1



## Administrative Conference Recommendation 2012
- 7 Agency Use of Third
- Party Programs to Assess Regulatory Compliance Adopted December 6, 2012

Federal agencies in diverse areas have developed third

- party programs to assess whether regulated entities are in compliance with regulatory standards and other requirements. Through these programs, third parties assess the safety of imported food, childr en’s products, medical devices, cell phones and other telecommunications equipment, and electrical equipment used in workplaces. Third parties also ensure that products labeled as organic, energy

- efficient, and water

- efficient meet applicable federal stan dards. In these regulatory third

- party programs, regulated entities generally contract with and pay third parties to carry out product testing, facility inspections, and other regulatory compliance assessment activities in the place of regulatory agencies . Regulatory agencies then adopt new roles in coordinating and overseeing these third

- part ies

. 1
In some areas of regulation, Congress has directed federal agencies to develop a third

party program; in others, regulatory agencies have developed programs under existing statutory authority. A third

- party program is just one of many regulatory approaches that Congress and agencies may adopt. 2 Regulatory objectives may, for example, be adequately met by requiring regulated entities to self

- assess and report their compliance (sometimes referred

1 Agencies may use third parties in connection with regulat ory , procurement, and federal assistance programs. This recommendation addresses use of third parties in regulatory programs.

2 The Administrative Conference has addressed various approaches in prior recommendations. See , e.g. , Recommendation 94

- 1, The Use of Audited Self

- Regulation as a Regulatory Technique, 59 Fed. Reg. 44,701 (Aug. 30, 1994); Recommendation 89

- 1, Peer Review and Sanctions in the Medicare Program, 54 Fed. Reg. 28,965 (Jul. 10, 1989); Recommendation 78

- 4, Federal Agency Interaction with Private Standard

- Setting Organizations, 44 Fed. Reg. 1357 (Jan. 5, 1979).2

to as “first

- party certification”). Also, statutory restrictions on information disclosure or other legal restrictions may preclude an agency from using third parties to conduct inspections and other compliance assess ment activities. Some compliance assessment activities may be inherently governmental, and thus require performance by government personnel. 3

Several broad reasons support the growing use of third

- party programs in federal regulation. In many areas, fed eral regulatory agencies are faced with assuring the compliance of an increasing number of entities and products without a corresponding growth in agency resources. Third

- party programs may leverage private resources and expertise in ways that make regulat ion more effective and less costly. In comparison with other regulatory approaches, third

- party programs may also enable more frequent compliance assessment and more complete and reliable compliance data. Because agencies can authorize third parties loca ted in other countries to undertake assessment activities, third

- party programs may be particularly effective when regulated products or processes are international in scope. Regulatory third

- party programs raise a host of important questions. Because t hird

party programs represent a partial privatization of the public function of implementing and enforcing regulatory law, they are a form of “public

- private governance,” in which private actors play roles that are traditionally viewed as governmental in nature. 4 While third

- party programs may increase regulatory compliance or otherwise improve the performance of regulated entities and products, these programs also pose risks. 5 If they are not well

- conceived

3 Office of Mgmt. & Budget, OMB Circular No. A

- 76 (Revised May 29, 2003).

4 See William J. Novak, Public

- Private Governance: A Historical Introduction , in G OVERNMENT BY C ONTRACT : O UTSOURCING AND A MERICAN D EMOCRACY (Freeman and Minow, eds., Harvard University Press, 2009) ; Martha Minow, Public and Private Partnerships: Accounting for the New Religion , 116 H ARV
. L. R EV
. 1229, 1230 (2002

- 2003); Jody Freeman, Ex tending Public Law Norms through Privatization , 116 H ARV
. L. R EV
. 1285, 1286

- 87 (2002

- 2003); Jody Freeman, Private Parties, Public Functions and the New Administrative Law, in R ECRAFTING THE R ULE OF L AW : T HE L IMITS OF L EGAL O RDER 331 (David Dyzenhaus ed., Hart, 1999).

5 See Lesley K. McAllister, Regulation by Third

- Party Verification , 53 B.C. L. R EV . 1 (2012).3

and well

- operated, they may both undermine the achievement of regulatory goals and impose unnecessary costs on agencies and regulated entities. Frequently, regulatory third

- party programs use the practices and terminology of a conformity assessment framework that has been developed by international private

- sector standards organizations. “Conformity assessment” is defined in international standards as the “demonstration that specified requirements relating to a product, process, system, person, or body are fulfilled.” 6 International standards also set forth how the organizations that conduct conformity assessment

– “conformity assessment bodies,” which are usually private organizations

– should operate. International standards have been developed for various types of conformity assessment bodies, including testing bodies, certification bodies, and inspection bodies. Recognizing the assessment of regulatory compliance as a form of conformity assessment, many federal agencies that have established third

- party programs have relied on conformity assessment standards and bodies. Agencies may require, for example, that third parties that certify conformity with regulatory requirements operate in accordance with the international standards for certification bodies. Federal agencies may also requir e that the third parties be accredited by accreditation bodies that operate in accordance with international accreditation standards. Accreditation bodies are established in many countries, and they may be either private or governmental. Agencies that establish third

- party programs generally cannot or do not delegate their regulatory authority to conformity assessment bodies. Rather, agencies authorize conformity assessment bodies to perform certain technical tasks to assess conformity, a nd regulatory agencies rely on these assessments in their own enforcement of regulatory requirements. The

6 American National Standards Institute (ANSI), National Conformity Assessment Principles for the United States, 3, available at http://publicaa.ansi.org/sites/apdl/Documents/News%20and%20Publications/Brochures/ NCAP%20second%20edition.pdf

.4

goal is to leverage private expertise and resources to serve regulatory objectives. Because the regulatory agency must remain ultimately responsible for achieving regulatory objectives, it is vital to provide public oversight of third

- party assessment activities. A key resource for agencies considering a regulatory third

- party program is the National Institute of Standards and Technology (NIST), which has the responsibility under the National Technology Transfer and Advancement Act of 1995 to coordinate government conformity assessment activities with similar activities of private

- sector entities, with the goal of avoiding unnecessary duplication and c omplexity. Following Office of Management and Budget (OMB) Circular A

- 119, NIST published guidance in 2000 for federal agencies on conformity assessment activities. 7 NIST: (1) provide s advice, solutions, and program support for development of technical s tandards and conformity assessment programs to support agency missions; and (2) develop s and conduct s customized standards

- related workshops and educational events for government. Recognizing the growing use of third parties and the issues it raises, the Administrative Conference makes this recommendation to assist federal agencies in determining whether and how to establish third

- party programs to assess regulatory compliance. The recommendation first suggests that , when considering a third

- party program , agencies should consult relevant governmental and nongovernmental resources. Next, agencies should compare the advantages and disadvantages of a third

- party approach to a more traditional approach of direct governmental compliance assessment. Also, if an agency is considering a program in which regulated entities could choose whether to contract with a third party for regulatory compliance assessment, it should first determine that regulated entities will have sufficient incentives to choose to contract with a third party.

7 OMB Circular A

- 119 Revised §§ 8, 13(e) (Feb. 10, 1998); NIST, Guidance on Federal Conformity Assessment Activities, 65 Fed. Reg. 48,894 (Aug. 10, 2000).5

The recommendation then sets forth considerations for agencies after they have decided to establish a third

- party program. An agency should design conformity assessment programs to be proportional to the risks associated with regula tory noncompliance. When regulatory noncompliance implies serious risk to public health, safety, or other important values, third

- party program rules should guarantee a high degree of rigor and independence. When possible, the agency should incorporate e xisting conformity assessment standards, which may avoid unnecessary duplication and create efficiencies for both agencies and regulated entities. The agency should also ensure appropriate government and public access to information about program operatio n. Finally, the agency should undertake appropriate oversight activities to ensure that the third

- party program fulfill s its regulatory purpose. 

### RECOMMENDATION
A. Considerations for a Federal Agency When Deciding Whether to Develop a Third
- Party Program to Assess Regulatory Compliance

1. Resources . When considering whether to develop a third

- party program to assess regulatory compliance, the agency should consult governmental and non

- governmental resources relating to third

- party conformity assessment , as appropriate . These include, but are not limited to, the National Institute of Standards and Technology (NIST); private conformity assessment standards, particularly the standards of the International Organization for Standardization (ISO); and conformi ty assessment bodies, for practical input on feasibility and the impacts on the regulated entities.

2. Compare Regulatory Approaches. The agency should compare a third

- party approach with direct governmental assessment of compliance. In choosing between them, the agency should evaluate the advantages and disadvantages of these approaches, with consideration of:6

(a) whether third

- party conformity assessment is likely to be effective in practice and as a technical matter for the applicable regulatory stan dards and context; ( b ) the costs and potential delay that may result from developing and establishing a third

- party program; ( c ) the capacity of the agency to perform effective oversight and its related costs; ( d ) the potential for the agency to achie ve efficiencies through reducing its direct compliance assessment costs and resource needs; ( e ) the costs to regulated entities of paying third parties to perform conformity assessment activities, which are likely to be of particular concern to small busi nesses; ( f ) the potential for development of a well

- functioning market in third

- party conformity assessment services; and ( g ) the benefits that may accrue to regulated entities by, for example, receiving regulatory approval to market their products more quickly or simultaneously satisfying the regulatory requirements of other agencies to which they are subject, including state agencies or agencies in other countries. ( See Administrative Conference of the United States, Recommendation 2011

- 6, Internation al Regulatory Cooperation, 77 Fed. Reg. 2257, 2259 (Jan. 17, 2012); Exec. Order 13,609 (May 1, 2012); Exec. Order 13,563 (Jan. 18, 2011)).

3. Evaluate Incentives. If an agency is contemplating a third

- party program in which regulated entities would have the choice of either contracting with third parties or being assessed directly by the agency, the agency should evaluate whether sufficient incentives exist or can be created to attract the participation of regulated entities in the third

- party program. I ncentives for regulated entities to utilize third parties may include: (a) exemption from a governmental fee that would otherwise be applicable; or7

(b) the ability to satisfy the regulatory requirements of multiple jurisdictions through a single third

- party conformity assessment engagement. B. Considerations for a Federal Agency When Establishing a Third
- Party Program to Assess Regulatory Compliance

4. Proportionality to the Risk . An agency that has decided to establish a third

- party program to ass ess regulatory compliance, or is directed by statute or other provision of law to do so, should design its conformity assessment program to be proportional to the risks associated with regulatory noncompliance. When the risks are high, a conformity assess ment program should be characterized by high degrees of rigor and independence. When the risks associated with noncompliance are lower, the regulatory objective may be achievable with less rigor and independence. Types of rules that may be established by the agency to help ensure rigor and independence include: (a) accreditation rules that set high standards of competence for the accreditation of third parties; (b) selection rules that pertain to how regulated entities select third parties, requiring, for example, that third parties disclose conflicts of interests or that regulated entities contract with a different third party after a specified number of assess ments; (c) performance rules that require third parties to perform a rigorous set of assessment activities; and (d) reporting rules that require third parties to provide sufficient information to the agency and the public about the process and outcomes of assessment activities.

5. Use of Existing Conformity Assessment Standards . The agency should consider relying on existing conformity assessment standards, particularly international standards that set forth requirements for conformity assessment and a ccreditation bodies. Incorporating8

existing standards may reduce costs for the agency and for the regulated entities. T o evaluate the suitability of using existing standards, t he agency should take into account the following considerations: (a) When an agency incorporates existing conformity assessment standards into its program requirements, important concerns may arise about the public availability of those standards due to the costs of obtaining copyrighted materials. When an agency considers incorp orating copyrighted material by reference, the agency should be cognizant of issues relating to incorporation by reference. ( See Administrative Conference of the United States, Recommendation 2011

- 5, Incorporation by Reference, 77 Fed. Reg. 2257 (Jan. 17, 2012)); (b) An agency that anticipates the use of conformity assessment bodies in other countries may particularly benefit by recognizing accreditation bodies that operate in accordance with international standards rather than the agency itself accredit ing conformity assessment bodies; (c) When an agency incorporates existing standards into its requirements for third parties, it can supplement those standards with program

- specific rules. An agency may require, for example, that in addition to being accredited to an international standard, a conformity assessment body must satisfy accreditation rules specific to the third

- party program; and (d) Agencies should also be aware that existing conformity assessment standards may include confidentiality pro visions that apply to information collected during the assessment. Agencies should consider when disclosure to agencies and/or the public is necessary and when confidentiality may be justified. Program

- specific reporting rules, as discussed in section 6 below, may be necessary to enable appropriate governmental or public access to such information.9

6. Access to Information. The agency should ensure that both the government and the public will have appropriate access to information about program operati ons. An agency’s development of third

- party program rules and guidance should include notice and an opportunity for public participation. Also, the agency should provide information to the public about the roles and identities of the third parties asso ciated with a regulatory program. Finally, the agency should establish reporting rules that require third parties to provide information to the agency based on the following considerations: (a) The reporting rules should facilitate transparency. Informa tion about the compliance of regulated entities should be available from the agency to the public, comparable to what would be available in the absence of a third

- party program. Agencies may also be able to provide additional compliance information to the public that was not available before the third

- party program; (b) The reporting rules should facilitate appropriate agency oversight. For example, conformity assessment bodies can be required to report to the agency potential conflicts of interest befo re performing a conformity assessment, or provide the dates of their assessment activities so that the agency can conduct site visits; (c) I n certain circumstances , the agency might have reporting rules that require conformity assessment bodies to send assessment results directly to the agency; and (d) The agency might require conformity assessment bodies and/or regulated entities to report electronically, which may facilitate the provision of information to the public.

7. Agency Oversight. T he agency has a duty to exercise oversight to ensure that the third

- party program is fulfilling its regulatory purpose. An agency should generally set forth how it intends to conduct such oversight. F or example, it may annually audit a certain number of accreditations or conformity assessments, or carry out a market surveillance program to test10

regulated products off

- the

- shelf. In exercising oversight, the agency should also take into account the following considerations: (a) Beyond conducting direct ov ersight, an agency can require third parties to conduct additional assessment activities that provide further information to the agency about program operation. For example, an agency may require accreditation bodies annually to audit a certain number of conformity assessments, or it may require conformity assessment bodies to conduct particular types of surveillance on products they assess; (b) The agency should establish procedures for receiving and responding to public complaints regarding potential no ncompliance or other aspects of program operation. The agency could, for example, require a third party that has assessed the conformity of a regulated product or entity to investigate a complaint of noncompliance. In any event , the agency should ensure that complaints are resolved in an appropriate and timely manner; and (c) The agency should make clear the possible adverse actions that it may take against third parties that do not comply with program rules. A key adverse action is removing third parties from the program. Third parties may be removed temporarily through a suspension of accreditation, or permanently through a withdrawal of accreditation.