```

[Federal Register Volume 77, Number 101 (Thursday, May 24, 2012)]
[Rules and Regulations]
[Pages 31074-31085]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2012-10922]

[[Page 31073]]

Vol. 77

Thursday,

No. 101

May 24, 2012

Part II

Consumer Product Safety Commission

-----------------------------------------------------------------------

16 CFR Parts 1112 and 1118

Audit Requirements for Third Party Conformity Assessment Bodies and 
Requirements Pertaining to Third Party Conformity Assessment Bodies; 
Final Rule and Proposed Rule

Federal Register / Vol. 77 , No. 101 / Thursday, May 24, 2012 / Rules 
and Regulations

[[Page 31074]]

-----------------------------------------------------------------------

CONSUMER PRODUCT SAFETY COMMISSION

16 CFR Part 1112

[CPSC Docket No. CPSC-2009-0061]

 Audit Requirements for Third Party Conformity Assessment Bodies

AGENCY: Consumer Product Safety Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Consumer Product Safety Commission (``CPSC,'' 
``Commission,'' or ``we'') is issuing a final rule establishing 
requirements for the periodic audit of third party conformity 
assessment bodies as a condition of their continuing accreditation.
    The final rule implements a section of the Consumer Product Safety 
Act (``CPSA''), as amended by the Consumer Product Safety Improvement 
Act of 2008 (``CPSIA'').

DATES: This rule is effective on July 23, 2012.

FOR FURTHER INFORMATION CONTACT: Randy Butturini, U.S. Consumer Product 
Safety Commission, 4330 East West Highway, Bethesda, MD 20814; 301-504-
7562; email: RButturini@cpsc.gov.

SUPPLEMENTARY INFORMATION: 

I. Introduction

    In the Federal Register of August 13, 2009 (74 FR 40784), we 
published a proposed rule that would establish requirements for the 
periodic audit of third party conformity assessment bodies as a 
condition of their continuing accreditation. The proposed rule would 
implement section 14(d)(1) of the CPSA, as amended by section 102(b) of 
the CPSIA. (On August 12, 2011, the President signed into law Public 
Law 112-28, which amended both the CPSA and the CPSIA. Section 10(a) of 
Public Law 112-28 redesignates what was identified as section 14(d) of 
the CPSA in the preamble of the proposed rule as section 14(i) of the 
CPSA; consequently, except where we are citing language from the 
proposed rule, the remainder of this document will refer to section 
14(i) of the CPSA.)
    Section 14(a)(1) of the CPSA (15 U.S.C. 2063(a)(1)) requires that 
the manufacturer (including the importer) and the private labeler, if 
any, of a product that is subject to an applicable consumer product 
safety rule under the CPSA, or any similar rule, ban, standard, or 
regulation under any other Act enforced by the CPSC, issue a 
certificate, which certifies ``based on a test of each product or upon 
a reasonable testing program, that such product complies with all 
rules, bans, standards, or regulations applicable to the product under 
this Act or any other Act enforced by the Commission'' and specifies 
each rule, ban, standard, or regulation applicable to the product. This 
requirement applies to any such product manufactured on or after 
November 12, 2008.
    Section 14(a)(2) of the CPSA establishes a third party testing 
requirement for children's products that are subject to a children's 
product safety rule. In general, section 14(a)(2) of the CPSA states, 
in part, that every manufacturer or private labeler (if the children's 
product bears a private label) of such products shall submit sufficient 
samples of the product, or samples that are identical in all material 
respects to the product, to an accredited third party conformity 
assessment body to be tested for compliance with such children's 
product safety rule.
    In the Federal Register of May 20, 2010 (75 FR 28336), we published 
a proposed rule that would establish the requirements for a reasonable 
testing program and for compliance and continued testing of children's 
products. In the Federal Register of November 8, 2011 (76 FR 69482), we 
published a final rule with respect to compliance and continued testing 
of children's products.
    Section 14(a)(3) of the CPSA establishes various timelines for 
accreditation and requires the Commission to publish a notice of the 
requirements for accreditation of third party conformity assessment 
bodies to assess conformity with specific laws or regulations. We have 
published several notices of requirements in the Federal Register (see, 
e.g., 76 FR 49286 (August 10, 2011) (``Third Party Testing for Certain 
Children's Products; Notice of Requirements for Accreditation of Third 
Party Conformity Assessment Bodies to Assess Conformity with the Limits 
on Phthalates in Children's Toys and Child Care Articles,''); 76 FR 
46598 (August 3, 2011) (``Third Party Testing for Certain Children's 
Products; Toys: Requirements for Accreditation of Third Party 
Conformity Assessment Bodies'')). Section 14(a)(3)(C) of the CPSA 
states that accreditation of third party conformity assessment bodies 
may be conducted by the Commission or by an independent accreditation 
organization designated by the Commission.
    Section 14(i)(1) of the CPSA requires the Commission to establish 
``requirements for the periodic audit of third party conformity 
assessment bodies as a condition for the continuing accreditation of 
such conformity assessment bodies'' under section 14(a)(3)(C) of the 
CPSA. This final rule implements section 14(i)(1) of the CPSA.

II. Comments on the Proposed Rule, the CPSC's Responses, and a 
Description of the Final Rule

    The proposed rule would create a new part 1112, titled, ``Audit 
Requirements for Third Party Conformity Assessment Bodies,'' in Title 
16 of the Code of Federal Regulations. Six commenters responded to the 
proposal.
    We describe and respond to the comments in this section of this 
document and also describe the final rule. A summary of each of the 
commenter's topics is presented, and each topic is followed by staff's 
response. For ease of reading, each topic will be prefaced with a 
numbered ``Comment''; and each response will be prefaced by a 
corresponding numbered ``Response.'' Each ``Comment'' is numbered to 
help distinguish between different topics. The number assigned to each 
comment is for organizational purposes only and does not signify the 
comment's value, or importance, or the order in which it was received. 
Comments on similar topics are grouped together.

A. Comments on Specific Provisions

    Most commenters addressed specific sections in the proposed rule, 
or referenced issues associated with a particular term in a proposed 
section, but not directly relevant to the proposed section itself. We 
address those comments in this section. However, on our own initiative, 
we have renumbered the sections and renamed the part in which the 
sections will be placed. For example, proposed Sec.  1112.1, titled, 
``Purpose,'' is now renumbered as Sec.  1112.20. As another example, 
the proposed rule would have created a part 1112, titled, ``Audit 
Requirements for Third Party Conformity Assessment Bodies''; however, 
the final rule divides the audit requirements into two subparts and 
renames part 1112, ``Requirements Pertaining to Third Party Conformity 
Assessment Bodies.'' We have taken this action because, elsewhere in 
this issue of the Federal Register, we have published a proposed rule 
to establish other requirements pertaining to third party conformity 
assessment bodies (such as the requirements for accreditation and 
provisions for the withdrawal and suspension of third party conformity 
assessment bodies) and wish to place all requirements for third party 
conformity assessment bodies in a single location. This will make it 
easier for interested

[[Page 31075]]

parties to locate the regulations pertaining to third party conformity 
assessment bodies.
1. Sec.  1112.30--Purpose
    Proposed Sec.  1112.1 (now renumbered as Sec.  1112.30 in the final 
rule) would describe the purpose of the audit rule. In brief, proposed 
Sec.  1112.1 would state that part 1112 ``establishes the audit 
requirements for third party conformity assessment bodies pursuant to 
section 14(d)(1) of the Consumer Product Safety Act (CPSA) (15 U.S.C. 
2063(d)(1)).'' Under section 14(i)(1) of the CPSA, compliance with the 
requirements in part 1112 would be a condition of continuing the 
accreditation of such third party conformity assessment bodies.
    (Comment 1)--One commenter noted that the proposal referred to 
certifying organizations under the Labeling of Hazardous Art Materials 
Act (LHAMA). The commenter stated that art and craft companies cannot 
afford both LHAMA and what the commenter called ``redundant'' testing 
under the CPSIA. The commenter said that retailers that do not 
recognize the Art and Creative Materials Institute (ACMI) as a third 
party conformity assessment body are demanding additional tests. The 
commenter said the CPSC should consider the acceptance of current 
certification programs, such as ACMI's, to be in full compliance with 
the CPSIA.
    (Response 1)--Although issues related to product testing are 
outside the scope of the audit rule, the commenter may have 
misinterpreted the statute and the proposed rule's reference to 
certifying organizations under LHAMA. Section 14(f)(2)(C) of the CPSA 
states that certifying organizations, as defined in appendix A to 16 
CFR 500.14(b)(8), are third party conformity assessment bodies with 
respect to certifying art materials and art products to Federal 
Hazardous Substances Act (FHSA) requirements. Current certification 
programs, such as ACMI's, are for certifying to LHAMA rules. Section 14 
of the CPSA, however, also requires children's products to be tested 
for compliance to children's product safety rules; and it defines 
``children's product safety rules'' as ``a consumer product safety rule 
under [the CPSA] or similar rule, regulation, standard, or ban under 
any other Act enforced by the Commission, including a rule declaring a 
consumer product to be a banned hazardous product or substance.'' Thus, 
because the definition of ``children's product safety rule'' is broader 
than certification of art materials and art products to FHSA 
requirements, testing under section 14 of the CPSA is not ``redundant'' 
to LHAMA certification.
    Therefore, the final rule retains the text of the ``Purpose'' 
section, although we have replaced ``part,'' with ``subpart,'' to 
reflect that the audit requirements are now subpart C of part 1112. 
Additionally, on our own initiative, we have:
     Changed the title from ``Purpose,'' to ``What Is the 
Purpose of this Subpart?'' to be consistent with the style used for 
other headings in the final rule;
     Revised the second sentence stating that ``Compliance with 
these requirements is condition for the continuing accreditation * * 
*'' to ``Compliance with these requirements is a condition of the 
continuing accreditation * * *''; and
     Revised the third sentence by inserting a comma between 
``Labeling of Hazardous Art Materials Act'' and ``even.''
    These changes are not substantive, and the latter two changes were 
made for grammatical purposes.
2. Subpart A--Purpose and Definitions
    Proposed Sec.  1112.3 would define various terms used in part 1112. 
The final rule now places all definitions in Sec.  1112.3 in subpart A, 
``Purpose and Definitions.''
a. Accreditation
    Proposed Sec.  1112.3(a) would define ``accreditation'' as:
    A procedure by which an authoritative body gives formal recognition 
that a third party conformity assessment body is competent to perform 
specific tasks. Accreditation recognizes a third party conformity 
assessment body's technical competence and is usually specific for 
tests of the systems, products, components, or materials for which the 
third party conformity assessment body claims proficiency.
    The preamble to the proposed rule explained that the definition was 
based on a description used by the International Organization for 
Standardization (ISO) in relation to ISO Standard ISO/IEC 17025:2005, 
``General Requirements for the Competence of Testing and Calibration 
Laboratories,'' except that it uses the term ``third party conformity 
assessment body,'' instead of ``lab,'' and refers to ``technical 
competence,'' instead of ``technical capability'' (see 74 FR at 40785). 
We explained that the term ``third party conformity assessment body'' 
is used in section 14(a)(3)(C) of the CPSA, and that we were aware that 
ISO/IEC 17025:2005, by reference, incorporates the definitions set 
forth in ISO/IEC 17000:2004, ``Conformity Assessment--Vocabulary and 
General Principles,'' but we decided against adopting the definition of 
``accreditation'' in ISO/IEC 17000 because it incorporates several 
other definitions by implied reference.
    (Comment 2)--One commenter would revise the first sentence of the 
definition to define ``accreditation'' as: ``A procedure by which an 
authoritative body gives formal recognition that a third party 
conformity assessment body meets competence requirements to perform 
specific tasks.'' The commenter explained that accreditation is ``not a 
subjective assessment of competence based on whatever the individual 
assessors think is important, but rather is a requirements-based 
activity.''
    (Response 2)--We agree with the commenter, and we have revised the 
definition accordingly.
    Additionally, on our own initiative, we have revised the numbering 
in Sec.  1112.3, generally, to eliminate the paragraph designations 
before each defined term. We removed the paragraph designations to be 
more consistent with accepted formats for regulations.
    (Comment 3)--One commenter suggested revising the definition of 
``accreditation'' to ``meet the international requirement,'' but they 
did not explain what is meant by ``the international requirement.''
    (Response 3)--For purposes of this response, we assume that the 
commenter's reference to ``international requirement'' means the 
definitions used in ISO/IEC 17000:2004, ``Conformity Assessment--
Vocabulary and General Principles.'' Section 5.5 of ISO/IEC 17000: 2004 
defines ``accreditation'' as ``third party attestation (5.2) related to 
a conformity assessment body (2.5) conveying a formal demonstration of 
its competence to carry out specific conformity assessment tasks.'' As 
we explained in the preamble to the proposed rule, ISO/IEC's definition 
of ``accreditation'' incorporates several other definitions by implied 
reference; therefore, we chose to adopt a more detailed definition of 
the term, rather than adopt a definition from ISO/IEC 17000, whose 
terms would compel the reader to consult even more definitions before 
they could understand how the rule defines ``accreditation'' (see 74 FR 
at 40785).
    Alternatively, because the commenter also discussed requiring 
reciprocity, it is possible that they meant to suggest that we amend 
the definition of ``accreditation'' to include a reciprocity 
requirement. As discussed later in part II.B of this preamble in the 
response to

[[Page 31076]]

Comment 12, a reciprocity requirement is beyond the scope of this rule.
    Consequently, we decline to revise the definition as suggested by 
the commenter.
    (Comment 4)--Another commenter stated that ISO/IEC 17025:2005 and 
ISO 17000:2004 have definitions that are the result of a consensus and 
are ``universally accepted and understood.'' The commenter said that 
the proposal's use of different definitions or modification of ISO 
definitions ``will create unnecessary problems in the process of 
accreditation and audits and should be avoided.''
    (Response 4)--As the preamble to the proposed rule explained (see 
74 FR at 40785), in the definition of ``accreditation,'' we chose to 
substitute the term ``third party conformity assessment body'' instead 
of ``lab'' to be consistent with the language in section 14(a)(3)(C) of 
the CPSA. The preamble to the proposed rule explained other differences 
between the proposed definitions and ISO/IEC 17025:2005 and ISO 
17000:2004; for example, we chose to define some terms to be consistent 
with notices of requirements issued by the Commission, while other 
definitions are almost identical to the corresponding ISO definition 
(id. at 40785 through 40786).
    Furthermore, because the commenter did not identify how any 
proposed definition would cause ``unnecessary problems,'' we decline to 
revise the rule as suggested by the commenter.
b. Accreditation Body
    Proposed Sec.  1112.3(b) would define ``accreditation body'' as 
``an entity that accredits or has accredited a third party conformity 
assessment body as meeting, at a minimum, the International 
Organization for Standardization (ISO) Standard ISO/IEC 17025:2005, 
`General Requirements for the Competence of Testing and Calibration 
Laboratories,' '' and any test methods or consumer product safety 
requirements specified in the relevant notice of requirements issued by 
the Commission, and is a signatory to the International Laboratory 
Accreditation Cooperation-Mutual Recognition Arrangement. The preamble 
to the proposed rule explained that the proposed definition of 
``accreditation body'' reflects the basic elements that the Commission 
has specified in its notices of requirements for the accreditation of 
third party conformity assessment bodies. The preamble also explained 
that the phrase ``at a minimum'' recognizes that some accreditation 
bodies, as part of the accreditation process, may demand that a third 
party conformity assessment body demonstrate its conformity with 
specific methods or programs, as well as demonstrate compliance with 
ISO/IEC 17025:2005 and with any test methods identified in the relevant 
notices of requirements issued by the Commission.
    (Comment 5)--Several commenters addressed issues relating to ISO/
IEC 17025:2005 rather than the definition itself.
    One commenter said that ISO/IEC 17025:2005 is a ``good baseline,'' 
but nevertheless, asserted that the CPSC should create a mechanism to 
supervise and control the acceptance of government-owned or government-
controlled conformity assessment bodies and firewalled conformity 
assessment bodies to help ensure their protection against undue 
influence. (A firewalled conformity assessment body is one that is 
owned, managed, or controlled by a manufacturer or private labeler of a 
children's product to be tested by the conformity assessment body for 
certification purposes and that seeks accreditation under the 
additional statutory criteria for ``firewalled'' conformity assessment 
bodies.)
    (Response 5)--Although the commenter's focus on issues of undue 
influence goes beyond the scope of the rule, we note that the statutory 
accreditation requirements pertaining to undue influence and 
government-owned, government-controlled, and firewalled conformity 
assessment bodies exceed those of ISO/IEC 17025:2005. Section 
14(f)(2)(D) of the CPSA requires firewalled conformity assessment 
bodies to have procedures to ensure that test results are protected 
from undue influence by the manufacturer, private labeler, or other 
interested party. Conformity assessment bodies that apply for CPSC 
approval as firewalled laboratories must submit to the Commission 
copies of their training documents, showing how employees are trained 
to notify the Commission immediately and confidentially of any attempt 
by the manufacturer, private labeler, or other interested party to hide 
or exert undue influence over the third party conformity assessment 
body's test results.
    For governmental laboratory applicants, CPSC staff engages the 
governmental entities relevant to requests for CPSC acceptance to 
obtain the necessary assurances of compliance with the statutory 
requirements for governmental conformity assessment bodies 
(laboratories). Section 14(f)(2)(B) of the CPSA requires that 
governmental-owned or controlled conformity assessment bodies may apply 
for CPSC recognition of their accreditation and be subject to the audit 
provisions, if, among other requirements:
     The conformity assessment body's testing results are not 
subject to undue influence by any other person, including another 
governmental entity; and
     The conformity assessment body does not exercise undue 
influence over other governmental authorities controlling distribution 
of products based on outcomes of the conformity assessment body's 
conformity assessments.

Thus, the final rule retains the definition of ``accreditation body'' 
without change, except that, on our own initiative, we have inserted 
``/International Electrotechnical Commission (IEC)'' after 
``International Organization for Standardization (ISO)'' to provide the 
full name corresponding to the abbreviation ``IEC''; and we added 
``:2005'' after ``17025'' to identify the particular edition of the 
standard. We address the process for initially accepting government and 
firewalled laboratories in the proposed rule on ``Requirements 
Pertaining to Third Party Conformity Assessment Bodies.''

    (Comment 6)--One commenter said that there are substantial 
differences among accreditation bodies. In some cases, the conformity 
assessment body and the accreditation body are both government-
controlled. The commenter added that H.R. 2749, titled, the ``Food 
Safety Enhancement Act of 2009,'' has stricter requirements for 
firewalled conformity assessment bodies, including a restriction on 
such laboratories certifying their own products. The commenter 
suggested that the CPSC designate individual accreditation bodies based 
on specific criteria to prove their competency with CPSC requirements.
    (Response 6)--The Commission, through its notices of requirements, 
has required all third party conformity assessment bodies to be 
accredited by an accreditation body that is a signatory to the 
International Laboratory Accreditation Cooperation-Mutual Recognition 
Arrangement (ILAC-MRA) and further mandated that the scope of the 
accreditation include testing relative to the appropriate test 
method(s) or regulation(s) cited in the notice of requirements. All 
ILAC-MRA accreditation bodies must maintain conformity with the current 
version of ISO/IEC 17011 and related ILAC guidance documents and ensure 
that all accredited laboratories comply with ISO/IEC 17025:2005 and 
applicable ILAC policy and guidance documents. This ensures some degree 
of similarity

[[Page 31077]]

or uniformity among accreditation bodies, regardless of their 
geographical location, and it also ensures consistency among third 
party conformity assessment bodies accredited by such ILAC-MRA 
accreditation bodies. Requiring specific criteria of accreditation 
bodies is beyond the scope of the requirements for auditing conformity 
assessment bodies.
    As for the Food Safety Enhancement Act of 2009, it would restrict 
testing laboratories' certification activities. However, under section 
14 of the CPSA and CPSC regulations at 16 CFR part 1110, third party 
conformity assessment bodies do not issue certifications; accordingly, 
the bill's potential requirements are not directly relevant here. 
Additionally, nothing in section 14 of the CPSA prohibits firewalled 
conformity assessment bodies from testing a manufacturer's own 
products.
c. Audit
    Proposed Sec.  1112.3(c) would define ``audit'' as ``a systematic, 
independent, documented process for obtaining records, statements of 
fact, or other relevant information, and assessing them objectively to 
determine the extent to which specified requirements are fulfilled.'' 
The preamble to the proposed rule (74 FR at 40785) explained that this 
definition is almost identical to the definition of ``audit'' in ISO/
IEC 17000. Proposed Sec.  1112.3(c) also would explain that, for 
purposes of part 1112, an audit consists of two parts: (1) An 
examination by an accreditation body to determine whether the third 
party conformity assessment body meets or continues to meet the 
conditions for accreditation (a process known more commonly as a 
``reassessment,'' and that the remainder of this preamble will refer to 
as a ``reassessment''); and (2) the resubmission of the ``Consumer 
Product Conformity Assessment Body Acceptance Registration Form'' (CPSC 
Form 223) by the third party conformity assessment body and the CPSC's 
examination of the resubmitted CPSC Form 223 (that the remainder of 
this preamble will refer to as an ``examination'' by the CPSC).
    We received no comments on the proposed definition. However, on our 
own initiative, we have revised the phrase, ``is composed of two 
parts,'' to read ``consists of two parts.'' This change is for 
grammatical purposes only. Additionally, as stated earlier in part II.A 
of this preamble in the response to Comment 2, we have removed the 
paragraph designation; thus, the definition of ``audit'' is now at 
Sec.  1112.3 of the final rule rather than at Sec.  1112.3(c) (as 
proposed).
d. Commission
    Proposed Sec.  1112.3(d) would define ``Commission'' to mean the 
Consumer Product Safety Commission.
    We received no comments on this provision, and therefore, other 
than removing the paragraph designation (i.e., removing ``(d)'' before 
the definition of ``Commission'' appears), we have finalized the 
provision without change.
e. Quality Manager
    Proposed Sec.  1112.3(e) would define ``quality manager'' as an 
individual ``(however named) who, irrespective of other duties and 
responsibilities, has defined responsibility and authority for ensuring 
that the management system related to quality is implemented and 
followed at all times and who has direct access to the highest level of 
management at which decisions are made on the conformity assessment 
body's policy or resources.'' The preamble to the proposed rule 
explained that this definition is patterned after the explanation of 
the quality manager's role in ISO/IEC 17025:2005, section 4.1.5 (74 FR 
at 40786).
    We received no comments on this provision, and therefore, other 
than removing the paragraph designation, we have finalized the 
provision without change.
f. Use of Statutory Definitions
    Proposed Sec.  1112.3(f) would explain that, unless otherwise 
stated, the definitions of section 3 of the CPSA, and additional 
definitions in the CPSIA, are applicable for purposes of part 1112 of 
this title. Thus, for example, the CPSIA's definition of ``third party 
conformity assessment body,'' which includes independent conformity 
assessment bodies, government-owned or government-controlled conformity 
assessment bodies (subject to certain requirements in section 
14(f)(2)(B) of the CPSA), and ``firewalled'' conformity assessment 
bodies (subject to certain requirements in section 14(f)(2)(D) of the 
CPSA), would apply to part 1112; and the term ``third party conformity 
assessment body'' in part 1112 would be understood to include all three 
types of conformity assessment bodies.
    (Comment 7)--One commenter stated that referring to firewalled and 
government-owned or government-controlled conformity assessment bodies 
as ``third party conformity assessment bodies'' misuses a term with a 
specific definition. The commenter said that there are differences in 
how conformity assessment bodies operate and opined further that the 
CPSC ``needs to address those differences, not only in their 
accreditation requirements, but also in their audit requirements.''
    (Response 7)--Although the commenter did not identify a particular 
provision, we assume that the commenter was addressing part of the 
preamble to the proposed rule in which the Commission explained that 
under proposed Sec.  1112.3(f), ``unless otherwise stated, the 
definitions of section 3 of the CPSA and additional definitions in the 
CPSIA apply for purposes of part 1112 of this title'' (see 74 FR at 
40786). The preamble to the proposed rule added: ``Thus, for example, 
the CPSIA's definition of `third party conformity assessment body,' 
which includes independent conformity assessment bodies, government-
owned or government-controlled conformity assessment bodies (subject to 
certain requirements in section 14(f)(2)(B) of the CPSA), and 
`firewalled' conformity assessment bodies (subject to certain 
requirements in section 14(f)(2)(D) of the CPSA), would apply to part 
1112, and the term `third party conformity assessment body' in part 
1112 would be understood as including all three types of conformity 
assessment bodies'' (id.).
    Thus, with respect to the definition of ``third party conformity 
assessment body,'' the preamble to the proposed rule was referring to 
the section 14(f)(2) of the CPSA. Because the statute considers 
government-owned or government-controlled conformity assessment bodies 
and firewalled conformity assessment bodies to fall under ``third party 
conformity assessment body'' in section 14(f)(2) of the CPSA, we 
decline to revise the rule as suggested by the comment.
    As for establishing different accreditation requirements, sections 
14(f)(2)(B) and (f)(2)(D) of the CPSA already establish different 
requirements for government-owned or government-controlled conformity 
assessment bodies and firewalled conformity assessment bodies. 
Furthermore, the Commission, through its notices of requirements for 
the accreditation of third party conformity assessment bodies, 
establishes accreditation requirements. Thus, the commenter's request 
for different accreditation requirements is outside the scope of this 
rule.
    With respect to different audit requirements, the commenter did not 
suggest any changes to the rule that would apply to government-owned, 
government-controlled, or firewalled conformity assessment bodies. 
Consequently, we have no basis to establish different audit 
requirements

[[Page 31078]]

for different types of third party conformity assessment bodies.
3. Sec.  1112.31--Who is subject to these audit requirements?
    Proposed Sec.  1112.5 (now renumbered as Sec.  1112.31 in the final 
rule) would explain that the requirements in part 1112 apply to third 
party conformity assessment bodies operating pursuant to section 
14(a)(2) of the CPSA, and it would reiterate that third party 
conformity assessment bodies must comply with the audit requirements as 
a condition of the Commission's acceptance of their accreditation.
    We received no comments on this provision, and other than to 
renumber it, we have finalized the provision without change.
4. Sec.  1112.33--What must an audit address or cover? Who conducts the 
audit?
    Proposed Sec.  1112.3(c) would explain that, for purposes of part 
1112, an audit consists of two parts: (1) An examination by an 
accreditation body to determine whether the third party conformity 
assessment body meets or continues to meet the conditions for 
accreditation (the ``reassessment'' portion of the audit); and (2) the 
resubmission of the ``Consumer Product Conformity Assessment Body 
Acceptance Registration Form'' (CPSC Form 223) by the third party 
conformity assessment body and the CPSC's examination of the 
resubmitted CPSC Form 223. If the third party conformity assessment 
body is a ``firewalled'' conformity assessment body or a government-
owned or government-controlled conformity assessment body, the CPSC's 
examination may include verification to ensure that the entity 
continues to meet the appropriate statutory criteria pertaining to such 
conformity assessment bodies.
a. Sec.  1112.33(a)--What does the reassessment portion of the audit 
cover?
    Under proposed Sec.  1112.7(a) (now renumbered as Sec.  1112.33(a) 
in the final rule), the reassessment portion of the audit may cover the 
management systems, specific tests, types of tests, calibrations, or 
types of calibrations that are the subject of the third party 
conformity assessment body's accreditation. The proposal also stated 
that the reassessment portion must examine the third party conformity 
assessment body's management systems to ensure that the third party 
conformity assessment body is free from any undue influence regarding 
its technical judgment.
    (Comment 8)--One commenter noted that the text might be interpreted 
to require that only the management system from ISO/IEC 17025:2005 be 
met. The commenter said that we should require applicants to fulfill 
all requirements in ISO/IEC 17025:2005 rather than the management 
requirements.
    (Response 8)--We interpret the commenter as referring to the 
preamble to the proposed rule (74 FR at 40786), which states that 
``Under proposed Sec.  1112.7(a), the reassessment portion of the audit 
may cover the management systems, specific tests * * *.'' and 
referencing proposed Sec.  1112.7(a), which also uses the word ``may.''
    During the reassessment portion of the audit, the accreditation 
body examines the competence of the entire operation of the conformity 
assessment body, including the competence of the personnel, the 
validity of the conformity assessment methodology, and the validity of 
the conformity assessment results. We agree with the commenter that the 
use of the word ``may'' in these sections could be misinterpreted as 
not requiring compliance by the conformity assessment body with all 
sections of ISO/IEC 17025:2005, and the proposed rule was not intended 
to suggest that the reassessment could be limited to management systems 
alone. To the contrary, the proposal's mention of ``specific tests, 
types of tests, calibrations, or types of calibrations'' was to show 
that a reassessment extends to technical requirements too. 
Consequently, we have revised Sec.  1112.33(a) to state that the 
reassessment portion of an audit of a conformity assessment body by an 
accreditation body covers management requirements and technical 
requirements. The remainder of Sec.  1123.33(a), pertaining to 
examination of the third party conformity assessment body's management 
systems, is unchanged.
    (Comment 9)--Several commenters said that because products must be 
certified as being in compliance, the principles for impartiality and 
undue influence need to come from ISO/IEC Guide 65, General 
Requirements for Bodies Operating Product Certification Systems, which 
is a standard for certifying bodies. One commenter said that ISO/IEC 
Guide 65 is important especially for firewalled and government 
conformity assessment bodies. Additionally, the commenter said that the 
CPSC should require ``applicants'' to submit evidence of fulfillment of 
ISO/IEC 17025:2005 section 4.1.5.b. as part of their application to the 
CPSC, both initially and with ongoing audits. The commenter said that 
this information is needed in addition to current firewalled training 
and that applicants need to be able to notify the Commission about 
undue influence. Further, ISO/IEC Guide 65 has several requirements to 
protect impartiality and conflict of interest, the commenter noted.
    One commenter added that the Occupation Safety and Health 
Administration (OSHA) has a National Recognized Testing Laboratory 
(NRTL) program that uses ISO/IEC Guide 65's requirements to review a 
laboratory's independence. Rigorous evaluation of the independence of a 
laboratory should be required annually or at least with surveillance 
and reassessment visits, the commenter urged.
    Another commenter remarked that OSHA's NRTL and the U.S. Federal 
Communications Commission's (FCC's) Telecommunications Body 
Certification (TBC) programs could be used as sources.
    Another commenter suggested that we consider the principles of 
product certification outlined in the American National Standards 
Institute document, titled, ``National Conformity Assessment Principles 
for the United States.'' The commenter said that manufacturer 
certification based on testing by laboratories accredited to ISO/IEC 
17025:2005 can ensure that a product conforms to a required standard at 
the time of testing, but it ``does not ensure that the product 
continues to conform to the standard throughout production and 
distribution.''
    (Response 9)--The commenters may have misinterpreted the rule. 
Conformity assessment bodies test products, whereas domestic 
manufacturers and importers are responsible for certifying that their 
products comply with all rules, bans, standards, or regulations under 
the CPSA or any other Act enforced by the Commission under existing 
CPSC regulations at 16 CFR part 1110. Consequently, with respect to the 
comment regarding ISO/IEC Guide 65, we note that ISO/IEC Guide 65 
provides requirements for certification bodies, which have different 
requirements and responsibilities than third party conformity 
assessment bodies (which, under section 14 of the CPSA and our 
regulations at 16 CFR part 1110, test children's products but do not 
issue certificates for such products), including attestations of 
conformity and surveillance activities. The requirements to protect 
impartiality and conflict of interest in ISO/IEC Guide 65 are tailored 
toward those functions.

[[Page 31079]]

    As for the suggestion that a conformity assessment body submit 
evidence of its fulfillment of ISO/IEC 17025:2005 section 4.1.5.b. as 
part of its application to the CPSC, both initially and with ongoing 
audits, section 102(c) of the CPSIA states that in establishing 
standards for accreditation of a third party conformity assessment 
body, the Commission may consider standards and protocols for 
accreditation of such conformity assessment bodies by independent 
accreditation organizations that are in effect on the date of enactment 
(August 14, 2008). Accreditation of third party conformity assessment 
bodies may be conducted either by the Commission or by an independent 
accreditation organization designated by the Commission. In our notices 
of requirements for the accreditation of third party conformity 
assessment bodies, we have established accreditation to ISO/IEC 
17025:2005, with the accreditation conducted by an accreditation body 
that is a signatory to the ILAC-MRA as a baseline requirement for 
accreditation. Thus, we have designated accreditation organizations 
(accreditation bodies) to conduct accreditation of third party 
conformity assessment bodies. Records related to accreditation 
assessments and reassessments are maintained by the accreditation 
bodies and the third party conformity assessment bodies.
    Consequently, the commenter's suggestion regarding evidence of a 
third party conformity assessment body's fulfillment of ISO/IEC 
17025:2005 requirements is unnecessary because Sec.  1112.39 requires a 
third party conformity assessment body to retain records related to the 
last three reassessments conducted by the accreditation body and make 
such records available to the CPSC upon request. Records of 
nonconformities related to safeguards against undue influence (or any 
ISO/IEC 17025:2005 requirement), as well as the corrective actions, 
must be made available upon the CPSC's request.
    In addition, Sec.  1112.37 requires the quality manager at the 
third party conformity assessment body to notify the CPSC within five 
business days of an accreditation body's notification of suspension, 
reduction, or withdrawal of accreditation. Failure to do so may lead to 
CPSC withdrawal of the laboratory as a CPSC-recognized third party 
conformity assessment body.
    As for the comment regarding a product's continued conformity to 
standards throughout the product's production and distribution, such 
matters are outside the scope of this audit rule; instead, they are 
addressed in a separate rulemaking pertaining to ``Testing and Labeling 
Pertaining to Product Certification'' (75 FR 28336 (May 20, 2010); 76 
FR 69482 (November 8, 2011)).
b. Sec.  1112.33(b)--Who conducts the reassessment portion of the 
audit?
    Proposed Sec.  1112.7(b) (now renumbered as Sec.  1112.33(b) in the 
final rule) would require the third party conformity assessment body to 
have the accreditation body that accredited the third party conformity 
assessment body perform the reassessment portion of the audit. For 
example, if a third party conformity assessment body was accredited for 
a particular scope by an accreditation body named AB-1, then AB-1 would 
conduct the reassessment. If, however, the same third party conformity 
assessment body changes its accreditation for the same scope, such that 
it becomes accredited by a different accreditation body, named AB-2, 
then AB-2 would conduct the reassessment.
    The preamble to the proposed rule also suggested that accreditation 
bodies performing reassessments conform to ISO/IEC 17011 titled, 
``Conformity Assessment--General Requirements for Accreditation Bodies 
Accrediting Conformity Assessment Bodies'' (74 FR at 40787). The 
preamble to the proposed rule stated that certain provisions in ISO/IEC 
17011, notably sections 7.11, ``Reassessment and Surveillance''; 7.12, 
``Extending Accreditation''; and 7.13, ``Suspending, Withdrawing, or 
Reducing Accreditation,'' may be relevant, particularly when conducting 
a reassessment (id.).
    (Comment 10)--One commenter stated that only a fraction of the many 
tests which a conformity assessment body may be accredited to perform 
actually are examined during any single reassessment. The commenter 
said it is up to the accreditation body performing the reassessment to 
decide which tests to undertake. In addition, the commenter asked 
whether a conformity assessment body must insist that the accreditation 
body reassess every two years all CPSC tests to which the conformity 
assessment body is accredited.
    (Response 10)--The commenter may have confused reassessment with 
surveillance. ISO/IEC 17011 defines ``assessment'' as ``a process 
undertaken by an accreditation body to assess the competence of a 
conformity assessment body, based on particular standard(s) and/or 
other normative documents and for a defined scope of accreditation.'' 
(See ISO/IEC 17011:2004, Conformity assessment--General requirements 
for accreditation bodies accrediting conformity assessment bodies, at 
section 3.7.) Assessing the competence of a conformity assessment body 
involves assessing the competence of all conformity assessment body 
operations, including (among other things) the competence of the 
personnel, the validity of the conformity assessment methodology, and 
the validity of the conformity assessment results. Reassessment is 
described as similar to an initial assessment, except that experience 
gained during previous assessments shall be taken into account. (Id. at 
section 7.11.1.) The outcome of these different approaches is the same 
in that the accreditation body must demonstrate that it has assessed 
adequately each of the third party conformity assessment body's 
competencies (including technical and management systems competencies) 
over the reassessment period.
    ``Surveillance'' is defined as ``a set of activities, except 
reassessment, to monitor the continued fulfillment by accredited CABs 
of requirements for accreditation'' (id. at section 3.18). Typically, 
surveillance consists of a subset of the reassessment activities, and 
it is conducted between reassessments.
    We note that, on our own initiative, we have revised the last 
sentence in Sec.  1112.33(b), by inserting a comma between ``changes it 
accreditation'' and ``so that it becomes accredited. * * *'' This 
change is for grammatical purposes.
c. Sec.  1112.33(c)--What is the examination portion of the audit?
    As for the examination portion of the audit, proposed Sec.  
1112.7(c) (now renumbered as Sec.  1112.33(c) in the final rule) would 
explain that the third party conformity assessment body must have the 
examination portion of the audit conducted by the Commission. The 
examination portion of the audit would consist of resubmission of CPSC 
Form 223 by the third party conformity assessment body to the CPSC and 
the CPSC's examination of the resubmitted form. Resubmission of the 
CPSC Form 223 would occur in two ways: (1) There would be a continuing 
obligation to ensure that the information submitted on CPSC Form 223 is 
current, such that a third party conformity assessment body would 
submit a new CPSC Form 223 whenever the information changes; and (2) In 
the absence of any changes that would necessitate the submission of a 
new CPSC Form 223, the third party conformity assessment body would 
reregister at the CPSC every 2 years, using CPSC Form 223.

[[Page 31080]]

    Additionally, proposed Sec.  1112.7(c) would contain specific 
requirements for the CPSC's examination of ``firewalled'' and 
government-owned or government-controlled conformity assessment bodies. 
For ``firewalled'' conformity assessment bodies, proposed Sec.  
1112.7(c)(1) would state that the examination portion of the audit 
conducted by the CPSC may include verification to ensure that the 
``firewalled'' conformity assessment body continues to meet the 
criteria set forth in section 14(f)(2)(D) of the CPSA. Thus, for 
example, under proposed Sec.  1112.7(c)(1), we could examine whether a 
``firewalled'' conformity assessment body's established procedures 
continue to exist; and likewise, it could review its mechanisms for 
confidential reporting of allegations of undue influence. For 
government-owned or government-controlled conformity assessment bodies, 
proposed Sec.  1112.7(c)(2) would state that the examination portion of 
the audit conducted by the CPSC may include verification that the 
government-owned or government-controlled conformity assessment body 
continues to meet the five criteria set forth in section 14(f)(2)(B) of 
the CPSA. Thus, for example, under proposed Sec.  1112.7(c)(2), the 
CPSC could examine whether a government-owned conformity assessment 
body has procedures in place to ensure that its testing results are not 
subject to undue influence by any other person.
    We received no comments on this provision, and aside from 
renumbering it as Sec.  1112.33(c), we finalized the provision without 
change. Elsewhere in this issue of the Federal Register, however, we 
have published a proposed rule to establish other requirements 
pertaining to third party conformity assessment bodies (such as the 
requirements for accreditation and provisions for the withdrawal and 
suspension of third party conformity assessment bodies). The proposed 
rule would establish different requirements on the resubmission of CPSC 
Form 223, by asking for additional documentation to support CPSC Form 
223.
5. Sec.  1112.35--When must an audit be conducted?
    Proposed Sec.  1112.9(a) (now renumbered as Sec.  1112.35 in the 
final rule) would state that, at a minimum, each third party conformity 
assessment body must be reassessed at the frequency established by its 
accreditation body for reassessments of the accreditation. For example, 
if the accreditation body would conduct a reassessment to reexamine a 
third party conformity assessment body's accreditation after 2 years, 
the minimum reassessment frequency for that third party conformity 
assessment body would be 2 years.
    As for the examination portion of the audit conducted by the CPSC, 
proposed Sec.  1112.9(b)(1) would require each third party conformity 
assessment body to ensure that the information it submitted on CPSC 
Form 223 is current and submit a new CPSC Form 223 whenever the 
information, such as the third party conformity assessment body's 
address, telephone number, or ownership, changes. In the absence of any 
changes that would necessitate the submission of a new CPSC Form 223, 
proposed Sec.  1112.9(b)(2) would require the third party conformity 
assessment body to reregister at the CPSC every 2 years, using CPSC 
Form 223.
    On our own initiative, we have decided against issuing a final rule 
regarding the timing of the examination portion of the audit. After the 
publication of the proposed rule in the Federal Register on August 13, 
2009, we have acquired more experience registering third party 
conformity assessment bodies and have made modifications to CPSC 
software, as well as to CPSC Form 223. This combination of experience 
and the modifications to the CPSC's registration system have prompted 
us to reconsider when the examination portion of an audit should be 
conducted. Elsewhere in this issue of the Federal Register, we have 
published a proposed rule to establish other requirements pertaining to 
third party conformity assessment bodies; the proposed rule contains a 
new provision regarding the timing of the examination portion of the 
audit; and we believe that the new proposed provision is clearer and 
easier to implement. Therefore, rather than codify when the examination 
portion of an audit must be conducted, the final rule reserves Sec.  
1112.35(b).
6. Sec.  1112.37--What must a third party conformity assessment body do 
after an audit?
    In general, once the accreditation body has conducted its 
reassessment of a third party conformity assessment body, the 
accreditation body will present its initial findings, along with any 
supporting evidence, to the quality manager for the third party 
conformity assessment body. The accreditation body may give the third 
party conformity assessment body's personnel the opportunity to present 
any objections they have to the initial findings. The accreditation 
body may adjust its findings in response to any valid objections.
    When the accreditation body presents its findings to the third 
party conformity assessment body, proposed Sec.  1112.11(a) would 
require the third party conformity assessment body's quality manager to 
receive the findings and, if necessary, initiate corrective action in 
response to the findings. Proposed Sec.  1112.11(b) would require the 
quality manager to prepare a resolution report; the resolution report 
would identify the corrective actions taken and any follow-up 
activities. If immediate corrective action is necessary (as may be the 
case if the findings identify problems associated with incorrect 
procedures, invalid actions, or the creation or use of invalid data), 
proposed Sec.  1112.11(b) would require the quality manager to document 
that they notified the relevant parties within the third party 
conformity assessment body to take immediate corrective action and also 
to document the action(s) taken.
    Proposed Sec.  1112.11(c) would require the quality manager to 
notify the CPSC if the accreditation body decides to reduce, suspend, 
or withdraw the third party conformity assessment body's accreditation 
and the reduction, suspension, or withdrawal of accreditation is 
relevant to the third party conformity assessment body's activities 
pertaining to a CPSC regulation or test method. The notification would 
be sent to the Assistant Executive Director, Office of Hazard 
Identification and Reduction, within five business days of the 
accreditation body's notification to the third party conformity 
assessment body. If a third party conformity assessment body does not 
notify the CPSC in the manner that proposed Sec.  1112.11(c) would 
require, then such noncompliance may be grounds for withdrawal of 
acceptance of the accreditation by the Commission under section 
14(e)(1)(B) of the CPSA for failure to ``comply with an applicable 
protocol, standard, or requirement established by the Commission'' 
under the audit regulations.
    Proposed Sec.  1112.11(d) would explain that the CPSC will notify 
the third party conformity assessment body if the CPSC finds that the 
third party conformity assessment body no longer meets the conditions 
contained in CPSC Form 223 or in the relevant statutory provisions 
applicable to that third party conformity assessment body. The CPSC 
also will identify the condition or statutory provision that is no 
longer met, specify a time by which the third party conformity 
assessment body must notify the CPSC of the steps that it intends to

[[Page 31081]]

take to correct the deficiency, and indicate when it will complete such 
steps. Proposed Sec.  1112.11(d) also would require the quality manager 
to document that they notified the relevant parties within the third 
party conformity assessment body to take corrective action and also 
document the action(s) taken.
    Proposed Sec.  1112.11(e) would describe the possible consequences 
if a third party conformity assessment body fails to remedy the 
deficiency in a timely fashion. In brief, proposed Sec.  1112.11(e) 
would state that the CPSC ``shall take whatever action it deems 
appropriate under the circumstances, up to and including withdrawing 
the CPSC's accreditation of the third party conformity assessment body 
or the CPSC's acceptance of the third party conformity assessment 
body's accreditation.''
    We received no comments on this provision, but we have renumbered 
the provision as Sec.  1112.37 in the final rule. Additionally, on our 
own initiative, we have:
     Revised the second sentence in Sec.  1112.37(b), by 
changing ``he/she notified'' to ``they notified'';
     Revised the address in Sec.  1112.37(c), to replace 
``Maryland'' with ``MD''; and
     Revised the next-to-last sentence in Sec.  1112.37(d), to 
change ``correct the deficiency and when it will complete such steps'' 
to ``correct the deficiency, and indicate when it will complete such 
steps''; and
     Revised the last sentence in Sec.  1112.37(d), by changing 
``he/she notified'' to ``they notified * * *.''

These changes are for grammatical purposes.
7. Sec.  1112.39--What records should a third party conformity 
assessment body retain regarding an audit?
    Proposed Sec.  1112.13 (now renumbered as Sec.  1112.39 in the 
final rule) would require a third party conformity assessment body to 
retain all records related to an audit and all records pertaining to 
the third party conformity assessment body's resolution of, or plans 
for, resolving nonconformities identified by the audit. Such 
nonconformities could be identified through a reassessment by an 
accreditation body or through an examination by the CPSC. The proposal 
also would require third party conformity assessment bodies to retain 
records related to the last three reassessments (or however many 
reassessments have been conducted, if the third party conformity 
assessment body has been reassessed less than three times) and make 
such records available to the CPSC, upon request.
    The proposal also would require third party conformity assessment 
bodies to retain records related to the last three reassessments 
because such records may reveal whether a pattern of problems with 
accreditation exists, and the records may indicate how quickly such 
problems are addressed and resolved.
    (Comment 11)--One commenter noted that ISO/IEC 17011 requires the 
accreditation body, rather than the conformity assessment body, to keep 
records of reassessments. The commenter said that it would be a burden 
on the accreditation body to make duplicates of these records and 
provide them to the conformity assessment body. The commenter said that 
a third party conformity assessment body could meet the objectives for 
record retention by keeping records of resolutions of nonconformities.
    (Response 11)--It is not the intent of the recordkeeping provision 
for the conformity assessment body to make available to the CPSC all 
records associated with reassessments that are maintained by the 
accreditation body. However, assessment and reassessment records need 
to be retained by the conformity assessment body and made available, 
upon request, to the CPSC, and the records must include reports of 
nonconformities, as well as resolution of nonconformities. In addition, 
assessment/reassessment reports that the accreditation body provides to 
the conformity assessment body must be made available to the CPSC, upon 
request.
    Consequently, we have amended the rule to clarify that the records 
retained should include any records received from the accreditation 
body, as well as the records generated by the conformity assessment 
body (such as a resolution report discussed in Sec.  1112.39) related 
to reassessment. Additionally, on our own initiative, and for 
grammatical purposes, we have revised the last sentence in Sec.  
1112.39, by inserting a comma between ``however many reassessments have 
been conducted'' and ``if the third party conformity assessment body 
has been reassessed less than three times'' and by inserting another 
comma after ``available to the CPSC'' and ``upon request.'' We also 
have changed the words ``relating to'' to ``related to'' throughout 
Sec.  1112.39; these changes are for grammatical purposes only.

B. General Comments

    Many comments pertained to issues outside the scope of the rule. 
For example, some comments addressed matters related to the initial 
accreditation of third party conformity assessment bodies. Other 
comments sought ``reciprocity'' between conformity assessment body 
(``laboratory'') programs administered by other federal agencies or 
other entities. We address those comments in this section.
    (Comment 12)--A commenter suggested that the CPSC include 
reciprocity provisions as part of its accreditation criteria for 
laboratories to ensure a level playing field for testing organizations 
based in the United States with respect to foreign competition. Another 
commenter suggested that the CPSC amend the proposed requirements to 
include reciprocity provisions drawn from OSHA's NRTL and FCC's TCB 
programs. The commenter argued that the CPSC would be putting in place 
a ``system of special privileges'' that would damage laboratories in 
the United States because the third party conformity assessment body 
accreditation process is ``open to all countries while other countries' 
conformity assessment systems are not open to U.S.-based 
laboratories,'' thus creating ``a one-way trading relationship and does 
not advantage all in the supply chain.'' Another commenter expressed 
concern about a lack of reciprocity requirements, stating that foreign 
countries that wish to participate in a third party conformity 
assessment body program should be ``mandated to offer recognition to 
U.S.-based laboratories for its certification programs.''
    (Response 12)--We decline to revise the rule as suggested by the 
commenters. Issues regarding reciprocity, either of laboratory 
accreditation or test results, are outside the scope of this rule. 
Nothing in section 14(i)(1) of the CPSA authorizes the Commission to 
include reciprocity of laboratory accreditations or test results as 
falling within a ``periodic audit of third party conformity assessment 
bodies as a condition for the continuing accreditation of such 
conformity assessment bodies under [section 14(a)(3)(C) of the CPSA].'' 
Furthermore, we do not believe that we have the legal authority to 
impose a requirement on foreign governments.
    (Comment 13)--One commenter expressed opposition to having 
accreditation by a signatory to the ILAC-MRA. The commenter said there 
is no reciprocal agreement with ILAC countries to accept accreditations 
by the American National Standards Institute, OSHA, or the Standards 
Council of Canada. The commenter said such acceptance by the CPSC would 
help to ensure the impartiality of certification.

[[Page 31082]]

    (Response 13)--As explained in more detail in the response to 
Comment 6 above, accreditation by a signatory to the ILAC-MRA ensures 
some degree of similarity or uniformity among accreditation bodies, 
regardless of their geographical location, and it also ensures 
uniformity among third party conformity assessment bodies accredited by 
ILAC-MRA accreditation bodies. While the commenter is correct that 
there is no reciprocal agreement with ILAC countries to accept certain 
accreditations by entities in the United States or Canada, we do not 
believe that the audit requirement in the CPSIA gives the Commission 
the authority to demand reciprocity from foreign countries as a 
function of the audit process. An international agreement of that type 
is beyond the scope of this rulemaking.
    As for the impartiality of certification, we note that the CPSA 
does not require conformity assessment bodies to issue certificates. 
Instead, under existing CPSC regulations at 16 CFR part 1110, domestic 
manufacturers and importers issue certificates.
    (Comment 14)--One commenter noted that, in some ``systems,'' the 
same government entity is responsible for accreditation, testing, and 
certification. The commenter said that sections 14(f)(2)(B)(i) through 
(f)(2)(B)(v) of the CPSA (which lists the criteria for Commission 
acceptance of governmental conformity assessment bodies) should require 
extensive documentation during initial acceptance and during audits.
    (Response 14)--The commenter did not elaborate on or describe what 
documentation would be necessary. In any event, the commenter's focus 
appears to be on revising the statutory or administrative criteria 
pertaining to government-owned or government-controlled conformity 
assessment bodies, rather than revising the proposed audit 
requirements. Thus, the comment is outside the scope of the rule.
    (Comment 15)--One commenter stated that a Government Accountability 
Office (GAO) report issued in August 2009, assessing the effectiveness 
of enforcement of the CPSC's requirements, identified some resource 
limitations that could affect our ability to address and enforce 
requirements on foreign laboratories (both government-owned or 
government-controlled and firewalled conformity assessment bodies).
    (Response 15)--The commenter may have confused laboratories whose 
tests form the basis for a manufacturer or importer to issue a 
children's product certificate, with CPSC laboratory testing in support 
of its import surveillance activities. The GAO report titled, ``Better 
Information and Planning Would Strengthen CPSC's Oversight of Imported 
Products,'' GAO-09-803 (available on the Internet at http://www.gao.gov/new.items/d09803.pdf), refers to overseas manufacturers 
whose products are imported into the United States and are tested by 
the CPSC at our laboratory facilities. The GAO report does not discuss 
accreditation or audit requirements for laboratories. Accordingly, 
issues regarding the GAO report are outside the scope of this rule.
    (Comment 16)--One commenter suggested that to alleviate uncertainty 
and confusion, the CPSC should address the lack of a definition for a 
``reasonable testing program.''
    (Response 16)--This comment is outside the scope of the audit 
provisions of section 14(i)(1) of the CPSA. This rulemaking implements 
section 14(i)(1) of the CPSA. A ``reasonable testing program'' is part 
of section 14(a)(1) of the CPSA, and we note that, in the Federal 
Register of May 20, 2010 (75 FR 28336), we published a proposed rule on 
``Testing and Labeling Pertaining to Product Certification.'' The 
proposed rule contained (among other things) requirements for a 
``reasonable testing program.'' However, in the final rule on ``Testing 
and Labeling Pertaining to Product Certification'' (76 FR 69482 
(November 8, 2011)), we decided to reserve, rather than finalize, the 
``reasonable testing program'' requirements. Thus, issues related to a 
``reasonable testing program'' are part of a separate rulemaking.
    (Comment 17)--One commenter suggested that the CPSC reassert that 
compliance to the CPSIA is the manufacturer's responsibility, not the 
retailer's, and that retailers must accept testing from any accredited 
third party conformity assessment body approved by the CPSC.
    (Response 17)--Current CPSC regulations, at 16 CFR part 1110, limit 
the persons required to comply with the certification requirements of 
section 14(a) of the CPSA to: the importer (for products manufactured 
outside of the United States) and to the domestic manufacturer (for 
products manufactured within the United States). Neither the CPSIA, nor 
the CPSA, require a retailer to accept product testing results from any 
accredited third party conformity assessment body whose accreditation 
is accepted by the CPSC.
    Additionally, as we noted in the preamble to our proposed rule on 
``Testing and Labeling Pertaining to Product Certification'' (75 FR 
28336, 28337 (May 20, 2010)):

    The Commission understands the economic ramifications that small 
businesses (and even large businesses) face regarding the testing 
costs required by section 102 of the CPSIA. Moreover, retailers and 
importers may be imposing significant additional testing cost on 
manufacturers by requiring that products that have already been 
tested by a third party conformity assessment body be tested again 
by a specific third party conformity assessment body selected by the 
retailer or importer. The Commission wants to emphasize to retailers 
and sellers of children's products that they can rely on 
certificates provided by product suppliers if those certificates are 
based on testing conducted by a third party conformity assessment 
body. Section 19(b) of the CPSA provides that a retailer or seller 
of a children's product shall not be subject to civil or criminal 
penalties for selling products that do not comply with applicable 
safety standards if it holds a certificate issued in accordance with 
section 14(a) of the CPSA to the effect that such consumer product 
conforms to all applicable consumer product safety rules, unless 
such person knows that such consumer product does not conform. The 
Commission notes that section 19(b) of the CPSA does not relieve any 
person of the obligation to conduct a corrective action should any 
product violate an applicable safety standard and need to be 
recalled.

III. Paperwork Reduction Act

    The final rule contains information collection requirements that 
are subject to public comment and review by the Office of Management 
and Budget (OMB) under the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501-3520).
    The OMB has approved the information collection requirements in 
this rule. The OMB control number pertaining to such approval is OMB 
3041-0140, and it expires on December 31, 2012.

IV. Regulatory Flexibility Act

    The CPSC has examined the impacts of the final rule under the 
Regulatory Flexibility Act (5 U.S.C. 601-612). The Regulatory 
Flexibility Act requires agencies to analyze regulatory options that 
would minimize any significant impact of a rule on small entities. 
Because the required information is minimal, and the costs associated 
with the audits are low, the Commission certifies that the final rule 
would not have a significant economic impact on a substantial number of 
small entities.

A. Objectives and Legal Basis for the Final Rule

    Section 14(i)(1) of the CPSA requires the Commission to establish 
requirements for the periodic audit of third party conformity 
assessment

[[Page 31083]]

bodies as a condition of their continuing accreditation. The final rule 
implements the requirements for the periodic audits. The purpose of a 
periodic audit is to ensure that an accredited laboratory continues to 
be competent to perform the testing services for which it has been 
accredited. In the case of accredited third party conformity assessment 
bodies that are owned, managed, or controlled by a manufacturer (or 
``firewalled laboratories''), or that are owned or controlled, in whole 
or in part, by a government entity, the audit requirements give the 
Commission the opportunity to ensure that the third party conformity 
assessment body continues to comply with the CPSIA's requirements for 
``firewalled'' and government-owned or government-controlled conformity 
assessment bodies.

B. Firms Subject to the Requirement for Periodic Audits

    The requirement for periodic audits will affect only third party 
conformity assessment bodies that intend to provide the CPSIA-required 
third party conformity assessment services for manufacturers or private 
labelers of children's products. Third party conformity assessment 
bodies that do not intend to offer third party conformance testing for 
children's products are not affected by the requirements for 
accreditation or periodic audits.
    As of August 29, 2011, the CPSC had accepted the accreditations of 
87 third party conformity assessment bodies located within the United 
States. This number could increase, somewhat, over the next year or so, 
as the remaining notices of requirements for accreditation are issued 
and the stays of enforcement of the requirements for third party 
testing (which the Commission issued pending clarification of the 
regulations and testing requirements) are lifted. Of the third party 
conformity assessment bodies located in the United States with CPSC-
accepted accreditations, 12 are owned by large, foreign-based 
companies; 22 are large, U.S.-based companies; and the remaining 53 
could be small businesses, according to the criteria established by the 
U.S. Small Business Administration (SBA), which, for a testing 
laboratory (NAICS code 54138), is a company with less than $12 million 
in annual revenue.

C. Requirements of the Final Rule and Possible Impacts on Small 
Businesses

    The notices of requirements issued by the CPSC for the 
accreditation of third party conformity assessment bodies state, as a 
baseline requirement, that third party conformity assessment bodies 
must be accredited by an accreditation body that is a signatory to the 
ILAC-MRA. ILAC is an international cooperation of laboratory 
accreditation bodies that seek to harmonize laboratory accreditation 
procedures to facilitate the acceptance of the testing results of 
accredited laboratories within and across national boundaries. The 
ILAC-MRA includes requirements for the initial assessment of 
laboratories, as well as periodic reassessments. Laboratories that do 
not submit to the periodic reassessments lose their accredited status.
    Under the final rule, the periodic audit of a third party 
conformity assessment body would consist of two parts. The first part 
would be a reassessment by the accreditation body to determine whether 
it continues to meet the conditions of accreditation. The second part 
of the audit would be the resubmission to the CPSC of CPSC Form 223 and 
its review by the CPSC.
    All signatories to the ILAC-MRA have requirements for the periodic 
reassessment of accredited laboratories. The ILAC-MRA harmonized 
procedures for surveillance and reassessment of accredited laboratories 
and recommended that the time between reassessments be no more than 60 
months, provided that the accreditation body undertakes somewhat less 
comprehensive surveillance visits at least every 18 months. However, 
many accreditation bodies opt to undertake more frequent full 
reassessments, rather than conduct surveillance visits. According to 
ISO/IEC 17011, if an accreditation body does not conduct surveillance 
visits, full reassessments of accredited laboratories must take place 
at least once every 2 years.
    The resubmission of CPSC Form 223 is intended to provide the 
Commission with an opportunity to ensure that the third party 
conformity assessment body continues to be accredited by an ILAC-MRA 
signatory and continues to comply with the requirements for firewalled 
and government-owned or controlled conformity assessment bodies, if 
applicable. However, because CPSC staff, in light of its experience 
with the accreditation process and software changes, has reconsidered 
when the form should be submitted, and therefore, the final rule does 
not state when the CPSC Form 223 must be resubmitted. Instead, such 
matters will be addressed in a separate rulemaking.
    Costs associated with periodic audits include: The time cost of the 
assessor from the accreditation body; and his or her travel, lodging, 
and meal expenses incurred while conducting the reassessment. According 
to an accreditation body representative, a reassessment typically takes 
2 to 3 days; and the cost charged to the third party conformity 
assessment body usually will be $3,000 to $4,000 per field (e.g., 
chemical, electrical, or mechanical testing) in which the third party 
conformity assessment body is accredited. Therefore, a third party 
conformity assessment body that is accredited for testing conformance 
to both chemical and mechanical standards could expect an assessment or 
reassessment to cost $6,000 to $8,000.
    Another expense of a reassessment by an accreditation body is the 
cost of the time spent by third party conformity assessment body 
personnel to cooperate with the assessors. This includes the time 
required to prepare or assemble documents needed by the auditors, as 
well as the time it takes to explain or demonstrate the procedures used 
at the third party conformity assessment body. No empirical estimates 
of this cost were found; however, the amount of time spent by third 
party conformity assessment body personnel during a reassessment could 
be close to the amount of time spent by the assessor. If the average 
reassessment takes 2.5 days (or 20 hours), and the wage of the 
employees involved is about $44 an hour, then the cost of the time of 
the third party conformity assessment body's personnel spent 
cooperating with the reassessment would be about $880. The median 
hourly wage of architecture and engineering occupations in testing 
laboratories (NAICS code 541380) is $31.65. U.S. Department of Labor, 
Bureau of Labor Statistics, National Occupational Employment and Wage 
Estimates, May 2008 (http://www.bls.gov/oes/oes_dl.htm). In 2008, 
wages and salaries represented about 71.9 percent of total compensation 
for professional and related occupations in private industry (U.S. 
Department of Labor, Bureau of Labor Statistics, Employer cost for 
Employee Compensation (data extracted on June 17, 2009)).) The cost 
could be higher if the reassessment takes longer than 2.5 days or 
higher-paid employees are involved in the reassessment.
    The periodic audits required would cost third party conformity 
assessment bodies about $4,000 to $5,000 (rounded to the nearest 
thousand) per field in which the third party conformity assessment body 
is accredited. This expense includes the cost of the accreditation 
body's assessors, as well as the third party conformity assessment body 
personnel's time spent on the assessments and other costs, such as the 
cost of providing the materials required

[[Page 31084]]

of ``firewalled'' conformity assessment bodies. The time between audits 
will vary to some degree among accreditation bodies; however, a typical 
period is about once every 2 years. Therefore, the annual average cost 
of the periodic audits would be approximately $2,000 to $2,500 per 
field in which the third party conformity assessment body is 
accredited. Therefore, the annual cost to a third party conformity 
assessment body accredited in three fields (e.g., chemical, mechanical, 
and electrical) would be approximately $6,000 to $7,500.
    As noted earlier, of the third party conformity assessment bodies 
based in the United States, for which the CPSC has recognized 
accreditations, 43 (or about 62 percent) appear to be small businesses, 
according to the SBA criteria. However, it is unlikely that the rule 
will have a significant adverse impact on many third party conformity 
assessment bodies. The only third party conformity assessment bodies 
that will seek accreditation for testing children's products are those 
that expect to receive substantial revenue from the third party testing 
requirement in the CPSA, as amended by the CPSIA. Those third party 
conformity assessment bodies that do not expect substantial revenue 
from the testing will not seek to be accredited for the testing, or 
they can choose not renew their accreditation--if they initially sought 
accreditation--but the revenue they expected did not materialize.

D. Alternatives to the Final Rule Considered

    Given that the CPSC is relying upon accreditation bodies that are 
signatories to the ILAC-MRA to accredit and reassess the third party 
conformity assessment bodies, there are no realistic alternatives to 
the final rule that would lower substantially the cost of the periodic 
audits. The frequency of the reassessments of the third party 
conformity assessment bodies is determined by the accreditation bodies, 
not by the CPSC.

V. Environmental Considerations

    This final rule falls within the scope of the Commission's 
environmental review regulations at 16 CFR Sec.  1021.5(c)(2), which 
provide a categorical exclusion from any requirement for the agency to 
prepare an environmental assessment or environmental impact statement 
for product certification rules.

VI. Effective Date

    The final rule becomes effective on July 23, 2012.

List of Subjects in 16 CFR Part 1112

    Consumer protection, Third party conformity assessment body, Audit.

    For the reasons stated above, the Commission amends Title 16 of the 
Code of Federal Regulations by adding a new part 1112, subpart A and 
subpart C, to read as follows:

PART 1112--REQUIREMENTS PERTAINING TO THIRD PARTY CONFORMITY 
ASSESSMENT BODIES

Sec.
Subpart A--Purpose and Definitions
1112.1 [Reserved]
1112.3 Definitions.
1112.1 [Reserved]
Subpart B--[Reserved]
Subpart C--Audit Requirements for Third Party Conformity Assessment 
Bodies
1112.30 What is the purpose of this subpart?
1112.31 Who is subject to these audit requirements?
1112.33 What must an audit address or over and who conducts the 
audit?
1112.35 When must an audit be conducted?
1112.37 What must a third party conformity assessment body do after 
an audit?
1112.39 What records should a third party conformity assessment body 
retain regarding an audit?

    Authority:  Pub. L. 110-314, section 3, 122 Stat. 3016, 3017 
(2008); 15 U.S.C. 2063.

Subpart A--Purpose and Definitions

Sec.  1112.3  Definitions.

    Unless otherwise stated, the definitions of section 3 of the CPSA 
and additional definitions in the Consumer Product Safety Improvement 
Act of 2008, Public Law 110-314, apply for purposes of this part. The 
following definitions apply for purposes of this subpart:
    Accreditation means a procedure by which an authoritative body 
gives formal recognition that a third party conformity assessment body 
meets competence requirements to perform specific tasks. Accreditation 
recognizes a third party conformity assessment body's technical 
capability and is usually specific for tests of the systems, products, 
components, or materials for which the third party conformity 
assessment body claims proficiency.
    Accreditation body means an entity that:
    (1) Accredits or has accredited a third party conformity assessment 
body as meeting, at a minimum, the International Organization for 
Standardization (ISO)/International Electrotechnical Commission (IEC) 
Standard ISO/IEC 17025:2005, ``General Requirements for the Competence 
of Testing and Calibration Laboratories,'' and any test methods or 
consumer product safety requirements specified in the relevant notice 
of requirements issued by the Commission; and
    (2) Is a signatory to the International Laboratory Accreditation 
Cooperation-Mutual Recognition Arrangement.
    Audit means a systematic, independent, documented process for 
obtaining records, statements of fact, or other relevant information, 
and assessing them objectively to determine the extent to which 
specified requirements are fulfilled. An audit, for purposes of this 
part, consists of two parts:
    (1) An examination by an accreditation body to determine whether 
the third party conformity assessment body meets or continues to meet 
the conditions for accreditation (a process known more commonly as a 
``reassessment''); and
    (2) The resubmission of the ``Consumer Product Conformity 
Assessment Body Acceptance Registration Form'' (CPSC Form 223) by the 
third party conformity assessment body and the Consumer Product Safety 
Commission's (``CPSC's'') examination of the resubmitted CPSC Form 223. 
If the third party conformity assessment body is owned, managed, or 
controlled by a manufacturer or private labeler (also known as a 
``firewalled'' conformity assessment body) or is a government-owned or 
government-controlled conformity assessment body, the CPSC's 
examination may include verification to ensure that the entity 
continues to meet the appropriate statutory criteria pertaining to such 
conformity assessment bodies.
    CPSC means the Consumer Product Safety Commission.
    Quality manager means an individual (however named) who, 
irrespective of other duties and responsibilities, has defined 
responsibility and authority for ensuring that the management system 
related to quality is implemented and followed at all times and has 
direct access to the highest level of management at which decisions are 
made on the conformity assessment body's policy or resources.

Subpart B--[Reserved]

Subpart C--Audit Requirements for Third Party Conformity Assessment 
Bodies

Sec.  1112.30  What is the purpose of this subpart?

    This subpart establishes the audit requirements for third party 
conformity assessment bodies pursuant to section

[[Page 31085]]

14(i)(1) of the Consumer Product Safety Act (CPSA) (15 U.S.C. 
2063(i)(1)). Compliance with these requirements is a condition of the 
continuing accreditation of such third party conformity assessment 
bodies pursuant to section 14(a)(3)(C) of the CPSA. However, this 
subpart does not apply to certifying organizations under the Labeling 
of Hazardous Art Materials Act, even if such organizations are third 
party conformity assessment bodies.

Sec.  1112.31  Who is subject to these audit requirements?

    Except for certifying organizations described in 16 CFR 
1500.14(b)(8), these audit requirements apply to third party conformity 
assessment bodies operating pursuant to section 14(a)(2) of the CPSA. 
Third party conformity assessment bodies must comply with the audit 
requirements as a continuing condition of the CPSC's acceptance of 
their accreditation.

Sec.  1112.33  What must an audit address or cover and who conducts the 
audit?

    (a) The reassessment portion of an audit must cover management 
requirements and technical requirements. Each reassessment portion of 
an audit also must examine the third party conformity assessment body's 
management systems to ensure that the third party conformity assessment 
body is free from any undue influence regarding its technical judgment.
    (b) The third party conformity assessment body must have the 
reassessment portion of the audit conducted by the same accreditation 
body that accredited the third party conformity assessment body. For 
example, if a third party conformity assessment body was accredited by 
an accreditation body named AB-1, then AB-1 would conduct the 
reassessment. If, however, the same third party conformity assessment 
body changes its accreditation so that it becomes accredited by a 
different accreditation body named AB-2, then AB-2 would conduct the 
reassessment.
    (c) The third party conformity assessment body must have the 
examination portion of the audit conducted by the CPSC. The examination 
portion of the audit will consist of resubmission of the ``Consumer 
Product Conformity Assessment Body Acceptance Registration Form'' (CPSC 
Form 223) by the third party conformity assessment body and the CPSC's 
examination of the resubmitted CPSC Form 223.
    (1) For ``firewalled'' conformity assessment bodies, the CPSC's 
examination may include verification to ensure that the ``firewalled'' 
conformity assessment body continues to meet the criteria set forth in 
section 14(f)(2)(D) of the CPSA.
    (2) For government-owned or government-controlled conformity 
assessment bodies, the CPSC's examination may include verification to 
ensure that the government-owned or government-controlled conformity 
assessment body continues to meet the criteria set forth in section 
14(f)(2)(B) of the CPSA.

Sec.  1112.35   When must an audit be conducted?

    (a) At a minimum, each third party conformity assessment body must 
be reassessed at the frequency established by its accreditation body.
    (b) [Reserved]

Sec.  1112.37   What must a third party conformity assessment body do 
after an audit?

    (a) When the accreditation body presents its findings to the third 
party conformity assessment body, the third party conformity assessment 
body's quality manager must receive the findings and, if necessary, 
initiate corrective action in response to the findings.
    (b) The quality manager must prepare a resolution report 
identifying the corrective actions taken and any follow-up activities. 
If findings indicate that immediate corrective action is necessary, the 
quality manager must document that they notified the relevant parties 
within the third party conformity assessment body to take immediate 
corrective action and also document the action(s) taken.
    (c) If the accreditation body decides to reduce, suspend, or 
withdraw the third party conformity assessment body's accreditation, 
and the reduction, suspension, or withdrawal of accreditation is 
relevant to the third party conformity assessment body's activities 
pertaining to a CPSC regulation or test method, the quality manager 
must notify the CPSC. Such notification must be sent to the Assistant 
Executive Director, Office of Hazard Identification and Reduction, 
Consumer Product Safety Commission, 4330 East West Highway, Bethesda, 
MD 20814, within five business days of the accreditation body's 
notification to the third party conformity assessment body.
    (d) If the CPSC finds that the third party conformity assessment 
body no longer meets the conditions specified in CPSC Form 223, or in 
the relevant statutory provisions applicable to that third party 
conformity assessment body, the CPSC will notify the third party 
conformity assessment body, identify the condition or statutory 
provision that is no longer met, and specify a time by which the third 
party conformity assessment body shall notify the CPSC of the steps it 
intends to take to correct the deficiency, and indicate when it will 
complete such steps. The quality manager must document that they 
notified the relevant parties within the third party conformity 
assessment body to take corrective action and also document the 
action(s) taken.
    (e) If the third party conformity assessment body fails to remedy 
the deficiency in a timely fashion, the CPSC shall take whatever action 
it deems appropriate under the circumstances, up to and including 
withdrawing the CPSC's accreditation of the third party conformity 
assessment body or the CPSC's acceptance of the third party conformity 
assessment body's accreditation.

Sec.  1112.39  What records should a third party conformity assessment 
body retain regarding an audit?

    A third party conformity assessment body must retain all records 
related to an audit that it receives from an accreditation body 
regarding a reassessment and all records pertaining to the third party 
conformity assessment body's resolution of, or plans for, resolving 
nonconformities identified through a reassessment by an accreditation 
body or through an examination by the CPSC. A third party conformity 
assessment body also must retain such records related to the last three 
reassessments (or however many reassessments have been conducted, if 
the third party conformity assessment body has been reassessed less 
than three times) and make such records available to the CPSC, upon 
request.

Todd A. Stevenson,
Secretary.
[FR Doc. 2012-10922 Filed 5-23-12; 8:45 am]
BILLING CODE 6355-01-P
```