FDA’s Accreditation of Third-Party Auditors Proposal
In our August 6, 2013 Alert, we mentioned the two proposals the Food and Drug Administration (FDA) issued on July 26, 2013 and further implement the Food Safety Modernization Act (FSMA), the first dealing with the Foreign Supplier Verification Programs (FSVP) and the second dealing with third-party auditors. In this edition, we address the FDA’s third-party auditor proposal, which is intended to regulate accreditation/certification bodies and third-party auditors. While the auditor proposal has less direct impact on food importers, it may nonetheless play a significant role in how companies evaluate their current and future business partners and also how they structure their future deals. We will first summarize the key provisions and then raise some questions that the FDA’s current proposal seems to overlook.
First, importers should keep in mind that the FSVP proposal allows them to rely on third-party audit results in specific circumstances. For example, the food poses a potential hazard, such as it is subject to an Import Alert, and to get the product imported further sampling/testing is proposed. In such a circumstance, the importer wants a reliable way to avoid the need for private lab testing and the related costs and delays. Under the third-party auditor proposal, an audit could provide such an option. Second, of course, at some point in the near future, the FDA will issue its Voluntary Qualified Importer Program (VQIP) standards. In much the same way the Customs and Border Protection (CBP) Customs-Trade Partnership Against Terrorism (or C-TPAT) program provides a means to speed up the release of goods from highly compliant companies, a similar result is expected from membership in the VQIP, and one indicia of compliance on the part of the foreign supplier may well be a third-party audit report leading to the conclusion that the auditee is highly compliant.
Because the standards that apply and the quality of audits currently available are gravely inconsistent, Section 307 of the FSMA was adopted to ensure the competence and independence of third-party auditors and accreditation and certification bodies who conduct foreign food safety audits. Section 307 requires the FDA to establish a program to recognize accreditation bodies and provide the criteria for the accreditation of third-party auditors and certification bodies. The third-party auditor could be a foreign government or agency or a private party.
The Third-Party Auditor Accreditation proposal provides a means by which to measure the objectivity and credibility of accreditation bodies and third-party auditors and certification bodies that choose to participate. The proposal contains eligibility, recognition, accreditation, monitoring, and oversight criteria that the FDA seeks to generate in large measure from criteria already being used by industry and accreditation bodies. Naturally, that also means removal, due process, and reinstatement procedures. To its credit, the FDA spent a lot of time meeting with accrediting bodies and private industry in order to gain insight into the broad standards that make for a good program, but also to seek to offer industry a way to build on existing standards so as to attempt to minimize the cost of compliance.
The FDA recognizes there are third-party audits, which are those conducted by an entity unaffiliated with the audited firm, but also second-party audits (those conducted by buyers for suppliers or contractors) and first-party audits or self-audits. In addition, there are consultative audits that are conducted for internal use and “true” audits, those intended to be relied on by outside parties, such as the FDA. While each has its role, it is only third-party audits that are addressed by the FDA proposal. The FDA has already indicated these audits must be unannounced, although issues about public disclosure of fees and appropriate limits of financial affiliation are not yet settled. One big hole in the FDA proposal is transparency. While there is much said about the need for accrediting bodies to be transparent about fees and payments to enhance the credibility of the process, that is not the only area where transparency is critical; see our concluding point below.
One important provision remaining to be published is the draft model accreditation standards, which would include factors such as the minimum requirements for education and experience not only for accrediting and credentialing bodies, but also for individuals and entities performing the actual audits. Even with the existing third-party audit proposal from the FDA, there remain open questions about quality assurance standards, as well as record-keeping requirements.
As with the FSVP proposal, when it comes to third-party audits, the FDA is inviting comments on many different topics, and so food companies are reminded to file their comments by the November 26, 2013, deadline. The FDA has also said it intends to implement the Third-Party Auditor Accreditation proposal only after the model accreditation standards are published and a final rule is issued on the third-party audit process.
For most importers, they may never read these audit standards unless and until they have an issue with a supplier. However, they would be wise to familiarize themselves with the criteria now so they can appreciate what will be involved. This is especially true in the context of cost. One area where the FDA may have severely underestimated impact is cost. It is reasonable to expect that foreign suppliers will seek to recover the cost of being audited and providing the resulting reports, but there are other questions that also must be addressed. For example, will it be cheaper to have the problem food arrive in the U.S. and endure the delay and cost associated with private lab testing, or will it be cheaper to have your supplier undergo a third-party audit? Given current conditions, most companies would likely say undergo the private lab test, but is that the wisest decision? While it is true there is a process available that allows a supplier to be removed from an Import Alert, it takes months and is costly. Will importers chose the test and wait option, especially if multiple shipments are involved, or will it be easier to find another supplier or simply not buy the product at all?
Many food importers have resisted joining C-TPAT as they gain no speed to the release of their shipments due to the FDA’s risk-assessment holds. As we await publication of the VQIP requirements, the pressing question is what will be the cost (direct and indirect) in joining? Will it be worth it? Will the cost of joining (cost and process requirements) VQIP make economic sense, and will the FDA really be able to speed up the release process enough to justify that cost? Right now, we simply do not know.
In addition to these open questions, we add one more. CBP has had a very difficult time dealing with the importation of grey market goods; these are goods that bear a legitimate trademark, but the seller or importer may not be an authorized licensee of the rights holder. These legitimate goods are generally available on the market because the rights holder sold them to a third party that is now reselling them. One of the major headaches for CBP has been the widespread existence of phony license documents. This headache arises in the FDA third-party audit context because there is nothing in the proposal that clearly requires transparency when it comes to the existence or the results of any third-party audits. Now, admittedly there are many obvious proprietary and perfectly legitimate reasons why a company might not want a report filed with the U.S. government to be made public, but unless the companies audited and/or the FDA provide a means whereby a recipient of a report can validate the accuracy of that report, in this day and age, when it is so easy to create documents and phony signatures on a computer, you have to ask – how can companies, especially small- and medium-sized ones, really protect themselves from an unscrupulous supplier who misrepresents the condition of his supply chain with phony audit reports? At the very least, the FDA should provide a means for an American importer to name the parties and food product and have the FDA provide a simple yes or no to these two questions – we can quibble about their exact wording, but everyone is going to want to know two things – was the company audited and, if so, did it pass (was it found compliant)? The FDA will say it cannot do so for trade secrets reasons, but, frankly, it can. It simply needs to require that any party filing an audit (first, second, or third party) report agrees that certain details may be released publicly, or, put another way, trade secrets are waived as to those specific data elements. After all, Commerce, State, and Treasury regularly release penalty decisions. Surely the FDA can figure out how to build on that model to further protect the American food supply.