Demand for food safety audits has surged in recent years in response to an increasingly complex global food supply chain and expanding market requirements for supplier verification. As mandated by the Food Safety Modernization Act (FSMA), new requirements for preventive controls and bolstering the safety of imported food were central themes of several regulations released by the U.S. Food and Drug Administration (FDA) within the past year.

Audits are highlighted as possible verification tools within several of the regulations, including the final rules for preventive controls for human and animal food, and the Foreign Supplier Verification Program (FSVP). The Accredited Third-Party Certification rule, on the other hand, is an auditing program with a different scope and intent. It is a voluntary program, which will accredit third-party certification bodies to perform food safety audits at foreign facilities and, if acceptable, issue certifications to these companies for the foods they produce for humans and animals. This rule is not applicable to companies located and producing products in the United States. It is applicable only to foreign companies and importers.

The role of audits within the FSMA regulations has generated many questions and sparked confusion within the food industry. The Accredited Third-Party Certification rule indicates a certification is obtained through a regulatory audit conducted by a third-party auditor/certification body accredited under FDA’s third-party accreditation regulations. While the Preventive Controls and FSVP rules refer to the use of “qualified auditors,” these rules do not require the use of accredited third-party auditors.[1,2] FDA supports “reliable” audits for produce, but to date, the agency has not defined the meaning of “reliable” in terms of produce safety audits.[3] Moreover, the FSMA rules have prompted numerous questions about the role of private food safety schemes, requirements for the use of an accredited certification body and the circumstances that would require a certification body to notify the FDA of a potential food safety risk.

The final rule for the accreditation of third-party certification bodies and related draft Model Accreditation Standards provide a structural framework for accreditation bodies and certification bodies (i.e., auditors) to ensure imported food and facilities comply with the standards of the Federal Food, Drug, and Cosmetic Act (FD&C Act) of 1938. Foreign suppliers will need to use accredited third-party certification bodies and obtain certifications for two reasons. The first and most common reason will be to establish eligibility to participate in the Voluntary Qualified Importer Program, known as VQIP, which offers an expedited review and entry of food into the United States. The second reason will be for certain cases for which FDA requires that a high-risk food offered for import is accompanied by a certification from an accredited third-party certification body.

Due to differences in notification and reporting requirements among the various FSMA rules using audits, it is important for companies to understand which types of audits can be used in various scenarios and to clearly identify this when requesting an audit. This article will provide an overview of the Accredited Third-Party Certification rule and discuss the role of auditing as referenced within other FSMA regulations.

Accredited Certification Bodies for Imports
According to recent government data, an estimated 114,000 foreign food facilities from approximately 200 countries export food to the United States. Currently, 19 percent of the U.S. food supply is imported. The growing number of foreign food facilities and increasing volume of imported food are extending an increasingly complex U.S. food supply chain. To address critical concerns about the safety of imported food, FSMA mandated the development of regulations to ensure that imported food meets the same U.S. food safety standards as domestically produced products.

The final rule, Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and to Issue Certifications, established a voluntary program for the accreditation of third-party certification bodies to conduct food safety audits and to issue certifications for foreign facilities and food.[4] FDA released the proposed rule in July 2013, and 2 years later issued draft guidance for Model Accreditation Standards to explain how the Accredited Third-Party Certification rule would function. The draft guidance is intended as a companion document for the rule and contains expectations for third-party auditor/certification body qualifications and incorporates relevant requirements from the rule itself.

The final rule, issued in November 2015, became effective in January 2016, but implementation will not occur until finalization and publication of the final Model Accreditation Standards guidance and the final rule on user fees. The latter, currently in draft format, establishes a fee-based program for accreditation and certification bodies participating in the program to reimburse FDA for its work in administering the voluntary third-party program.

Under this rule, FDA must recognize accreditation bodies for the accreditation of third-party certification bodies. Accreditation bodies can be a foreign government or private party. The agency requires accreditation bodies to comply with specific capabilities related to a legal authority to assess third-party certification bodies’ competency and capacity; protection against conflict of interest; quality assurance; and procedures for reports and records.

Accreditation bodies will evaluate third-party certification bodies for accreditation, monitor the performance of certification bodies, conduct self-assessments and submit reports and other notifications to FDA as stipulated by the final rule.

A certification body is defined by the rule as a foreign government, foreign cooperative or another third party such as a single individual or organization. The FDA program for the accreditation of third-party certification bodies will establish eligibility requirements for recognition as an accreditation body as well as eligibility requirements for accreditation as a third-party certification body. Again, this is a voluntary program for the accreditation of certification bodies to conduct food safety audits of foreign food facilities and food.

The requirements for third-party certification bodies accredited for the FDA program involve the following factors:

Competence and Capacity: A third-party certification body must have an adequate number of employees with relevant knowledge, skills and experience. The certification body must also demonstrate it has adequate financial resources for its operations.

Objectivity: The certification body must have written measures and other capabilities as defined in the rule to protect against conflicts of interest between itself, its auditors, its administrative personnel and its clients.

Quality Assurance: Third-party certification bodies must implement a written program for self-assessment of the performance of its employees involved in auditing and certification activities. This requires the identification of deficiencies and verification of corrective actions.

Record-keeping: Firms must implement written procedures to establish, control and retain records as necessary to comply with contractual and legal obligations.

FDA issued the draft Model Accreditation Standards in 2015 to provide a framework for the qualifications of third-party certification bodies. The draft also considers current practices and relevant sections of the standard ISO 17021:2011, Conformity Assessment – Requirements for Bodies Providing Audit and Certification Management Systems.

The draft standards defined a “certification body” as a “foreign government, agency of a foreign government, foreign cooperative or any other third party that is eligible to be considered for accreditation to conduct food safety audits and to certify that eligible entities meet applicable requirements of the FD&C Act.”[5] The draft states an individual or organization can be recognized as a certification body. The final version of the standards will be based on the final rule.

Although it is not stated directly, the third-party model established by FDA aligns closely with the accredited certification process followed by industry and the International Accreditation Forum, including the Global Food Safety Initiative (GFSI) and its benchmarking of private industry schemes. The difference is that FDA has expanded the certification body definition to include foreign governments and individual third-party auditors.

Who Will Need Certification?
FDA would require a foreign company to obtain certification by an accredited certification body for only two purposes: 1) eligibility to participate in the VQIP and 2) for the import of a high-risk food as determined by FDA.

The VQIP, the so-called fast lane system for facilitating the entry of imported food shipments into the United States, is expected to launch by January 2018. The VQIP would provide importers with benefits such as expedited entry into the United States, limited FDA examination and/or sampling and expedited FDA laboratory analysis of “for cause” situations or audit samples. VQIP importers must import food only from certified facilities.

Under Section 303 of the law, FDA can require a mandatory import certification when food safety risks are associated with a product, or safety risks or related concerns are associated with the food’s country, territory or region of origin. For example, if a food originated from a country or region with an inadequate food safety regulatory system or a history of food safety problems, then FDA could request certification prior to admission. The agency may refuse admission of imported food in the absence of certification to show the food complies with U.S. food standards. The import certification requirements could impact foreign food manufacturers, processors, packers, holders and importers.

Two Types of Audits
Under the rule, a food safety audit refers to either a “consultative audit” or a “regulatory audit.” Both types of audits are required and must be conducted as unannounced assessments. A consultative audit is an internal audit to determine compliance with food safety requirements and industry standards and must be conducted in preparation for the later regulatory audit. A regulatory audit would also evaluate compliance with applicable food safety regulatory requirements, but this audit will be used to determine eligibility for certification.

Both types of audits will require a records review prior to the on-site assessment of the facility, processes and food products. The records review can be scheduled, but the audit must be conducted unannounced within a 30-day time frame. Certification bodies are required to notify FDA of any condition discovered during a regulatory audit that “will cause serious adverse health consequences or death to humans or animals.” A certification body is not required to submit reports from consultative reports to FDA, but the reports must be available upon request. If environmental or product sampling is conducted during a regulatory audit, the accredited third-party certification body must use a laboratory accredited to ISO 17025 or an equivalent accreditation standard.

What Will Be Reported?
Audit reports must be generated for both consultative and regulatory audits, but certification bodies are required to submit regulatory audit reports directly to their accreditation body and FDA. If an entity must implement corrective actions due to findings from a regulatory audit, the certification body cannot issue a food or facility certification until the facility has submitted its corrective action plans and the certification body has verified they address the deficiencies and are being properly implemented. Once issued, the certification is active for a term of 12 months.

Section 1.652 of the final rule specifies the content required to be included in food safety audit reports completed by third-party certification bodies. For regulatory audits, the report must provide general information about the audited facility as well as information about the following issues:

•    Deficiencies: The report must identify observed deficiencies that pose a reasonable probability of causing serious adverse health consequences or a potential risk for temporary adverse health consequences.

•    Corrective Actions: Certification bodies must document the facility’s corrective action plan for addressing deficiencies unless the deficiencies were resolved during the audit.

•    Sampling and Analysis: The report must document whether sampling and laboratory testing are utilized within the
    facility.

•    History: The certification body must report information about food safety recalls during the previous 2 years and document any significant changes to the facility within the previous 2 years.

•    Certifications: The report must include information about any food or facility certifications issued to the entity within 2 years of the audit. The completion of a regulatory audit and implementation of a corrective action plan (if applicable) are required before a certification body can issue a food or facility certification.

The final rule includes additional reporting requirements for certification bodies pertaining to notification of FDA, eligible entities and their accreditation body.

Scope of Accredited Third-Party Audits
Audits performed under the Accredited Third-Party Certification rule should not be confused with audits conducted as verification activities or to comply with certain requirements of other FSMA regulations.

As stated previously, FDA would require certification by an accredited certification body for only two purposes: 1) eligibility to participate in the VQIP and 2) for the import of high-risk food as determined by FDA. Under the rule, a food safety audit refers to both a consultative audit and a regulatory audit. A regulatory audit must be conducted to obtain certification under VQIP or a mandatory import certification requirement. A consultative audit must be conducted in preparation for a regulatory audit.

Accredited third-party certification bodies are not required for audits conducted for purposes other than VQIP and mandatory import certification. The Accredited Third-Party Certification rule does not apply to audits to show compliance with industry standards, audits by certification bodies not accredited under FDA’s program or audits conducted as part of a verification program for either the Preventive Controls or FSVP rule.

Audits and Other FSMA Regulations
Foreign food facilities, importers and domestic facilities have the option of using audits conducted by accredited certification bodies to comply with the supplier verification requirements of the Preventive Controls and FSVP regulations. In these rules, audits are described as an effective verification activity. Moreover, the preamble of FDA’s Produce Safety rule suggests a greater emphasis on audits by stating “third-party audits are an important component” of FDA’s overall compliance strategy.

Under the Preventive Controls rule, if there is a reasonable probability that an identified hazard will result in serious adverse health consequences or death, then an appropriate supplier verification activity would include on-site audits of the applicable suppliers. According to the rule, an on-site supplier audit must be performed by a “qualified auditor.”

Both the Preventive Controls and FSVP rules define a “qualified auditor” as a “person who is a qualified individual as defined…[within the rule]…and has technical expertise obtained through education, training or experience (or a combination thereof) necessary to perform the auditing function as required” by the regulations. All applicable training must be documented in records, but FDA is not planning to develop a training curriculum for qualified auditors or minimum standards for competency.

The food industry has relied on private audits for years as a means to comply with purchasing requirements. In fact, the preamble of the final rule for produce safety emphasized the historic reliance on audits by produce suppliers to affirm compliance and suggested “adequately rigorous and reliable private audits can be an important additional tool for fostering food safety and ultimately compliance” with the rule. The agency intends to work with “produce industry and other government and private partners to improve the rigor and reliability of private audits,” but the agency has not yet defined terms such as “reliable” or “rigorous.”

What Is the Role of Private Third-Party Audits and Certifications?
For decades, the food industry has used voluntary standards for food safety audits and certification to evaluate food safety systems and to ensure confidence in the safety of the food supply.

Industry food safety schemes recognized by the GFSI are currently the gold standard for ensuring the reliability and rigor of voluntary third-party audits for food safety.

Worldwide, many retailers and manufacturers expect suppliers to demonstrate their commitment to safe and quality products through global certification schemes benchmarked and recognized by GFSI, including SQF, BRC Global Standard for Food Safety, IFS Food Standard and FSSC 22000.

Accredited certification does not guarantee food safety, according to GFSI, but rather “provides a proven framework of checks and balances that significantly improves the rigor of the audit process and reduces the risk of food safety failures.”[6]

During FDA public meetings on the various FSMA regulations, many stakeholders asked about the role of private standards and audits by third-party auditors. A common question in public comments and meetings concerned how the use of voluntary third-party standards could be used to demonstrate compliance with FSMA regulations.

According to FDA, private schemes are outside the scope of the final rule for the accreditation of third-party certification bodies for imported food. Beyond the Accredited Third-Party Certification rule, the agency is considering an expanded role for third-party audits related to the other FSMA rules. To date, the agency has advised that third-party audits and private certification schemes should be modified to ensure compliance with FDA regulations as applicable. We know that the private schemes are indeed taking action. Those with a large presence in the United States have completed gap analyses against the requirements in the main FSMA rules and are developing tools that can be added to their scheme requirements to determine compliance.

Accreditation and certification bodies are also taking actions related to the Accredited Third-Party Certification rule as they continue to learn more about it. As previously stated, the third-party model established by FDA aligns closely with the accredited certification process currently followed by industry, so both accreditation and certification bodies already operate under a rigorous system. Adopting the requirements of the Accredited Third-Party Certification rule will require some changes, but the basic core processes are already in place.

Questions Remain
Audits are commonly recognized as important tools for ensuring food safety in today’s increasingly complex global food supply chain. Ultimately, the in-tegrity and credibility of food safety audits depend on the use of competent, unbiased auditors who audit to rigorous food safety standards.

While the use of third-party audits is referenced within several FSMA rules, the expectations for “qualified auditors” and “rigorous and reliable” audits have generated confusion among food industry stakeholders. In public comments and meetings, several industry stakeholders suggested the agency should consider private food safety schemes as criteria for regulatory audits, particularly audits related to supplier verification, manufacturing facilities and produce safety. Collaboration between FDA and industry partners is a potential means for ensuring consistency and minimizing the redundancies of multiple audits often required to comply with regulatory or market requirements.

Addressing industry concerns and questions about FSMA regulations, the agency is expected to issue new guidance later this year to facilitate industry compliance with several foundational rules of FSMA. At this time, it is unclear if the forthcoming guidance documents will address questions concerning the role of audits and third-party auditors.   

Patrick Kennedy is an information service manager for Mérieux NutriSciences. He has over 15 years of food industry experience and has written extensively on a wide range of food safety and regulatory subjects.

References
1. www.fda.gov/Food/GuidanceRegulation/FSMA/ucm361902.htm.
2. www.regulations.gov/document?D=FDA-2011-N-0920-1979.
3. www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334114.htm.
4. www.fda.gov/Food/GuidanceRegulation/FSMA/ucm361903.htm.
5. www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM455331.pdf.
6. www.mygfsi.com/images/mygfsi/schemes_certification/certification/third_party/GFSI_White_Paper.pdf.