FSMA Accreditation of Third-Party Auditors/Certification Bodies: A Look at FDA’s Proposed User Fee Rule and Model Accreditation Standards Guidance

By Jenifer R. Stach* & Ricardo Carvajal –

On July 24, 2015, FDA issued a proposed rule amending the Agency’s previously issue proposed rule on Accreditation of Third-Party Auditors/Certification Bodies (see our prior posts here and here) and establishing user fees for the Agency’s proposed accreditation program (hereinafter “User Fee Proposed Rule”).  On the same day and in a related publication, FDA issued a draft guidance for Model Accreditation Standards (hereinafter “Draft Guidance”).  

On their face, the User Fee Proposed Rule and the Draft Guidance might seem to be of interest only to those who might participate in the Voluntary Qualified Importer Program (see our prior post here).  However, FDA’s accreditation standards can be expected to influence the content of similar standards currently used by third-party auditors and their certifiers.  In addition, because the accreditation program set up by FDA might not be revenue neutral, administration of the program could divert resources from other program areas – one of the several issues on which the Agency has requested comment.  Comments on both the User Fee Proposed Rule and the Draft Guidance are due October 7, 2015.  Below we provide summaries of both documents.  

User Fee Proposed Rule.  Section 808(c)(8) of the FDC Act (which was added by FSMA) requires FDA to establish a user fee program to set up and administer the Agency’s proposed accreditation program.  FDA explains the costs associated with establishing and maintaining the accreditation program in the User Fee Proposed Rule in a Q&A format. The Questions are presented as follows: (1) Who would be subject to a user fee; (2) What user fees would be established; (3) How will FDA notify the public about the fee schedule; (4) When must the user fees be submitted; (5) What are the consequences for not paying a user fee on time; and (6) What are the possible exemptions?

(1) Who would be subject to a user fee?

Accreditation Bodies (ABs) and third-party auditors/certification bodies (CBs) would be subject to user fees.  As presented in the proposed § 1.700, FDA identifies four main groups subject to a user fee:

• ABs submitting applications or renewal applications for recognition in the third-party accreditation program;
• Recognized ABs participating in the third-party accreditation program subject to FDA monitoring activities;
• CBs submitting applications or renewal applications for direct accreditation; and
• Accredited CBs (whether accredited by recognized ABs or by FDA through direct accreditation) participating in the third-party accreditation program subject to FDA monitoring activities.

(2) What user fees would be established?

The proposed language in § 1.705 establishes application fees and annual fees for ABs and CBs in the four categories listed in the above section “Who would be subject to a user fee?”  FDA bases the costs for this proposed User fee program on other established User fee programs such as the Prescription Drug User Fee Act (PDUFA) and the Medical Device User Fee Act (MDUFA).  These exiting User fee models show that every seven full-time federal employees (FTEs) who perform direct FDA work require three indirect and supporting FTEs.  FDA calculates the base unit for the hourly fee rate of an FTE as $202.  The base unit for the hourly fee rate of an FTE requiring foreign inspection travel is calculated at $305, and the hourly fee rate of an FTE requiring domestic inspection travel is $217.

In the User Fee Proposed Rule, FDA estimates the amount of time it will take to perform the functions necessary to establish and maintain the accreditation program.  For example for FDA to accredit an AB applying for recognition, FDA estimates that it will take approximately 60 person-hours to review a submitted application, 48 person-hours to perform an onsite performance evaluation, and 45 person-hours to prepare a written report.  Therefore, the total estimated average cost for FDA to review an application submitted by an AB is $35,850.      

Using similar hourly estimate calculations, FDA provides user fee costs for the following functions:  

• AB Applying for Recognition, $ 35,850 (as discussed in the example)
• AB Renewal Application,  $18,853
• CB Applying for Direct Accreditation from FDA, $35,850
• CB Renewal Application, $26,930
• Annual Fees for Recognized ABs, $7,928 over 5 years  
• Annual Fees for CBs Directly Accredited by FDA, $21,104
• Annual Fees for CBs Accredited by a Recognized AB, $7,928 over 4 years  

FDA states that the proposed fee structure for ABs and CBs is consistent with the current industry model.  FDA is requesting comment on whether these fees should be paid as a flat fee or billed on an hourly basis.  FDA proposes that the alternative approach of an hourly bill may incentivize ABs and CBs to submit higher quality applications, in other words, applications that are faster to review because of the substantive quality of the application.  FDA also requests comment on a proposed flat fee, hourly fee, or whether a hybrid approach of flat fee and hourly would be appropriate.   

(3) How will FDA notify the public about the fee schedule?

Under the proposed § 1.710, FDA intends to notify the public annually in the Federal Register prior to the beginning of the fiscal year for which the fee will apply.  As an example, MDUFA fee rates were published on July 30, 2014 for fees beginning in 2015.   

(4) When must the user fees be submitted?

Application and renewal fees will be submitted concurrently with an application or renewal.  FDA will not review an application or renewal until the fee has been submitted.  FDA also notes that user fees are not refundable.  FDA tentatively concludes that this is the simplest approach to encourage high quality applications for ABs and CBs who have made a thoughtful decision to stay in the program for subsequent years.    

(5) What are the consequences for not paying a user fee on time?

Annual fees will be paid within 30 days of the due date.  After 30 days, the entity (AB or CB) will face suspension.  After 90 days, the status of the entity will be revoked.  

(6) What are the possible exemptions?

In the proposed rule, FDA does not provide an exemption or reduced fee for small businesses or entities.  FDA is requesting comment on whether the final rule should account for small businesses by offering an exemption or fee reduction.  FDA also proposes to charge user fees to foreign governments that are participating in the program as either an AB or CB.  FDA requests comment on whether for trade reasons, or other reasons, they should consider a different approach.  

Draft Guidance.  Section 808(b)(2) of the FDC Act requires FDA to develop Model Accreditation Standards for recognized accreditation bodies (ABs).  Pursuant to the statute, ABs shall use these model standards to qualify third-party auditors/certification bodies for accreditation.  FDA noted that the Draft Guidance, “if finalized, will constitute the model accreditation standards referred to in section 808(b)(2) of the FD&C Act.  In instances where this draft guidance provides different or more specific recommendations than are contained in the ISO/IEC 17021:2011, or conflicts with ISO/IEC 17021:2011, the recommendations of this guidance apply.”  As is the case with any guidance, alternative approaches may be used to the extent that they meet the requirements of the statute, and in this case, the proposed rule.    

• Authority and responsibility:  A third-party auditor/certification body must demonstrate the authority, as a governmental entity or through legally enforceable contractual rights, to exert any authority necessary to perform credible audits and certifications of the program.  Specifically, a third-party auditor/certification body must have authority to (1) Review relevant records; (2) Conduct onsite audits; and (3) Suspend or withdraw certification for failure to comply with requirements of the program.  
• Capacity and competence:  A third-party auditor/certification body must demonstrate that it has the adequate number of competent personnel to implement the program, as well as sufficient finances to operate in compliance with the program.  Competent personnel must have relevant knowledge, skills, and experience to audit and assess compliance with FDA requirements under the program.  Competency is based on education, industry experience, ongoing training, and professional development in the area of food safety.  A third-party auditor/certification body should have a documented process to ensure that audit agents and managers meet the requirements for competency.      
• Conflicts of interest:  A written program must be in place to prevent conflicts of interest between a third-party auditor/certification body and entities seeking certification.  The written program should include measures for promoting independence, objectivity, and impartiality and procedures for effectively identifying, investigating, and resolving potential conflicts. 
• Quality assurance:  A third-party auditor/certification body must implement a written program to conduct periodic self-assessment, implement corrective actions, and prepare a report written in English documenting the results of the self-assessment.  FDA recommends that the third-party auditor/certification body establish procedures to conduct annual reviews for their self-assessment.   The annual review would include areas of improvement for deficiencies, corrective action taken to address deficiencies, assessment of the effectiveness of the corrective action, an evaluation of personnel compliance with conflict of interest measures, and an identification of resource needs.  
• Records:  A third-party auditor/certification body must maintain written procedures to establish, control, and retain records.  The written procedures must include requirements that records must be written in English and retained electronically for four years.  A third-party auditor/certification body should also have legal authority to grant FDA access to relevant records. 
• Regulatory audit reports:  Within 45 days of completing a regulatory audit, an accredited auditor/certification body must prepare and submit a report written in English to FDA and to its accreditation body.  In the case of direct accreditation, an accredited auditor/certification body would only submit the report to FDA.  The audit report should include the name and address of the facility; the FDA food facility registration number, if applicable; the date and scope of the audit; the processes and foods observed during the audit; the identity of the person responsible for compliance at the facility; deficiencies observed, and the reasonable probability that the deficiency poses a serious adverse consequence to public health; corrective action for any deficiency; whether sampling or analysis was used at the facility; whether a food-safety recall has been issued in the last 2 years, and the reason for the recall; whether significant changes have been made to the facility, processes, or products in the last 2 years; and a list of any food or facility certifications issued to the entity in the last 2 years.         
• Miscellaneous:  A third-party auditor/certification body must maintain an updated list of eligible entities on its website.  For each eligible entity listed, the website should identify the duration and scope of the certification and the date the entity paid, or was reimbursed for, a fee associated with their certification.  Also, a third-party auditor/certification body must issue food or facility certifications electronically in English.    

*Admitted only in Maryland.  Practicing under the supervision of the Firm.