What records requirements must a third-party certification body that has been accredited meet?
21 C.F.R. § 1.658
in effectEffective: 2024-07-01(a) A third-party certification body that has been accredited must maintain electronically for 4 years records created during its period of accreditation (including documents and data) that document compliance with this subpart, including:
(1) Any audit report and other documents resulting from a consultative audit conducted under this subpart, including the audit agent's observations, correspondence with the eligible entity, verification of any corrective action(s) taken to address deficiencies identified during the audit;
(2) Any request for a regulatory audit from an eligible entity;
(3) Any audit report and other documents resulting from a regulatory audit conducted under this subpart, including the audit agent's observations, correspondence with the eligible entity, verification of any corrective action(s) taken to address deficiencies identified during the audit, and, when sampling and analysis is conducted, laboratory testing records and results from a laboratory that is accredited in accordance with § 1.651(b)(3), and documentation demonstrating such laboratory is accredited in accordance with § 1.651(b)(3);
(4) Any notification submitted by an audit agent to the accredited third-party certification body in accordance with § 1.650(a)(5);
(5) Any challenge to an adverse regulatory audit decision and the disposition of the challenge;
(6) Any monitoring it conducted of an eligible entity to which food or facility certification was issued;
(7) Its self-assessments and corrective actions taken to address any deficiencies identified during a self-assessment; and
(8) Significant changes to its auditing or certification program that might affect compliance with this subpart.
(b) An accredited third-party certification body must make the records of a consultative audit required by paragraph (a)(1) of this section available to FDA in accordance with section 414 of the FD&C Act.
(c) An accredited third-party certification body must make the records required by paragraphs (a)(2) through (8) of this section available for inspection and copying promptly upon written request of an authorized FDA officer or employee at the place of business of the accredited third-party certification body or at a reasonably accessible location. If such records are requested by FDA electronically, the records must be submitted electronically not later than 10 business days after the date of the request. Additionally, if the records are maintained in a language other than English, an accredited third-party certification body must electronically submit an English translation within a reasonable time.
Source: eCFRURL: https://www.ecfr.gov/api/versioner/v1/full/2024-07-01/title-21.xmlFetched: 7/26/2026