Contains Nonbinding Recommendations 
 
 
 
 
 
Third-Party Certification Body 
Accreditation for Food Safety Audits: 
Model Accreditation Standards: 
Guidance for Industry and FDA Staff 
 
Additional copies are available from: 
Center for Food Safety and Applied Nutrition 
Food and Drug Administration 
5001 Campus Drive 
College Park, MD 20740 
(Tel) 240-402-1700 
http://www.fda.gov/FoodGuidances 
 
You may submit either electronic or written comments regarding this guidance at any time. 
Submit electronic comments to http://www.regulations.gov. Submit written comments to the 
Division of Dockets Management (HFA-305), Food and Drug Administration, 5630 Fishers 
Lane, rm. 1061, Rockville, MD 20852. All comments should be identified with the docket 
number listed in the notice of availability that publishes in the Federal Register. 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Food Safety and Applied Nutrition 
Center for Veterinary Medicine 
Office of Regulatory Affairs 
  
February 2022 
  1   
Contains Nonbinding Recommendations 
 
Table of Contents 
I. Introduction ...................................................................................... 3
   
 
II. Scope .................................................................................................. 4
   
III. Definitions ......................................................................................... 5
   
IV. Legal authority and responsibility .................................................. 7
   
V. Capacity and competence ................................................................ 9
   
A. Capacity .......................................................................................... 9
   
B. Competency .................................................................................... 9
   
VI. Conflicts of interest ........................................................................ 12
   
VII. Quality assurance ........................................................................... 13
   
VIII.Records ............................................................................................ 13
   
A. Records procedures ...................................................................... 14
   
B. Written program to protect against conflicts of interest ......... 14
   
C. Documentation of competence .................................................... 15
   
Appendix .................................................................................................. 17
 
Document History .................................................................................... 18
 
 
  2   
Contains Nonbinding Recommendations 
Third-Party Certification Body 
Accreditation for Food Safety Audits: 
Model Accreditation Standards: 
Guidance for Industry and FDA Staff 
 
This guidance represents the current thinking of the Food and Drug Administration (FDA or 
Agency) on this topic. It does not establish any rights for any person and is not binding on 
FDA or the public. You can use an alternative approach if it satisfies the requirements of the 
applicable statutes and regulations. To discuss an alternative approach, contact FDAs 
Technical Assistance Network by submitting the form available at 
https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-technical-assistance-
network-tan. 
 
I. Introduction 
This guidance is intended to assist industry and the Food and Drug Administration (FDA) staff 
by recommending standards for accrediting third-party certification bodies1 for the voluntary 
third-party certification program established under the FDA Food Safety Modernization Act 
(FSMA). The guidance serves as a companion document to the implementing regulations in 21 
CFR parts 1, 11, and 16 that establish the framework, procedures, and requirements for 
accreditation bodies and third-party certification bodies for this program. 
 
By way of background, section 307 of FSMA, Accreditation of Third-Party Auditors, amends the 
Federal Food, Drug, and Cosmetic Act (FD&C Act) to add section 808 (21 U.S.C. 384d) under 
the same name. Section 808 of the FD&C Act directs FDA to establish a voluntary program for 
the recognition of accreditation bodies that accredit third-party certification bodies to conduct 
food safety audits and issue food and facility certifications to eligible foreign entities, (including 
registered foreign food facilities) for the purposes specified in sections 801(q) and 806 of the 
FD&C Act. The statute specifies that foreign governments, agencies of foreign governments, 
foreign cooperatives, and other third parties meeting the eligibility criteria in the statute and FDA 
regulations may be accredited under the third-party certification program by an FDA-recognized 
accreditation body, except in limited circumstances when FDA may directly accredit third-party 
certification bodies.2 
 
1 As defined in 21 CFR 1.600(c), a third-party certification body has the same meaning as third-party auditor as 
that term is defined in section 808(a)(3) of the FD&C Act. For consistency with the implementing regulations in 
21 CFR parts 1, 11, and 16, this final guidance uses the term certification body. 
2 Section 808(b)(1)(A)(ii) of the FD&C Act allows FDA to directly accredit third-party certification bodies if we 
have not identified and recognized an accreditation body to meet the requirements of section 808 within 2 years 
after establishing the third-party certification program. 
  3   
Contains Nonbinding Recommendations 
 
Pursuant to section 808(b)(2) of the FD&C Act, FDA must develop Model Accreditation 
Standards that recognized accreditation bodies shall use to qualify third-party certification bodies 
for accreditation, and in so doing, look to existing standards for certification bodies (as of the 
date of enactment of FSMA) to avoid unnecessary duplication of efforts and costs.3 
 
On November 27, 2015, we finalized the implementing regulations establishing the framework, 
procedures, and requirements of the third-party certification program, including conflict of 
interest safeguards and other requirements necessary to ensure the competency and independence 
of recognized accreditation bodies and of accredited third-party certification bodies, which will 
help ensure the validity and reliability of certifications and other information resulting from the 
food safety audits conducted by accredited third-party certification bodies (80 FR 74569) 
(implementing regulations).  
 
This final guidance document fulfills the statutory mandate under section 808(b)(2) of the FD&C 
Act that FDA must develop Model Accreditation Standards that recognized accreditation bodies 
shall use to qualify third-party certification bodies for accreditation. As part of these 
recommendations, we looked to voluntary consensus standards on accreditation that are widely 
used in determining the qualifications of third-party bodies that audit and certify the food 
industry. Specifically, we refer to International Organization for Standardization (ISO)/ 
International Electrotechnical Commission (IEC) recommendations contained in the ISO/IEC 
17021:2011, ISO/IEC 17021: 2015, ISO/IEC 17065:2012, and/or ISO/IEC 17065:2015. In 
instances where recommendations that are contained in the ISO/IEC 17021:2011, ISO/IEC 
17021: 2015, ISO/IEC 17065:2012, and/or ISO/IEC 17065:2015, conflict with the requirements 
in the statute or implementing regulations, the requirements in the statute and regulations apply. 
 
The contents of this document do not have the force and effect of law and are not meant to bind 
the public in any way, unless specifically incorporated into a contract. This document is intended 
only to provide clarity to the public regarding existing requirements under the law. FDA 
guidance documents, including this guidance, should be viewed only as recommendations, unless 
specific regulatory or statutory requirements are cited. The use of the word should in FDA 
guidances means that something is suggested or recommended, but not required. 
 
II. Scope 
This guidance document describes the standards for accreditation of third-party certification 
bodies as required under section 808 of the FD&C Act and the implementing regulations for the 
third-party certification program. The guidance discusses specified clauses of ISO/IEC 
17021:2011, ISO/IEC 17021:2015, and ISO/IEC 17065:2012, as well as industry practices that 
are currently being used by third-party certification bodies, and that FDA recommends 
accreditation bodies consider as a model when making accreditation decisions under the third- 
 
3 We also note that the National Technology Transfer and Advancement Act of 1995 directs Federal agencies to use 
voluntary consensus standards in lieu of government-unique standards, except where inconsistent with law or 
otherwise impractical. 
  4   
Contains Nonbinding Recommendations 
party certification program. Other documents consulted by FDA are listed in the Appendix. 
Alternative approaches to those described in the guidance may be used if they would meet the 
standards of the statute and the implementing regulations. 
 
III. Definitions 
For the purposes of this guidance document, the following definitions, which are consistent with 
the definitions in  1.600, apply, as follows: 
 
Accreditation means a determination by a recognized accreditation body (or, in the case of direct 
accreditation, by FDA) that a third-party certification body meets the applicable requirements of 
21 CFR part 1, subpart M. 
 
Accreditation body means an authority that performs accreditation of third-party certification 
bodies. 
 
Accredited third-party certification body means a third-party certification body that a recognized 
accreditation body (or, in the case of direct accreditation, FDA) has determined meets the 
applicable requirements of 21 CFR part 1, subpart M and is accredited to conduct food safety 
audits and to issue food or facility certifications to eligible entities. An accredited third-party 
certification body has the same meaning as accredited third-party auditor as defined in section 
808(a)(4) of the FD&C Act. 
 
Assessment means: 
(i)  With respect to an accreditation body, an evaluation by FDA of the competency and capacity of the 
accreditation body under the applicable requirements of 21 CFR part 1, subpart M for the defined 
scope of recognition. An assessment of the competency and capacity of the accreditation body 
involves evaluating the competency and capacity of the operations of the accreditation body that 
are relevant to decisions on recognition and, if recognized, an evaluation of its performance and the 
validity of its accreditation decisions under the applicable requirements of 21 CFR part 1, subpart 
M. 
(ii) With respect to a third-party certification body, an evaluation by a recognized accreditation body 
(or, in the case of direct accreditation, FDA) of the competency and capacity of a third-party 
certification body under the applicable requirements of 21 CFR part 1, subpart M for the defined 
scope of accreditation. An assessment of the competency and capacity of the third-party 
certification body involves evaluating the competency and capacity of the operations of the third-
party certification body that are relevant to decisions on accreditation and, if accredited, an 
evaluation of its performance and the validity of its audit results and certification decisions under 
the applicable requirements of 21 CFR part 1, subpart M. 
 
Audit means the systematic and functionally independent examination of an eligible entity under 
21 CFR part 1, subpart M by an accredited third-party certification body or by FDA. An audit 
conducted under subpart M is not considered an inspection under section 704 of the FD&C Act. 
  5   
Contains Nonbinding Recommendations 
Audit agent means an individual who is an employee or other agent of an accredited third-party 
certification body who, although not individually accredited, is qualified to conduct food safety 
audits on behalf of an accredited third-party certification body. An audit agent includes a 
contractor of the accredited third-party certification body but excludes subcontractors or other 
agents under outsourcing arrangements for conducting food safety audits without direct control 
by the accredited third-party certification body. 
 
Consultative audit means an audit of an eligible entity: 
(i)  To determine whether such entity is in compliance with the applicable food safety requirements of 
the FD&C Act, FDA regulations, and industry standards and practices; 
(ii) The results of which are for internal purposes only; and 
(iii) That is conducted in preparation for a regulatory audit; only the results of a regulatory audit may 
form the basis for issuance of a food or facility certification under 21 CFR part 1, subpart M. 
 
Direct accreditation means accreditation of a third-party certification body by FDA. 
 
Eligible entity means a foreign entity in the import supply chain of food for consumption in the 
United States that chooses to be subject to a food safety audit under 21 CFR part 1, subpart M 
conducted by an accredited third-party certification body. Eligible entities include foreign 
facilities required to be registered under 21 CFR part 1, subpart H. 
 
Facility means any structure, or structures of an eligible entity under one ownership at one 
general physical location, or, in the case of a mobile facility, traveling to multiple locations, that 
manufactures/processes, packs, holds, grows, harvests, or raises animals for food for 
consumption in the United States. Transport vehicles are not facilities if they hold food only in 
the usual course of business as carriers. A facility may consist of one or more contiguous 
structures, and a single building may house more than one distinct facility if the facilities are 
under separate ownership. The private residence of an individual is not a facility. Non-bottled 
water drinking water collection and distribution establishments and their structures are not 
facilities. Facilities for the purpose of 21 CFR part 1, subpart M are not limited to facilities 
required to be registered under 21 CFR part 1, subpart H. 
 
Facility certification means an attestation, issued for purposes of section 801(q) or 806 of the 
FD&C Act, by an accredited third-party certification body, after conducting a regulatory audit 
and any other activities necessary to establish whether a facility complies with the applicable 
food safety requirements of the FD&C Act and FDA regulations. 
 
Food has the meaning given in section 201(f) of the FD&C Act, except that food does not 
include pesticides (as defined in 7 U.S.C. 136(u)). 
 
Food safety audit means a regulatory audit or a consultative audit that is conducted to 
determine compliance with the applicable food safety requirements of the FD&C Act, 
FDA regulations, and for consultative audits, also includes conformance with industry 
standards and practices. An eligible entity must declare that an audit is to be conducted 
as a regulatory audit or consultative audit at the time of audit planning and the audit 
will be conducted on an unannounced basis under 21 CFR part 1, subpart M. 
 
Recognized accreditation body means an accreditation body that FDA has determined meets the 
  6   
Contains Nonbinding Recommendations 
applicable requirements of 21 CFR part 1, subpart M and is authorized to accredit third-party 
certification bodies under 21 CFR part 1, subpart M. 
 
Regulatory audit means an audit of an eligible entity: 
(i)  To determine whether such entity is in compliance with the applicable food safety requirements of 
the FD&C Act and FDA regulations; and 
(ii) The results of which are used in determining eligibility for certification under section 801(q) or 
under section 806 of the FD&C Act. 
 
Self-assessment means an evaluation conducted by a recognized accreditation body or by an 
accredited third-party certification body of its competency and capacity under the applicable 
requirements of 21 CFR part 1, subpart M for the defined scope of recognition or accreditation. 
For recognized accreditation bodies this involves evaluating the competency and capacity of the 
entire operations of the accreditation body and the validity of its accreditation decisions under 
the applicable requirements of 21 CFR part 1, subpart M. For accredited third-party certification 
bodies this involves evaluating the competency and capacity of the entire operations of the third- 
party certification body and the validity of its audit results under the applicable requirements of 
21 CFR part 1, subpart M. 
 
Third-party certification body has the same meaning as third-party auditor as that term is defined 
in section 808(a)(3) of the FD&C Act and means a foreign government, agency of a foreign 
government, foreign cooperative, or any other third party that is eligible to be considered for 
accreditation to conduct food safety audits and to certify that eligible entities meet the applicable 
food safety requirements of the FD&C Act and FDA regulations. A third-party certification body 
may be a single individual or an organization. Once accredited, a third-party certification body 
may use audit agents to conduct food safety audits. 
 
IV. Legal authority and responsibility 
Under 21 CFR 1.641, a third-party certification body must demonstrate that it is capable of 
exerting any authority necessary to perform its required duties under the third-party certification 
program. These necessary authorities include the authority to review relevant records; grant 
FDA access to relevant records; conduct onsite audits; and to suspend or withdraw certification 
for failure to comply with applicable requirements. 
 
To this end, a third-party certification body should make available to the recognized 
accreditation body information about its organizational structure, ownership, and the legal or 
natural persons exercising control over the third-party certification body. If the third-party 
certification body is a legal entity that is wholly or partly owned by a larger organization, the 
third-party certification body should clearly document the activities, structure, and governance of 
that larger organization. If the third-party certification body wholly or partly owns other legal 
entities, the third-party certification body should clearly define and document the activities and 
  7   
Contains Nonbinding Recommendations 
responsibilities of those other entities, as well as their legal and operational relationships with the 
third-party certification body. 
 
For additional guidance on demonstrating necessary legal authority, we recommend that 
recognized accreditation bodies and third-party certification bodies refer to the following, as 
applicable: 
  ISO/IEC 17021:2011, subclause 5.1.1, Legal responsibility; 
  ISO/IEC 17021:2015, subclause 5.1.1, Legal responsibility; and 
  ISO/IEC 17065:2012, subclause 4.1.1, Legal responsibility. 
 
Additionally, the third-party certification body must demonstrate that it has the authority, if 
accredited, to: 
(1) Conduct an unannounced audit to determine whether the facility, process(es), and food of the 
eligible entity (within the scope of the audit) comply with the applicable food safety requirements 
of the FD&C Act and FDA regulations and, for consultative audits, also includes conformance with 
applicable industry standards and practices ( 1.651(b)(1)); 
(2) Access any records and any area of the facility, process(es), and food of the eligible entity relevant 
to the scope and purpose of such audit ( 1.651(b)(2)); 
(3) When, for a regulatory audit, sampling and analysis is conducted, use a laboratory that is accredited 
in accordance with ISO/IEC 17025:2017 to perform the analysis ( 1.651(b)(3)); 
(4) Notify FDA immediately if, at any time during a food safety audit, the accredited third-party 
certification body (or its audit agent, where applicable) discovers a condition that could cause or 
contribute to a serious risk to the public health and provide information required by  1.656(c) ( 
1.651(b)(4)); 
(5) Prepare reports of audits conducted 21 CFR part 1, subpart M, as follows: (i) For consultative 
audits, reports that contain the elements specified in  1.652(a) and maintain such records, subject 
to FDA access in accordance with section 414 of the FD&C Act; and (ii) for regulatory audits, 
reports that contain the elements specified in  1.652(b) and submit them to FDA and to its 
recognized accreditation body (where applicable) under 
(6)  1.656(a) ( 1.651(b)(5)); and 
(7) Allow FDA and the recognized accreditation body that accredited such third-party certification 
body, if any, to observe any food safety audit conducted under 21 CFR part 1, subpart M, for 
purposes of evaluating the accredited third-party certification bodys performance under  1.621 
and 1.662 or, where appropriate, the recognized accreditation bodys performance under  1.622 
and 1.633 ( 1.651(b)(6)). 
 
For additional guidance on legally enforceable agreements for the provision of certification 
activities, we recommend that accreditation bodies and third-party certification bodies refer to 
the following, as applicable: 
  ISO/IEC 17021:2011, subclause 5.1.2, Certification agreement; 
  ISO/IEC 17021:2015, subclause 5.1.2, Certification agreement, and 
  ISO/IEC 17065:2012, subclause 4.1.2, Certification agreement. 
 
For additional guidance on authority for certification decisions, we recommend that recognized 
accreditation bodies and third-party certification bodies refer to the following, as applicable: 
  ISO/IEC 17021: 2011, subclause 5.1.3, Responsibility for certification decisions; 
  ISO/IEC 17021:2015, subclause 5.1.3, Responsibility for certification decisions; and 
  ISO/IEC 17065:2012, subclause, 4.1.2, Certification agreement, and subclause 4.1.3, 
  8   
Contains Nonbinding Recommendations 
Use of license, certificates, and marks of conformity. 
 
V. Capacity and competence 
A. Capacity 
 
A third-party certification body may range in size from a single person operation to a large 
organization with offices across the globe. Capacity demands vary depending on several factors 
such as the scope of accreditation and the volume of work. A third-party certification body must 
have the capacity to meet all of the applicable requirements under the implementing regulations 
( 1.642(b)). Specifically, a third-party certification body seeking accreditation under the 
voluntary third-party certification program must demonstrate that it has the resources necessary 
to fully implement its certification program, including: 
(1) Adequate numbers of employees and other agents to examine for compliance with 
applicable FDA food safety requirements of the FD&C Act and FDA regulations, 
conformance with applicable industry standards and practices, and issuance of valid 
and reliable certification ( 1.642(a)(1)); and 
(2) Adequate financial resources for its operations ( 1.642(a)(2)). 
 
To be adequate, a third-party certification bodys resources should include: 
  A documented organizational structure with clear roles, responsibilities, and lines of 
authority; 
  Staff (i.e., employees and other agents) necessary to provide support services for the 
certification program and to conduct quality assurance activities; 
  The resources necessary to ensure that auditors and managers are adequately trained; 
  The equipment necessary to conduct audits; 
  The resources, other than staff, necessary to accomplish audits and, as appropriate, 
sampling, and analysis by a laboratory accredited for such analysis under ISO/IEC 
17025:2017 as described in  1.651(b)(3); 
  The resources necessary to properly maintain appropriate records; and 
  The resources for effective communication with eligible entities (e.g., foreign food 
facilities that are required to register under section 415 of the FD&C Act), accreditation 
bodies, and FDA 
 
For additional guidance on capacity, we recommend that recognized accreditation bodies and 
third-party certification bodies refer to the following, as applicable: 
  ISO/IEC 17021:2011, subclause 5.3.2, Liability and Financing and subclause 7.2.2, 
Personnel involved in the certification activities 
  ISO/IEC 17021:2015, subclause 5.3.2, Liability and Financing and subclauses 7.2.1 
and 7.2.2, Personnel involved in the certification activities; and 
  ISO/IEC 17065:2012, subclause 4.3.2, Liability and Financing and subclause 6.1.1.1, 
Certification body personnel 
 
B. Competency 
 
To qualify for accreditation under 21 CFR part 1, subpart M, a third-party certification body 
must demonstrate that its employees and other agent(s) have relevant knowledge, skills, and 
  9   
Contains Nonbinding Recommendations 
experience to effectively examine for compliance with applicable FDA food safety requirements 
of the FD&C Act and FDA regulations, conformance with applicable industry standards and 
practices, and decisions on issuance of valid and reliable certifications ( 1.642(a)(1)). 
 
Where a third-party certification body is a single individual, such individual must have the 
relevant knowledge, skills, and experience both to conduct food safety audits and to issue valid 
and reliable certifications, in the manner described in this document. Where a third-party 
certification body uses employees or other agents to conduct food safety audits, relevant 
knowledge, skills, and experience may be divided among various individuals. FDA recommends 
that the knowledge, skills, and experience of employees and agents of third-party certification 
bodies be assessed using objective criteria, such as through a written test or oral questions on the 
food safety requirements of the FD&C Act and FDA regulations. 
 
Before assigning an audit agent to conduct a specific food safety audit, a third-party certification 
body must determine that the agent is qualified to conduct the audit under the criteria established 
in  1.650(a), considering the scope and purpose of the audit and the type of facility, its 
process(es), and food ( 1.650(b)). Specifically, once accredited, a third-party certification body 
must ensure that any audit agent it uses to conduct food safety audits under the third-party 
certification program meets the following competency requirements: 
(1) Has relevant knowledge and experience that provides an adequate basis for the audit 
agent to evaluate compliance with applicable food safety requirements of the 
FD&C  Act  and  FDA  regulations  and,  for  consultative  audits,  also  includes 
conformance with applicable industry standards and practices ( 1.650(a)(1)); 
(2) Has been determined by the accredited third-party certification body, through 
observations of a representative sample of audits, to be competent to conduct food 
safety audits under 21 CFR part 1, subpart M ( 1.650(a)(2)); and 
(3) Has completed annual food safety training that is relevant to activities conducted 
under 21 CFR part 1, subpart M ( 1.650(a)(3)). 
 
1. Recommended Prerequisites for Auditors (e.g., Audit Agents) and Managers: 
 
A third-party certification bodys certification program should define requirements to qualify 
auditors and managers involved in food safety audit related functions. The requirements should 
include the following elements: 
 
Education and/or Experience--Entry Level Auditor 
  A full course of study at an accredited college or university leading to a bachelors or 
higher degree in a food-related or relevant scientific discipline; or 
  30 semester hours of course work or an equivalent level of instruction as described 
above, plus appropriate experience or additional education; or 
  Demonstration of sufficient knowledge and experience to successfully perform the 
function required and designated tasks. 
 
Education and/or Experience--Lead Auditor 
  At least five years full-time experience in food or associated industry, including two 
years work in quality assurance or food safety functions in food production or 
manufacturing, retail, inspection, or enforcement, or the equivalent; 
  10   
Contains Nonbinding Recommendations 
  Other formal qualifications (e.g., an advanced degree) as a substitute for a maximum of 
three years of working experience towards five years of experience. 
 
Personal Attributes and Code of Conduct 
Skills, personal attributes, and behaviors of auditors and management should include: 
  High ethical standards 
  Objectivity 
  Reasoning skills 
  Interpersonal skills 
  Analytical skills 
  Communication skills 
  Diligence 
  Adaptability 
  Tenacity 
  Intuition 
  Observational skills 
 
2. Training for Auditors and Managers 
 
Training in FDAs food safety requirements: The third-party certification body, its managers, 
and its auditors should understand and properly apply FDAs food safety requirements under the 
FD&C Act and FDA regulations for purposes of auditing and issuing certifications under the 
third-party certification program. Technical training may vary depending on the processes and 
products being audited and should address any gaps in trainees knowledge or changes in 
applicable FDA requirements. 
 
Continuing professional development: To help keep the audit agents knowledge current. 
Training methods may include classroom training, annual food safety training, and joint audits 
with a qualified trainer to help the audit agent apply classroom learning. 
 
3. Ensuring competency of employees and other agents 
 
Evaluation criteria: The third-party certification body should have a documented process for 
performing initial and on-going evaluations of auditor knowledge, skills, and abilities, with 
documented evaluation criteria that includes requirements for witness audits (i.e., 
observations of audits). 
 
Monitoring: The third-party certification body should have a documented process for on-going 
monitoring of auditors to assure consistency in audit performance. Monitoring methods may 
include review of records of audits; feedback from audited firms, supervisors, and peers; and 
periodic witness audits. 
 
Frequency of evaluation: The third-party certification body should evaluate auditor performance 
annually, at a minimum, and confirm skills through a witness audit at least once every two years. 
 
For additional guidance on competency, we recommend that recognized accreditation bodies and 
third-party certification bodies refer to the following, as applicable: 
  11   
Contains Nonbinding Recommendations 
  ISO/IEC 17021:2011, subclause 7.1, Competence of management and personnel, 
subclause 7.2, Personnel involved in the certification activities; 
  ISO/IEC 17021:2015, subclause 7.1, Competence of personnel, and subclause 7.2, 
Personnel involved in the certification activities; and 
  ISO/IEC 17065:2012, subclause 6.1, Certification body personnel 
 
VI. Conflicts of interest 
A third-party certification body seeking accreditation must demonstrate that it has implemented 
written measures to protect against conflicts of interest between the third-party certification body 
(and its officers, employees, and other agents involved in auditing and certification activities) 
and clients seeking examinations or certification from, or audited or certified by, such third-party 
certification body ( 1.643(a)). 
 
Further, a third-party certification body must have the capability to meet the conflict of interest 
requirements in proposed  1.657, if accredited ( 1.643(b)). Section 1.657 requires a written 
program to protect against conflicts of interest between the accredited third-party certification 
body (and its officers, employees and other agents involved in auditing and certification 
activities) and an eligible entity seeking a food safety audit or food or facility certification from, 
or audited or certified by, such accredited third-party certification body. Such a program should 
include measures for promoting independence, objectivity, and impartiality in third-party 
certification body activities and should include procedures for effectively identifying, 
investigating, and resolving conflicts of interest. The required elements of the written conflict of 
interest program are described in the Records section below (section VIII). 
 
For additional guidance on impartiality, objectivity, and conflict of interest safeguards, we 
recommend that recognized accreditation bodies and third-party certification bodies refer to the 
following, as applicable: 
  ISO/IEC 17021:2011, subclause 5.2, Management of impartiality; 
  ISO/IEC 17021:2015, subclause 5.2, Management of impartiality; and 
  ISO/IEC 17065:2012, subclause 4.2 Management of impartiality. 
 
We note that for purposes of the third-party certification program, an accredited third-party 
certification body may allow its audit agents to conduct both consultative audits and regulatory 
audits of the same eligible entity within a 13-month period, if the third-party certification body 
demonstrates to FDA under  1.663 that there is insufficient access to accredited third-party 
certification bodies in the country or region where the eligible entity is located. If the accredited 
third-party certification body is an individual, that individual is also subject to such limitations ( 
1.650(c)). 
 
Additionally, in order to meet the conflict of interest requirements of  1.657, a third-party 
certification body must be capable of maintaining a Web site with an up-to-date list of the 
eligible entities to which it has issued food or facility certifications under 21 CFR part 1, subpart 
M, as required under  1.657(d). For each such eligible entity on the list, the Web site must also 
identify the duration and scope of the certification and the date(s) on which the eligible entity 
paid the third-party certification body any fee or reimbursement associated with the certification 
  12   
Contains Nonbinding Recommendations 
( 1.657(d)). 
 
For additional guidance, we recommend that recognized accreditation bodies and third-party 
certification bodies refer to the following, as applicable: 
  ISO/IEC 17021:2011, subclause 8.1, Publicly accessible information; 
  ISO/IEC 17021;2015, subclause 8.1, Public information; and 
  ISO/IEC 17065:2012, subclause 4.6, Publicly available information, and subclause 7.8, 
Directory of certified products. 
 
VII. Quality assurance 
A third-party certification body must demonstrate that it has implemented a written program for 
monitoring and evaluating the performance of its officers, audit agents, and managers involved 
in auditing and certification activities ( 1.644(a)). 
 
A third-party certification body also must demonstrate the capability to meet the quality 
assurance requirements of  1.655 ( 1.644(b)). These requirements include periodic self- 
assessment; the ability to identify deficiencies in complying with the implementing 
requirements; the ability to quickly implement effective corrective actions to address any 
deficiencies; establishment and maintenance of corrective actions; and preparation of a written 
report in English of the results of the self-assessments (see  1.655). 
 
Additionally, we recommend that the third-party certification body establish procedures for 
annual reviews of its management system to ensure its continued adequacy, effectiveness, and 
impartiality, including assessment of the results of self-assessments and other internal audits, 
appeals and complaints, and other relevant input or feedback. We recommend that the review 
includes: 
  Identification of areas for improvement in auditing activities and certification decision- 
making and the root cause(s) for any deficiencies; 
  Identification and implementation of appropriate corrective action(s) for any deficiency; 
  Assessment of the effectiveness of corrective actions taken for any deficiencies identified 
during the preceding years review including external complaints; 
  Evaluation of the compliance of officers, personnel and other agents with conflict of 
interest measures; and 
  Identification of any resource needs. 
 
For additional guidance on establishing and maintaining a management system that is capable of 
meeting quality assurance requirements, we recommend that recognized accreditation bodies and 
third-party certification bodies refer to the following, as applicable: 
  ISO/IEC 17021:2011, clause 10, Management system requirements for certification 
bodies; 
  ISO/IEC 17021:2015, clause 10, Management system requirements for certification 
bodies; and 
  ISO/IEC 17065:2012, clause 8, Management system requirements. 
 
VIII. Records 
  13   
Contains Nonbinding Recommendations 
A. Records procedures 
 
A third-party certification body seeking accreditation must demonstrate that it has implemented 
written procedures to establish, control, and retain records (including documents and data) for a 
period of time necessary to meet its contractual and legal obligations and to provide an adequate 
basis for evaluating its program and performance ( 1.645(a)). 
 
A third-party certification body seeking accreditation must demonstrate that it is capable of 
meeting the records requirements of  1.658, if accredited ( 1.645(b)). Section 1.658(a) states 
that an accredited third-party certification body must maintain electronically, for 4 years, records 
created during its period of accreditation that document compliance with 21 CFR part 1, subpart 
M, including: 
(1) Any audit report and other documents resulting from a consultative audit conducted under 21 CFR 
part 1, subpart M, including the audit agent's observations, correspondence with the eligible entity, 
verification of any corrective action(s) taken to address deficiencies identified during the audit; 
(2) Any request for a regulatory audit from an eligible entity; 
(3) Any audit report and other documents resulting from a regulatory audit conducted under 21 CFR 
part 1, subpart M, including the audit agent's observations, correspondence with the eligible 
entity, verification of any corrective action(s) taken to address deficiencies identified during the 
audit, and, when sampling and analysis is conducted, laboratory testing records and results from a 
laboratory that is accredited under ISO/IEC 17025:2017 to perform such analysis  in accordance 
with   1.651(b)(3), and documentation demonstrating such laboratory is accredited in accordance 
with  1.651(b)(3); 
(4) Any notification submitted by an audit agent to a third-party certification body of any condition 
that could cause or contribute to a serious risk to the public health discovered during a food safety 
audit in accordance with  1.650(a)(5); 
(5) Any challenge to an adverse regulatory audit decision and the disposition of the challenge; 
(6) Any monitoring it conducted of an eligible entity to which food or facility certification was 
issued; 
(7) Its self-assessments and corrective actions taken; and 
(8) Significant changes to its auditing or certification program that might affect compliance with 
subpart M. 
 
B. Written program to protect against conflicts of interest 
 
The third-party certification body must have a written conflict of interest program that: 
(1) Ensures that a third-party certification body and its officers, personnel, or agents (other than audit 
agents subject to the provision below) do not own or have a financial interest in, manage, or 
otherwise control an eligible entity to be certified, or any affiliate, parent, or subsidiary of the entity 
( 1.657(a)(1)); 
(2) Ensures that a third-party certification body and, its officers, employees, or other agents involved in 
auditing and certification activities are not owned, managed, or controlled by any person that owns 
or operates an eligible entity to be certified ( 1.657(a)(2)); 
(3) Ensures that an audit agent of the accredited third-party certification body does not own, operate, 
have a financial interest in, manage or otherwise controls an eligible entity or any affiliate, parent, 
or subsidiary of the entity that is subject to a consultative or regulatory audit by the audit agent ( 
1.657(a)(3)); and 
(4) Prohibits an officer, employee, or other agent of the third-party certification body from accepting 
any money, gift, gratuity, or item of value from the eligible entity to be audited or certified. ( 
1.657(a)(4)). 
  14   
Contains Nonbinding Recommendations 
 
To assist accreditation bodies in documenting a written conflict of interest program, we 
recommend that third-party certification bodies identify in writing their officers, personnel, 
agents, committee members, lines of authority, and relationships to other parts of the business 
entity (if applicable) in an organizational chart, referring to ISO/IEC 17021:2015, subclause 
6.1.1, Organizational structure and top management ISO/IEC 17065:2012, subclause 5.1.2, 
Organizational structure and top management, and ISO/IEC 17065:2012, subclause 5.2.2, 
Mechanism for safeguarding impartiality, as applicable, for guidance on documenting 
organizational structure and identification of top management. 
 
C. Documentation of competence 
 
A third-party certification bodys written procedures should include procedures for the 
maintenance of current and accurate records relevant to the competence of its audit agents and 
others involved in certification activities. 
 
The third-party certification body should have developed and documented processes to: 
  Initially qualify employees and other agents involved in audit and certification functions, 
based on demonstrated competence; 
  Establish requirements for necessary advanced and/or technical training required for 
specific audits; 
  Ensure that the competence of employees and other agents involved in audit and decision 
making functions is maintained on a continuing basis; and 
  Provide employees and other agents with appropriate support and resources where 
needed. 
 
For additional guidance, we recommend that recognized accreditation bodies and third-party 
certification bodies refer to the following, as applicable; 
  ISO/IEC 17021:2011, subclause 7.4, Personnel records; 
  ISO/IEC 17021:2015, subclause 7.4, Personnel records; and 
  ISO/IEC 17065:2012, subclause 6.1.2.2, Certification body personnel. 
 
IX. Requirements for regulatory audit reports 
Section 808(b)(2) of the FD&C Act requires FDA to include in the model accreditation 
standards, requirements for regulatory audit reports. Under  1.652(b), an accredited 
certification body must, no later than 45 days after completing a regulatory audit, prepare and 
submit electronically, in English, to FDA and to its accreditation body (or, in the case of direct 
accreditation, only to FDA) a report of such regulatory audit that includes the following 
information: 
 
  The identity of the site or location where the regulatory audit was conducted, including: 
  The name, address, and FDA Establishment Identifier of the facility subject to the 
regulatory audit and a unique facility identifier, if designated by FDA; and 
  Where applicable, the FDA registration number assigned to the facility under 21 
CFR part 1, subpart H; 
  The identity of the eligible entity, if different from the facility, including: 
  15   
Contains Nonbinding Recommendations 
  The name, address, and FDA Establishment Identifier of the facility subject to the 
regulatory audit and a unique facility identifier, if designated by FDA; and 
  Where applicable, the FDA registration number under 21 CFR part 1, subpart H; 
  The dates and scope of the regulatory audit; 
  The process(es) and food(s) observed during such regulatory audit; 
  The name(s) and telephone number(s) of the person(s) responsible for the facility's 
compliance with the applicable requirements of the FD&C Act and FDA regulations; 
  Any deficiencies observed during the audit that present a reasonable probability that the 
use of or exposure to a violative product: 
  Will cause serious adverse health consequences or death; or 
  May cause temporary or medically reversible adverse health consequences or 
where the probability of serious adverse health consequences is remote; 
  The corrective action plan for addressing each deficiency identified, as discussed above, 
unless corrective action was implemented immediately and verified onsite by the 
accredited third-party certification body (or its audit agent, where applicable); 
  Whether any sampling and laboratory analysis (e.g., under a microbiological sampling 
plan) is used in the facility; and 
  Whether the eligible entity has made significant changes to the facility, its process(es), or 
products during the 2 years preceding the audit. 
  16   
Contains Nonbinding Recommendations 
Appendix 
We consulted the following additional materials in developing this guidance: 
 
  FDAs Accreditation of Third-Party Certification Bodies to Conduct Food Safety Audits and 
to Issue Certifications, Proposed Rule, 78 FR 45782, and Final Rule, 80 FR 74570, (issued 
on November 27, 2016 and codified at 21 CFR part 1, subpart M); 
  FDAs Manufactured Foods Regulatory Program Standards (MFRPS), which establish a 
uniform foundation for the design and management of State programs responsible for the 
regulation of facilities manufacturing, packaging, labeling, or holding human food; 
  FDAs draft International Comparability Assessment Tool, an objective framework, based 
on the MFRPS, for determining the robustness of a foreign trading partners overall food 
safety system; 
  FDAs Animal Feed Regulatory Program Standards, which help promote uniformity and 
consistency among animal food regulatory programs; 
  FDAs Guidance on Voluntary Third-Party Certification Programs for Foods and Feeds, 
issued in January 2009, which provided FDAs thinking at that time on general certification 
program attributes necessary to provide verification of food product safety; 
  International Medical Device Regulators Forums Competence and Training Requirements 
for Auditing Organizations, which specifies competence and training requirements for 
personnel involved in medical device regulatory audits and decision making; 
  International Medical Device Regulators Forums Requirements for Medical Device 
Auditing Organizations for Regulatory Authority Recognition; 
  ISO/IEC Guide 65:1996, General Requirements for Bodies Operating Product Certification 
Systems; 
  ISO/IEC 17065:2012, Conformity Assessment  Requirements for Bodies Certifying 
Products, Processes and Services; 
  ISO/IEC 17021:2011, Conformity assessmentRequirements for bodies providing audit 
and certification of management systems, which is referenced in the 21 CFR part 1, subpart 
M; 
  ISO/IEC 17021:2015, Conformity assessmentRequirements for bodies providing audit 
and certification of management systemsPart 1: Requirements; 
  ISO/IEC 19011:2011, Guidelines for auditing management systems; and 
  Codex Alimentarius, Guidelines for the Design, Operations, Assessment, and Accreditation 
of Food Import and Export Inspection and Certification Systems. 
  17   
Contains Nonbinding Recommendations 
Document History   
 
Status of  Timing of  Type of  Description of Changes 
Guidance  Current  Revisions 
Version 
Draft guidance  July 2015  Level 1  First version 
Final guidance  December 2016  Level 1  Edits made as described in the Federal Register 
notice at: 
https://www.federalregister.gov/documents/2016/
12/07/2016-29278/third-party-certification-body-
accreditation-for-food-safety-audits-model-
accreditation-standards 
Final guidance  February 2022  Level 2  Edits made to conform with final rule 
Laboratory Accreditation for Analyses of Foods 
 
  18