FSMA 7 Major Rules Series
Rule 5: Accredited Third-Party Certification
In this edition of the factsheet series, we will be discussing the next of the major rules under the Food Safety Modernization Act (FSMA): Accredited Third-Party Certification. This rule, possibly more so than others given its overarching nature, is crucial for ensuring the safety of the food supply chain and maintaining consumer confidence through maintenance of benchmarked standards and auditors.
Overview & Background
This rule, which was finalized in November 2015, specifically focuses on the accreditation of third-party auditors and certification bodies who conduct food safety audits and issue certifications for foreign human and animal food producing facilities. The rule itself is voluntary but due to the requirements of many customers, border checks and statutes, this may not always be the case in practice.
This rule is aimed at ensuring the competence and independence of third-party auditors and certification bodies, which are often used by U.S. importers to verify the food safety practices of their foreign suppliers. Certifications may be used by importers to help establish eligibility for participation in the Voluntary Qualified Importer Program (VQIP), which offers expedited review on entry of foodstuffs at border control.
To prevent potentially harmful food from reaching US consumers, the FDA can also require in specific circumstances that a food offered for import into the U.S. be accompanied by a certification from an accredited third-party certification body. In these situations, it then becomes a mandatory requirement.
Third party audits are just one part of a company’s overall audit regime.
1st Party Audit:
- Conducted by the organization itself.
- Internal audit where the company assesses its own processes, systems, and controls.
- Focus is on compliance with internal policies, procedures, and quality standards.
- A tool for continuous improvement and risk management within the organization.
- Provides insights for self-regulation and corrective actions.
2nd Party Audit:
- Conducted by an external party but is typically a customer or a stakeholder closely associated with the organization (these are the sorts of audits that RQA does for our clients).
- The external party assesses the supplier’s processes, systems, and controls.
- Focus is on ensuring compliance with specific contractual requirements, customer expectations, or industry standards.
- Helps build and maintain strong relationships between suppliers and customers.
- Aims to verify that the supplier is meeting agreed-upon standards.
3rd Party Audit:
- Conducted by an independent and accredited certification body.
- Objective assessment of a company’s processes, systems, and controls against established standards (e.g., SQF or ISO 22000 etc. for food safety).
- Focus is on verifying compliance with industry standards or regulations.
- Results in a certification that can be used for marketing and regulatory purposes.
- Provides an impartial evaluation of the organization’s practices against a known standard.
- Can be consultative or regulatory, notably the Rule applies to both in this case.
In summary, 1st party audits are self-assessments conducted internally, 2nd party audits involve external parties closely related to the organization, and 3rd party audits are conducted by independent certification bodies to ensure compliance with external standards and regulations. Therefore, it makes sense to ensure that those bodies and auditors performing and delivering certification from a 3rd party stance can be trusted, benchmarked and are reliable.
The guidance and requirements put upon the certified third party auditing bodies themselves covers many aspects, as expected, from auditor experience, capability, and competency through to professional training, certification, and independency/removal of conflict of interest.
Key Requirements of Rule 5:
- Accreditation Bodies: Accreditation bodies must be recognized by the Food and Drug Administration (FDA) in order to accredit third-party auditors and certification bodies. These bodies must demonstrate that they have the necessary expertise, resources, and processes to effectively accredit auditors and certification bodies.
- Certification Bodies: Certification bodies must meet certain criteria to issue food safety certifications. They must be accredited by a recognized accreditation body, have qualified personnel, and use appropriate certification standards.
- Auditor Competency: Third-party auditors must be competent and qualified to conduct food safety audits. They must have the necessary knowledge, skills, and training to effectively assess food safety risks and preventive controls.
- Unannounced Audits: Rule 5 requires that at least one out of every three audits conducted by a third-party auditor be unannounced. This is to ensure that audits are conducted without prior notice, providing a more accurate assessment of the facility’s actual food safety practices.
- Audit Reports: Third-party auditors must provide the audit reports to the FDA upon request. The reports must include detailed information about the audited facility, the scope of the audit, and the findings and conclusions of the audit. The Rule also provides some exceptions. The mandatory import certification authority under FSMA does not apply to:
- Alcoholic beverages manufactured by foreign facilities under certain circumstances (detailed further within the white paper itself)
- Certain meat, poultry and egg products that are subject to U.S. Department of Agriculture oversight at the time of importation.
It is clear to see why the specific requirements of this Rule help to drive forward compliance. Importers rely on these certifications to verify the safety credentials of their foreign suppliers, and failure to comply with this Rule can result in the revocation of accreditation or certification, which can have significant financial and reputational consequences for both certification bodies and importers.
Conclusion:
This Rule is a crucial regulation for ensuring the safety and integrity of the food supply chain by adding rigor to the 3rd party audit process. Although effectively the choice to have a third-party audit is in some part a voluntary one, many customers will mandate this. It is important to check the accreditation of any audit or certification body used, to ensure the reliability and accuracy of their work. By adhering to this regulation, all involved parties can ensure the safety and quality of the food supply, protecting standards and maintaining both customer and consumer confidence.
RQA can assist with:
Training to understand the rule and key implementation steps
FSMA related training courses e.g. FSVP for human and animal food as well as Intentional Adulteration, Conducting Vulnerability Assessments training
Development of a 1st party internal assessment auditing program or reviewing your current practices
2nd party on-site audits
Gap analysis for 3rd party audits (e.g., SQF or ISO 22000)
