21 U.S.C. § 384d — Accreditation of third-party auditors

(a) Definitions. "Audit agent" is an employee or agent of an accredited third-party auditor who is qualified to run food safety audits but isn't accredited individually. "Accreditation body" is an authority that accredits third-party auditors. "Third-party auditor" is a foreign government, agency, cooperative, or other outside party the Secretary allows to be considered for accreditation to run food safety audits; it can be a single person, and can use audit agents to help. "Accredited third-party auditor" is a third-party auditor an accreditation body has actually accredited; it can be one individual. "Consultative audit" checks whether an entity follows this chapter and industry standards, but the results are for internal use only. "Eligible entity" is a foreign business in the food import chain — including a registered foreign facility — that chooses to be audited. "Regulatory audit" checks whether an entity follows this chapter, and its results decide whether a food or facility qualifies for certification. (b) Accreditation system. (1) Within 2 years of January 4, 2011, the Secretary must set up a system recognizing accreditation bodies that accredit third-party auditors. If, 2 years after that system starts, the Secretary hasn't recognized any accreditation body, the Secretary may accredit third-party auditors directly. Each recognized accreditation body must give the Secretary a list of every auditor and audit agent it has accredited. The Secretary must promptly revoke recognition from any accreditation body that stops following the rules, but must also set up a way to reinstate a body if revocation turns out to have been wrong or the body meets the rules again. (2) Within 18 months of January 4, 2011, the Secretary must create model accreditation standards, including requirements for audit reports, which every recognized accreditation body must use to qualify auditors; the Secretary should look at standards already in place to avoid duplicating work. (c) Third-party auditors. (1) Before accrediting a foreign government or agency, the accreditation body (or the Secretary, for direct accreditation) must review that government's food safety programs and systems to confirm it can properly ensure that certified entities or foods meet this chapter's requirements. Before accrediting a foreign cooperative or other party, the accreditation body must review the training and qualifications of its audit agents and its internal systems to confirm certified entities meet the requirements. (2) An accreditation body can't accredit an auditor unless the auditor agrees to issue a written (and, where appropriate, electronic) certification for each food shipment or facility, following the Secretary's requirements; the Secretary must weigh these certifications when deciding where to focus inspections. The Secretary uses these certifications to decide whether a food meets import requirements and whether a facility can join the voluntary importer program. An auditor may only issue this certification after doing a real regulatory audit; only accredited auditors or the Secretary can issue facility or food certifications. (3) Within 45 days of an audit, the auditor must prepare an audit report — and submit it, for regulatory audits — including who at the entity is responsible for food safety, the audit dates, its scope, and other information the Secretary requires. The Secretary can, at any time, demand the full onsite audit report and related documents for any certified entity, but this doesn't apply to consultative-audit records, except as allowed under section 350c. (4) If an auditor finds a condition during an audit that could seriously threaten public health, the auditor must immediately tell the Secretary who the entity is and what the condition is. Auditors may do both consultative and regulatory audits, but an auditor can't do a regulatory audit of an entity it audited (consultative or regulatory) in the past 13 months — though the Secretary can waive this if there aren't enough auditors available in that country or region. (5) An accredited auditor can't be owned, managed, or controlled by anyone who owns or runs an entity it certifies; it must have procedures to prevent employees with a financial conflict of interest from doing that entity's audit; and it must yearly disclose to the Secretary how well it followed these conflict-of-interest rules. The same three rules apply to individual audit agents. Within 18 months of January 4, 2011, the Secretary must write regulations requiring audits to be unannounced, reducing conflict-of-interest risk (including public disclosure of audit fees), and limiting financial ties between auditors and the entities they certify. (6) The Secretary must withdraw an auditor's accreditation if food or a facility it certified is linked to a foodborne-illness outbreak that could seriously harm or kill people or animals; if the Secretary finds the auditor no longer meets the requirements; or if the auditor refuses to let U.S. officials audit or investigate it. The Secretary may also withdraw accreditation if the auditor's own accreditation body loses its recognition, if there's good cause. The Secretary can waive withdrawal for an outbreak-linked auditor if the Secretary investigates the outbreak and finds the auditor's certification was still justified. (7) The Secretary must set up a way to reinstate a withdrawn auditor's accreditation if the auditor shows it now meets the requirements, or — if its accreditation body lost recognition — if it gets re-accredited within a year by direct accreditation or by another body in good standing. (8) The Secretary must create a user-fee program, similar to one under section 1622(h) of title 7, charging auditors to reimburse the FDA for running this accreditation system. This fee program must be revenue-neutral — it can't generate a surplus — and the fees can only be collected and spent as Congress provides in appropriation laws, though they don't expire. (d) Recertification of eligible entities. An entity must apply for a new certification every year if it wants to join the voluntary importer program under section 384b, or if it must give the Secretary a certification under section 381(q). (e) False statements. False statements by an entity's employee to an auditor, or by an auditor to the Secretary, can be prosecuted under section 1001 of title 18. (f) Monitoring. To make sure this section is being followed, the Secretary must: (1) re-evaluate accreditation bodies at least every 4 years; (2) evaluate each accredited auditor at least every 4 years, by reviewing its audit reports, the compliance history of entities it certified, and other measures; (3) at any time, do its own onsite audit of any certified entity, with or without the auditor present; and (4) take any other steps it thinks are necessary. (g) Publicly available registry. The Secretary must maintain a public registry listing accreditation bodies and accredited auditors, with contact information and other details the Secretary thinks are needed. (h) Limitations. (1) Audits done under this section don't count as inspections under section 374. (2) Nothing here limits the Secretary's separate power to inspect any certified entity under this chapter.