audit and the certification number; (v) The name of the audit agent(s) (where applicable) conducting the regulatory audit; and (vi) The scope of the food or facility certification, date of issuance, and date of expiration. (3) FDA may refuse to accept any certification for purposes of section 801(q) or 806 of the FD&C Act, if FDA determines, that such food or facility certification is not valid or reliable because, for example: (i) The certification is offered in support of the admissibility of a food that was not within the scope of the certification; (ii) The certification was issued by an accredited third-party certification body acting outside the scope of its accreditation under this subpart; or (iii) The certification was issued without reliable demonstration that the requirements of paragraph (a) of this section were met.

21 C.F.R. § 1.654 When must an accredited third-party certification body monitor an eligible entity that it has issued a food or facility certification?

If an accredited third-party certification body has reason to believe that an eligible entity to which it issued a food or facility certification may no longer be in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations, the accredited third-party certification body must conduct any monitoring (including an onsite audit) of such eligible entity necessary to determine whether the entity is in compliance with such requirements. The accredited third-party certification body must immediately notify FDA, under § 1.656(d), if it withdraws or suspends a food or facility certification because it determines that the entity is no longer in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations. The accredited third-party certification body must maintain records of such monitoring under § 1.658.

21 C.F.R. § 1.655 How must an accredited third-party certification body monitor its own performance?

(a) An accredited third-party certification body must annually, upon FDA request made for cause, or as required under § 1.631(f)(1)(i), § 1.634(d)(1)(i), or § 1.635(c)(1)(i), conduct a self-assessment that includes evaluation of compliance with this subpart, including: (1) The performance of its officers, employees, or other agents involved in auditing and certification activities, including the performance of audit agents in examining facilities, process(es), and food using the applicable food safety requirements of the FD&C Act and FDA regulations; (2) The degree of consistency among its officers, employees, or other agents involved in auditing and certification activities, including evaluating whether its audit agents interpreted audit protocols in a consistent manner; (3) The compliance of the accredited third-party certification body and its officers, employees, and other agents involved in auditing and certification activities, with the conflict of interest requirements of § 1.657; (4) Actions taken in response to the results of any assessments conducted by FDA or, where applicable, the recognized accreditation body under § 1.621; and (5) As requested by FDA, any other aspects of its performance relevant to a determination of whether the accredited third-party certification body is in compliance with this subpart. (b) As a means to assess its performance, the accredited third-party certification body may evaluate the compliance of one or more of eligible entities to which a food or facility certification was issued under this subpart. (c) Based on the assessments and evaluations conducted under paragraphs (a) and (b) of this section, the accredited third-party certification body must: (1) Identify any deficiencies in complying with the requirements of this subpart; (2) Quickly implement corrective action(s) that effectively address the identified deficiencies; and (3) Under § 1.658, establish and maintain records of such corrective action(s). (d) The accredited third-party certification body must prepare a written report of the results of its self-assessment that includes: (1) A description of any corrective action(s) taken under paragraph (c) of this section; (2) A statement disclosing the extent to which the accredited third-party certification body, and its officers, employees, and other agents involved in auditing and certification activities, complied with the conflict of interest requirements in § 1.657; and (3) A statement attesting to the extent to which the accredited third-party certification body complied with the applicable requirements of this subpart. (e) An accredited third-party certification body may use a report, supplemented as necessary, on its conformance to ISO/IEC 17021: 2011 or ISO/IEC 17065: 2012 in meeting the requirements of this section.

21 C.F.R. § 1.656 What reports and notifications must an accredited third-party certification body submit?

(a) Reporting results of regulatory audits. An accredited third-party certification body must submit a regulatory audit report, as described in § 1.652(b), electronically, in English, to FDA and to the recognized accreditation body that granted its accreditation (where applicable), no later than 45 days after completing such audit. (b) Reporting results of accredited third-party certification body self-assessments. An accredited third-party certification body must submit the report of its annual self-assessment required by § 1.655 electronically to its recognized accreditation body (or, in the case of direct accreditation, electronically and in English, to FDA), within 45 days of the anniversary date of its accreditation under this subpart. For an accredited third-party certification body subject to an FDA request for cause, or § 1.631(f)(1)(i), § 1.634(d)(1)(i), or § 1.635(c)(1)(i), the report of its self-assessment must be submitted to FDA electronically, in English, within 60 days of the FDA request, denial of renewal, revocation, or relinquishment of recognition of the accreditation body that granted its accreditation. Such report must include an up-to-date list of any audit agents it uses to conduct audits under this subpart. (c) Notification to FDA of a serious risk to public health. An accredited third-party certification body must immediately notify FDA electronically, in English, if during a regulatory or consultative audit, any of its audit agents or the accredited third-party certification body itself discovers a condition that could cause or contribute to a serious risk to the public health, providing the following information: (1) The name, physical address, and unique facility identifier, if designated by FDA, of the eligible entity subject to the audit, and, where applicable, the registration number under subpart H of this part; (2) The name, physical address, and unique facility identifier, if designated by FDA, of the facility where the condition was discovered (if different from that of the eligible entity) and, where applicable, the registration number assigned to the facility under subpart H of this part; and (3) The condition for which notification is submitted. (d) Immediate notification to FDA of withdrawal or suspension of a food or facility certification. An accredited third-party certification body must notify FDA electronically, in English, immediately upon withdrawing or suspending any food or facility certification of an eligible entity and the basis for such action. (e) Notification to its recognized accreditation body or an eligible entity. (1) After notifying FDA under paragraph (c) of this section, an accredited third-party certification body must immediately notify the eligible entity of such condition and must immediately thereafter notify the recognized accreditation body that granted its accreditation, except for third-party certification bodies directly accredited by FDA. Where feasible and reliable, the accredited third-party certification body may contemporaneously notify its recognized accreditation body and/or the eligible entity when notifying FDA. (2) An accredited third-party certification body must notify its recognized accreditation body (or, in the case of direct accreditation, FDA) electronically, in English, within 30 days after making any significant change that would affect the manner in which it complies with the requirements of this subpart and must include with such notification the following information: (i) A description of the change; and (ii) An explanation for the purpose of the change.

21 C.F.R. § 1.657 How must an accredited third-party certification body protect against conflicts of interest?

(a) An accredited third-party certification body must implement a written program to protect against conflicts of interest between the accredited third-party certification body (and its officers, employees, and other agents involved in auditing and certification activities) and an eligible entity seeking a food safety audit or food or facility certification from, or audited or certified by, such accredited third-party certification body, including the following: (1) Ensuring that the accredited third-party certification body and its officers, employees, or other agents involved in auditing and certification activities do not own, operate, have a financial interest in, manage, or otherwise control an eligible entity to be certified, or any affiliate, parent, or subsidiary of the entity; (2) Ensuring that the accredited third-party certification body and, its officers, employees, or other agents involved in auditing and certification activities are not owned, managed, or controlled by any person that owns or operates an eligible entity to be certified; (3) Ensuring that an audit agent of the accredited third-party certification body does not own, operate, have a financial interest in, manage, or otherwise control an eligible entity or any affiliate, parent, or subsidiary of the entity that is subject to a consultative or regulatory audit by the audit agent; and (4) Prohibiting an accredited third-party certification body's officer, employee, or other agent involved in auditing and certification activities from accepting any money, gift, gratuity, or other item of value from the eligible entity to be audited or certified under this subpart. (5) The items specified in paragraph (a)(4) of this section do not include: (i) Money representing payment of fees for auditing and certification services and reimbursement of direct costs associated with an onsite audit by the third-party certification body; or (ii) Lunch of de minimis value provided during the course of an audit and on the premises where the audit is conducted, if necessary to facilitate the efficient conduct of the audit. (b) An accredited third-party certification body may accept the payment of fees for auditing and certification services and the reimbursement of direct costs associated with an audit of an eligible entity only after the date on which the report of such audit was completed or the date a food or facility certification was issued, whichever is later. Such payment is not considered a conflict of interest for purposes of paragraph (a) of this section. (c) The financial interests of the spouses and children younger than 18 years of age of accredited third-party certification body's officers, employees, and other agents involved in auditing and certification activities will be considered the financial interests of such officers, employees, and other agents involved in auditing and certification activities. (d) An accredited third-party certification body must maintain on its Web site an up-to-date list of the eligible entities to which it has issued food or facility certifications under this subpart. For each such eligible entity, the Web site also must identify the duration and scope of the food or facility certification and date(s) on which the eligible entity paid the accredited third-party certification body any fee or reimbursement associated with such audit or certification.

21 C.F.R. § 1.658 What records requirements must a third-party certification body that has been accredited meet?

(a) A third-party certification body that has been accredited must maintain electronically for 4 years records created during its period of accreditation (including documents and data) that document compliance with this subpart, including: (1) Any audit report and other documents resulting from a consultative audit conducted under this subpart, including the audit agent's observations, correspondence with the eligible entity, verification of any corrective action(s) taken to address deficiencies identified during the audit; (2) Any request for a regulatory audit from an eligible entity; (3) Any audit report and other documents resulting from a regulatory audit conducted under this subpart, including the audit agent's observations, correspondence with the eligible entity, verification of any corrective action(s) taken to address deficiencies identified during the audit, and, when sampling and analysis is conducted, laboratory testing records and results from a laboratory that is accredited in accordance with § 1.651(b)(3), and documentation demonstrating such laboratory is accredited in accordance with § 1.651(b)(3); (4) Any notification submitted by an audit agent to the accredited third-party certification body in accordance with § 1.650(a)(5); (5) Any challenge to an adverse regulatory audit decision and the disposition of the challenge; (6) Any monitoring it conducted of an eligible entity to which food or facility certification was issued; (7) Its self-assessments and corrective actions taken to address any deficiencies identified during a self-assessment; and (8) Significant changes to its auditing or certification program that might affect compliance with this subpart. (b) An accredited third-party certification body must make the records of a consultative audit required by paragraph (a)(1) of this section available to FDA in accordance with section 414 of the FD&C Act. (c) An accredited third-party certification body must make the records required by paragraphs (a)(2) through (8) of this section available for inspection and copying promptly upon written request of an authorized FDA officer or employee at the place of business of the accredited third-party certification body or at a reasonably accessible location. If such records are requested by FDA electronically, the records must be submitted electronically not later than 10 business days after the date of the request. Additionally, if the records are maintained in a language other than English, an accredited third-party certification body must electronically submit an English translation within a reasonable time.

21 C.F.R. § 1.600 What definitions apply to this subpart?

(a) The FD&C Act means the Federal Food, Drug, and Cosmetic Act. (b) Except as otherwise defined in paragraph (c) of this section, the definitions of terms in section 201 of the FD&C Act apply when the terms are used in this subpart. (c) In addition, for the purposes of this subpart: Accreditation means a determination by a recognized accreditation body (or, in the case of direct accreditation, by FDA) that a third-party certification body meets the applicable requirements of this subpart. Accreditation body means an authority that performs accreditation of third-party certification bodies. Accredited third-party certification body means a third-party certification body that a recognized accreditation body (or, in the case of direct accreditation, FDA) has determined meets the applicable requirements of this subpart and is accredited to conduct food safety audits and to issue food or facility certifications to eligible entities. An accredited third-party certification body has the same meaning as accredited third-party auditor as defined in section 808(a)(4) of the FD&C Act. Assessment means: (i) With respect to an accreditation body, an evaluation by FDA of the competency and capacity of the accreditation body under the applicable requirements of this subpart for the defined scope of recognition. An assessment of the competency and capacity of the accreditation body involves evaluating the competency and capacity of the operations of the accreditation body that are relevant to decisions on recognition and, if recognized, an evaluation of its performance and the validity of its accreditation decisions under the applicable requirements of this subpart. (ii) With respect to a third-party certification body, an evaluation by a recognized accreditation body (or, in the case of direct accreditation, FDA) of the competency and capacity of a third-party certification body under the applicable requirements of this subpart for the defined scope of accreditation. An assessment of the competency and capacity of the third-party certification body involves evaluating the competency and capacity of the operations of the third-party certification body that are relevant to decisions on accreditation and, if accredited, an evaluation of its performance and the validity of its audit results and certification decisions under the applicable requirements of this subpart. Audit means the systematic and functionally independent examination of an eligible entity under this subpart by an accredited third-party certification body or by FDA. An audit conducted under this subpart is not considered an inspection under section 704 of the FD&C Act. Audit agent means an individual who is an employee or other agent of an accredited third-party certification body who, although not individually accredited, is qualified to conduct food safety audits on behalf of an accredited third-party certification body. An audit agent includes a contractor of the accredited third-party certification body but excludes subcontractors or other agents under outsourcing arrangements for conducting food safety audits without direct control by the accredited third-party certification body. Consultative audit means an audit of an eligible entity: (i) To determine whether such entity is in compliance with the applicable food safety requirements of the FD&C Act, FDA regulations, and industry standards and practices; (ii) The results of which are for internal purposes only; and (iii) That is conducted in preparation for a regulatory audit; only the results of a regulatory audit may form the basis for issuance of a food or facility certification under this subpart. Direct accreditation means accreditation of a third-party certification body by FDA. Eligible entity means a foreign entity in the import supply chain of food for consumption in the United States that chooses to be subject to a food safety audit under this subpart conducted by an accredited third-party certification body. Eligible entities include foreign facilities required to be registered under subpart H of this part. Facility means any structure, or structures of an eligible entity under one ownership at one general physical location, or, in the case of a mobile facility, traveling to multiple locations, that manufactures/processes, packs, holds, grows, harvests, or raises animals for food for consumption in the United States. Transport vehicles are not facilities if they hold food only in the usual course of business as carriers. A facility may consist of one or more contiguous structures, and a single building may house more than one distinct facility if the facilities are under separate ownership. The private residence of an individual is not a facility. Non-bottled water drinking water collection and distribution establishments and their structures are not facilities. Facilities for the purposes of this subpart are not limited to facilities required to be registered under subpart H of this part. Facility certification means an attestation, issued for purposes of section 801(q) or 806 of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish whether a facility complies with the applicable food safety requirements of the FD&C Act and FDA regulations. Food has the meaning given in section 201(f) of the FD&C Act, except that food does not include pesticides (as defined in 7 U.S.C. 136(u)). Food certification means an attestation, issued for purposes of section 801(q) of the FD&C Act by an accredited third-party certification body, after conducting a regulatory audit and any other activities necessary to establish whether a food of an eligible entity complies with the applicable food safety requirements of the FD&C Act and FDA regulations. Food safety audit means a regulatory audit or a consultative audit that is conducted to determine compliance with the applicable food safety requirements of the FD&C Act, FDA regulations, and for consultative audits, also includes conformance with industry standards and practices. An eligible entity must declare that an audit is to be conducted as a regulatory audit or consultative audit at the time of audit planning and the audit will be conducted on an unannounced basis under this subpart. Foreign cooperative means an autonomous association of persons, identified as members, who are united through a jointly owned enterprise to aggregate food from member growers or processors that is intended for export to the United States. Recognized accreditation body means an accreditation body that FDA has determined meets the applicable requirements of this subpart and is authorized to accredit third-party certification bodies under this subpart. Regulatory audit means an audit of an eligible entity: (i) To determine whether such entity is in compliance with the applicable food safety requirements of the FD&C Act and FDA regulations; and (ii) The results of which are used in determining eligibility for certification under section 801(q) or under section 806 of the FD&C Act. Relinquishment means: (i) With respect to an accreditation body, a decision to cede voluntarily its authority to accredit third-party certification bodies as a recognized accreditation body prior to expiration of its recognition under this subpart; and (ii) With respect to a third-party certification body, a decision to cede voluntarily its authority to conduct food safety audits and to issue food and facility certifications to eligible entities as an accredited third-party certification body prior to expiration of its accreditation under this subpart. Self-assessment means an evaluation conducted by a recognized accreditation body or by an accredited third-party certification body of its competency and capacity under the applicable requirements of this subpart for the defined scope of recognition or accreditation. For recognized accreditation bodies this involves evaluating the competency and capacity of the entire operations of the accreditation body and the validity of its accreditation decisions under the applicable requirements of this subpart. For accredited third-party certification bodies this involves evaluating the competency and capacity of the entire operations of the third-party certification body and the validity of its audit results under the applicable requirements of this subpart. Third-party certification body has the same meaning as third-party auditor as that term is defined in section 808(a)(3) of the FD&C Act and means a foreign government, agency of a foreign government, foreign cooperative, or any other third party that is eligible to be considered for accreditation to conduct food safety audits and to certify that eligible entities meet the applicable food safety requirements of the FD&C Act and FDA regulations. A third-party certification body may be a single individual or an organization. Once accredited, a third-party certification body may use audit agents to conduct food safety audits.

21 C.F.R. § 1.601 Who is subject to this subpart?

(a) Accreditation bodies. Any accreditation body seeking recognition from FDA to accredit third-party certification bodies to conduct food safety audits and to issue food and facility certifications under this subpart. (b) Third-party certification bodies. Any third-party certification body seeking accreditation from a recognized accreditation body or direct accreditation by FDA for: (1) Conducting food safety audits; and (2) Issuing certifications that may be used in satisfying a condition of admissibility of an article of food under section 801(q) of the FD&C Act; or issuing a facility certification for meeting the eligibility requirements for the Voluntary Qualified Importer Program under section 806 of the FD&C Act. (c) Eligible entities. Any eligible entity seeking a food safety audit or a food or facility certification from an accredited third-party certification body under this subpart. (d) Limited exemptions from section 801(q) of the FD&C Act—(1) Alcoholic beverages. (i) Any certification required under section 801(q) of the FD&C Act does not apply with respect to alcoholic beverages from an eligible entity that is a facility that meets the following two conditions: (A) Under the Federal Alcohol Administration Act (27 U.S.C. 201 et seq.) or chapter 51 of subtitle E of the Internal Revenue Code of 1986 (26 U.S.C. 5001 et seq.), the facility is a foreign facility of a type that, if it were a domestic facility, would require obtaining a permit from, registering with, or obtaining approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States; and (B) Under section 415 of the FD&C Act, the facility is required to register as a facility because it is engaged in manufacturing/processing one or more alcoholic beverages. (ii) Any certification required under section 801(q) of the FD&C Act does not apply with respect to food that is not an alcoholic beverage that is received and distributed by a facility described in paragraph (d)(1)(i) of this section, provided such food: (A) Is received and distributed in prepackaged form that prevents any direct human contact with such food; and (B) Constitutes not more than 5 percent of the overall sales of the facility, as determined by the Secretary of the Treasury. (iii) Any certification required under section 801(q) of the FD&C Act does not apply with respect to raw materials or other ingredients that are imported for use in alcoholic beverages provided that: (A) The imported raw materials or other ingredients are used in the manufacturing/processing, packing, or holding of alcoholic beverages; (B) Such manufacturing/processing, packing, or holding is performed by the importer; (C) The importer is required to register under section 415 of the Federal Food, Drug, and Cosmetic Act; and (D) The importer is exempt from the regulations in part 117 of this chapter in accordance with § 117.5(i). (2) Certain meat, poultry, and egg products. Any certification required under section 801(q) of the FD&C Act does not apply with respect to: (i) Meat food products that at the time of importation are subject to the requirements of the United States Department of Agriculture (USDA) under the Federal Meat Inspection Act (21 U.S.C. 601 et seq.); (ii) Poultry products that at the time of importation are subject to the requirements of the USDA under the Poultry Products Inspection Act (21 U.S.C. 451 et seq.); and (iii) Egg products that at the time of importation are subject to the requirements of the USDA under the Egg Products Inspection Act (21 U.S.C. 1031 et seq.).

Source: eCFRURL: https://www.ecfr.gov/api/versioner/v1/full/2024-07-01/title-21.xmlFetched: 7/26/2026