# Third

- Party Programs to Assess Regulatory Compliance

Lesley K. McAllister

University of San Diego School of Law

Oct ober 22, 2012

This report was prepared for the consideration of the Administrative Conference of the United States. The views

ex

pressed are those of the author and do not necessarily reflect those of the members of the Conference or its

committees.



### ADMINISTRATIVE CONFERENCE

OF THE UNITED STATESi Report Prepared for the Administrative Conference of the United States *

Lesley K. McAllister 1

Table of Contents

I. Introduction

................................ ................................ ................................ ................................ . 1 II. Conformity Assessment in a Regulatory Context

................................ ................................ ...... 2

III. Review of Federal Third

- Party Programs

................................ ................................ ................. 7 A. Programs for Mandatory Standards

................................ ................................ ..................... 10 1. FDA, Imported Food Programs

................................ ................................ ........................ 10

2. C PSC, Children’s Product Safety Rule

................................ ................................ ............. 15 3. FDA, Medical Device Inspections

................................ ................................ .................... 21 4. FCC, Telecommunication Certification Body Program

................................ ................... 28

B. Programs for Voluntary Standards

................................ ................................ ....................... 31 1. OSHA, National Recognized Testing Laboratories Program

................................ ........... 31 2. AMS, National Organic Program

................................ ................................ ..................... 33 3. EPA/DOE, Energy Star Program

................................ ................................ ...................... 35 4. EPA, WaterSense Program

................................ ................................ ............................... 38

IV. Evaluating Third

- Party Programs

................................ ................................ ........................... 40

A. Metrics of Success

................................ ................................ ................................ ............... 40 1. Reliability of Third

- Party Determinations

................................ ................................ ........ 40 2. Rates of Compliance

................................ ................................ ................................ ......... 44 3. Agency Capacity to Administer the Third

- Party Program

................................ ................ 45 4. Public Acceptance

................................ ................................ ................................ ............. 48 5. Industry Acceptance

................................ ................................ ................................ .......... 49 B. Incentives to Participate When Use of Third Parties is Voluntary

................................ ...... 52 V. Recommendations to Federal Agencies

................................ ................................ ................... 54 A. Deciding Whether to Use a Third

- Party Program

................................ ................................ 55 1. Consult gov ernmental and non

- governmental resources relating to third

- party conformity

assessment

................................ ................................ ................................ ............................. 55 2. Consider the characteristics of the reg ulatory standards and the regulatory target

.......... 57 3. Compare the benefits and drawbacks of third

- party programs with other approaches

..... 59 4. If the use of third parties will be voluntary, evaluate whether sufficient incentives exist to attract participation

................................ ................................ ................................ ............... 62 B. Establishing a Third

- Party Program

................................ ................................ ..................... 62

1. Calibrate the third

- party program to the level of risks associated with noncompliance

... 62 2. Incorpo rate existing conformity assessment standards and activities when possible

....... 63 3. Ensure that the agency and the public have appropriate access to information

................ 66

* This draft report was prepared for consideration of the Administrative Conference of the United States. The views expressed are those of the author and do not necessarily reflect those of the members of the Conference or its

committees.

1 Stanley Legro P rofessor in Environmental Law, University of San Diego School of Law; Associate Adjunct Professor, University of California San Diego, School of International Relations & Pacific Studies. J

. D

. , Stanford Law School, 2000; Ph.D., University of California Ber keley, 2004. The author may be contacted at mcallister@sandiego.edu or (619) 260

- 7999.ii 4. Commit to undertaking appropriate oversight activities

................................ ................... 68 Appendix A: Interviews by Phone and Email

................................ ................................ ............. A

- 1 Appendix B: ISO Standards for Conformity Assessment Activities

................................ .......... A

- 3 Appendix C: List of Abbreviations

................................ ................................ ............................. A

- 4

Tables Table 1: Federal Regulatory Third

- Party Programs with Selected Program Attributes

................. 9

Figures Figure 1: General Structure of Third

- Party Programs to Assess Regulatory Compliance

............ 7 Figure 2: Structure of Third

- Party Program for Imported Food Certifications

........................... 12 Figure 3: Structure of Third

- Party Program for Food Safety Testing

................................ ......... 13 Figure 4: Struct ure of Third

- Party Program for Children’s Product Testing

................................ 16 Figure 5: Structure of Third

- Party Program for Medical Device Faciliti es

................................ .. 24 Figure 6: Structure of Third

- Party Program for Telecommunication Equipment

........................ 30 Figure 7: Structure of Third

- Party Program for Workplace Product Safety

................................ . 32 Figure 8: Structure of Third

- Party Program for Organic Food Label

................................ ........... 35 Figure 9: Structure of Third

- Party Program for Energy Star Product Label

................................ 36 Figure 10: Structure of Third

- Party Program for WaterSense Product Label

.............................. 381 I

. Introduction

Federal agencies in diverse areas of regulation are using private third parties to carry out inspections and verify that regulated entit ies are in compliance with federal standards and other requirements. With oversight by the responsible federal agency , third parties are charged with

assess ing the safety of imported food, children’s products, medical devices, cell phones and oth er telecommunications equipment, and electrical equipment used in workplaces. Third parties also

ensure that products labeled as organic, energy

- efficient, and water

- efficient meet applicable

federal standards. In these regulatory third

- party programs, thir d parties carry out product testing, facility inspection s , and other regulatory compliance activities in the place of regulatory agencies. Regulatory agen cies take on new roles in coordinating and overseeing these private

actors.

T hird

- party programs ope rated by federal agencies for regulatory purposes var y in important

ways

. In many cases, Congress provided legislative authority for the third

- party program and set forth certain design elements in statute. In other cases, agencies have implemented third

- party programs under existing statutory authority. Several programs are a decade or two old, but most have been established more recently. Depending on the program, third parties assess compliance with mandatory or voluntary regulatory standards, and regulated entities may either be required or may have the option to contract with third parties for such assessment.

There are several reasons why third

- party programs are being increasingly incorporated into regulation. Some regulatory problems are difficult to address using tr aditional regulatory approaches such as ensuring the safety or correct labeling of food and other products manufactured in complex international chains of production. Third

- party programs may extend

the reach of regulators by enabling third parties around the globe to participate in compliance

assessment

. Another motivating factor is that agency resources are often inadequate to address

the ever

- growing number of problems and entities subject to regulat ion. T hird

- party programs may have the effect of shifting some regulatory costs to priv ate parties and thereby conserving governmental resources.

Regulatory third

- party programs raise a host of significant theoretical and practical questions. Represent ing a partial privatization of the public function of implementing and enforcing regulatory law, they are a form of “public

- private governance,” in which private actors play roles

that are traditionally viewed as governmental in nature. 2 While they may enable innovation, efficiency, and quality in the provisio n of governmental services, third

- party programs may also jeopardize the fulfillment of public purposes and commitments. Difficult issues are presented regarding considerations such as the competence and ind ependence of third

- party actors, the extent of gov ernmental control and oversight, and the management and coverage of third

- party

2 Jody Freeman, Private Parties, Public Functions and the New Administrative Law

, in R ECRAFTING THE R ULE OF
L AW : T HE L IMITS OF L EGAL O RDER 331 (David Dyzenhaus ed., Hart, 1999); Martha Minow, Public and Private Partnerships: Accounting for the New Religion , 116 H ARV

. L. R EV

. 1229, 1230 (2002

- 2003); Jody Freeman, Extending Public Law Norms through Privatization , 116 H ARV

. L. R EV

. 1285, 1286

- 87 (2002

- 2003); William J. Novak, Public

- Private Governance: A Historical Introduction , in G OVERNMENT BY C ONTRACT : O UTSOURCING AND
A MERICAN D EMOCRACY ( Freeman and Minow, eds.

, Harvard University Press, 2 009)

.Third

- Party Programs to Assess Regulatory Compliance

2 program costs.

A variety of sources inform this paper. Information about particular programs was gathered primarily from relevant statutes, regulations, agency guidance documents, and agency reports.

The author also conducted twenty phone interviews

, mostly with agency staff responsible for

, or otherwise very knowledgeable about

, third

- party programs (see Appendix A)

. T he paper also

draws from relevant academic literature. 3

The rest of the paper is divided into four sections. Section II introduces the language of

conf ormity assessment. M any regulatory third

- party programs, particularly newer ones, explicitly incorporate terminology and concepts from private

- sector conformity assessment
systems

. O lder programs do not as much , but the vocabulary of conformity assessment remains helpful in understanding their structure.

Section III surveys eight programs in which federal agencies rely on private third parties to provide information about the compliance of regulated entities . The programs are diverse. T hey

are operated by six different regulatory agen cies. Half assess compliance with mandatory standards, and the other half assesses compliance with volunta ry standards. The use of third parties is required in six and optional in two.

Section IV identi fies fi ve metrics to ass ess the success of third

- party programs . These metrics include the reliability of third

- party determinations, the rate of compliance , agency capacity to administer the third

- party program, public acceptance, and industry acceptance. They

are discussed with examples drawn from the surveyed programs

.

In the final section , recommendations are made to federal agencies . The first set of

recommendations re gards how an agency should consider whether or not to establish a third

party program. The second set of recommendations is directed towards agencies that have

decided to establish such a program

.

II. Conformity Assessment in a Regulatory Context

Regulatory third

- party programs are often built using the terminology and practices of a broad “conformity assessment” framework that has been developed by standards bodies in the private sector. Conformity assessment is defined as “demonstration that specified requ irements relating to a product, process, system, person, or body are fulfilled.” 4 It is commonly used in the private sector by purchasers who want to verify that a potential supplier’s product or service

3 See especially Lesley K. McAllister, Regulation by Third

- Party Verification , 53 B.C. L. R EV . 1 (2012); Friederike Albersmeier et al., The Reliability of Third

- Party Certification in the Food Chain: From Checklists to Risk

- Oriented Auditing , 20 F OOD C ONTROL 927, 930 (2009); Stepan Wood, Voluntary Environmental Codes and Sustainability

, in

E NVIRONMENTAL L AW FOR S USTAINABILITY 229, 230 (2006); Errol E. Meidinger, The New Environmental Law: Forest Certification , 10 B UFF

. E NVTL

. L.J. 211, 284 (2002).

4 American National Standards Institute (ANSI), National Conformity Assessment Principles for the United States, 3, available at http ://publicaa.ansi.org/sites/apdl/Documents/News%20and%20Publications/Brochures/ NCAP%20second%20edition.pdf

.Third

- Party Programs to Assess Regulatory Compliance

3 conform to their requirements

. 5

Given the importa nce of conformity assessment to business transactions, the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

have published a series of standards relating to conformity assessment

. Also, a large number of private organizations have been established to perform conformity assessment

- related services. As federal agencies have recognized that verifying compliance with regulatory requirements can be viewed as a form of conformity assessme nt, they have built relevant international standards and the work of related organizations into their compliance programs.

The vocabulary of conformity assessment has thus become essential to understanding third

party programs operated by federal agenci es. Indeed, the term “third party” is part of that vocabulary. International standards divide conformity as sessment into three major types. 6 F irst

party conformity assessment is performed by the manufacturer or supplier itself and is also

referred to as “supplier’ s declaration of conformity” (SD oC). 7 Second

- party conformity assessment is performed by the purchaser or customer. Third

- party conformity assessment is performed by an independent entity, which may (in this general terminology) be a governmen t agency or a private party. 8 This report is concerned with third

- party conformity assessment conducted by private parties under the direction of federal agencies for regulatory purposes.

Definitions of the various types of activities and organizations related to conformity

assessment are also set forth in international standards. 9 “ T esting ” means the “determination of one or more characteristics of an object of conformity assessment, according to a procedure

. ” 10

“C ertification” means “third party attestation related to products, processes or persons that conveys assurance that specified requirements have been demonstrated.” 11 Testing is usually conducted by laboratories ( which may also be referred to as testing bodies ), while c ertification s

are con ducted by certification bod ies (which may also be laboratories)

. Both testing bodies and certification bodies are referred to as conformity assessment bodies. 12

5 Margaret M. Blair et al., The New Role for Assurance Services in Global Commerce , 33 J. C ORP

. L. 325, 329

- 30 (2008) (tracing the origins of the th ird

- party assurance industry and many of its most important firms back to the 1800s when marine insurance companies hired private inspectors to make sure that ships carrying insured goods were seaworthy).

6 Christopher Johnson, U.S. International Trade Com mission, Technical Barriers to Trade: Reducing the Impact of Conformity Assessment Measures 4 (2008), available at http://www.usitc.gov/publications/332/working_p apers/ca

dft

- rev

- final082008.pdf

. 7 Id. (defining SDoC as a procedure by which a manufacturer (or other supplier) provides written assurance of the conformity of its products to specified requirements.)

8 Id. at 7.

9 ISO/IEC 17000 sets out standard definitions of conformity assessment terms.

10 ISO/UNIDO, Building Trust: The Conformity Assessment Toolbox 34 (2010), http://www.iso.org/iso/casco_building

- trust.pdf

. 11 ANSI, supra note 4 , at 5.

12 Another type of conformity assessment body that could be relevant to third

- party programs for regulatory purposes is an inspection body. ISO/IE C 17000 defines inspection as an “Examination of a product design, product, process or installation and determination of its conformity with specific requirements or, on the basis of professional judgment, with general requirements.” ISO/UNIDO, supra note 10 , at 35. The international standard for inspection

bodies is ISO/IEC 17020 , General criteria for the operation of various bodies performing ins pec tion. None of the

third

- party programs surveyed in this report have incorporated the standard for inspection bodies.Third

- Party Programs to Assess Regulatory Compliance

4 I n the language of conformity assessment, testing is often necessary for certification but it is

distinct

. Unlike testing, c ertification is always performed by a third party, and it requires that the third party conduct not just initial testing but also the surveillance necessary to attest to the continuing conformity of a product , process, system , or person

. 13 “ Surveillance ” is defined by

ISO as a “ systematic ite ration of conformity assessment activi ties as a basis for maintaining the validity of the statement of conformity. ” 14 Market surveillance is a particular form of

surveillance used in some certification schemes where samples of certified products in the marketplace are test ed to determine whether they conform to specified requirements

. 15

Accreditation is another important element of private confor m ity assessment systems.

“ Accreditation ” is de fined as “third party attestation related to a conformity ass essment body conveying formal demonstration of its competence to carry out specific conformity assessment

tasks.” 16 Accreditation bodies decide whether to accredit conformity assessment bodies by using auditing techniques to assess their organizational and technical capabilities. 17 They are often appointed by national governments , but not all countries have a national accreditation body and

some countries have one or more private accreditation bodies in addition to or instead of a national accreditation body

. 18

Accreditation bodies are often members of an international association of accreditation bodies, such as the International Accreditat ion Forum (IAF) or the International Laboratory Accreditation Cooperation (ILAC). 19 IAF is comprised of accreditation bodies that accredit

certification bodies whereas ILAC is comprised of accreditation bodies that accredit laboratories.

Both IAF and ILAC have established voluntary agreements through which member accreditation bodies agree to adhere to international standards when accrediting testing and certification

bodies : the IAF Multilateral Recognition Agreement (MLA) and the ILAC Mutual Recognition Agreement (MRA)

. 20 IAF and ILAC use a system of peer evaluation to assess accreditation bodies for membership and to perform reassessments every four years

. 21 The ir objective is that conformity assessment bodies accredited by member accreditation bodies would be recognized

13 Interview (by phone) , Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and Technology, Aug. 15, 2012. See also IAF FAQ, http://www.iaf.nu/articles/FAQ/288 (last visited Sept. 11, 2012) (sta ting that ISO/IEC defines certification as a “third

- party attestation related to products, processes, systems or persons”) ; ISO/UNIDO, supra note 10 , at 52

- 55 (setting forth various systems that include surveillance and meet the definition of product certification).

14 ISO/UNIDO, supra note 10 , at 44.

15 Id. at 45.

16 ANSI, supra note 4 , at 5; ISO/UNIDO, supra note 10 , at 24.

17 ISO/UNIDO, supra note 10 , at 44.

18 ISO/UNIDO, supra note 10 , at 25, 86

- 88.

19 See e.g ., International Laboratory Accreditation Cooperation, https://www.ilac.org/

. 20 Office of the United States Trade Representative (USTR), Technical Barriers to Trade (TBT Report) 28 (2012), http://www.ustr.gov/about

- us/press

- office/reports

- and

- publications/2012/technical

- barriers

- trade

- tbt

- report (last visited Sept. 11, 2012 )

. See also IAF/ILAC Multi

- Lateral Mutual Recognition Arrangements (Arrangements): Narrative Framework for Reporting on the Performance of an Accreditation Body (AB) A Tool for the Evaluation Process, IAF/ILAC

- A3:07/2011 (2011), http://www.compad.com.au/cms/iafnu/workstation/upFiles/ IAFILACA3072011.pdf (last visited Sept. 11, 2012).

21 Id.Third

- Party Programs to Assess Regulatory Compliance

5 as competent in multiple jurisdictions and markets. 22 In the words of the accreditation industry

, “tested or certified once

- accepted everywhere.” 23

It is useful to understand that private conformity assessment encompasses a spectrum of rigor and independence. 24 Depending on the level of confidence or assurance required, the technical activities of conformity assessment may be more or less rigorous, and the organizations that conduct conformity may be more or less independent. When t he user of a conformity assessment
system

— for example a purchaser

— needs just a basic level of assurance, an SDoC based on the

manufacturer ’ s own inspection or testing may be adequate. When the purchaser needs more assurance, it may require an SDoC suppor ted by testing in a n accredited third

- party laboratory.

When the purchaser needs much more assurance, it may require certification by an accredited third party, perhaps with testing conducted in an accredited third

- party laboratory

.

Importantly, c onformity assessment impose s costs on a manufacturer or other entities that are subject to conformity assessment requirements

. 25 These costs tend to be higher in conformity

assessment systems that are more rigorous and independent. 26 In other words, a confo rmity assessment system that requires third

- party certification will tend to be more costly to the entities that must show conformity than a system that only requires sDoC. 27 Redundancy in accreditation has also been observed to add costs to conformity ass essment: a laboratory or certification body may need to get different accreditations to perform similar assessment in different localities, states and countries. 28 These costs may then result in higher market prices

for product s and services subject to co nformity assessment requirements . Also, differences in conformity assessment requirements across global markets can act as non

- tariff barriers, a type

of t echnical barrier to trade. 29 The Agreement on Technical Barriers to Trade requires that

22 ISO/UNIDO, supra note 10 , at 89. See also USTR, supra note 20 , at 28 (explaining that b y demonstrating the equivalence of the accreditation bodies that accredit testin g and certification bodies, they aim to “provide governments, as well as suppliers, as surances that a body

– regardless of its location

– is competent to test and certify products for relevant markets.” ).

23 United Kingdom Accreditation Service, IAF: What is the International Accreditation Forum, INC.?, http://www.ukas.com/technical

- information/international

- role/iaf.asp (last visited Sept. 11, 2012) ; see also http://www.iaf.nu/ (showing the s logan “certified once, accepted everywhere” in the bottom right hand corner of the page).

24 Interview (by phone) , Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and Technology, Aug. 15, 2012.

25 ISO/UNIDO, supra note 10 , at 48.

26 Interview (by phone) , Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and Technology, Aug. 15, 2012.

27 In contrast, a conformity assessment system based on sDoC may be more costly to the party that seeks to rely on the conformity assessment determination (for example a purchaser or a regulatory agency) because that party may

need to conduct its ow n inspections or other surveillance to assure conformity. See especially OSHA, Notice: Nationally Recognized Testing Laboratories; Supplier’s Declaration of Conformity, 75 Fed. Reg. 79035 , 79047 (Dec. 17, 2010 ) (stating, “OSHA estimated that implementing an SDoC system in the U.S. could cost the Agency approximately $360 million annually. In contrast, the current budget associated with operating the NRTL Program is approximately $1 million per year. Based on this estimate, operating an effective SDoC prog ram would require OSHA to incur substantial additional costs.”)

. 28 National Research Council, Standards, Conformity Assessment, and Trade: Into the 21 st Century (1995, National Academy Press), available at http://www.nap.edu/openbook.php?record_id=4921

. 29 Johnson, supra note 6

.Third

- Party Programs to Assess Regulatory Compliance

6 conformity assessment procedures adopted by the US and other member governments be non

discriminatory and avoid creating unnecessary obstacles to international trade. 30

Federal agencies have often incorporated ISO standards and terminology relating to conformity assessment into their third

- party programs. Agencies have most often relied on

international standards that concern how testing bodies should conduct testing ( ISO/IEC 17025 ); how certification bodies should conduct certifications ( I SO/IEC Guide 65 , to be replaced by ISO/IEC 17065); and how accreditation bodies should conduct accreditations ( ISO/IEC 17011 ) (see Appendix B)

. 31 Agencies have also tapped into the international networks of accreditation bodies, certification bodies, and t esting bodies that seek to operate in conformity with these standards and do the work of conformity assessment.

In regulatory third

- party programs, third parties determine whether the products or production pro cesses of regulated entities conform to cert ain standards. Most often these standards are established by the responsible government al agencies , referred to as “government

unique” standards. In other regulatory programs, agencies have required compliance with privately

- established “voluntary consen sus standards

. ” Voluntary consensus standards are

st andards developed or adopted by domestic or international voluntary consensus standard

setting bodies, such as the A merican S ociety for T esting and M aterials ( ASTM) or ISO. 32

Pursuant to the National Technology Transfer and Advancement Act of 1995 and OMB Circular

A

- 119, federal agencies are required to adopt voluntary consensus standards instead of
government

- unique standards when available and appropriate. 33 Also, since the passage of the NTTAA, fede ral employees have become much more involved in the private sector organizations that establish voluntary consensus standards. In FY2010, more than 2,800 federal agency staff participated in more than 500 private

- sector standards organizations. 34

In most of the programs reviewed below, regulatory agencies rely on third parties that serve the function of certification bodies. Regulatory agencies have used a v ariety of names for these

third parties, such as Third

- Party Auditors , Telecommunication Certificat ion Bodies, and

Accredited Persons. The programs tend to share the same basic structure (see Figure 1)

. R egulated entities contract with a third

- party certification body to assess and certify whether they

are in conformity with an applicable regulatory standard. The certification bodies are generally private entities that have been accredited to perform this task by an accreditation body that has

been approved or recognized by the regulatory agency. The appl icable standard may be a mandatory standard, such as a product safety rule, or a voluntary standard, as for an organic

30 Agreement on Technical Barriers to Trade, Apr. 15, 1994, Marrakesh Agreement Establishing the World Trade Organization, Annex 1A, Legal Instruments

-- Results of the Urug uay Round, available at http://www.wto.org/english/docs_e/legal_e/17

- tbt_e.htm

. 31 See Appendix A.

32 OMB Circular No A

- 119

- Revised (Feb. 10, 1998)

, available at http://www.whitehouse.gov/omb/circulars_a119

. 33 Id. ; National Technology Transfer and Advancement Act of 1995, Pub. L. No. 104

- 113 , 110 Stat . 775 (1996) (codified in scattered sections of 15 U.S.C.).

34 First Responder Technologies

- Ensuring a Prioritized Approach for Homeland Security Research and Development: Hearing Before the Subcomms. on Emergency Preparedness, Response and Communications & Cybersecurity, Infrastructure Protection, and Security Technologies of the H. Comm. on Homeland Secu rity, 112th Cong. (May 9, 2012) (t estimony of Mary H. Saunders, Director, Standards Coordination Office, National Institute of Standards and Technology)

, http://ho meland.house.gov/sites/homeland.house.gov/files/Testimony

Saunder.pdf (last visited Sept. 11, 2012).Third

- Party Programs to Assess Regulatory Compliance

7 labeling scheme. In some programs , regulated entities are required to contract with a third party; in others, they have an option to do so.

H owever, this general structure varies . I n some programs, for example, the regulatory agency itself accredits the certification bodies directly, without reliance on an accreditation body. Or the regulatory agency may require the certification body to be accredited by an accreditation body, but the agency may not explicitly approve or recognize accreditation bodies. Also, several of the programs rely on a combination of certification bodies and testing bodies.

Figure 1: General Structure of Third

- Party Programs to Assess Regulatory Compliance

II I

. Review of Federal Third

- Party Programs

This paper surveys the most significant regulatory third

- party programs implemented by federal agencies. 35 In these programs, federal agencies directly rely on private third parties to provide information about regulatory compliance with mandatory or voluntary standards. Several types of programs that share some similarities but do not meet this description are outside the scope of this report. Examples includ e: (1) where a federal agency places responsibility for inspecting and providing information about compliance directly on regulated entities; 36 (2 ) where a federal agency relies on state agency personnel to inspect and provide information about compliance; 37 (3) where a federal agency takes into account whether a

35 A significant program is one that is large, long

- standing, well

- documented, or some combination thereof. Several other programs implemented by the EPA may fall within the scope of this report but are relatively small and/or very

recent . These include EPA’s requirement of attest engagements in its regulation of fuels (see http://www.e pa.gov/otaq/fuels/reporting/attestengage.htm ); EPA’s program regarding formaldehyde in wood (see http://www.epa.gov/opptintr/chemtest/formaldehyde/ ); and its Design for Environment label (DfE ) ( http://www.epa.gov/dfe/ ).

36 See, e.g.

, USDA’s proposed rule, Modernization of Poultry Slaughter Inspection, 77 Fed. Reg. 4408 (Jan. 27, 2012).

37 An example is provided by USDA’s Good Agricultural Practices/Good Handling Practices (GAP/GHP) Audit Program, in which auditors from USDA and related state agencies certify on a fee

- for

- service basis the compliance A Regulatory Agency

Accreditation Bodies approves

that accredit

Conformity Assessment Bodies

that assess whether

Regulated Entities or Regulated Products

A Regulatory Standard are in conformity withThird

- Party Programs to Assess Regulatory Compliance

8 regulated entity is certified as meeting an ISO/IEC standard or another similar privately

established standard in determ ining its inspection priorities; 38 and (4) whe re an agency uses private third pa rties to assess compliance with its own procurement or federal assistance policies

. 39

The eight third

- party programs that are surveyed have been implemented by six different federal agencies (see Table 1). In four of t he programs, third parties are called upon by regulatory agencies to assess compliance with mandatory regulatory stand ards. In the other four,

third parties assess compliance with voluntary regulatory standards. In two of the eight programs, regulated entities have a choice ab out whether or not to use third parties to assess their compliance. In the others, the regulated entity has no choice but to contract with a third party if it wants to show compliance with the mandatory or voluntary standard. Four of the third

- party

progr ams were estab lished before 2003 (with one dating to the late 1980s), and four others have

been established since 2008.

The reviewed programs are discussed with attenti on to the following questions: What is the overall purpose of the third

- party program and the natur e of the standard applied (voluntary or mandatory, governmentally

- set or privately

- set)? What is the authorizing law for the program? Who are the regulated entities that are subje ct to the third

- party program? Who are the third parties and how are they acc redited? What measures are in place to prevent conflicts of interest between third parties and regulated entities? How does the agency exercise oversight? And what funding exists for the administration of the third

- party program? For each program, Table 1

summarizes program attributes such as the assessment activities that third parties perform; whether the applicable standard is set by the government or privately (i.e. a voluntary consensus standard); and whether the agency directly accredits the third parties or relies on private

accreditation bodies.

of farms and food facilities with voluntary standards set by FDA. See USDA , Fresh Fruit and Vegetable Audit Programs, http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template= TemplateN&page=GAPG HPAuditVerificationProgram (last visited Sept. 11, 2012)

. 38 An example is provided by a program in which FDA intends to use the results of a voluntary ISO 13485 audit as part of its risk assessment to determine whether that establishment can be removed fro m FDA’s routine inspection work plan for one year from the last day of the audit. See FDA, Guidance for Industry, Third Parties and Food and Drug Administration Staff, Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program (March 19, 2012), http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM212798. pdf [hereafter “ FDA 13485 Prog ram Guidance ” ]. The program is authorized by statute at 21 U.S.C. § 374(g)(7)(F) (providing that “For the purpose of setting risk

- based inspectional priorities, the Secretary shall accept voluntary submissions of reports of audits assessing conformance wit h appropriate quality system standards set by the International Organization for Standardization (ISO) and identified by the Secretary in public notice.”)

39 Since 1965, the Department of Health and Human Services has relied on third parties such as the Joi nt Commission on Accreditation of Hospitals (now the Joint Commission) to certify that hospitals meet the Medicare Conditions of Participation (CoP) and are thus eligible to receive providing Medicare

- funded services. See generally Eleanor D. Kinney, Priva te Accreditation as a Substitute for Direct Government Regulation in Public Health Insurance Programs: When Is It Appropriate ? 57 L AW & C ONTEMP

. P ROBS

. 47 (1994); Timothy Stoltzfus Jost, Medicare and the Joint Commission on Accreditation of Healthcare Orga nizations: A Healthy Relationship? 57

L AW & C ONTEMP

. P ROBS

. 15 (1994); Jody Freeman, The Private Role in Public Governance , 75 N.Y.U. L. R EV

. 543 (2000).Third

- Party Programs to Assess Regulatory Compliance

9 Table 1: Federal Regulatory Third

- Party Programs with Selected Program Attributes

Federal Agency Program Name Authorizing Legislation and/or

Year Established Regulated

Product or Activity Third

- Party Assessment

Activities Use of Third

Parties: Required or Voluntary Standard

- setting Entity:

Government or

Private Accreditation Entity: Agency or Accreditation

Bodi es

Programs to Assess Compliance with Mandatory Standards

Food & Drug

Administration (FDA) Import Certification Program and Voluntary Qualified Importer Program (VQIP) Food Safety

Modernization Act of

2011 Imported Food - Certification of foreign food facilities;

- Laboratory testing of imported food products Required Government Accreditation Bodies ( for both certification bodies

and laboratories )

Consumer Product Safety Commission (CPSC) Third Party Testing

and Certification Consumer Product Safety Improvement

Act of 2008 Children’s

Products - Laboratory testing of children’s products Required Government and

Private Accreditation Bodies ( for

laboratories )

FDA Premarket Notification

510 (k) Third Party Review Prog ram/ Inspections by

Accredited Persons (AP) Program FDA Modernization

Act of 1997 (premarket program) /

Medical Device User

Fee and Modernization

Act of 2002 (inspection program) Medical Devices - Review of premarket

notifications /

- Inspection of medical device production

facilities Voluntary Government Agency

Federal

Communications Commission (FCC) Telecommunication Certification Body (TCB) Program N/A (established by regulation in 1999) Tele com

munication Equipment - Certification of telecom products V oluntary Government Accreditation bodies ( for certification bodies )

Programs to Assess Compliance with Voluntary Standards

Occupational Safety

& Health

Administration (OSHA) National Recognized Testing Laboratory (NRTL) Program N/A (established by regulation in 1988) Labeling of

electrical and

other types of equipment in workplaces - Certification of equipment

- Inspection of equipment production facilities Required Private Agency

Agricultural Marketing Service (USDA AMS) National Organic Program (NOP) Organic Foods

Production Act of 1990 (implemented by regulation in 2000) Labeling of Organic Products - Inspection and certification of organic production facilities Required Government Agency

Environmental Protection Agency (EPA)/ Department

of Energy (DOE) Energy Star N/A (established through agency guidance in 2011) Labeling of Energy Efficient

Products - Certification of products

- Laboratory testing of products Required Government Accreditation Bodies ( for both certification bodies

and labor atories )

EPA WaterSense N/A (established through agency guidance in 2009) Labeling of

Water

Conservation

Products - Certification of products Required Government Accreditation Bodies ( for certification bodies )Third

- Party Programs to Assess Regulatory Compliance

10 A. Programs for Mandatory Standards

Several federal laws enable regulatory a gencies to rely on third parties to assess compliance with mandatory standards. Mandatory standards must be complied with in order for a regulated entity to legally operate or sell a regulated product. In two of the programs

— imported food

programs administered by the Food & Drug Administration ’s (FDA) and c hild ren’s p roduct safety rules administered by the C onsumer Product S afety C ommission ’s (CPSC)

— the third

party certifier is an obligatory p art of the compliance process: the regulated company is requ ired

to contract with the third p arty for compliance assessment . In FDA’s programs for medical devices, in contrast, the use of a third party is optional: companies ha ve the choice of hiring a

th ird party or having the agency conduct the review or inspection instead. In the FCC’s program for telecommunications equipment, the use of a third party is optional for most types of equipment.

1. FDA, Imported Food Programs

As amended by the Food Safety Modernization Act of 2011 (FSMA) , the Federal Food

, Drug , and Cosmetic Act ( FDCA ) enables the FDA to rely on third

- party audits in its regulation of imported foods

. 40 Overall, the FDA is responsible for ensuring the safety of about 80% of US

food su pply. 41 Increasingly, much of this food supply is imported, including 80% of seafood, 50% of fresh fruits, and 20% of fresh vegetables. 42

FSMA significantly strengthened FDA’s authority to regulate imported food, 43 and it relies

on accredited third

- party auditors in two different ways. First, the law requires FDA to create a Voluntary Qualified Importer Program (VQIP) through which participating importers may receive expedite d importation if the facility from which the imported food comes is certified by a

third

- party auditor

. 44 Second , the law provides that the FDA may require that an importer present a certification from a third

- party auditor in order to import food into the United States

. 45

The third

- party auditors that issue these certifications have to be accredited by either an accreditation body recognized by FDA or by the FDA directly. 46

In both programs, the third

- party auditors would be responsible for performing an audit to assess and certify compl iance with the mandatory requirements of the law. 47 While VQIP is a voluntary program in the se nse that importers are not required to participate

, it is likely that for

40 See FDA Food Safety Modernization Act (FSMA), Pub. L. No. 111

- 353, 124 Stat. 3885 (2011).

41 Silliker, In c., FDA Food Safety Modernization Act: Marking a New Era in U.S. Food Safety, available at http://www.foodsafetymagazine.com/article.asp?id=4005&sub=sub2

. 42 Dina ElBo ghdady, Taking New Look at Food Inspection

, W ASH

. P OST , March 5, 2012 , at A1

. 43 Id.

44 21 U.S.C. § 384b (also known as FDCA § 806 and FSMA §302).

45 21 U.S.C. § 381(q) (also known as FDCA § 801(q) and FSMA § 303 ).

46 2 1 U.S.C. § 384d (also known as FDCA § 808 and FSMA § 307).

47 In the case of the import certification program, certification involves an assessment of whether a food satisfies the requirements of section 801(q) [21 U.S.C. § 381(q)]

. See 21 U.S.C. § 384d(c)(2)(B)(i)

. In th e case of the VQIP program, certification involves an assessment of whether a facility is eligible to be part of the program. See 21 U.S.C. § 384d (c)(2)(B)(ii).Third

- Party Programs to Assess Regulatory Compliance

11 an importer to participate, it will be required to contract with a third

- party auditor. 48 Similarly, it is likely that the import certification program will also require the participation of a third party, which in this case may be the government of the country from which the food originated

. 49

The structure of the third

- party program contemplated by FSMA is shown in Figure 2. T he law provid es that the FDA will recognize accreditation b odie s that will, in turn, accredit third

party a uditors to audit and certify foreign food facilities or imports

. 50 Under the law, an accreditation body is “an authority that performs accreditation of third

- party auditors,” and a

third

- party auditor refers to a foreign government (or an agency thereof), a foreign cooperative, or any other third party as deemed appropriate by the FDA in its regulations.” 51 Private third

party auditors can be single individuals, but are more likely to be companies that employ “audit agents.” 52 FDA is required by law to establish the system for the recognition of accreditation bodies by January 4, 2013 (two years after the enactment of the law)

. 53 If the FDA has not recognized any accreditation bodies within two years of the establishment of such system, it may directly accredit third

- party auditors. 54

The law directs FDA to develop model standards for becoming an accredited third

- party auditor and for preparing audit reports by July 4, 2012 (18 months after the enactment of the law). 55 The statute itself contains several relevant requirements, including that the FDA should look to standards already in place (existing volunta ry consensus standards, for example) 56 and an audit report should be submitted within 45 days of conducting an audit. 57 As of May 2012, FDA was in the process of drafting such regulations. 58

48 The law provides that the FDA may provide the certification, 21 U.S.C. § 384d (c)(2)(C)(ii ), but based on the experience of other federal third

- party programs it seems likely that forthcoming regulations will generally require

the use of an accredited third

- party auditor.

49 21 U.S.C. § 381(q)(3). It should be noted that the law also allows the FDA to provide the certification, per 21 U.S.C. § 384d (c)(2)(C)(ii), but it seems likely that forthcoming regulations will gener ally require the use of a third

party.

50 21 U.S.C. § 384d(b)(1)(A)(i).

51 Id

. § 384d(a)(3).

52 The law provides that a third

- par ty auditor may be a single individual. 21 U.S.C. § 384d (a)(3).The law also states

that third

- party auditors may employ “audit agents,” defined as “an individual who is an employee or agent of an

accredited third

- party auditor and, although not individuall y accredited, is qualified to conduct food safety audits on

behalf of an accredited third

- party auditor.” 21 U.S.C. § 384d(a)(1).

53 21 U.S.C. § 384d(b)(1)(A)(i).

54 Id . § 384d(b)(1)(A)(ii).

55 Id . § 384d(b)(2).

56 Id . § 384d (b)(2).

57 Id . § 384d (c)(3)(A).

58 Interview (by phone), Charlotte C h risten, U.S. Food and Drug Administration

, May 16, 2012.Third

- Party Programs to Assess Regulatory Compliance

12 Figure 2: Structure of Third

- Party Program for Imported Food C ertifications

It is also important to note that FSMA also requires the establishment of a system for the accreditation of laboratories to conduct food safety tests

. 59 Figure 3 illustrates the third

- party
structure for laboratories. Accredited labs must be used to satisfy a variet y of testing requirements, such as testing required by FDA to address an identified or suspected food safety problem and testing to support admission of an imported food. 60 The law directs FDA to establish a program for the testing of food by accredited lab oratories and a public registry of accreditation bodies and accredited laboratories by January 4, 2013. 61 The law also states that the FDA shall develop model accreditation standards that include, for example, appropriate sampling methods, quality system r equirements, and employee training requirements. 62

Importers may choose to seek certification from a third

- party auditor in order to participate in the VQIP program, or they may be required to seek certification because FDA imposes an import

certification requirement on the food they import. Under the statute, t he audits for such

certification s are termed “regulatory audits.” 63 Importers and other regulated entities may also

contract with an accredited third

- party auditor to conduct a “consultative audit, ” defined in the law to be for internal purposes only. 64

59 21 U.S.C. § 350k.

60 Id . § 350k(b)(1).

61 Id

. §350k(a)(1).

62 Id . § 350k(a)(6).

63 Id . § 384d (a)(7).

64 Id . § 384d (a)(5). FDA

Accreditation Bodies recognizes

that accredit

Third

- Party Auditors

that audit and certify

Foreign Food Facilities or Imports

Requirements of the FDCA are in conformity withThird

- Party Programs to Assess Regulatory Compliance

13 Figure 3: Structure of Third

- Party Program for Food Safety Testing

Importers that import foods from facilities that have received certification from a third

- party
auditor may request to have that food become part of the VQIP. 65 The law directs the FDA to consider a range of factors to make a determination on whether the food should receive expedited review and importation through the VQIP, including the safety risks of the food, the compliance history of the suppliers used by th e importer, and the capability of the exporting country’s regulatory system. 66

With its import certification authority, the FDA may require that certain food imports be accompanied by a certification that they comply with the requirements of U

. S

. food saf ety law

. 67
To determine that a food import requires certification, the law instructs FDA to consider factors such as the safety risks of the food and its place of origin , and to make a scientifically

- supported finding that the “food safety programs, systems, and standards in the country, territory, or region of origin of the food are inadequate to ensure that the article of food is as safe as a similar article of food that is manufactured, processed, packed, or held in the United States in accordance with the requirements of this Act

. ” 68

Recognized accreditation bodies ensure that third

- party auditors and th eir audit agents meet
the accreditation standards. 69 The law defines the types of entities that can become third

- party
auditors and sets forth certain requirements for their accreditatio n. In particular, the law states

that f oreign governments may be accredited based on a review of their food safety programs to

65 An importer “ means the person that brings food, or causes food to be brought, from a foreign country into the customs territory of the United States.” 21 U.S.C. § 384b (g). Elsewhere the law defines an importer as “ the US owner or consignee of the food article at the time of entry,” or if none, “t he US agent of a foreign owner or consignee at the time of entry.” 21 U.S.C. § 384a.

66 21 U.S.C. § 384b(d). See also Silliker, supra note 41

. 67 Se e generally 21 U.S.C. § 381(q).

68 21 U.S.C. § 381(q) ( 2).

69 Id . § 384d (b)(2). FDA

Accreditation Bodies recognizes

that accredit

Laboratories

that test whether

Food Products

Food Safety Standards are in conformity withThird

- Party Programs to Assess Regulatory Compliance

14 ensure that the foreign government is capable of determining that U.S. requirements a re met

. 70
Foreign cooperatives and other third parties may be accredited based on a review of internal systems and the training and qualifications of their audit agents to ensure conformity with the model standards to be issued by the FDA. 71

The law addresses the potential of conflicts of interest between accredited third

- party auditors and the companies that contract with them to perform audits. It sets forth several specific provisions and also requires FDA promulgate regulation s to further protect against conflicts of interest. The law directly provides that third

- party auditors may not perform a regulatory audit of an entity for which it has performed a consultative audit or a regulatory audit in the previous 13 months. 72 It also states that third

- party auditor s cannot be owned or operated by the same person as the entities they certify

, must have procedures to protect against financial

conflicts of interest

, and must annually disclose to the FDA how they have complied with

conflicts

- of

- i nterest rules and procedures. 73 Similarly, audit agents cannot own or operate the entity they certify, must have procedures to prot ect against financial conflicts of interest, and

must make an annual disclosure. 74

According to the statute, FDA’s conflict of interest regulations shall require that audits performed by accredited third

- party auditors be unannounced and shall place limits on the extent to which there may be financial affiliations between auditors and audit agents and the entiti es they certify. 75 The regulations must also establish timing, disclosure, fee payment and other rules that decrease the potential for conflicts of interest. 76

The law contains several specific provisions regarding how the FDA should oversee

accreditation bodies and accredited third

- party auditors and what audit information must be made available to the agency and to the public . Accreditation bodies are required to provide a list of

all third

- party auditors they have ac credited and their audit agents

, 77 and the FDA is required to establish a public registry of all accreditation bodies and accredited third

- party auditors

. 78 FDA

must reevaluate accreditat ion bodies at least once every four years 79 and must revoke the recognition of an accreditation body that is out of compliance with its rules

. 80

Accredited third

- party auditors are directly answerable to FDA in a variety of ways. The FDA may at any time require an accredited auditor to submit an onsite audit report fr om a regulatory audit and any related reports or documents. 81 In contrast, the FDA may not directly require an audit or to submit the reports from a consultative audit, but can still access the results

of such audits based on its general authority to inspec t records when FDA has a reasonable belief

70 Id . § 384d (c)(1)(A).

71 Id . § 384d (c)(1)(B).

72 Id . § 384d (c)(4)(C)(i).

73 Id . § 384d(c)(5)(A).

74 Id . § 384d(c)(5)(B).

75 Id . § 384d(c)(5)(C)(i) and (iii).

76 Id . § 384d(c)(5)(C)(ii).

77 Id . § 384d(b)(1)(B).

78 Id . § 384d (g).

79 Id . § 384d (f)(1)

80 Id . § 384d(b)(1)(C)

. 81 Id . § 384d(c)(3)(B).Third

- Party Programs to Assess Regulatory Compliance

15 that an article of food “presents a threat of serious adverse health consequences or death to

humans or animals.” 82 Also, an accredited auditor must immediately notify the FDA if it

“ discovers a condition that cou ld cause or contribute to a serious risk to the public health ” during either a regulatory or a consultative audit

. 83

In addition, FDA is required to evaluate the performance of each accredited third

- par ty auditor at least once every four years, which should include the review of its regulatory audit reports and the compliance history of its certified entities

. 84 The FDA may also conduct its own onsite audit of any certified entity whether or not the certifying third

- party auditor is prese nt. 85
The FDA may withdraw accreditation from an auditor if food from a facility it has certified is

linked to a seriou s outbreak of foodborne illness, if FDA evaluates it and finds it to be out of compliance with accreditation requirements, if it refuses t o allow the government to conduct

nece ssary audits and investigations, or if FDA revokes the recognition of the accreditation bodies

which accredited it. 86 Also, false statements or representations made to an accredited third

- party auditor by a regulated e ntity or to the FDA by an accredited third

- party auditor are subject to criminal penalties. 87

The law provides that FDA will establish a user

- fee program to make operating the

accredited third

- party auditor program revenue neutral. 88 With the user fees, acc redited third

party auditors and audit agents are to reimburse the FDA for “the work performed to establish and administer the accreditation system.” 89

2

. CPSC, Children’s Product Safety Rule

Pursuant to the Consumer Product Safety Improvement Act of 2008 (CPSIA) , the CPSC requires manufacturers and importers of children’s products to demonstrate that they meet mandatory product safety standards through third

- party testing

. 90 Testing must be conducted by

a ‘ ‘Third Party Conformity Assessment B ody ” (TPCAB)

, defined by regulation as “a testing laboratory whose accreditation has been accepted by the CPSC to conduct certification testing on children’s products.” 91 Based on the results of the third

- party testing, t he manufacturer or

82 21 U.S.C. § 384d(c)(3)(C) (referring to FDA’s authority to inspect records at 21 U.S.C. § 350c).

83 Id . § 384d(c)(4)(A); see al so FDA, Imports, http://www.fda.gov/Food/FoodSafety/FSMA/ucm257980.htm (last visited Sept. 11, 2012) (answering in the affirmative the question, “I.4.2 Is the accredited auditor required to notify the FDA if a condition of concern is found during a consultative audit?”).

84 21 U.S.C. § 384d(f)(2).

85 Id . § 384d(f)(3).

86 Id . § 384d(c)(6)(A) and (B).

87 Id . § 384d(e)

. See also Charles F. Woodhouse, Imported Food Provisions of the Food Safety Modernization Act, 2001, http://www.food

- label

- compliance.com/Sites/5/Downloads/White

- Paper

- FSMA

- IMPORT

- PROVISIONS

Woodhouse

- Nov

- 8

- 2011.pdf (last visited Sept. 11, 2012) (a white paper emphasizing the significance of specific inclusion of provisions relating to False Statements)

. 88 21 U.S.C. § 384d(c)(8).

89 Id.

90 Pub. L. No. 110

- 314, 122 Stat. 3016 (2008); 15 U.S.C. § 2063(a)(2). The law defines a “children’s product” as a consumer product designed or intended primarily for children 12 years of age or younger. 15 U.S.C. § 2052(a)(2).

91 Testing and Labeling Pertaining to Product Certification, 76 Fed. Reg. 69482 (Nov. 8, 2011) (codified at 16 C.F.R. Part 1107); see also 15 U.S.C. § 2063(f)(2)(A) (defining a “third party conformity assessment body” to mean a conformity assessment body that is not owned, managed, or controlled by the manufacturer or private labeler of a product assessed by the laboratory, unless such a laboratory has satisfied certain statutory criteria.”) It is worthThird

- Party Programs to Assess Regulatory Compliance

16 importer submits a Children’s Product Certificate indicating compliance

. 92 Under the law, third

party testing is mandatory; manufactur ers cannot opt

- out of the third

- party testing system and rely instead on CPSC to assess compliance. The structure of this third

- party program is shown in Figure 4.

Different rules and standards apply depending on the product. For example, the CPSC has promulgated safety rules with standards for products such as bicycle helmets

, 93 bunk beds

, 94

infant bath se ats

, 95 and electrically operated toys or articles

. 96 CPSC product safety rules containing standards for flammability

, 97 small parts

, 98 and lead content 99 may also apply. In addition, CPSC has mandated compliance with a variety of toy safety standards establish ed by

the ASTM regarding, for example, toy chests, stuffing materials, and sound producing toys. 100

Figure 4: Structure of Third

- Party Program for Children’s Product Testing

The CPSIA established a schedule for implementing third

- pa rty testing and included a

time line for the accreditation of third party conformity assessment bodies. 101 The law specifies

that third

- party testing requirements apply to any children ’ s product manufactured more than 90 days after the CPSC has published req uirem ents for accreditation of third

- party testing

noting that while the statute uses the term certification, the third

- party program that it requires is a third

- party testing program rather than a certification program under the definitions of internati onal standards.

92 15 U.S.C. § 2063(a)(2). See also Certificates of Compliance, 73 Fed. Reg. 68328 (Nov. 18, 2008); 16 C.F.R. Part 1110, Certificates of Compliance.

93 16 C.F.R. pt. 1203, Bicycle Helmets (effective date Feb. 10, 2010).

94 Id

. pt. 1513, Bu nk Beds (effective date Feb. 10, 2010 ).

95 Id

. pt. 1216, Infant Walkers (effective date Dec. 21, 2010).

96 Id

. pt. 1505, Electrically Operated Toys or Articles (effective date Jul. 29, 2010).

97 Id

. pts. 1610, 1611, 1615, 1616, 1630, 1631, 1632, and 1633.

98 Id

. pt. 1501.

99 Test Method CPSC

- CH

- E1001

- 08 and/or CPSC

- CH

- E1001

- 08.1

100 ASTM F963 Standard Consumer Safety Specifications for Toy Safety, http://www.cpsc.gov/cgi

bin/labsearch/Default.aspx ( last visited Sept. 11, 2012) ( list of rules that require third

- party testing and certification ).

101 15 U.S.C. § 2063(a)(3). CPSC

Accreditation Bodies

accredit

Third Party Conformity Assessment Bodies (laboratories)

that test whether

Children’s Products

CPSC safety rules and/or ASTM standards are in conformity with Accepts the accreditation ofThird

- Party Programs to Assess Regulatory Compliance

17 laboratories to assess conformity with a children ’ s product safety rule. 102 For example, the CPSC published such a notice of requirements for the lead paint rule on S eptember 22, 2008 and the

third

- party testing requirement for lead paint became effective December 22, 2008 for products

manufactured on or after that date. 103 In total, CPSC published 19 notices of requirements between August 14, 2008 and August 14, 2011. 104 However, there have been delays and stays of enforcement that have led to departures from the statutory schedule. For example, the CPSC stayed the enforcement of testing and certification requirements that would have gone into effect on February 10, 2009 fo r new total lead content limits, p hthalates limits for certain products, and mandatory toy standards, among other things. 105 As of January 1, 2012, almost all s tays had been lifted, and third

- party certification and testing was required for nearly all the children’s product safety rules. 106

R ulemaking for the CPSC third

- party program has also progressed. On November 8, 2011, the CPSC issued a final rule establishing protocols and standards for certification and testing of children’s products and also detailing requirements for the labeling of certified products. 107 The final rule applies to products manufactured after February 8, 2013. 108 On May 24, 2012, the CPSC published its final rule, “Aud it Requirements for Third Party Conformity Assessment

Bodies

. ” Also o n May 24, 2012, the CPSC published a proposed rule, “Requirements Pertaining to Third Party Conformity Assessment Bodies.” 109 The proposed rule, if finalized, would establish the requirements related to CPSC acceptance of the accreditation of laboratories for purposes of testing children’s p roducts. 110 The proposed requirements are largely the same as the requirements that the CPSC has set forth in the various notices of requirements that it has published since August 2008.

Nearly all children ’ s product s are required to undergo third

- party tes ting. 111 In 2011, Congress enacted a mendments to the CPSIA that, among other things, provided an exemption

from third

- party testing for “small batch manufacturers .” 112 Small batch manufacturers are those

that produce d fewer than 7500 units and collected less than $1 million in consumer products

102 15 U.S.C. § 2063(a)(3)(A) (stating that the third

- party testin g requirement does not commence “more than 90 days” after the Commiss ion publishes a notice of requirements pertaining to the regulation or standard to which the children’s product is subject.)

. 103 In brief at http://www.cpsc.gov/library/foia/foia10/b rief/102testing.pdf

. 104 In brief at http://www.cpsc.gov/library/foia/foia12/brief/tprequirements.pdf at 6.

105 Press release at http://www.cpsc.gov/cpscpub/prerel/prhtml09/09115.html ; see Notice of Stay of Enforcement of Testing and Certification Requirements, 74 Fed. Reg. 6396 ( staying the enforcement of certain provisions of section 14(a) of the CPSA) ; 74 Fed. R eg. 68588 (Dec. 28, 2009) (revising the terms of stay of enforcement); Consumer Product Safety Act: Notice of Commission Action on the Stay of Enforcement of Testing and Certification Requirements, 76 Fed. Reg. 6765 (Feb. 8, 2011) (continuing the stay of e nforcement for testing and certification of children’s products for which a notice of requirements for accreditation of laboratories had not yet been published).

106 CPSC, FAQs: Certification and Third Party Testing, http://www.cpsc.gov/info/toysafety/3ptfaq.html#foot1 (last visited Sept. 11, 2012).

107 Testing and Labeling Pertaining to Product Certificati on, 76 Fed. Reg. 69482 (Nov. 8, 2011) (codified at 16

C.F.R. pt. 1107).

108 Id. at 69482.

109 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31087

- 88 (May 24, 2012)

, available at http://www.gpo.gov/fdsys/pkg/FR

- 2012

- 05

- 24/pdf/2012

- 10923.pdf

. 110 Id.

111 Id.

112 Pub. L. No. 112

- 28, § 2(a)(4), 125 Stat. 273 (2011) (codified at 15 U.S.C. 2063(d))

.Third

- Party Programs to Assess Regulatory Compliance

18 revenues in the pr evious year. According to CPSC, small batch manufacturers are still required

to third

- party test for compliance with some children’s product safety rules but not others. 113 An exemption w as also provided for ordin ary books for children aged 4 to 12. 114

There are three ty pes of third

- party testing: (1) initial certification testing (2) material change testing; and (3) periodic testing. 115 Initially, each c hildren’s product must be third

- par ty tested by a CPSC

- accepted laboratory for compliance with all applicable children ’ s product safety

rules. Mat erial change testing by a third

- party CPSC

- accepted laboratory is required if a material change is subsequently made to any component part of tha t children ’ s product. Periodic testing applies to continuing production of a children ’ s product. If a children ’ s product initially is certified, and then a dditional production continues, periodic testing is required for all the applicable children ’ s produ ct safety rules, even if there are no material changes. The requirements to test children ’ s product when there is a material change and to undertake periodic testing become effective on February 8, 2013. 116

The law provi des that accreditation of TPCABs may be conducted either by the CPSC or by

a designated accreditation body

. 117 T hree types of TPCABs are contemplated by the law : (1)

those that are not owned, managed, or controlled by a manufacturer or private labeler of a children’s product to be tested for certification purposes (“independent” laboratories); (2) those that are owned, managed, or controlled by a manufacturer or private labeler of the children’s product (“firewalled conformity assessment bodies” ) 118 ; and (3) those owned or controlled, in

who le or in part, by a government (“governmental laboratories”). 119

For a TPCAB to be accepted to test children ’ s products for conformity with children ’ s product safety rules, it must be accredited by an accreditation body that is a signatory to the

ILAC MRA

. 120 To be an ILAC

- MRA signatory, an accreditation body must, inter alia

, operate
in accordance with ISO / IEC 17011

. 121 To make an accreditation determination, the accreditation body asses ses the laboratory’s conformity with ISO/IEC 17025 . As described by

CPS C, ISO/IEC 17025 includes technical requirements relating to the competence of laboratory staff, suitability and maintenance of test equipment, and quality assurance of test data. 122 It also includes management requirements relating to organization, managem ent systems, document

113 CPSC, Small Batch Manufacturers and Third Party Testing, http://w ww.cpsc.gov/info/toysafety/smallbatch.html (last visited Sept. 11, 2012).

114 15 U.S.C. § 2063(i)(5)(A)(i).

115 CPSC, FAQs: Certification and Third Party Testing, http://www.cpsc.gov/info /toysafety/3ptfaq.html#foot1 (last visited Sept. 11, 2012).

116 Id

. 117 15 U.S.C. § 2063(a)(3)(C).

118 See infra notes 130

- 132 and accompanying text.

119 Requirements Pertaining to Third Party Conformity Assessment Bodie s, 77 Fed. Reg. 31086, 31087

- 88 (May 24, 2012); see also 15 U.S.C. § 2063(f)(2).

120 Third Party Conformity Assessment Body Accreditation Requirements for Testing Compliance with 16 C.F.R.

pt. 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22, 200 8), available in unpublished form at http://www.cpsc.gov/library/foia/foia09/brief/smallparts.pdf ; see also Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 F ed. Reg. 31086, 31088 (May 24, 2012).

121 ILAC, ILAC MRA and Signatories, http://www.ilac.org/ilacarrangement.html (last visited Sept. 11, 2012).

122 Id

.Third

- Party Programs to Assess Regulatory Compliance

19 controls, audits, and management reviews. 123

Laboratories are accredited with a defined “scope of accreditation,” which indicates the children’s product safety rule s and/or test method s for which it is accredited to test

. 124 As required by the CPSIA, the commission maintains an online listing of accredited TCPABs and their scopes of accreditation

. 125 The current list includes hundreds of laboratories in about 35

countries. 126 For example, the U.S.

- based laboratory NSF Internatio nal is accredited by International Accreditation Services Inc. (IAS) and its scope of accreditation includes about 45

different product safety rules and ASTM standards

. 127

Several measures exist to address conflicts of interest that might raise doubt abou t the impartiality of product certifications . As part of being accredited to ISO/IEC 17025 , laboratories

must “ have policies and procedures to avoid involvement in any activities that would diminish confidence in its competence, impartiality, judgment, or operational integrity.” 128 A laboratory must “demonstrate that it is impartial and that its personnel are free from any undue commercial, financial, and other pressures that might influence their technical judgment.” CPSC has also

state d in its Notices of Requirements that accredited laboratories are subject to either an on

- site surveillance or a full reassessment every two years to ensure that they maintain their standards of independence and technical expertise. 129

In addition to the baseline accreditation requirements, firewalled laboratories and governmental laboratories seeking CPSC approval must meet additional requirements that relate to their impartiality and independence. The CPS I A specifies that the CPSC may approve a firewalled laboratory if the la boratory has established procedures to ensure that

(I) its test results are protected from undue influence by the manufacturer, private labeler or other interested party; (II) the Commission is notified immediately of any attempt by the manufacturer, pri vate labeler or other interested party to hide or exert undue influence over test results; and (III) allegations of undue influence may be reported confidentially to the Commission. 130

In CPSC’s published Notices of Requirements, the CPSC has required that firewalled labs

see k ing approval submit copies, in English, of their training documents showing how employees are trained to notify the CPSC immediately and confidentially of any attempt by the

123 Id

. 124 See CPSC, CPSC Form 223

- Lab Accreditation, http://www.cpsc.gov/cgibin/labregentry/ (last visited Sept. 11, 2012).

125 15 U.S.C. § 2063(a)(3)(E) (requiring that the Commission maintain on its website an up

- to

- date list of entities that have been accredited to assess conformity with children’s product safety rules.)

126 CPSC, List of CPSC

- Accepted Testing Laboratories, http://www.cpsc.gov/cgi

- bin/labsearch/ (last visited Sept. 11, 2012).

127 Id. (detailed information displayed by highlighting the laboratory name and clicking “submit”).

128 Requirements Pertaining to Third Part y Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31093 (May 24, 2012).

129 See

, e.g.
, Third Party Conformity Assessment Body Accreditation Requirements for Testing Compliance with 16 C.F.R. Part 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22 , 2008), available in unpublished form at http://www.cpsc.gov/library/foia/foia09/brief/smallparts.pdf

130 15 U.S.C. § 2063(f)(2)(D)(ii).Third

- Party Programs to Assess Regulatory Compliance

20 manufacturer, private labeler, or other interested party to hi de or exert undue influence over the

TCPAB’s test results. 131 This additional requirement applies to any laboratory in which a manufacturer or private labeler of a children ’ s product to be tested by it owns an interest of ten
percent or more. 132

Similarly, the CPS I A contains five criteria that a governmental laboratory must satisfy for its accreditation to be accepted by the CPSC. 133 The CPSC must determine that to the extent practicable, manufacturers located in any nation are permitted to choose a laborator y that is not owned or controlled by the government of that nation; that the testing results are not subject to undue influence by any other person; that the governmental laboratory and its testing results do

not receive more favorable treatment than other accredited laboratories in the same nation; and that the governmental laboratory does not exercise undue influence on the decisions of other governmental authorities that make decisions affecting its operation or controlling distribution of products. 134 The CPSC’s proposed rule requires governmental labs seeking CPSC acceptance to submit a variety of relevant information to assist it in making these determinations. 135

The CPS I A requires the CPSC to establish “requirements for the periodic audit of third part y conformity assessment bodies as a condition for the continuing accreditation of such conformity

assessment bodies

. ” 136 CPSC’s final rule, “ Audit Requirements for Third Party Conformity Assessment Bodies, ” implements this provision. 137 It provides t hat the periodic audit of

TCPABs consists of two parts. 138 The first part is a reassessment by the same accreditation body

that it received its initial accreditation from to determine whether it continues to meet accreditation criteria. The second part is the resu bmission to the CPSC of the CPSC’s “Consumer Product Conformity Assessment Body Acceptance Registration Form” and its review by the CPSC. The rule does not specify the frequency of the periodic audit but rather says that it

must occur at a minimum “at the frequency established by its accreditation body.” 139 CPSC

ob serves that according to ISO/IEC 17011 a full reassessment must occur at least every two years, unless an accreditation body undertakes less comprehensive surveillance visits every six

months. 140 I n this case, the time between reassessments must be no more than 5 years. 141

131 Third Party Conformity Assessment Body Accr editation Requirements for Testing Compliance with 16 C.F.R. Part 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22, 2008), available in unpublished form at http://www.cp sc.gov/library/foia/foia09/brief/smallparts.pdf ; see also Requirements Pertaining to Third Party Conformity Assessment Bo dies, 77 Fed. Reg. 31086, 31088, 31133 (May 24, 2012) (stating that the requirement is that the laboratory “train employees that they may notify the CPSC immediately, and that a report to the CPSC may be confidential.”)

132 Id

. 133 15 U.S.C. § 2063(f)(2)(B); summarized in Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31088

, 31133 (May 24, 2012).

134 Id

. 135 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31133

- 34 (May 24, 2012).

136 15 U.S.C. § 2063(i)(1) (before amendments in H.R. 2715, this provision was located instead at 15 U.S.C. § 2063(d)(1)).

137 Audit Requirements for Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31074 (May 24, 2012).

138 Id . at 31083.

139 Id . at 31085.

140 Id . at 31083.

141 Id

.Third

- Party Programs to Assess Regulatory Compliance

21 The law provides that the CPSC may wit hdraw its acceptance of a TPCAB if it finds that “(A) a manufacturer, private labeler, or governmental entity has exerted undue influence on such conformity assessment body or otherwise interfered with or compromised the integrity of the testing process with respect to the certification of a children ’ s product under this section; or (B) such conformity assessment body failed to comply with an applicable protocol, standard, or requirement established by the Commission...

. ” 142 The law also provides that the CPSC may suspend a laboratory’s accreditation if it fails to cooperate with the CPSC in an investigation regarding its certification activities. 143 In May 2012, CPSC published a proposed rule, “Requirements Pertaining to Third Party Conformity Assessment Bodies,” which would implement these provisions. 144 The rule would establish whether, when and how the CPSC may deny a TCPAB’s application; suspend accreditation; and withdraw accreditation. 145 It would also establish how a person may submit to the CPSC information alleging a ground for denial, suspension, or withdrawal. 146

The CPSC ’s third

- party p rogram has been f unded with appropr iated funds. The statute contains no provisions regarding the assessment of user fees to cover the costs of program development and implementation.

3. FDA, Medical Device Inspections

In fulfillment of statutory requirements , the FDA has developed two programs through which regulated entities can opt to have third parties perform compliance assessment tasks related to medical devices that the regulatory agency would otherwise perform. Through the first program,

manufacturers of certain medical devices may have third parties review their 510(k) premarket

notifications. Th rough the second program, third parties may conduct inspections of facilities that manufacture certain medical devices. In both, third

- party or ganizations recognized by FDA

evaluate a m anufacturer ’ s compliance with mandatory standards in the Federal Food, Drug, and Cosmetic Act ( FDCA). 147

Premarket Notification 510(k) Third Party Review Program

The FDA Modernization Act of 1997 (FDAMA) directed the FDA to accredit third parties ( referred to as either Accredited Persons or Recognized Third Parties ) in the private sector to conduct the 510(k) pre

- market review for low risk (Class I) and certain moderate risk (Class II)

devices. 148 Pursuant to this authorization, the FDA established a ccreditation criteria (including

142 15 U.S.C. § 2063(e)(1). See also 15 U.S.C. § 2063(e)(2) (setting forth procedures for accreditatio n withdrawals).

143 15 U.S.C. § 2063(e)(3).

144 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086 (May 24, 2012).

145 Id . at 31119.

146 Id

. 147 As used in the program, the term “Persons” refers to organizations. See GAO, Report to Congressional Committees, Medical Devices: Status of FDA’s Program for Inspections by Accredited Organizations 3 (January 2007) [hereinafter “ Status of FDA’s Program ” ]

. 148 See generally FDA, Guidance for Third Parties and FDA Staff; Third Party Review of Premarket Notifications, (Sept. 28, 2004), http://www.fda.gov/MedicalDevices/D eviceRegulationandGuidance/

GuidanceDocuments/ucm082191.htm ; FDA, Implementation of Third Party Programs under the FDA Modernization Act of 1997; Final Guidance for Staff, Industry and Third Parties (February 2, 2001), http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/Third

- Party Programs to Assess Regulatory Compliance

22 criteria to prevent conflicts of interest) and conducted accreditations, 149 published a list of

Accredited Persons

, 150 and conducted a training program for Accredited Persons. 151 By creating this option for device manufact urers, Congress intended “to enable FDA to use its scientific review resources for higher

- risk devices, while maintaining a high degree of confidence in the

review of low

- to

- moderate risk devices by Accredited Persons, and to provide manufacturers of eligible de vices an alternative review process that may yield more rapid 510(k) decisions.” 152

Post

- Market Inspections by Accredited Persons Program

The rest of this section provides an in depth discussion of the post

- market Inspections by APs Program, in part beca use it involves facility inspections in addition to document review , and in part because information was more readily about this program. The overall structure of the third

party program for medical device facility inspections is shown in Figure 5.

T he Medical Device User Fee and Modernization Act of 2002 (MDUFMA) authorized FDA

to establish the “Inspection by Accredited Persons” program (AP Program). 153 Under the AP Program, certain manufacturers of Class II (medium

- risk) and Class III (high

- risk) med ical devices may voluntarily contract with an AP to conduct a “Third

- Party Inspection” of their facility

. FDA considers an inspection by an AP to be “an alternative to the traditional inspection by an FDA official.” 154 With t he AP Program, accredited third p arties may conduct these inspections “in lieu” of the FDA. 155 In requiring its establishment, Congress sought to address the FDA’s inability to meet its inspection burden. 156 The program also purported to offer an advantage to manufacturers that produce for both the US market and foreign markets by providing the opportunity to undergo a single inspection process that satisfies multiple jurisdictions. 157

ucm094459. p df (noting that FDA’s policy permitted third party review of class II dev ices only if device

- specific guidance or recognized consensus standards existed) [hereinafter Implementation of Third Party Programs]; see also 21 U.S.C. §360m (containing the statutory requirement).

149 Medical Devices; Implementation of Third Party Review Under the Food and Drug Administration Modernization Act of 1997; Emergency Processing Request Under OMB Review, 63 Fed. Reg. 28388 (May 22, 1998) (publishing these criteria); Implementation of Third P arty Programs Under the FDA Modernization Act of

1997

- Final Guidance for Staff, Industry and Third Parties (Feb. 2, 2001), http://www.fda.gov/Medi calDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm094450.htm (last visited Sept. 9, 2012).

150 Current List of Accredited Persons for 510(k) Review under the FDA Modernization Act of 1997 (updated Sept. 5, 2012), http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfthirdparty/accredit.cfm (last visited Sept. 9, 2012).

151 Implementation of Third Party Programs, supra note 148

. 152 Id.

153 Medical Device User Fee and Modernization Act of 2002

, Pub

. L . No. 107

– 250 , § 201, 116 Stat. 1588 (2002) ( codified at 21 U.S.C. § 374 (g) ) ( amended section 704 of the Federal Food, Drug, and Cosmetic Act by adding subsection (g) )

. 154 See FDA, Medical Devices, Accredited Persons Inspection Program, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 11, 2012)

. 155 Id

. 156 Medical Devices

- Challenges for FDA in Conducting Manufacturer Inspections: Hearing B efore the Subcomm

. on Oversight and Investigations of the H. Comm

. on Energy and Commerce , 110th Cong. (Jan. 29, 2008) (statement of Marcia Crosse, Director, Health Care, United States General Accountability Office) (citing H.R. Rep. No. 107

- 728, pt. 1, at 35

- 36 (20 02)) [hereinafter “ Challenges for FDA ” ].

157 Id

.Third

- Party Programs to Assess Regulatory Compliance

23 The mandatory standard that applies in such inspections is the Quality System (QS) regulation and ot her devi ce requirements in the FDCA and its regulations. 158 The QS regulation requires that domestic and foreign manufacturers establish a quality system that implements current good manufacturing practices relevant to the “design, manufacture, packaging, labeling, storage, installation, and servicing of finished medical devices intended for human use” in the

United States. 159 In a QS inspection, FDA inspectors examine manufacturing controls, processes, and records. 160 When a manufacturer participates in the AP program , the AP prepares and submits its reports to FDA, which remains responsible for making a final compliance

assessment. 161

FDA has also implemented the MDUFMA’s third

- party inspection provisions through its

Pilot Multi

- purpose Audit Program (PMAP). 162 PMAP wa s established in 2006 in partnership with FDA’s Canadian counterpart Health Canada, which also had a third

- party certification and inspection program for medical devices. 163 PMAP aimed to include 10 inspections in which

manufacturers would hire a single acc redited third party to conduct an audit that would serve the regulatory purposes of both FDA and Health Canada. 164 In total, eleven such inspections were conducted, and the agencies produced a final joint report to summarize lessons learned. 165

Importantly, t he AP by Inspections program is completely voluntary. Eligible manufacturers may choose to utilize an AP to conduct an inspection or they may continue to have FDA perform inspections. 166 If a manufacture r is inspected by an AP, FDA removes the manufacturer from its routine inspection work plan for two years. 167 In effect, the manufacturer receives a two

- year

158 21 C.F.R. pt. 820 (2007).

159 Id

. § 820.1(a)(1).

160 Status of FDA’s Program, supra note 147 , at 1.

161 See FDA, Medical Devices, Accredited Persons Inspection Program, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 11, 2012). See also 21 U.S.C. § 374(g)(7)(A) (stating that APs shall prepare an inspection report and that “any official classification of the inspection shall be determined by the Secretary.”)

162 FDA, Pilot Multi

- Purpose Audit Program (PMAP)

- Questions and Answers Related to the Pilot, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125453.htm (last visited Sept. 11, 2012) [hereinafter PMAP Q&A]; see also Cha llenges for FDA, supra note
156 , at 9, 19

- 21

. 163 Pilot Multi

- Purpose Audit Program, supra note 162 (stating that Health Canada’s CMDCAS was established several years before FDA established the AP Program)

. 164 On international cooperation in regulation, see Administrative Conference of the United States, Recommendation

2011

- 6, International Reg ulatory Cooperation (Dec. 8, 2011), available at http://www.acus.gov/acus

r ecommendations/international

- regulatorycooperation/

. 165 FDA, Medical Devices, Final Joint Report of the Pil ot Multipurpose Audit Program (P MAP), http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm232806.htm (also available in PDF format at http://www.hc

- sc.gc.ca/dhp

- mps/alt_formats/pdf/md

im/activit/int/md_pmap_rep_im_ppafm_rap

- eng.pdf ) [here in after PMAP report]; Interview (by phone) , Kim Trautman, Associate Director, International Affairs, Office of the Cente r Director, Center for Devices and Radiological Health, U.S. Food and Drug Administration, Jun. 5, 2012 (reporting that eleven PMAP inspections were conducted).

166 See FDA, Medical Devices, Accredited Persons Inspection Program, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 9, 2012)

. 167 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.Third

- Party Programs to Assess Regulatory Compliance

24 “inspection holiday” from regular FDA inspections unless FDA receives a complaint or has other

cause to inspect.

Figure 5 : Structure of Third

- Party Pro gram for Medical Device Facilities

Only certain manufacturers are eligible to participate in the program. T he manufacturer must

manufacture a Class II o r Class III device. 168 Further, it must market a t least one of these

medical device s in the United States and also market or plan to market a t least one of these

medical device s in a foreign country that certifies, accredits, or otherwise recognizes the chosen AP as having the authority to conduct device inspections. 169 Also , the program was “limited to

establishments whose most recent inspection was classified by FDA as e ither ‘ No Action

Indicated ’ or ‘ Voluntary Action Indicated .’ ” 170 The Food and Drug Administration Amendments Act (FDAAA) of 2007 streamlined the Accredited Person for Inspection Program by eliminating the req uirement that a device establishment must seek prior FDA approval for a

Third

- Party Inspection and by eliminating the limit of two consecutive Third

- Party I nspections unless FDA granted a waiver. 171 After the amendments, eligible manufacturers may simply

su bmit notification of their intent to use the program. 172

168 FDA, Guidance for Industry, FDA Staff, and FDA

- Accredited Third Parties

- Manufacturer's Notification of the

Intent to Use an Accredited Person under the Accredited P ersons Inspection Program Authorized by Section 228 of the Food and Drug Administration Amendments Act of 2007 (FDAAA), 4 (Mar. 2, 2009), http://www .fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm085187.htm

, 169 Id. (stating “At least one foreign country where you market or intend to market your class II or class III device must certify, accredit, or otherwise recognize the A P you have chosen as a person authorized to conduct device inspections.” Id. at 6). See also 21 U.S.C. § 374(g)(6)(A)(ii)(IV)(bb).

170 21 U.S.C. § 347(g)(6)(A)(i). See also Status of FDA’s Program, supra note 147 , at 6 (stating “Based upon its findings during inspection, FDA classifies completed inspections into one of three categories based on the extent to

which the establishment deviates from applicable requirements of the quality system regulation: No action indicated (which indicates no deviations or only minor deviations), voluntary action indicated (which indicates minor to significant deviations), or official action indicated (which indica tes significa nt deviations and warnings).”); FDA, Guidance for Industry, FDA Staff, and Third Parties

- Inspection by Accredited Persons Under The Medical Device

User Fee and Modernization Act of 2002 and the FDA Amendments Act of 2007 ; Accreditation Crite ria (Aug. 6, 2009), http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm089702.htm (last visited Sept. 9, 2012) [he reinafter “ Guidance for Industry ” ].

171 Guidance for Industry, supra note 170 , at 4.

172 Agency Information Collection Activities; Proposed Collection; Comment Request; Manufacturer’s Notification of the Intent To Use an Accredited Person Under the Accredited Persons Inspection Program Authorized by Section FDA (Third Party Recognition Board)

Accredited Persons (APs) a ccredits

that inspect

Medical Device Facilities

to assess conformity with

Quality System (QS) regulation and other requirementsThird

- Party Programs to Assess Regulatory Compliance

25 Unlike the two programs reviewed above, FDA does not utilize independent accreditation bodies in this program. Rather, a ccreditation determinations are made by FDA’s Third Party Recognition Board (TPR B), which was established in 1998 to make accreditation determinations for the 510(k) pre

- market review program. 173 MDUFMA required FDA to establish criteria for the accreditation of Accredited Persons and to conduct further activities to approve their emplo yees to conduct inspections. 174 Under the law , an applicant for accreditation must not be a federal government employee and must be a legall y

- constituted independent entity with no organizational, material or financial affiliation with a manufacturer, suppli er or vendor of articles regulated under the act. 175

According to FDA guidance, the applicant must agree to operate in accordance with generally accepted professional and ethical business practices and agree in writing to, inter alia

, limiting its work to that for which competence and capacity are available; promptly responding and attempting to resolve complaints regarding accredited activities; and protecting against officer and employee financial conflicts of interest. 176 FDA also requires that APs have

s ufficiently trained personnel, including at least one individual with supervisory capability and authority, and the necessary infrastructure to interface with FDA’s electronic data systems and to protect confidential information. 177

After an organization is approved as an AP, its employees must complete classroom training conducted by the Association for the Advancement of Medical Instrumentation (AAMI) and the

FDA. 178 Upon successfully completing the classroom training, AP employees must then successfully co mplete three j oint inspections with FDA including a collaborative inspection (in which the trainee acts primarily as an observer of the FDA inspector); a modified performance inspection (in which the trainee conducts the inspection with the assistance of a n FDA inspector); and a full performance inspection (in which the trainee independently performs an

228 of the Food and Drug Administra tion 76 Fed. Reg. 29764 (May 23, 2011); see also Guidance for Industry,

supra note 170 , at 4 (noting the specific information that the notice must include).

173 Guidance for Industry, supra note 170 , at 5. The Third Party Recognition Board is situated within the FDA’s

Center for Devices and R adiological Health and chaired by William Sutton. Id . at 22. On how the TPRB interacts with applicants and reviews applications, see Implementation of the Inspection by Accredited Persons Program

Under the Medical Device User Fee and Modernization Act o f 2002; Accreditation Criteria: Guidance for Industry, FDA Staff, and Third Parties; Availability, 68 Fed. Reg. 22400, 22402

- 03 (Apr. 28, 2003). On the 510(k) program generally, see supra notes 148

- 151 and accompanying text.

174 21 U.S.C. § 374(g)(2). These criteria were published at 68 Fed. Reg. 22400 (Apr. 28, 2003). On October 4, 2004, FDA published revised accreditation criteria at 69 Fed. Reg. 59250 to incorporate changes to MDUFMA made by the Medical Devices Technical Corrections Act (MDTCA), Pub. L. No. 108

- 214, signed into law on April 1, 2004.

175 21 U.S.C. § 374(g)(3); see also Guidance for Industry, supra note 170

. 176 Guidance for Industry, supra note 170 , at 6

- 8.

177 Id

. ; see also 21 U.S.C. § 374(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and Modernization Act of 2002; Accreditation C riteria; Availability, 69 Fed. Reg. 59250 (Oct. 4, 2004) (providing that the qualifications for APs’ personnel will be equivalent to that of FDA personnel); see also 21 U.S.C. § 374(g)(3)(E)(iii) (providing that an AP must protect from public disclosure tr ade secret, confidential commercial or financial information, and private personal identifier information in records, except that such information may be made available to FDA)

. 178 Guidance for Industry, supra note 170 , at 9

- 10.Third

- Party Programs to Assess Regulatory Compliance

26 inspection that is observed and evaluated by an FDA inspector). 179

FDA instructs APs to prepare an inspection report to be submitted to both the manufactur er and the FDA using the format defined in its Investigations Operations Manual (IOM)

. 180 The report must describe in detail each significant non

- conformity found and identify any other matters that relate or that may influence compliance with the A ct. 181 Th e report must also describe any recommendations made by the AP to the manufacturer during the inspection or at the closing meeting and describe any promised corrective actions or other discussions with the manufacturer at the conclusion of the inspection. 182 APs are required to maintain certain records regarding their initial and continuing qualifications to be APs and regarding each inspection. 183
The law requires also an AP that discovers a condition that it believes could cause or contribute

to an unreason able risk to public health to report the problem to FDA immediately. 184

Since 2003, the FDA has accredited 16 organizations as APs and conducted classroom training for the AP auditors. 185 FDA maintains a list of Accredited Persons with contact

information online. 186 F or example, US

- based organizations that have been recognized as APs

include : Intertek Testing Services; Lloyd’s Register Quality Assurance, Inc.; TUV Rheinland of North America, Inc.; an d Underwriters Laboratories , Inc . (UL)

. 187 Some of the recogn ized firms

based outside the U.S. include AMTAC Certification Services Limited, in the United Kingdom; Center for Measurement Standards/Industrial Technology Research Institute (CMS/ITRI), in China; and Quality Management Institute (QMI), in Canada. 188 The list sets forth the types of device manufacturing facilities that each AP is recognized to inspect (often “all medical devices”) and the foreign countries that certify, accredit, or otherwise recognize the AP as having the authority to conduct device insp ections

. 189

MDUFMA and its regulations require that APs and their employees (including contract employees) be free from conflicts of interest and the appearance of conflicts of interest that could

179 Id

. See also 21 U.S.C. § 347(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third Parties; Implementation of the Inspection by Accredited Persons Pro gram Under the Medical Device User Fee and Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59291 (providing that APs are

not eligible to conduct independent inspections until they successfully complete FDA’s training pr ogram and perform a satisfactory inspection under FDA’s observation)

. 180 See FDA, Inspections, Compliance, Enforcement, and Criminal Investigations, Investigations Operation Manual, http://www.fda.gov/or a/inspect_ref/iom/ (last updated March 2, 2012) ; see also 21 U.S.C. § 374(g)(7)(A) (stating that APs are required to prepare inspection reports in the form and manner designated by FDA).

181 Guidance for Industry, supra note 170 , at 12

- 13.

182 Id

. 183 Id . at 13

- 14.

184 21 U.S.C. § 374(g)(7)(E).

185 Guidance for Industry, supra note 170 , at 3

- 4 (noting that the law required that no more than 15 firms be accredited during the first year of the AP Program).

186 See FDA, Medical Devices, Accredited Persons Inspection Program, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (las t visited Sept. 9, 2012).

187 Id.

188 Id.

189 Id.Third

- Party Programs to Assess Regulatory Compliance

27 affect the inspection process or the preparation of reports. 190 APs may not be owned, operated or controlled by a manufacturer, supplier or vendor of a ny article regulated under the A ct, and no personnel of an AP involved in inspections, nor their spouses or minor children, may have ownership of or other financial interest in any product, manufacturer, supplier or vendor regulated under the A ct. 191 Potential conflicts of interest are also present if the AP or any of its inspection personnel provides consultative services to any manufacturer, supplier, or vendor of products regulated under the A ct; if inspection personnel participate in an inspection of a firm they were employed by within th e last 12 months; or i f the fees charged or accepted are contingent or based upon the observations in the report made by the AP. 192

When applying to become APs, organizations are required to submit a copy of the written policies, procedures and sample certi fication/compliance statements established to prevent conflicts of interest. FDA uses a rating criteria checklist to evaluate whether APs have established, documented, and executed policies and procedures to prevent individual and organizational conflicts of interest. 193 FDA states that APs should either adopt the conflict of interest standards that apply to federal agency employees

, 194 use the Model Conflict of Interest Policy that it provides in guidance

, 195 or “explain alternative equivalent procedures” to sa feguard against conflicts of interest.

FDA is also required by statute to monitor manufacturers’ requests to use a particular AP, and it can stop inspections by APs who may have developed inappropriate business relationships

with manufacturers. 196 As descr ibed by FDA, business relationships that may undermine the independence or objectivity of an AP include contracts between a manufacturer and an AP that represent a significant share of the AP ’ s income such that continuation or termination of the

contract m ay create undue financial influence or at least the appearance of such influence. 197
Evidence of a financial conflict of interest between the AP and the owner or operator of the inspected device establishment may constitute cause for withdrawal of the AP ’ s a ccreditation. 198
Finally, the statute requires each AP to annually make available to the public the extent to which the AP complies with conflict of interest requirements. 199

The A ct sets forth several prohibited acts including the knowing failure of an AP to

190 See 21 U.S.C. § 374(g)(2) and (3); Guidance for Industry, Food and Drug Administration Staff, and Third Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59252 (Oct. 4, 2004)

. 191 21 U.S.C. § 374(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59252 (Oct. 4, 2004)

. 192 Guidance for Industry, supra note 170

. 193 Id. ( see especially the checklist contained in Appendix 3.)

194 See “ Standards of Ethical Conduct for Employees of the Executive Branch, ” available at http://www.oge.gov/Laws

- and

- Regulations/Employee

- Standards

- of

- Conduct/Standards

- of

- Ethical

- Conduct

- for

Employees

- of

- the

- Executive

- Branch

- (PDF)/ (last visited Sept. 11, 2012) (compiling ethics standards codified in 5 C.F.R. pt. 2635 as amended at 76 Fed. Re g. 38547 (July 1, 2011))

. 195 Guidance for Industry, supra note 170 (see especially the Model Conflict of Interest Policy contained in Appendix 2).

196 Guidance for Industry, supra note 170

. 197 Id.

198 21 U.S.C. § 374(g)(5).

199 Id . § 374(g)(3)(E).Third

- Party Programs to Assess Regulatory Compliance

28 immediately notify FDA of a condition noted during an inspection that could cause or contribute

to an unreaso nable risk to the public health, the knowing inclusion by an AP of false info rmation in an inspection report, and the knowing failure of an AP to include material facts in such a
report. 200 With respect to public disclosure, FDA states that inspection records and information collected from the manufacturer and submitted to FDA by APs will generally be available for disclosure after the agency issues a compliance decision, unless such information is exempt from disclosure by law. 201 The law provides that FDA will audit APs on a periodic basis, and the

FDA states in guidance that it will make onsite visits on a periodic basis to each AP to audit performance and inspect records, correspondence, and other materials relating to AP Program inspection s

. 202

FDA may withdraw accreditation when an AP is substantially not in compliance with the standards of accreditation, poses a threat to the public healt h, or fails to act in a m anner consistent with the A ct. 203 FDA may also withdraw accreditation where FDA determines that there is a financial conflict of interest between the AP and the owner or operator of a device establishment that the AP has inspected. 204 Before FDA withdraws an AP’ s accreditation, it

notifies the AP and provide s an opportunity for an informal hearing. 205

The FDA ’s design and implementation of the AP program has been funded with appropriated funds. The statute contains no provisions rega rding the assessment of user fees to cover the costs of program development and implementation. As of 2012, the program was largely inactive and a single FDA employee administered the program as a collateral duty

. 206 Also as of 2012, the 510(k) premarket review program had no full

- time positions committed to it. Administrative

re sponsibilities are spread over three employees as part of their other workload. 207

4. FCC, Telecommunication Certification Body Program

I n 1998, the FCC adopted rules for the establishment of Telecommunication Certification Bodies (TCBs) that have the authority to certify that equipment meets the FCC’s requirements and issue a written grant of equipment authorization

. 208 FCC requirements gen erally apply to all

200 21 U.S.C. § 331(gg). See also 21 U.S.C. § 374(g)(7)(E); Guidance for Industry, supra note 170 , at 13 (providing that “If at any time during an inspection the AP discovers a co ndition that it believes could cause or contribute to an unreasonable risk to public health, the AP must report the problem to FDA immediately ” )

. 201 Guidance for Industry, supra note 170 , at 13. Applicable disclosure laws include the Freedom of Information Act (5 U.S.C. § 552) , the Trade Secrets Act (18 U.S.C. § 1905), relevant provisions of the FDCA (21 U.S.C. § 331(j))

and FDA regulations implementing these statutes ( see e.g., the FDA regulations implementing the Freedom of

Information Act in 21 C.F.R. p t

. 20 and FDA’s FOIA web page at http://www.fda.gov /RegulatoryInformation/foi/

default.htm ).

202 21 U.S.C. § 374 (g)(5)(A)(i); Guidance for Industry, supra note 170 , at 5 , 11 (further stating that i t audits APs on

a periodic and “for cause” basis ).

203 21 U.S.C. § 374(g)(5); Guidance for Industry, supra note 170 , at 14.

204 Id

. 205 Guidance for Indu stry, supra note 170 , at 14.

206 E mail from Jean Cooper, Senior Staff Fellow, U.S. Food and Drug Administration

, July 17, 2012 (on file with author)

. 207 Id.

208 64 Fed. Reg. 4995 (Feb. 2, 1999); 47 C.F.R. §§ 2.960

- 2.962 & 68.160

- 68.162

. The applicable telecommunications equipment regulations are at 47 CFR p ts

. 0 through 101. The requirements for Telecommunication Certification Bodies (TCBs) were spec ified in the Commission’s Report and Order (R&O) inThird

- Party Programs to Assess Regulatory Compliance

29 devices that generate radio frequency (RF) energy to ensure that they operate effectively without causing harmful interference to radio communications. Certain devices must also be evaluated for radiofrequency radiation exposure to prot ect human health

. 209

Only certain types of equipment require certification, and often the certification can be conducted by either a TCB or the FCC. 210 Examples of devices which may be submitted to either include, but are not limited to cell phones, RF light s, microwave o ven s, RC transmitters, family r adio s, telem etry transmitters, w i reless phones, and walkie t alkies. 211 Some devices may only be submitted to the FCC (such as certain new technologies) or TCBs (all computers and computer peripherals). When a manufacturer seeks certification directly from the FCC, equipment authorization fees apply. 212

Figure 6 shows the third

- party structure of the TCB program. TCBs are required to be accredited as operating in accordance with ISO/IEC Guide 65 (1996), General Requirements for Bodies Operating Product Certification Systems and FCC ’s technical requirements for TCBs

. 213

Under its National Voluntary Conformity Assessment Evaluation (NVCASE) p rogram, National Institute of Standards and Technology (NIST) is responsib le for recognizing the private accreditation bodies that accredit TCBs in the United States. The two recognized accreditation

bodies are American Nation al Standards Institute (ANSI) and the American Association for Laboratory Accreditation (A2LA). 214 Certi fication bodies located outside the US may be recognized by the FCC as a TCB when there is a government to government M utual R ecognition

A greement between the country they are located in and the US. In that case, the TCB is accredited by appropriate auth orities in that country. 215 A n online list of recognized TCBs is maintained by FCC. 216 The TCB program went into effect in June 2000 with 13 recognized TCBs, and as of 2012, there are 34 recognized TCBs. 217

T he task of the TCB has two steps: first, to evaluate the product (which involves laboratory testing or reliance on testing conducted by the manufacturer); and second, to make the

certification decision. 218 TCBs are accredited with certain scopes, which indicate the product types they may approve (e.g ., Scope A: Unlicensed Radio Frequency Devices; Scope B:

GEN Docket 98

- 68 (FCC 98

- 338), adopted on December 17, 1998. Further guidance on the requirements for TCBs was given in Public Notice DA 99

- 1640 , FCC Provides Further Information on the Accreditation Requ irements for Telecommunication Certification Bodies GEN Docket 98

- 68, released on August 17, 1999.

209 47 CFR §§ 2.1091, 2.1093; see also http://transition.fcc.gov/oet/rfsafety/ (last visited Sept. 11, 2012).

210 See 47 CFR § 2.907 (on “certification”). Equipment with a low risk of causing harmful interference may generally satisfy FCC requirements through a manufacturer’s “verification,” 47 CFR § 2.902, or “Declaration of Conformity,” 47 CFR § 2.906.

211 See http://transition.fcc.gov/oet/ea/procedures.html (last visited Sept. 11, 2012).

212 See http://ap ps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=41712&switch=P (last visited Sept. 11, 2012) (showing fees ranging from $490

- $1265 for certification of devices).

213 TCB Program Rules and Responsibilities, FCC Office of Engineering and Technology (OET) Laboratory Division, (Jan. 6, 2011). See also 47 CFR § 68.160(b).

214 Id.

215 Id. See also 47 CFR § 68.160(b).

216 See https://apps.fcc.gov/tcb/index.html (last visited Sept. 11, 2012).

217 David A. Case & W illiam Graff, Approval Options: A Look at the FCC and TCB Approval Processes (2001), http://www.ce

- mag.com/archive/01/09/case.html (for 2001 number); Interview (by phone) , George Tannahill, FCC

Of fice of Engineering and Techn ology, August 27, 2012 (for 2012 number).

218 TCB Program Rules

, supra note 213

, at 3; see also 47 C.F.R. § 68.162(b)(2).Third

- Party Programs to Assess Regulatory Compliance

30 Licensed Radio Service Equipment). For accreditation, TCBs must demonstrate expert knowledge of the regulations for the product types in each of their scopes. Also, t he TCB must
have the technical e xpertise and capability to test the equipment it will certify and shall also be

accredited in accordance with ISO/IEC 17025 to demonstrate it is competent to perform such

tests. 219 Testing of products may be performed by subcontractors of TCBs, but the TCB must maintain oversight and remains responsible for the test results. 220 The F CC has not established

conflict

- of

- interest rules for TCBs beyond what is required for accreditation to ISO Guide 65. 221

Figure 6 : Structure of Third

- Party Program for T elecommunication Equipment

Before a TCB can grant an equipment authorization, it must submit all required information to the FCC’s online system. 222 After the system automatically performs certain validity checks, it can be used to grant the authorization. FCC reserves to itself 30 days to review the completed action and set aside the authorization if necessary. Much of the information that is uplo aded such as pictures of the product, pictures of the label and certain testing data becomes publicly

available. Other information entered into the system may be considered proprietary and kept

confidential.

Also, the FCC requires TCB s to conduct certain surveillance testing of equipment they certify

. 223 TCBs must test additional equipment samples for at least 5% of the grants they issue

219 47 C.F.R. § 68.162(b)(3), TCB Program Rules

, supra note 213

, at 2.

220 Id

. § 68.162(d).

221 Guide 65 states that a certification body should “ensure that activities of related bodies do not affect the confidentiality, objectivity and impartiality of its certifications, and it shall not 1) supply or desig n products of the type it certifies, 2) give advice or provide consultancy services to the applicant as to methods of dealing with matters which are barriers to the certification requested, 3) provide any other products or services which could compromise

t he confidentiality, objectivity or impartiality of its certification process and decisions.”

222 Inte rview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012.

223 47 C.F.R § 2.962(g)(2); see Federal Communications Commission, Office of Engineering and Technology Laboratory Division, TCB Post

- Market Surveillance, 1 610077 D01 TCB Post Market Surveillance v05r03 NVCASE

Accreditation Bodies recognizes

that accredit

Telecommunication Certification Bodies (TCBs)

that certify

Products

FCC requirements are in conformity with FCC

recognizesThird

- Party Programs to Assess Regulatory Compliance

31 and electronically submit an annual surveillance report. If a TCB finds that a certified product fails to comply, it mu st notify FCC and the manufacturer, which will be asked to take actions to

correct the situation. 224 Subject to certain procedural requirements, the FCC retains authority to

withdraw its recognition of TCBs and revoke the certification of products by TCBs. 225 FCC itself also conducts market surveillance activities that may include pre

- grant testing, post

- grant testing, and off

- the

- shelf product testing

. Upon receiving a complaint from a TCB or the public about a problem with another TCB or certified equipmen t, FCC may pursue the complaint itself, request an assessment by the relevant accreditation body, or require further testing by the

relevant TCB. 226

B. Programs for Voluntary Stan dards

In f our programs, federal agencies rely on third parties to assess an d certify compliance with voluntary standards established or endorsed by the agency. All these programs offer companies the opportunity to display a label on their products attesting to their compliance

. In all of them

, the use of third parties is obliga tory: to participate in the program, the company that sells the labeled product has to c ontract with a third party

.

1 . OSHA, National Recognized Testing Laboratories Program

Since 1988, the Occupational Safety & Health Administration (OSHA) has operated a third

party program through which it ascertains that specified equipment and materials (products) used

in OSHA

- regulated workplaces meet safety standards. 227 The program’s structure is illustrated in Figure 7. Under OSHA’s Nationally Recogni zed Testing Laboratory (NRTL) Program

, private sector organizations approved by OSHA are hired by manufacturers of specified products to test and certify them . The NRTL then authorizes the manufacturer to affix a label (or mark) on the products, which is v isible to the OSHA workplace inspector.

The standards that the products must meet to be certified by a NRTL are voluntary consensus standards, rather than government

- unique OSHA standards. 228 OSHA requires NRTL

certification for many different types of products, such as printers and copiers, electric heater and air conditioners, alarm systems, fire extinguishers, acetylene torches, and liquefied petroleum gas

ovens

. 229 These standards are set by national standards

- producing org anizations such as

(Oct. 25, 2011), http://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=20540&switch=P (last visited Sept. 11, 2012).

224 47 C.F.R § 68.162(g)(3).

225 Id

. § 68.162(f)(6).

226 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012.

227 53 Fed

. Reg

. 12102 (Apr. 12, 1988); 29 CFR § 1910, subpart S. See also Bernard Pasquet, OSHA Requirements for Nationally Recognized Testing Laboratory Approval of Products, http://www.osha.gov/dts/otpca/nrtl/NRTLarticle.html (last visited Sept. 11, 2012) (stating that workplaces subject to OSHA’s jurisdiction include the “vast majority” of private employers in the United States and its territories; most

fe deral government places of employment; and state and local government places of employment in states that have received OSHA approval to administer their own occupational safety and health program).

228 See 29 C.F.R. § 1910.7(c) (defining the test standards used in the NRTL program).

229 See Pasquet, supra note 227 ; OSHA, Type of Products Requiring NRTL Approval, http://www.osha.gov/dts/otpca/nrtl/prodcatg.html (setting forth 37 product categories, of which electrical equipment is the largest, and citing to General Industry Standards, 29 C.F.R. p t

. 1910).Third

- Party Programs to Assess Regulatory Compliance

32 American Nati onal Standards Institute (ANSI), American Socie ty for Testing and Materials (ASTM), Factory Mut ual Research Corporation (FMRC), and UL

. 230 In effect, manufacturers are not required by law to meet these standards to market the ir products, but workplaces that are regulated by OSHA are required to utilize certified products.

Figure 7 : Structure of Third

- Party Program for Workplace Product Safety

NRTLs are private organizations that are recognized by OSHA to be qualified to perform safety testing and product certification. 231 OSHA regulations set forth the requirements for

NRTLs. 232 NRTLs must be capable of performing the proper testing, meaning that they must have the proper equipment and facilities, staff, proc edures, and quality control programs. 233 They shall, as necessary, implement control procedures; inspect the production of items at factories; and conduct field inspections to monitor the proper use of their marks on products. 234 They must be “completely inde pendent” of both the manufacturers and vendors of equipment subject to testing and the employers subject to the tested equipment requirements. 235 NRTLs must maintain effective procedures for producing objective and unbiased reports and for fairly handling

co mplaints and disputes. 236

If its application is approved by OSHA, a NRTL ’ s initial recognition is valid for five

years. 237 OSHA approv es NRTLs with certain “scopes of recognition” by specifying the test

230 Occupational Safety & Health Administration, Nationally Recognized Testing Laboratory Program Application Guidelines, at 1, http://www.osha.gov/dts/otpca/nrtl/applguid.pdf (last visited Sept. 11, 2012) [hereinafter “ OSHA Application Guidelines ” ]. A list of standards recognized by OSHA is at http://www.osha.gov/dts/otpca/nrtl/allstds.html

. 231 See OSHA, Frequently Asked Questions (FAQs), http://www.osha.gov/dts/otpca/nrtl/faq_nrtl.html#1 (last visited Sept. 11, 2012) (stating that “ OSHA’s recognition is not a government license or position, or a delegation or grant of government authority. I nstead, the recognition is an acknowledgment that an organization has necessary qualifications to perform safety testing and certification of the specific products covered within its scope of recognition).

232 29 C.F.R. § 1910.7.

233 Id

. § 1910.7(b)(1).

234 Id

. § 1910.7(b)(2).

235 Id

. § 1910.7(b)(3).

236 Id

. §§ 1910.7(b)(4)(i) & (ii).

237 OSHA Application Guidelines, supra note 230 at 1. OSHA

National Recognized Testing Laboratories (NRTLs) recognizes

that test and certify

Certain products used in OSHA

- regulated workplaces

Voluntary Consensus Standards for Product Safety (i.e. ASTM standards) are in conformity withThird

- Party Programs to Assess Regulatory Compliance

33 standards with whic h they can certify conformity. OSHA maintains an online registry of NRTLs and their scopes of recognition. 238 Currently, 15 NRTLs are recognized by OSHA. 239 Twelve

are headquartered in the United States, and three NRTLs are headquartered in other countries

. 240

Some NRTLs are based in one c ountry but also have offices in others. For example, CSA International is based in Toronto, Canada and also has offices in Ohio and California, and UL is

based in Illinois and also has offices in four other U.S. states and 10 fo r eign countries.

NRTLs and applicants for NRTL recognition must pay fees. 241 OSHA assesses fees for processing applications for “ initial recognition, expansion of recognition, or renewal of recognition, including on

- site reviews; review and evaluation of the applications; and preparation of reports, evaluations an d Federal Register notices; and a udits of sites. ” 242 Fees first went into effect on October 1, 2000. 243 They were revised in 2002, 2007 and 2011. 244 A current listing of the applicable fees is maintained online. 245 For exam ple, current ly, total fees to become recognized as a NRTL amount to over $40,000 (including an initial application review fee of $17,750 ; an assessment fee of $4,440 plus travel expenses ; and a final report and Federal Register notice fee of $19,520)

. 246 Substantial f ees also apply when a NRTL expands or renews its recognition. For the audits that OS H A requires of recognized NRTLs, OSHA charges at least $4,400 plus travel expenses for an on

- site audit and $1,120 for an office audit. 247 Audit fees are signi ficantly higher if non

- conformances are found or if more than one day is required.

2

. AMS

, National Organic Program

The National Organic P rogram (NOP) , administered by the United States Department of Agriculture’s Agricultural Marketing Service (AMS), r elies on a system of third

- party
certification. The Organic Foods Production Act of 1990 , the authorizing legislation for the

NOP , state s that the “ Secretary shall implement the program . . . through certifying agents

. ” 248

In regulations promulgated in 2000

, AMS set the organic standards that cover the production, postharvest handling, and processing of organic foods and specified the third

- party certification

238 List of NRTLs is available at http://www.osha.gov/dts/otpca/nrtl/ (last visited Sept. 11, 2012).

239 Email from Kevin Robinson, Occupa tional Safety & Health Administration, U.S. Department of Labor , October 11, 2012.

240 Id.

241 29 C.F.R. § 1910.7(f).

242 Id

. § 1910.7(f)(1)(i) & (ii) (describing how fees are determined and stating that the fees reflect the full cost of performing the listed ac tivities).

243 OSHA, Fee Paymen t Instructions and Information, http://www.osha.gov/dts/otpca/nrtl/nrtlfees.html ; see also Nationally Recognized Testing Laboratories

-- Fees; Public Comment Period on Recognition Notices, 65 Fed. Reg. 46798 (July 31, 2000), available at http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=15480

. 244 Nationally Recognized Testing Laboratories Fees, 76 Fed. Reg. 10500 (Feb. 25, 2011) http://www.gpo.gov/fdsys/pkg/FR

- 2011

- 02

- 25/html/2011

- 3937.htm (last visited Sept. 11, 2012) (revising the fee regulations).

245 OSHA, Fee Schedule (e ffective March 28, 2011), http://www.osha. gov/dts/otpca/nrtl/nrtlschedule.html (last visited Sept. 11, 2012).

246 Id.

247 Id.

248 7 U.S.C. § 6503(d).Third

- Party Programs to Assess Regulatory Compliance

34 system that would determine whether a certain product met those standards. 249

T hese regulatory standards are voluntary in that food producers or handlers are only required

to conform to them if they label their products as organic

. However, i f food producers or

handler s label their products as organic , it is mandatory that they use a n accredited third party to provide the required certification. 250 The certifying agents are responsible for all aspects of the certification process: conducting inspection as necessary to verify complian ce with regulatory requirements, issuing certification decisions, issuing notices of noncompliance

, and suspending or revoking the certification of clients that are out of compliance. 251

As shown in Figure 8, t hird

- part y certifying agents are directly accredited by the AMS . They may be private or governmental entities , and under certain circumstances, the agency may acc ept a foreign government’s accreditation of foreign certifying agents. 252 To be accredited, the entity must have sufficient expertise and adequately trained personnel to comply with t he terms of the organic certification program

. 253 Certifying agents must also conduct an annual program review

of their certification activities and correct any noncompliances, 254 and they must maintain records of certification processes and make them availab le for inspection upon request. 255 As of 2012, 91 entities

– 51 domestic and 40 foreign

– were accredited by the NOP to a ct as certifying
agents. 256 Examples of domestic certifying agents include private organizations like Global Organic Alliance, Inc. , based in Ohio, and the Idaho State Department of Agriculture’s Division

of Plant Industries. 257 Overall, s tate agencies constituted 17 of the 51 domestic organic

certifiers. 258 Examples of foreign domestic certifying agents include Argencert S.A. , based in Argentina, and CAAE Certification Service , based in Spain. 259

The NOP regulations include several provisions to avoid potential conflicts of interest. 260

C ertifying agents are required to prevent conflicts of interest by not certifying operations that they have any commercial interest in, excluding the participation of employees or contractors that have any such commercial interests, not permitting employees or contractors t o accept any payment or gifts other than prescribed fees for certification, not providing consultation services to certified operations, requiring employees and contractors to complete annual conflict of interest disclosure reports, and requiring that the decision to certify be made by someone

249 The final organic rule was published on December 21, 2000, and the regulations implementing the NOP became effective October 21, 2002. See 7 C.F.R. p t

. 205.

250 USDA, National Organic Program, Organic Certification & Accreditation, http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateN&navID=NationalOrganicPro gram&leftNav=NationalOrganicProgram&page=NOPAccreditationandCertification&descri ption=Accreditation%20 and%20Certification&acct=nopgeninfo (last visited Sept. 11, 2012).

251 7 C.F.R §§ 205.403

- 205.406.

252 Id . § 205.500(c)

253 Id . § 205.501(a)(1)

- (6).

254 Id . § 205.501(a)(7).

255 Id . § 205.501(a)(9).

256 USDA, National Organic Program, Organic Certification & Accreditation

, supra note 250

. 257 See the list of domestic certifying agents at http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5074486 (last visited Sept. 11, 2012).

258 Id.

259 See the list of foreign certifying agents at http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5074487 (last visited Sept. 11, 2012).

260 7 C.F.R. § 205.501(a)(11).Third

- Party Programs to Assess Regulatory Compliance

35 different from those conducting prior certification activities. 261

Figure 8: Structure of Third

- Party Program for Organic Food Label

The regulation s provide that AMS will conduct on

- site reviews of accredited certifying
agents. Such reviews encompass “ the certifying agent ’ s certification procedures, decisions, facilities, administrative and management systems, and production or handling operations certified by the certifying agent. ” 262 Such reviews should occur before or soon after initial accreditation, before renewal of accreditation, and one or mor e time s during the five year period

of accreditation. 263 NOP reports that 56 such onsite reviews or inspections occurred in 2012. 264

The authorizing legislation stated that the NOP should provide for the “collection of reasonable fees from producers, certifying agents and handlers who participate in such

program. ” 265 The NOP regulations specify that the cost of the program’s accreditation services will be collected from applicants for initial accreditation and accredited certifying agents for

review of annual reports and accreditation renewal

. 266 In 2010, the average cost to a domestic

c ertifying agent applicant was $4,428, and the average cost to a foreign certifying agent was $24,082. 267

3. EPA/ DOE, Energy Star Program

The Energy Star Program was est ablished by the Environmental Protection Agency (EPA) in

261 Id.

262 Id . § 205.508(a).

263 See 7 C.F.R. §§ 205.508 (b)

, 205.500 (specifying that th e duration of accreditation is five years)

264 Interview (by phone) , Cheri Courtney, Acting Director, Accreditation and International Activities Division, NOP (August 16, 2012). Some audit reports and corrective action reports can be found on the NOP website at http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateJ&page=NOPReadingRoomHo

me (last visited Sept. 9, 2012)

. 265 7 U.S.C. § 6506(a)(10).

266 7 C.F.R. § 205.640.

267 U SDA, National Organic Program, FAQ: Becoming a Certifying Agent, http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateN&navID=NOPFAQsHowAccr edited&topNav=&leftNav=NationalOrganicProgram&page=NOPFAQsHowAccredited&description=FAQ:%20%2

0Bec oming%20a%20Certifying%20Agent&acct=nopgeninfo (last visited Sept. 9, 2012). AMS

Third

- Party Certifying Agents accredits

that certify

Food Products marketed as Organic

Organic Standards are in conformity withThird

- Party Programs to Assess Regulatory Compliance

36 1992 to provide a labeling system for products that voluntarily meet certain energy efficiency standards. The Department of Energy (DOE) has jointly administered the program since 1995,

when labeled products expanded from computers and monitors to additional office equipment and residential heating, ventilation, and cooling (HVAC) equipment. 268 Over 60 product categories may now carry the Energy Star label including major appliances, office equipment, lighting, home electronics, new homes, and commercial and industrial buildings. 269 As of 2010,

m ore than 40,000 individual product models made by over 1,600 manufacturers had earned the Energy Star label. 270

Effective i n 2011, after a critical report by the Government Accountability Office, Energy

Star was significantly restructured by EPA to require that products carrying the label be certified by third parties. 271 The new third

- party structure for the program is shown in Figure 9. Previously, manufacturers self

- declared that their products met the Energy Star requirements.

With the new third

- party certification requirement, product testing must be conducted in an EPA

recognized laboratory and the results have to be certified and su bmitted to EPA by an EPA

recognized certification body. EPA recognition, in turn, generally depends on accreditation to an appropriate ISO standard by an EPA

- recognized accreditation body.

Figure 9 : Structure of Third

- Party Program for Energy Star Prod uct Label

Accreditation bodies play the role of providing the accreditation that certification and

268 US Government Accountability Office (GAO), E NERGY S TAR P ROGRAM : C OVERT T ESTING S HOWS THE E NERGY
S TAR P ROGRAM C ERTIFICATION P ROCESS I S V ULNERABLE TO F RAUD AND A BUSE

, 3 GAO

- 10

- 470 (March 2010),

available at http://www.gao.gov/products/GAO

- 10

- 470

. 269 For general information see Energy Star, History of Energy Star, http://www.energystar.gov/index.cfm?c=about.ab_history (last visited Sept. 11, 2012) (noting that labeled products include major appliances, office equipment, lighting and home electronics, among others).

270 USEPA, ENERGY STAR® and Other Climate Protectio n Partnerships 2010 Annual Report 4, available at http://www.energystar.gov/ia/partners/publications/pubdocs/2010%20CPPD%204pgr.pdf

. 271 See GAO, supra note 268 ; see generally EPA Energy Star, Third

- Party Certification, http://www.e nergystar.gov/index.cfm?c=third_party_certification.tpc_index

. EPA

Accreditation Bodies recognizes

that accredit

Laboratories

that test

Products

Energy Star Label Requirements for conformity with Certification Bodies Accreditation Bodies

that certify

Products

are in conformity with

Energy Star Label Requirements accredit recognizes recognizesThird

- Party Programs to Assess Regulatory Compliance

37 laboratories require to become EPA

- recognized. To accredit certification bodies, an accreditation body must be a signatory to the IAF MLA

. 272 As of April 2012, there were 54 signatories to the IAF MLA based in about 50 different countries. 273 In the U.S. , the re are four IAF MLA signatories, including A2LA , IA S and ANSI

.

To accredit laboratories, an accreditation body must be itself recognized by the EPA. For recognition, the accreditation body must operate its accreditation program i n accordance with

ISO/IEC 17011 and maintain an affiliation with ILAC

. 274 By May 2012 , EPA had recognized 27

accreditation bodies around the world , including A2LA, IAS, and three others in the U.S

. 275

EPA

- recognized certification bodies (CBs) play the role of certify ing that elig ible products meet the requirements of the Energy Star label

. A key requirement for recognition is

accreditation to ISO/IEC Guide 65 by an accreditation body that is an IAF MLA signatory. ISO/IEC Guide 65 requires

, for example

, that the CB make certification decisions impartially and based on information gathered during the evaluation process. 276 EPA also imposes a variety of other requirements regarding how CBs determine whether a product qualifies for the E nergy S tar label and how CBs must conduct a verification testing program to verify that their certified products continue to meet Energy Star requirements. 277 More specifically , CBs are required to annually select and test at least 10% of all m odels they have certified , with ha lf the models being randomly selected and half se lected based on EPA referrals. As of August 2012, Energy Star had recognized 21 certification bodies around the world. 278

In general, Energy Star qualifying p roducts should be tested in an EPA

- recognized

lab oratory. F or recognition, laboratories must be accredited to ISO/IEC 17025 by an EPA

recognized accreditation b ody. ISO/IEC 17025 requires, for example, that a laboratory employ experienced personnel with adequate training ; have adequate physical plant facilities and test equipment; and ensure that measuring equipment is accurate. 279 Recognized labs must also agree to a variety of other requirements such as reporting to EPA and otherwise enabling EPA oversight. 280 Recognized labs need not be independent; th ey may be owned by the

manufact urers of the products they test

.

272 Energy Star, Accreditation Body Resources, http://www.energystar.gov/index.cfm?c=third_party_c ertification.tpc_accred_bodies (last visited Sept. 11, 2012).

273 See full list at http://www.iaf.nu/articles/IAF_MEM_USA__all/112 , accessible from IAF, IAF MLA, http://www.iaf.nu/articles/IAF_MLA/14 (last visited Sept. 9, 2012)

. 274 See EPA, Conditions and Criteria for Recognition of Accreditation Bodies for ENERGY S TAR® Laboratory Recognition, http://www.energystar.gov/ia/partners/downloads/mou/Criteria_Accreditation_Bodies_Labs.pdf?e75e

ee91 (last visited Sept. 11, 2012).

275 See Energy Star, EPA

- Recognized Accreditation Bodies, http://www.energystar.gov/index.cfm?c=partners.epa_recognized_accreditation_bodies (last visited Sept. 9, 2012)

. 276 See EPA, Conditions and Criteria for Recogn ition of Certification Bodies for the ENERGY STAR program, http://www.energystar.gov/ia/partners/downloads/mou/Conditions_ and_Criteria_for_Recognition_of_Certification_ Bodies.pdf (last visited Sept. 11, 2012).

277 Id

. 278 I nterview (by phone) , Eamon Monahan, EPA Energy Star Program, August 6, 2012.

279 EPA, Conditions and Criteria for Recognition of Laboratories for the ENERGY STA R program, at http://www.energystar.gov/ia/partners/downloads/mou/Criteria_Laboratories.pdf (last visited Sept. 9, 2012).

280 Id

.Third

- Party Programs to Assess Regulatory Compliance

38 Manufacturers’ laboratories that are not accredited may also be used for testing under the Energy Star’s Witnessed Manufacturers’ Testing Laboratory (WMTL) or Supervised Manufacturers’ Testing Laboratory (SMTL) programs. 281 Under these programs, a CB may operate a testing program to accept test data from such a lab if the CB commit s to exercising and documenting a high degree of oversight, including on

- site assessment and monitoring to ensure

t he laboratory’s compliance with ISO 17025 and applicable test methods. As of August 2012, Energy Star testing was being conducted in 463 laboratories: 224 accredited labs; 180 supervised labs; and 59 witnessed labs. 282 About 200 of these labs were located in the Asia

- P acific region, most of which were fully accredited. 283

EPA does not assess any user fees for participation in the Energy Star program. Funding for its development and maintenance has come from appropriated funds.

4 . EPA, WaterSense Program

EPA’s WaterSense product certification program, which provides a label for high

performing, water

- efficient products

, also relies on third

- party certification as shown in Figure

10. Modeled after Energy Star, WaterSense was launched in 2006 and has required third

- party
certification since 2009. 284 A ll products bearing the WaterSense label must be assesse d for conformity with the WaterSense product specification by an accredited third

- party certifying body. The certifying bodies, in turn

, are accredit ed by an accreditation body approved by EPA.

Figure 10 : Structure of Third

- Party Program for WaterSense Product Label

281 Id . at 6

- 7.

282 I nterview (by phon e) , Eamon Monahan, EPA Energy Star Program, August 6, 2012.

283 Id

. 284 See EPA WaterSense, Comprehensive List of all Frequent Questions, http://www.epa.gov/watersense/full_list.html (last visited Sept . 11, 2012). EPA issued the first WaterSense product certification system in 2009. WaterSense Product Certification System (March 23, 2009), http://www.epa.gov/watersense/docs/cert_system_revised508.pdf . EPA issued a revised version in 2009. EPA WaterSense, WaterSense®, Version 2.0 Product Certification System (Sep. 29, 2011), http://www.epa.gov/watersense/docs/cert_system_508.pdf [hereinafter “ WaterSense 2.0 ” ]. EPA

Accreditation Bodies approves

that accredit

Third

- Party Certifying Body

that certify

Products

WaterSense Product Specifications are in conformity withThird

- Party Programs to Assess Regulatory Compliance

39 The applicable standards in WaterSense are EPA’s “product specifications,” which are currently finalized for five product categories: Tank

- Type Toilets, Lavatory Faucets, Flushing

Urin als, Showerheads, and Weather

- Based Irrigation Controllers. 285 Manufacturers seeking to
use the WaterSense label on products in these categories first enter into a WaterSense partnership agreement with EPA and then have the ir product (s) certified for conformance to the Wat erSense specification by an EPA

- licensed certifying body. 286 Manufacturers apply directly to the licensed certifying body for certification and to obtain the WaterSense label. 287

To be approved by EPA, an accreditation body must be domiciled in the U.S. and show that it operates in accordance with the requirements of ISO/IEC 17011

. 288 Also it must o ffer

accreditation services to ISO/IEC Guide 65 and the IAF Guidance on the Applic ati on of ISO/IEC

Guide 65 and be an IAF

- MLA sign atory for products. 289 As of 2012, EPA had approved three

accreditation bodies : A2LA, ANSI, and IAS

. 290

Product c ertifying bodies must be accredited by an approved accreditation body in

accordance with ISO/IEC Guide 65 and the IAF Guidance on the Application of ISO/IEC Guide 65 to operate the WaterS ense product certification system and certify products to the relevant WaterSense product specifications . The accreditation body determines the certifying body’s scope of accreditati on by accrediting it for any or all of the WaterSense product specifications established by EPA

. Accredited certifying bodies also sign a licensing agreement with EPA to certify and label products for WaterSense

. 291 As of May 2012, EPA had licensed seven

ce rtification bodies to provide product certifications for one or more of the five product categories. 292 Examples of licensed certification bodies include Intertek, NSF International, and

UL , based in the U.S.; and CSA I nternational, based in Canada.

In add ition, certifying bodies must have procedures in place to ensure that the testing data that they rely on is reliable. Independent testing labs that are used by certifying bodies must demonstrate compliance with ISO/IEC 17025 and the relevant WaterSense pr oduct specification. 293 If a certifying body relies on testing data from a manufacturer’s laboratory,

285 WaterSense, Compendium of Product & Program Specifications, http://www. epa.gov/watersense/partners/product_program_specs.html#final (last visited Sept. 9, 2012).

286 WaterSense, Product Certification & Labeling, http://www.epa.gov/watersens e/about_us/product_certification_labeling.html (last visited Sept. 9, 2012).

287 Id

. 288 WaterSense 2.0, supra note 284 , at 4. The requirement that th e accreditation body be domiciled in the U.S. is not present in EPA’s Energy Star program or other programs included in this review.

289 Id . (noting that references to ISO/IEC Guide 65 will be superseded by ISO/IEC 17065 once ISO/IEC 17065 is published.)

290 WaterSense, Accreditation & Licensed Certifying Bodies, http://www.epa.gov/watersense/about_us/cert_bodies.html#accreditation (last visited Sept. 9, 2012).

291 WaterSens e 2.0, supra note 284 , at 4

- 5.

292 WaterSense, Accreditation & Licensed Certifying Bodies, http://www.epa.gov/watersense/about_us/cert_bodies.htm l (last visited Sept. 9, 2012).

293 WaterSense 2.0, supra note 284 , at 8. See also EPA, Response to Public Comments Received on June 2011 WaterSense Draft Revised Product Certification System (September 29, 2011) (clarifying that WaterSense does not require ISO/IEC 17025 accreditation for testing laboratories; it only requires that labs “demonstrate compliance with” ISO/IEC 17025”)

.Third

- Party Programs to Assess Regulatory Compliance

40 addition al requirements are imposed. 294 To the extent that a certification body outsources its evaluation process to contractors, it must have “documented policies and procedures for qualifying, assessing, and monitoring” them, and it must make a list of them available to the EPA or accreditation body to review. 295

EPA does not assess any user fees for participation in the WaterSense program. Funding for

its development and maintenance has come from appropriated funds.

IV . Evaluating Third

- Party Programs

Given the growing prevalence of third

- party programs in regulatory contexts, it is important

to evaluate which work well and why. This section first sets forth five metrics to assess success. They include the reliability of third

- party determinations; compliance rates; agency capacity to

administer the third

- party system; public acceptance; and industry ac ceptance

. The second part discusses the incentives that are necessary to attract participation in programs where regulated entities may choose w hether to contract with a third party or rely on regulatory agency for verification of regulatory compliance.

A . Metri cs of Success

1. Reliability of Third

- Party Determinations

A key metric of success of third

- party programs is whether the third

- party assessment produces determinations that are sufficiently reliable and accurate for the regulatory purpose at

hand

. T his metric allows for some variation. It may be acceptable to the agency , for example,

for the reliability of third

- party determinations regarding conformity with voluntary standards to

be lower than the reliability o f those regarding conformity with mandatory standards. Similar to private conformity assessment systems that may vary depending on the needs of the purchaser, regulatory third

- party systems may also be allowed to vary depending on regulatory needs

. 296

To a large degree, the reliability of determinations made by third parties will depend on their competence and independence. Generally, t hird parties must be competent to perform the required assessment tasks and independent (or unbiased) in their assessment

. In addition, programs should be designed to enhance the consistency of third

- party determinations and avoid problems that have undermine d the reliability of similar assessments in non

- regulatory contexts.

In some areas of regulation in which regulator y third

- party progra ms are being constructed,

third parties have been used by private parties to assess conformity for many years. However, these private systems have sometimes suff ered from a lack of reliability. For example, in the food safety area, corporate purchasers have required suppliers to conduct independent third

- party
audits of their facilities. Newsworthy failures in these systems have suggested problems with the

294 Id

. at 8

- 10.

295 Id

. 296 Cf. infra notes 437 to 438 and accompanying text (recommending that agencies calibrate the design of third

- party programs to the level of risks associated with noncompliance)

.Third

- Party Programs to Assess Regulatory Compliance

41 reliability of these audit determinations. In the case of the Peanut Corpora tion of America and

the salmonella outbreak with which it is associated, third

- party auditors had given the

manufacturer a “ superior rating ” but later investigation by FDA showed that product testing had

revealed instances of salmonella contamination. 297 In cases like this, questions have been raised about both the competence and the independence of third

- party auditors.

To ensure competence, an agency may have to give serious attent ion to the training of third parties. Two recent pilot programs undertaken b y FDA have underscored the importance of such training. In a pilot program conducted by the FDA in which certification bodies (CBs) were selected to inspect establishments in the aquacultured shrimp industry for compliance with US food safety standards, t he agency’s audits of the CBs found that some were not using the correct standards in their inspections even though they had been instructed to do so. 298 Rather, they were using standards of other countries, which they had presumably used in other audits. 299
FDA concluded that it would have to conduct additional training to implement a full

- scale third

party program. 300 Similarly, in PMAP, FDA’s pilot program with Canada for medical device facility inspections, FDA found that training was needed to ensure that “additional regulatory requirements outside of the ISO 13485:2003 standard and the QS regulation are adequately covered during audits/inspections.” 301

Despite the training issues, however, the FDA concluded in PMAP that the use of third

- party
auditors held promise. FDA gave an overall vote of confidence in its workability, stating that “Health Canada and FDA have confidence in the ability of a qualified and competent auditing organization to plan, carry out, and report on the audit/inspection according to b asic Health Canada and FDA requirements.” 302 In a similar vein, an FDA staffer who has worked with the AP Inspections program indicated that he perceived AP inspectors to be very competent, particularly in performing ISO 13485 facilit y inspections

. 303 He note d, however, that because they do not usually do AP inspections

, the information provided to the FDA through such inspection is generally not adequate to support an enforcement action. He opined that if the AP inspectors conducted a lot of inspections

– fo r example, if the program were mandatory or otherwise attracted high participation by regulated entities

– an entire industry of competent inspectors could emerge.

In the shrimp aquaculture pilot, in contrast, the FDA ’ s conclusions were more pessimistic. It

found that the a gency needed “to more fully explore communication, logistic, administration, and training options fo r conducting future third

- party programs. ” 304 Indeed, FDA noted significant deficiencies when it observed and assessed third parties to see if they met eleven

297 Andrew Martin, Peanut Plant says Audits Declared it in Top Shape , New York Times (Feb. 4, 2009), available

at http://www.nytimes.com/2009/02/05/business/05peanuts.html?_r=1&ref=peanutcorporationofamerica

. 298 FDA, Assessment of the Third

- Party Certification Pilot for Aquacultured Shrimp (July 2011). See also 73 Fed. Reg. 39704 (Jul

. 10, 2008) (announcing the pilot p rogram and calling for applications from certification bodies).

299 Id. at 7.

300 Id. at 26.

301 PMAP report, supra note 165 , at 2. Note that Canada and many other countries rely directly on “ ISO 13485:

Medical devices

-- Quality management systems

-- Requirements for regulatory purposes ” in their regulation of medical devices. The QS regulation of the US is similar, but not the same.

302 Id. at 4.

303 Inter view (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.

304 FDA, supra note 298

, at 26.Third

- Party Programs to Assess Regulatory Compliance

42 “crit ical audit performance elements. ” These critical audit performance elements were defined as “key knowledge, skills, and abilities that, if not demonstrated by the auditor, could result in the failure of the auditor to detect the pr ocessing of potentially unsafe food.” 305 FDA conducted 28 audits and found that only 3 out of 11 of its critical elements were met in the majority of the audits and only one was met in all of the audits. For example, only 4 out of the 28 audits met

such cr itical elements as: “ Did the auditor demonst rate an understanding of how to identify, evaluate and control the food safety hazards associated with the product and process being

audited? ” and “ Did the auditor recognize, thro ugh in

- plant observations, defici encies in the

identification and control of hazards? ” 306

Another prevalent concern about third

- party auditors re lates to their independence. When an auditor is paid by a regulated entity to assess that entity’s compliance, concerns about the objectivity of the third party arise. As discussed in the literature on financial auditing, in addition to potentially conscious moti vations, a variety of unconscious biases can affect an auditor’s judgment. 307 For example, the standards with which the auditor must assess conformity may have ambiguities, and “[b]ias thrives wherever there is the possibility of interpreting information in different ways.” 308 Also , an “attachment bias” results from the fact that the auditor has strong business reasons to please the client and equates his own interests with those of the client. 309 Also,

t he certain and immediate beneficial consequences of giving a positive audit opinion may outweigh the uncertain and distant negative consequences of not doing so

. 310 Another threat to independence occurs when auditors provide their clients with additional “non

- audit” consulting

and tax services. 311 In this case, an a uditor that renders a negative audit opinion risks losing not just the audit engagement but the additional business as well.

Similar issues of auditor independence can be expected to appear in third

- party programs for regulatory purpose s. An example of an issue involving third

- party independence is provided by the NRTL program. Curtis Straus LLC (CSL) was recognized as a NRTL in 1999 and applied to have its recognition renewed in 2004. 312 In 2007, OSHA informed Curtis Straus by letter that it did not appear to meet the NRTL program policy on independence because of a change in its ownership in 2005. 313 After the change in ownership, the i nvestment firm (Wendel) owned 58 %

of CSL as well as 32% of Legrand, a manufacturer of electrical products that require NRTL testing and certification.

Over the next several years, CSL sought OSHA approval by providing more information and making some ch anges to its business structure . For example, it so ught to convince OSHA that a firewall existed to assure the independence of its certification process and that it would use

305 Id.

306 Id. at 31, app. B.

307 Max H. Bazerman et al., Why Good Accountants Do Bad Audits

, H ARV

. B US

. R EV

. 97

- 98 (Nov. 2002).

308 Id. at 98.

309 Id. at 99; see also Amy Shapiro, Who Pays the Auditor Calls the Tune? : Auditing Regulation and Clients’

Incentives , 35 S ETON H ALL L. R EV

. 1029, 1040 (2005) (discussing the attachment bias and explaining that working for a client creates a tendency for an auditor to make judgment calls that favor a client).

310 Id.

311 Keith A. Houghton & Christine A. Jubb, The Market for Financial Report Audits: Regulation of and Competition for Auditor Independence , 25 L. & P OL ’ Y 299, 308

– 09 (2003).

312 OSHA, Curtis

- Straus LLC, Application for renewal of Recognition, 76 Fed. Reg. 62850 (Oct. 11, 2011).

313 Id.Third

- Party Programs to Assess Regulatory Compliance

43 external and internal audits to ensure its independence. 314 In 2010, however, OSHA made a negative finding of renewal based in part on concerns that OSHA would not be able to effectively monitor CSL’s efforts, given the extent and complexity of Wendel’s and Legrand’s business operations. 315 In its continued efforts to persuade OSHA to renew, Wendel decreased its ownership stake in Legra nd to11% in 2011.

In 2011, OSHA published notice of its preliminary finding to deny renewal, and a final finding is expected to be published in September 2012. 316 In the preliminary finding, OSHA explains that the NRTL program requires “complete independence,” meaning that NRTLs “must be free from commercial, financial and other pressures that could compromise” its testing and

certification. 317 CSL’s substantial r elationship with Legrand deriving from Wendel’s partial ownership of both violates t his independence requirement. OSHA’s final determination on CSL’s renewal has still not been published, suggesting that a lengthy process is required when an agency seeks to terminate the accreditation of a certification body.

In addition to questions of competence and independence, agencies should be concerned about the consistency of third

- party determinations. If third

- party firms and individuals are able

to conduct th e required assessment tasks in different ways, their determinations may be less

consistent than governmental determinations, particularly if the latter would be centralized. For example, when the E nvironmental P rotection Agency decided to verify greenhouse gas

emissions data itself rather than require emitters to contract with a third

- party verifier, it suggested that this would allow it to comprehensively review the data and provide the necessary consistency and quality. 318 If EPA had opted to incorporate third

- party verification, it “ would still need to review and perform consistency checks after the third party verification was complete. ” 319

Aside from competence and independence, there are other characteristics common in auditing that may also be preventing reliable and accurate results. One scholar of private third

party systems in the food sector found that auditors focus their review on the records kept by companies rather than actual company practices. In a study of audits performed t o check the compliance of agricultural suppliers with buyers’ standards, the scholar observes that “what are mostly audited are not the practices of suppliers, but their records. Put differently, auditors larg e l y rely on proxy measures to verify compliance

. ” 320 As such, the audit may verify that there is documentation showing that a certain standard was met but not actually verify that the

standard was met.

Other scholars have point ed out that a udits may verify compliance with many detailed performance speci fications while failing to assess true risks. 321 To standardize their task,

314 Id.

315 Id.

316 Id. ; Interview (by phone) , Robert Biersner, D epartment of L abor, Office of the Solicitor (Aug. 10, 2012)

. 317 Id.

318 Mandatory Reporting of Greenhouse Gases; Final Rule, 74 Fed. Reg. 56260, 56282 (Oct. 30, 2009).

319 Id. at 56283.

320 Maki Hatanaka, Certification, Partnership, and Morality in an Organic Shrimp Network: Rethinking Transnational Alternative Agrifood Networks , 38(5) World Developm ent 706, 710 (2010).

321 Albersmeier et al., supra note 3 , at 930

- 933.Third

- Party Programs to Assess Regulatory Compliance

44 auditing organizations may develop detailed checklists, so there is lots of “ticking the boxes” but “crucial quality risks can go unnoticed at the same time because they are not spe cifically provided for on the checklist of technical requirements.” 322 Moreover, there are reasons that the checklists may be favored in third

- party programs run by federal agencies. Namely, it removes discretion from the auditor, and it may be perceived as more standardized and fair. 323

When constructing third

- party programs to serve regulatory purposes, agencies have many ways to respond to these various concerns and increase the reliability of third

- party
determinations. 324 With rules regarding how third parties are accredited and how regulated

entities select third parties, the agency can create a high bar for third

- party competence and independence. With rules regarding how assessment tasks are performed, an agency can further

enhance the rel iability and consistency of third

- party determinations. Importantly, a gencies can

also employ a variety of oversights mechanisms to make sure that third parties comply with program rules.

2. Rates of Compliance

Another metric to assess third

- party pr ograms for regulatory purposes can be found in the extent to which a program ensures and enhances regulatory compliance

. When third

- party programs are used for regulatory purposes, they should increase

– not reduce

– rates of compliance

. A third

- party prog ram that enables a greater degree of noncompliance

, and thereby

eviscerates or dilutes valuable regulatory protectio ns
, can not be considered a success.

In many existing regulatory programs
, compliance inspections occur infrequently and compliance rates are hard to determine. For example, i n 2011, about 254,000 foreign food facilities and 167,000 domestic food facilities were registered with the FDA. 325 With limited inspectorial resources (about 1

, 000 inspectors), FDA inspected only 6% of the 421,000 registered facilities in 2010. 326 Also, a ccording to the FDCA , domestic manufacturers of a class

II or III medical device shall be inspected by the FDA at least once in every two

- year period. 327

However, with limited resources, FDA had not satis fied this biennial inspection mandate. As reported by the U.S. G eneral A ccountability O ffice (GAO) in 2008, domestic high

- risk facilities receive inspections only once every three years and medium

- r isk facilities only once every five

years. 328 While the law does not impose an inspection frequency for foreign manufacturers, those that are high

- risk are report edly inspected only once every six years and medium

- risk only once every 27 years. 329

T hird

- party programs designed for regulatory purposes can enable mo re frequent inspection s and more complete data about compliance

. A program may be designed, for example, to require

322 Id. at 933.

323 Id.

324 Cf. McAllister, supra note 3

. 325 Kathy Gombas & Howard Seltzer, Regulatory Report, The Reportable Food Registry: A Valuable New Tool for Preventing Foodborne Illness

, F OOD S AFETY M AGAZINE (June/July 2011), available at http://www.foodsafetymagazine.com/article.asp?id=4117&sub=sub1

. 326 ElBoghdady, supra note 42

. 327 Guidance for Industry, supra note 170

. See also 21 U.S.C §360(h) (containing the statutory requirement).

328 Challenges for FDA, supra note 156 , at 1 st page (unnumbered).

329 Id.Third

- Party Programs to Assess Regulatory Compliance

45 an assessment of the compliance status of all regulated entities or products each year or every few

years. Importantly, the mere knowledge that a third party will inspect their activities can change the behavior of regulated firms. Evidence suggests that w hen managers expect outside observers, they tend to change how they perform their jobs and how they relate to other managers in ways

that favor adherence. 330 As such, the performance of an individual or group improves when it is singled out for observation and study by an outsider. 331 Also in third

- party assessment process es
, there may be opportunities for third parties to educate and persuade t he regulated entity to comply.

Indeed

, many third

- party programs have been implemented by federal agencies in response to a perceived deficit in the agency’s ability to inspect regulated entities. The low inspection rates of foreign food facilities by FDA led to the new third

- party programs for imported food in

FSMA. A decade earlier, Congress mandated t he AP program due to concern about FDA’s

inabilit y to conduct inspections every three or five years as legally required. Also, EPA

introduced its third

- p arty program for Energy Star in 2011 after a GAO inspection revealed the possibility of fraud and abuse in the pr evious system of self

- declaration. In these programs and others, legislators and regulators appear to hope that third

- party programs will lead to higher compliance rates, and ultimately better regulatory outcomes.

3

. Agency Capacity to Administer the Third

- Party Program

Another metric for evaluating third party programs in regulatory contexts is the sufficiency of agency resources for establ ishing and maintaining a program. Judging from existing programs, a great deal of agen cy resources may be required to set up a program. Also, without

effective governmental oversight, third

- party programs may lack transparency and accountability and ultimately erode public confidence in regulation and compromise public welfare. Although private actors may carry out many tasks in a third

- party program, the agency must have the strength and resources to ensure t hat the program is effectively serving regulatory purposes.

Depending to some extent on how a third

- party program is designed, a large investment of time and resources may be necessary to get it up and running. In particular, if an agency approves certific ation bodies itself instead of delegating this to an accreditation organization, it will need to do all the work of establishing the relevant rules and implementing them to verify the qualifications of the third parties. Even if an accreditation organizat ion is used, the agency will have to establish the relevant rules and oversee the accreditation organization’s implementation of them.

Several existing programs illustrate the challenges involved in a ccrediting certification

bodies. In the FDA AP Inspections program, selection and training of APs took many years to complete. FDA’s aquacultured shrimp pilot further demonstrates the resource requirements of verifying the qualifications of third

- parties, particula rly when they are outsi de the U S. As part of the application process, FDA asked candidate certification bodies ( CBs ) to assess their own

conform ity with certain attributes that FDA determined were necessary for CB certification

programs. 332 These included, for example, that audi tors should understand the food safety issues

330 See A SEEM P RAKASH & M ATTHEW P OTOSKI

, T HE V OLUNTARY E NVIRONMENTALISTS : G REEN C LUBS

, ISO 14001,

AND V OLUNTARY R EGULATIONS 60 (2006) (explaining that third

- party inspections “mitigate shirking by creat ing incentives for managers within the firm to adhere to program obligations”).

331 Id. at 61

– 62, 181.

332 Assessment of Pilot for Aquacultured Shrimp, supra note 298

.Third

- Party Programs to Assess Regulatory Compliance

46 related to the processes and products they audit; the CB should have a quality assurance program that monitors its auditors and audits; and the CB should have sufficient resources, such as equipment and infrast ructure. The FDA developed self

- assessment checklists, and participants reported with few exceptions that they met most of the attributes. However, when FDA performed its onsite certification program assessments, it found the information in the checklist responses was often unsupported by source documents and that the self

- assessment checklists themselves were not sufficient to assure attainment of the attributes. Ultimately, FDA found that most CBs did not fully meet the majority of attributes. 333 The FDA c oncluded that the onsite program assessments and associated discussions with CB personnel were critical to FDA’s evaluation of the CB programs. 334

Through this pilot, moreover, the FDA realized the difficulty of performing such onsite assessments. FDA repo rts that onsite assessments require d at least four people to spend three to

five days at t he headquarters of each of the six CBs, four of which were outside the US. 335 It also found that not all supporting documentation and relevant personnel were available at the headquarters and, in this situation, “FDA’s ability to make a full assessment of one or more of the program attributes was limited.” 336 For the CBs located outside the US, the overseas travel and need for translation services further complicated FDA’ s assessment efforts. 337

In the final phase of the pilot, FDA observed CBs conducting audits of shrimp processors and farms and conducted its own audits of the laboratories CBs used. Spread across seven foreign countries, FDA confronted problems in coord inating the schedules of multiple stakeholders ( i.e. FDA, the CB, the competent a uthorities in foreign countries, and the processors, farms, and labs being audited) and in receiving permission to observe some processors, farms and labs. 338 In addition, some changes in FDA’s plans were necessitated by international crises and civil unrest in countries where audits had been planned. 339 Given the difficulties, some CBs conducted

“mock a udits” to accommodate the FDA. FDA concluded that the “coordination among mul tiple stakeholders demanded significant tim e and resources

. ” 340

Finally, the pilot made clear that agencies that implement third

- parties program are likely to need to provide training to their own personnel and develop new information technology (IT) systems. FDA concluded that operationalizing a third

- party certification program in the future would require “establishing robust formal training for Agency personnel involved in on

- site

program assess ments and performance audits of CB auditors and supporting laboratories.” 341 The pilot, which involved only six CBs , taxed existing FDA infrastructure and indicated “that an operating program in the future would need additional resources to be successful, as well as a

333 Id. at 13, tbl. 3

334 Id. at 11.

335 Id. at 11, 6 tbl. 1

336 Id. at 12.

337 Id. at 25 ( “Language barriers and different operating models and paradigms (i.e. industry vs. regulatory) made understanding between FDA and the CBs challenging and clear communication even more critical” and “It should be noted that the number of interpreters needed for a full

- scale third

- party certification program are likely to be substantial.”)

338 Id. at 16.

339 Id. at 16

340 Id. at 24.

341 Id. at 25.Third

- Party Programs to Assess Regulatory Compliance

47 central coordinating point within the Agency.” 342 Moreover, FDA reported that “current IT systems and databases were not designed to accommodate third

- party certification audits ” and

“ more in

- depth evaluation, updating, and the potential developme nt of new systems and

databases ” would be required for FDA to operationalize a third

- party certification program. 343

Energy Star provides an example of a program in which the agency delegate s accreditation to private accreditation bodies. The accredi tatio n bodies that accredit laboratories must themselves be approved by EPA. EPA relies extensively on that accreditation and does little oversight of

accredited labs. The accreditation bodies that accredit CBs do not need specific EPA approval; any accredita tion body that is a signatory to the IAF ML A may accredit Energy Star CBs. The accreditation bodies are responsible for conducting periodic assessments of the CBs they accredit, and the Energy Star program itself conducts additional oversight including au dits of product certifications

. 344

E xisting programs show that agencies may have difficulty maintaining the resources needed to provide adequate oversight. In 2010, the USDA Office of Inspector General (OIG) found deficiencies in AMS’s oversight of NOP certifying agents and organic operations. 345 OIG also found that NOP officials did not make required onsite assessments and did not identify inconsistencies in implementation of NOP regulations. 346 Lacking sufficiently specific rules and adequate oversight, ce rtification agents developed different criteria for determining whether non

compliances were present and whether they were major or minor. 347 OIG concluded that “AMS did not ensure consistent oversight of organic operations by its certifying agents.” 348 This lack of oversight , in turn, undermined the overarching goal of NOP “to assure consumers that products meet consistent, uniform standards.” 349

The OIG found even more serious deficiencies in AMS’s oversight of foreign certifying
agents. 350 AMS is required to make onsite reviews of foreign certifying agents, but 5 of 44 never

received such a review and 24 of 44 received reviews more than two years after receiving their

conditional accreditation. The NOP had underestimated the number of applications they would receive when the program began in 2002 and had failed to develop a policy to handle the review of certifying agents located in countries with travel warnings issued by the Department of

State. 351 When NOP reviews were performed, NOP officials often found t hat certifying agents

342 Id. at 23.

343 Id. at 24

- 25

. 344 See E PA

, Conditions and Criteria for Recognition of Certification Bodies, supra note 276 , at 1(i) (authorizing

EPA to con duct audits at its discretion); I nterview (by phone) , Eamon Monahan, EPA Ener gy Star Program, August 6, 2012 (mentioning that Energy Star picked at random some product categories and had CBs send all related certification files).

345 USDA Office of the Inspector General (OIG), Oversight o f the National Organic Program, Audit Report 01601

- 03

- Hy (March 2010), at 29

- 30.

346 USDA OIG, supra note 345 , at 3

. 347 Id. at 21

- 27 (describing how NOP lacked clear and sufficiently focused rules and did not oversee their implementation).

348 Id. at 21.

349 Id.

350 Id. at 28

- 29.

351 Id.Third

- Party Programs to Assess Regulatory Compliance

48 committed major noncompliances such as failing to identify mislabeled products, maintain complete certification files, and complete annual conflict of interest disclosures. 352

The response of AMS to the OIG report indicate s that the ro ot of the problem was that the NOP program lacked sufficient resources. AMS stated that the NOP budget had increased in 2009 to $3.87 million and its staff to 16, and that a 3.1 million dollar budget increase in 2010

would enable the program to grow to 31 staff members

. 353 In 2007, the NOP had just nine staff members and an annual budget of $1.5 million. 354

It is worth noting that the international scope of many third

- party programs interacts with the issue of governmental oversight. The international dimens ions of certain regulatory objectives like food safety may make third

- party programs particularly attractive, but these same international dimensions complicate oversight. Not only may effective oversight be more costly, but the agency may not have the au thority in foreign jurisdiction to do the kinds of oversight it

would do in a domestic context.

4

. Public Acceptance

Another metric of success is the support and acceptance that the third

- party program receives from stakeholders. The most relevant stakeholders are the concerned public (the beneficiaries of regulation) and the regulated industry (the target of regulation). Issues relevant to the industry’s acceptance of a program are discussed in the se ction that follows.

One gauge of public support for regulatory change consists of the comments received by agencies in response to rulemaking processes a nd other requests for comments. The public i s often represented by non

- governmental organizations. Wh ile most third

- party programs described in this report have garnered little public attention, there are a couple exceptions.

First, NGOs concerned with food safety have been very wary of the introduction of third

party auditors into the FDA’s regulatory framework. In comments to the agency, one NGO acknowledged that FSMA authorizes third

- party certification for imported food, but emphasizes that “the law does not permit it for domestic facilities.” 355 The commenter then stresses the need for the agency t o rigorously apply conflict

- of

- interest requirements and otherwise conduct oversight of third

- party auditors. Another NGO criticizes the legislative decision to allow FDA to rely on third

- party auditors for regulatory audits, regretting that FDA will “exp end precious resources” developin g conflict

- of

- interest standards and overseeing third parties. It cites failures in the National Organic Program 356 and private food safety audits 357 to support its conclusion

352 Id.

353 Id. at appended back pages ( AMS response)

. 354 Uncle Matt’s Organic Blog, http://unclematts.com/dev/how

- to

- add

- oomph

- to

- organic/ (last visited Sept. 11, 2012).

355 Comment of Make Our Food Safe and Safe Food Coalition, Docket No s . FDA

- 2011

- N

- 0145, § 303, Authority to require import certifications for food & FDA

- 2011

- N

- 0146, § 307, Accreditation of T hird

- P arty Auditors (Apr. 29, 2011).

356 Cf. USDA OIG, supra note 345 (finding that AMS fails to adequately oversee NOP third parties).

357 A prominent such failure involved the salmonella outbreak caused by peanuts processed by Peanut Corporation of America in a facility that had received a superior rating in a private food safety audit required by a buyer, KelloggThird

- Party Programs to Assess Regulatory Compliance

49 that FDA “should invest its resources into doing a s many as the imported food inspections itself and should avoid at all costs a reliance on a privatized inspection system.” 358

In the product safety arena, NGOs have been more supportive of third

- party testing. Major

consumer NGOs such as the Consumer Fede ration of America and US PIRG expressed strong
support for “ a CPSC

- administered, third party safety certification program for monitoring the safety of all products ” before the passage of the CPSIA in 2008. 359 In the aftermath of its passage, they have partic ipated in the regulatory process to voice support for a strong third

- party testing system. 360

A common concern of NGOs regarding the use of third

- party inspection and certification systems is that they will weaken governmental accountability and transparen cy. A food

- safety NGO, for example, expresses a preference for inspections performed by FDA, other US agencies, or foreign governments (in that order) over inspections by third

- party auditors, as the

latter “ may not have the same public health objective or may not be supported by the same level of expertise, training, resources, and accountability as are FDA inspectors. ” 361 When the Energy Star program announced its intention to establish a third

- party verification and testing program,

an environmental NGO e xpressed strong support but stressed the need for “ complete
transparency of the program’s procedures and testing results.” 362

5

. Industry Acceptance

The other major group of stakeholders consists of the regulated entities. A very common

reaction to an agency’s announcement that it is implementing a third

- party verification program is industry concern about costs. Indeed, a third

- party program will often shift some of the costs of inspection and compliance assessment from the government to industry. 363 T o augment industry support, third

- party programs should reduce the burden on industry as much as possible

while still achieving regulatory objectives. Third

- party p rograms may also be able to provide benefits to industry , for example, by reducing the proc essing times of product approvals

Corp. See Jim Prevor’s Perishable Pundit, Lessons From The Peanut Salmonella Outbreak: Audit System B roken, http://www.perishablepundit.com/index.php?date=02/19/09&pundit=1 (last visited Sept. 11, 2012).

358 Comment of Food & Water Watch, Docket No s . FDA

- 2011

- N

- 0145, § 303, Autho rity to require imp ort
certifications for food & FDA

- 2011

- N

- 0146, § 307, Accreditation of T hird

- P arty Auditors (Apr. 29, 2011).

359 Letter from Consumers Union to The Honorable Daniel K. Inouye (Oct. 26, 2007)

, available at http://www.consumersunion.org/pub/2007/10/005073print.html (last visited Sept. 11, 2012).

360 Comments of Consumers Union, Consumer Federation of America, Kids in Danger, and the U.S. Public Interest Research Group to the U.S. Consumer Product Safety Commission on “Notice of Requirements for Accreditation of Third Party Conformity Assessment Bodies to Assess Conformity with Part 1215 of Title 16, Code of Federal Regulations” (July 6, 2010)

, available at http://www.consumerfed.org/elements/www.consumerfed.org/file/Comments%20on%203PT%20Bath%20Seats%2 0(Final)%20(2).pdf (last visited Sept. 11, 2 012).

361 Comment of Make Our Food Safe and Safe Food Coalition, supra note 355

. 362 Comment of Natural Resources Defense Counci l , NRDC’s Comments on Energy Star’s Proposed Enhanced Testing and Verification Program 4 (April 30, 2010) (emphasis o n “complete transparency” removed from original)

, available at http://www.energystar.gov/ia/partners/downloads/mou/Natural_Resources_Defense_Council_Comments.pdf

. 363 See McAllister, supra note 3 , at 27

.Third

- Party Programs to Assess Regulatory Compliance

50 applications and by creating a single approval process that satisfies various national jurisdictions. Notably, third

- party programs raise special concerns about costs for small businesses

.

One important way to contain c osts in a third

- party program is to ensure that there are a sufficient number of third parties to create competition among them. 364 A representative of the Energy Star program stated that the primary way that the program responded to industry

concerns about third

- party certification was by encouraging the rapid development of a strong

market of certification bodies and laboratories. 365 In contrast, in the FDA’s AP program, it took the agency many years to get APs through all required training and cleared to conduct independent inspections. By May 2008, four years after the program was established, only 8 APs out of 16 had completed all training. 366 Because of the delays, few APs were available to conduct independent inspections in the early years of the program.

As an agency seeks to encourage a competitive market, however, certain precautions need to be taken. First, an agency should not unduly lower its requirements for competence and independence in order to accredit more third parties. In the AP program, for example, the training that was given may have been essential for APs to adequately carry out their tasks.

Second , an agency should establish program rules to ensure that third parties can not compete in ways that compromise the quality of the assessment. T he agency can require in its program rules, for example, that third parties inspect a certain number of product samples or make a certain number of site visits to a manufacturing facility.

The CPSC’s third

- party program for the testing of children’s products has provoked substantial industry resistance. As the CPSC has developed regulations, product manufacturers have repeate dly expressed concerns about the cost of the required third

- parting testing. It was

clear that these concerns had reached Congress when it amended the CPSIA in August 2011. 367

The amendments g ave the CPSC new authority to exempt qualifying small batch man ufacturers (mostly small businesses) from third

- party testing. They also required the CPSC to issue a request for public comments on opportunities to reduce the cost of third

- party testing requirements.

Manufacturers expressed many concerns about the costs of third

- party testing in their

comments. 368 They recommended for example that CPSC exempt more individual products and categories of products by regulation; that CPSC make additional attempts to reduce testing requirements based on the actual likelih ood of exposure ; and that CPSC increase efforts to

364 Cf. I nterview (by phone) , Eamon Monahan, EPA Ener gy Star Program, August 6, 2012 (discussing that Energy Star sought to keep costs low for regulated entities by encouraging the participation of a sufficient number of CBs

and labs to create the possibility for competition among them).

365 Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012.

366 U.S. Gov’t Accountability Office, GAO

- 08

- 780T , Medical Devices: FDA Faces Challenges in Conducting Inspections of Foreign Manufacturing Establishments 19 (May 14, 2008), available at http://www.gao.gov/products/GAO

- 08

- 780T

. 367 H.R. 2715, Pub

. L . No. 112

- 28 (Aug

. 12, 2011) (creating a new section 14(i)(3)(A) of the CPSA); 15 U.S.C. § 2063(i)(3); Application of Third Party Testin g Req uirements; Reducing Third Party Testing Burdens

, 76 Fed. Reg. 69596 (Nov

. 8, 2011); Public Comments in response are available at regu lations.gov, Docket No. CPSC

– 2011

- 0081 (listing 22 comments).

368 Comments on Application of Third Party Testing Requirements; Reducing Third Party Testing Burdens, COSC

Docket No. CPSC

- 2011

- 0081; available at www.reg ulations.gov

.Third

- Party Programs to Assess Regulatory Compliance

51 harmonize federal, international and state laws applicable to consumer products. Other suggestions included decreasing the frequency of retesting and allowing more retesting to be done by the manufacturers themselves rather than a third

- party lab. 369

Small manufacturers have been most concerned about the new third

- party testing requirements. A trade association of small jewelry makers complains of the unreasonable cost burdens imposed by the CPSIA. 370 It re ports that almost one quarter of its members “have reduced their children’s products offerings, and 16% have exited the children’s jewelry market entirely.” 371 A European maker of heirloom quality toys calls third

- party testing of its small batches “prohibit ive and impossible” and warns that “specialized toys with high playing value will disappear from the US market” if the CPSIA is not amended. 372 This manufacturer and others small manufacturers from Europe request that the CPSA exempt products tested to the European safety standards from CPSIA’s third

- party testing requ i rements. 373 Also, a manufacturer that describes itself as “medium

- sized” expressed that the exemption for small

batch manufacturers does not cover all low

- volume manufacturers, even though they too are considerably different from large volume manufacturers. 374

In Energy Star, manufacturers also voiced concerns about the cost of third

- party certification. As reported in a 2011 study of Energy Star by the GAO, “ Almost all the manufacturing partners we spoke with stated the cost to participate in the program had increased. Some manufacturing
partners

— particularly small manufacturers or manufacturers with few Energy Star products

— also told us the increasing costs could discourage their partici pation. ” 375 Energy Star program staff, however, perceive widespread acceptance of the new rules and have not noticed a drop in applications for the Energy Star label. 376

As in the case of the CPSC rule, small businesses have been particularly concerned about the new costs of certification. If they are not able to afford certification for their products, their consumer base may be reduced. A lso delays in getting products to market may be more prejudicial to small than large companies. As stated by one comment er on the Watersense program, “High cost will discourage manufacturers, especially small ones, from participating in the process at all.” 377 In effect, the costs of third

- party certification may benefit larger companies a t the expense of smaller ones.

369 Id. (see especially c omments submitted by the Society of the Plastics Industry , Inc. ; the Toy Industry Association; and Libbey )

. 370 Id. (see comments submitted by the Fashion Jewelry and Accessories Trade Association).

371 Id. at 11.

372 Id. ( see c omments of Glueckskaefer )

. 373 Id. ( see comments of Fagus and Grimm’s )

. 374 Id. (see c omments of Orbit Baby, Inc .).

375 Comment, McGowan to Vokes ( April 28, 2010) (in which the American Lighting Association reported that it had surveyed its members and 3/1 9 said the changes would cause them to end their participation in Energy Star and 15/19 said the changes would cause them to limit the number of fixtures they submit for certification)

. 376 I nterview (by phone) , Eamon Monahan, EPA Energy Star Program, August 6, 2012.

377 EPA Waters ense, Comments on the May 2007 D raft WaterSense Certification Scheme 19 (Nov. 2007)

, available

at http://www.epa.gov/WaterSense/docs/cert_scheme_comments508. pdf

.Third

- Party Programs to Assess Regulatory Compliance

52 The Small Business Administration’s Office of Advocacy has been concerned about third

party programs. 378 One concern is that once agencies shift the costs of inspection to industry, the government will not be as limited in imposing regulatory requirements. Also, whereas many

g overnment al programs establish a lower fee for small businesses, third parties are not as likely to be as concerned with the affordability to small businesses. The Office of Advocacy suggests that when agencies establish third

- party program s
, they should consider mechanisms to help

reduce the burden on small businesses.

While a third

- party program is likely to impose costs, it may also impart benefits that were not available without the program. The TCB program, for example, cut the approva l time of telecommunications equipment from 30 to 90 days in the late 1990s to often just a few days

. 379

In addition

, a program may be designed such that a third

- party assessme nt satisfies the regulatory requirements of both the US and other countries. FDA reports that it is currently developing a “single audit program” for medical devices that would result in “a saving of audit/inspection time in person days (and associated costs) and les s disruption of the manufacturer’s day

- to

- day operations; and greater control over the scheduling of regulatory audits/inspections.” 380

Factors aside from cost s and benefits may also play a role in how industry reacts to a third

party program. A third

- part y program may be well

- explained and well

- implemented by an

agency , or it may not be . In the latter case, industry is more likely to find the program to be overly complex and objectionable

.

B. Incentives to Participat e W hen Use of Third Parties is Volun tary

Programs in which regulated entities have a choice as to whether to contract with a thi rd
party have an additional metric of success: the rate of regulated entity participation. If regulated

entities do not use a program, then the resources an agency used to create it may seem wasted. Differences in participation in three programs described in this pap er illustrate the situation:

FDA’s AP I nspection s program for medical device production facilities ; FDA’s 510(k) Thi rd

Party Review program for m edical devices ; and FCC’s TCB program.

The FDA’s Inspections by AP program has had a very low rate of participation. Despite an estimated 8,000 manufacturers that could use the program

, 381 only 80 independent inspections (i.e. unaccompanied by FDA inspectors) have been conducted by APs in eight years of program operation

. 382 The FDA had hoped that manufacturers would be attracted by the possibility that a single AP inspection might satisfy regulatory requirements in multipl e jurisdictions. 383

378 Interview (by phone), David Rostker, Assistant Chief Counsel, Office of Advocacy, U.S. Small Business

Administration , Aug. 17, 2012.

379 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012

. 380 PMAP report, supra note 165 , at 4.

381 Agency Information Collection Activities; Proposed Collection; Comment Request; Manufacturer’s Notification

of the Intent To Use an Accredited Person Under the Accredited Persons Inspection Program Authorized by Section 228 of the Food and Drug Administration Amendments Act of 2007

, 76 Fed. Reg. 29764, 29765 (May 23, 2011) (reporting FDA’s estimate that there are 4,00 0 domestic manufacturers and 4,000 foreign manufacturers that are eligible for inclusion in the AP program)

. 382 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.

383 Status of FDA’s Program, supra note 147

, at 13. This could occur if the same inspection could serve to both verify the manufacturer’s compliance with the FDA’s QS regulation and the manufacturer’s conformi ty with “ISOThird

- Party Programs to Assess Regulatory Compliance

53 However, the effect of this incentive has been limited because manufacturers have had doubts that APs could cover the multiple requirements of various standards in a single inspection. 384
Also, the program allows manufacturer to control t he scheduling of inspections 385 and offers a

two

- year inspection holiday from regular FDA inspections.

M any disincentives to participation also exist. Under the AP Program, manufacturers have to bear the cost of the inspection, whereas FDA inspections are f ree. Moreover, the manufacturer may not think an FDA inspection will occur in the near future , and an AP i nspection may result in further regulatory action. 386 As reported by the GAO, “one industry representative questioned why manufacturers would ask for

— and pay for

— inspections when the result could be that FDA

closes them down.” 387 M anufacturers expressed concern that, because FDA makes the final determination of compliance with its requirements, FDA might want to conduct an additional inspection after reading the report prepared by the third

- party inspector. 388 Observing the very small number of AP inspections in 2008, the GAO stated it raised “ questions about the practicality and effectiveness of establishing similar programs that rely on third parties t o help FDA fulfill other responsibilities” 389

The FDA’s 510(k) pre

- market third

- party review program has attracted more participation

than the AP Inspections program. As described above, this program enables certain

manuf acturers to contract with third part ies to certify that products they intend to market. The FDA reported in July 2012 that about 8% of all 510 (k) submissions are received from third parties, which is close to 300 submissions annually. 390 One difference between the AP inspection and pre

- marke t programs is that in the latter, device manufacturers pay FDA a user fee if they do not go through an AP. In FY 2012, the fee is $4,049 ($2,024 for quali fied small businesses)

. 391 However, it is likely that the user fee is lower than the amount that the

m anufacture r pays to a private third party. 392

Another i ncentive that is present in the premarket program but not in the AP inspections program is that manufacturers want this review to happen expeditiously in order to get their products to market more quickl y. According to the FDA, 510(k)s reviewed by APs in 2002 received FDA marketing clearance 29% faster compared to 510(k) s reviewed entirely by

13485: Medical devices

-- Quality management systems

-- Requirements for regulatory purposes,” which many

other countries use as their standard. See also infra note 434 and accompanying text.

384 Id. By being able to schedule inspections, they are able to minimize facility disruptions and ensure that the necessary personnel and documentation is on hand at the right time. Also, FDA may only give a week of notice of an inspection, but AP inspections ca n be scheduled months in advance. See Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.

385 Status of FDA’s Program, supra note 147

, at 13.

386 Id. at 15.

387 Id. at 16.

388 Id.

389 Challenges for FDA, supra note 156 , at 6

- 7 (reporting 7 inspections between Mar

. 2004 and Jan

. 2008).

390 Email from Jean Cooper, Senior Staff Fellow, U.S. Food and Drug Administration

, July 17, 2012

. 391 FDA, Premarket Notification [510(k)] Review Fees, http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/HowtoMarketYourDevice/PremarketSubmis sio

ns/PremarketNotification510k/ucm134566.htm (last visited Sept. 11, 2012). MDUFMA, enacted in 2002, gave FDA authorization to charge manufacturers fees for premarket review. See i d.

392 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA , July 31, 2012.Third

- Party Programs to Assess Regulatory Compliance

54 FDA. 393 FDA also highlights that the APs generally “have specialized expertise in areas that may be helpful to 510 (k) submitters, such as device testing, standards, or foreign regulatory requirements” and that they have locations throughout the world “so they often can provide local

service.” 394

In the FCC’s TCB program, there is a very high participation rate for eligible products and

third

- par ty review has become the norm. In 2011, 98.5% of equipment authorization

certifications (13,427 out of 13,645) were issued by TCBs rather than the FCC. 395 FCC staff explain s that co mpanies prefer going to TCBs because their products are approved more quickly and they can get to market faster. 396 In the late 1990s, product certifications were all conducted by the FCC and processing times tended to range from 30 to 90 days. Presently, c ertifications conducted by TCBs may take just a few days. The 1.5% of certifications that continue to be conducted by FCC tend to involve new technology that the FCC excludes from TCB approval until it published a measurement procedure. 397 Also, given that the FCC charges fees for certifications, the costs of using a TCB may be lower. In 2011, the FCC’s device certification

fees ranged from $490 to $1265. 398

In sum, voluntary programs have varied greatly in terms of the costs and benefits of participation, a nd participation rates have reflected this variation. As illustrated by the AP Program, i f t he costs to participate are high and the offsetting benefits are not clear , firms will

not participate. On the other hand, the TCB program shows that in different circumstances

, optional third

- party certification may become the industry’s preference.

V

. Recommendations to Federal Agencies

T his section sets forth recommend ations to federal agencies regarding the use of private thir d parties for regulatory purposes. Regulatory third

- party programs pose risks

. If third part y

programs are not well

- conceived and well

- operated

, they may both undermine the achievement of regulatory goals and impose high costs on regulated entities. Yet, third

- party program s als o offer benefits

. By harnessing conformity assessment expertise in the private sector, they may extend the reach of regulatory agencies in ways that increase regulatory compliance and otherwise improve the performance of regulated entities and products. The recommendations

discussed below seek to help agencies minimize the risks and maximize the benefits of third

party programs

.

The first important question that agencies face may be whether or not to establish a third

party program. Alternatively, Congress may have directed the agency to develop a third

- party

program. Of the eight programs surveyed in this report, four were explicitly required by

393 FDA, Medical Devices, Third

- Party Review, http://www.fda.gov/MedicalDevices/Device RegulationandGuidance/HowtoMarketYourDevice/PremarketSubmissions/ThirdParyReview/default.htm#3 (last visited Sept. 11, 2012).

394 Id.

395 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012 (data on

file with author).

396 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012

. 397 Id. ; see also TCB Program Rules, supra note 213 , at 4.

398 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012; see also http://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=41712&switch=P

.Third

- Party Programs to Assess Regulatory Compliance

55 Congress. 399 The first set of recommendations below is targeted to situations in which agencies are themselves deciding whether to establish a third

- party p rogram. However, aspects of the

recommendations will also be useful when agencies are required to do so.

Agencies that are charged with or make the choi ce to establish a third

- party program will need to write the rules by which the program will operate. The key rules of a third

- party program can be categorized into several types: accreditation rules, which determine who may be approved

as a third party; s election rules, which govern how regulated entities select third parties; performance rules, which specify how third

- party testing and certification should be performed; and reporting rules, which set forth what information is provided to the regulatory ag ency by various program actors. 400 Moreover, the agency must make decisions about how it will conduct oversight and enforce these rules. 401

When a third

- party program is required by statute, certain characteristics of the third

- party program may already b e determined. Yet, within the constraints of the statute, agencies are still likely to have many options regarding program design. The second set of recommendations regards how to establish a third

- party program , with most relevance to program aspects tha t have not been statutorily determined.

A. Deciding Whether to Use a Third

- Party Program

1. C onsult governmental and n on

- g overnmental r esources relating to third

- p arty conformity

a ssessment

There are several important governmental and nongovernmental resources available to agencies considering third

- party programs. The federal government has developed expertise in conformity assessment since the passage of the National Technology Transfer an d Advancement

Act of 1995 (NT T AA). Most importantly, the NT T AA directed NIST to coordinate the conformity assessment act ivities of governmental and private sector entities with the goal of eliminating unnecessary duplication and complexity

. 402 Also

, i n 199 8, the Office and Management and Budget’s Circular A

- 119 instructed NIST to write guidance for agencies to

en sure effective coordination of governmental and private conformity assessment activities. 403

NIST published this guidance in 2000. 404

The Standards Se rvices Division of NIST is available to consult with agencies interested in incorporating third

- party conformity assessment processes into their regulatory processes. Upon

the request of an agency, NIST staff can become involved in helping an agency desig n a third

party program. For example, in the WaterSense program, the chief of the Standards Services

Division essentially functioned as part of WaterSense staff for a few months to explain the

399 The four that were required explicitly by Congress are the FDA programs for food imports, the CPSC program for children’s products, the FDA programs for medi cal devices, and the USDA National Organic Program.

400 Cf. McAllister, supra note 3 , at 47

- 59.

401 Id. at 59

- 61

. 402 P.L. 104

- 113, § 12(d)(1) ( codifi ed at 15 U.S.C. § 272 ) ; see also NIST

, Guidance on Federal Conformity

Assessment Activities , 65 Fed. Reg. 48894 (Aug. 10, 2000).

403 OMB Circular A

- 119 Revised §§ 8, 13(e) (Feb. 10, 1998).

404 NIST Guidance, supra note 402

.Third

- Party Programs to Assess Regulatory Compliance

56 relevant ISO standards and help establish the third

- party prog ram. 405 NIST coordinates the Interagency Committee on Standards Policy (ICSP ), which consists of one prin cipal representative from each federal executive agency, who is referred to as the “agency standards

e xecutive .” According to NIST’s guidance, agency standards executives are responsible for,

inter alia , promoting the development of agency positions on conformity assessment related issues that are in the public interest; ensuring that agency participation in conformity assessment

related activities is c onsistent with agency missions, authorities, priorities, and budgets; and establishing an ongoing process for identifying efficiencies that can be achieved through coordination with other agency and private sector conformity assessment activities. 406

NIST a lso runs the NVCASE program, which has responsibility for recognizing the private

accreditation bodies t hat accredit TCBs for the FCC. To confer recognition, NVCASE performs an initial assessment of the accreditation body and then performs a reassessment every two years to ensure that it continues to operate in accordance with ISO/IEC 17011

. 407 Under its regulations, NIST accepts requests to perform these functions only in certain situations. 408
Otherwise, private accreditation bodies can be recognized direc tly by federal agencies, and the assessment role played by NVCASE may be performed instead by an international organization like the IAF (for certification bodies) or ILAC (for laboratories). 409

OMB and NIST are both currently considering revising their gui dance to agencies regarding conformity assessment. In March 2012, OMB issued a request for information and notice of public workshop regarding, inter alia

, whether A

- 119 should be revised to set out relevant principles on conformity assessment

. 410 NIST has also expressed an interest in revising its 2000 guidance. 411

Agencies can also tap into expertise about conformity assessment that exists in private standards organizations. Most significantly, agencies should become familiar with ISO’s

405 Interview (by phone) , Stephanie Tanner, WaterSense Program, U.S. Environmental Protection Agency, Aug. 10,

2012.

406 NIST Guidance, supra note 402 , § 287.5. See also OMB Circular A

- 119, supra note 403 , § 15 (setting forth t he

roles of the ICSP and standards executives ).

407 Interview, Ramona Saar (by phone) , Standards Services Division, National Institute of Standards and Technology, Aug. 24, 2012 (explaining that NVCASE ensures that the accreditation bodies operate in accordance with ISO/IEC17011 in accrediting TCBs to ISO/IEC Guide 65 and the FCC’s technical requirements for TCBs ).

408 15 C

. F

. R

. § 286.2, available at ht tp://gsi.nist.gov/global/docs/NVCASE_CFR.pdf (stating that NIST accepts requests for recognition of accreditation bodies “when (i) directed by U.S. law; (ii) requested by another U.S. government agency; or (iii) requested to respond to a specific U.S. indu strial or technical need, relative to a mandatory foreign technical requirement, if it has been determined after public consultation that (A) there is no satisfactory accreditation alternative available and the private sector has declined to make acceptabl e accreditation available, and (B) there is evidence that significant public disadvantage would result from the absence of any alternative”)

. 409 Interview (by phone) , Ramona Saar, Standards Services Division, National Institute of Standards and Technology, Aug. 24, 2012 (explaining that NVCASE does a reassessment every two years whereas the IAF and ILAC do a reassessment every 4 years ). See also supra notes 19

- 21 and accompanying text.

410 77 Fed. Reg

. 19357 ( Mar. 30, 2012)

. 411 Id.Third

- Party Programs to Assess Regulatory Compliance

57 conformity assess ment standards and guides , referred to collectively as the conformity

a ssessment (or CASCO) t oolbox. 412

It is important to note, h owever, that ISO standards and guides are ordinarily subject to copyright restrictions

. Some have suggested that t his could potentially present a barrier to wider use of standardized conformity assessment in regulatory programs if the cost of purchasing copyrighted standards is high and other reasonable means of accessing the materials are not

available to regulated entities an d other stakeholders

. 413 Several documents that provide context for and explain these standards are publicly available. 414

2. Consider the characteristics of the regulatory standar ds a nd the regulatory target

Different types of regulatory standards and environments entail different considerations about the suitability of a third

- party program. W hile particular characteristics may not preclude or determine suitability, they may weigh in favor or against.

T he regulatory standard s used in a third

- party p rogram should facilitate the objec tive assessment of conformity. When possible, s tandards should be quantitative and the qualities of

interest should be measurable. 415 In the absence of objective standards , the risk of unreliability

and inconsistency in the determinat ions of third parties becomes high er

. Notably, the majority of programs surveyed above involve product standards that lend themselves to objective measurement ( e.g. the CPSC program, FDA’s premarket program, the FCC Program, the OSHA

program, a nd the EPA Energy Star and WaterSense programs).

When noncompliance with the regulatory standard implies significant risks to health, safety or other highly valued regulatory interests, a third

- party program may also be less suitable. Inherently, relian ce on third parties reduces the agency’s control over regulatory implementation.

412 ISO/UNIDO, supra note 10 , at 170

- 174 (providing a chart of all standards and guides related to conformity assessment)

. 413 See Administrative Conference of the United Sta tes, Recommendation 2011

- 5, Incorporation by Reference , 77 Fed. Reg. 2,257 ( Jan. 17 , 2011), available at http://www.acus.gov/research/the

- conference

- curr ent

projects/incorporation

- by

- reference/ (recommending best practices for federal agencies that incorporate by reference extrinsic materials, including voluntary consensus standards, into regulations); see also Emily S. Bremer, Incorporation by Reference i n Federal Regulations , Report to the Administrative Conference 26

- 32 (Oct. 19, 2011) (discussing ways agencies have increased public access to copyrighted standards); Comments of Scott Rafferty in Response to Request for Information OMB

- 2012

- 0003 at 10

- 11 (posted May 18, 2012) ( noting high cost of ISO standards and suggesting that “lack of meaningful access is a particularly serious barrier to wider use of standardized conformity assessment in federal regulatory programs... Agencies can be reluctant to delega te inspection or audit functions if the procedural and operational principles are not openly posted on the internet .”)

. 414 See especially ISO/UNIDO, supra note 10 ; ANSI, National Conformity Assessment Principles for the United States (2007), available at http://publicaa.ansi.org /sites/apdl/Documents/News%20and%20Publications/Brochures/NCAP%20second%20editio n.pdf ; USTR, supra note 20 ; Johnson, supra note 6 ; Gordon Gillerman, Making the Confidence Connection: Conformity Assessment System Design , ASTM Standardization News (December 2004), available at http://www.astm.org/SNEWS/DECEMBER_2004/gillerman_dec04.html ; Maureen A. Breitenberg, NIST, The ABC’s of the U.S. Conformity Assessment System (April 1997), available at http://gsi.nist.gov/global/docs/pubs/NISTIR_6014.pdf ; National Research Council, supra note 28

. 415 Hatanaka, supra note 320 , at 708 (emphasizing the importance of measurability and stating that “that which is being audited must be clearly identifiable, th at is, it must be objective in the sense that it is (at least in principle) independently verifiable” ).Third

- Party Programs to Assess Regulatory Compliance

58 If it is of paramount importance that a certain negative regulatory outcome be prevented , then the agency should retain full regulatory control. Moreover, if the risks associated with noncompliance are high, a more complete and costly conformity assessment system is warranted. At some point, the costs of operating and overseeing the third

- party pr ogram may be so high as to exceed the costs of direct regulatory implementation and enforcement. As explained by a

NIST official , the more con trol that is needed , the greater the resources that are required

. 416

Along these lines, voluntary regulatory standa rds established to confer a marketing label may

be more suited to a third

- party program than mandatory standards that directly protect public health and safety. Among the programs surveyed, the NOP, Energy Star, and WaterS e nse are the best examples of the former. 417 When a program confers a marketing label, a failure in the compliance assessment system has a more limited impact than when a program is established directly to protect health and safety. Of course, the impact may still be significant and there is an important governmental interest in the integrity of the marketing labels th at agencies establish.

The CPSC program and the various FDA programs , in contrast, involve mandatory standards designed to protect public health and safety. In some ways, t his represent s the most difficult case

for third

- party compliance assessment. Notably, these programs were all created directly by Congress in response to perceived deficiencies in the ability of the responsible agencies to conduct an adequate level of tes ting or inspections directly

.

Relatedly , a third

- party program may be more suitable when the standard is a voluntary

consensus standard (VCS) rather than a governmental

- unique standard. In the NRTL program,

the standards are all VCSs ; in the CPSC program, some of the standards are VCSs . When the

standard is a VCS, private sector bodies may already familiar with it and hav e relevant experience testing or certifying to it. Also, if the standard to be applied in the program is an

intern ational standard, it becomes more likely that regulated entities will be able to utilize a single third

- party conformity assessment process to satisfy multiple regulatory jurisdictions. 418

Finally, when the regulated product or activity (the regulatory targe t) is international in scope

because of international trade , it may be better suited to a third

- party program . Many of the existing programs have regulatory targets with significant international dimensions. FDA’s program for food safety is specifically focused on imported food. Children’s products, medical devices, telecommunications equipment, electrical equipment, organic food, and energy

- and

water

- efficient products are all often manufactured in an international production chain. T hird

party program s enable reg ulatory agencies to extend their reach outside national borders by incorporating private actors around the globe. On the other hand, a new challenge arises: agencies may have difficulty overseeing the private actors operating in other countrie s.

416 Interview (by phone) , Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and Technology, Aug. 15, 2012.

417 The NRT L program similarly confers a label, but it is different in that OSHA

- regulated workplaces are required to use labeled products and that the label is more related to health and safety than the other three programs.

418 An example is provided by ISO 13485, w hich by its name explicitly sets forth standards for q uality management systems for regulatory purposes . An FDA official explained that ISO 13485 is directly used in the regulation of many other countries and could become the US regulatory standard in the future. Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012. The offic ial further explained that FDA’s current QS regulation is similar in many ways but demands more evidence that the quality system is being effectively implemented. Id.Third

- Party Programs to Assess Regulatory Compliance

59 3. Compare the benefits and drawbacks of third

- party programs with other a pproaches

Agencies that are considering third

- party compliance assessment programs to achieve regulatory goals should compare this approach with others. Most importantly, the agency should compare a third

- party approach with direct governmental compliance assessmen t and with requiring regulated entities to make a self

- declaration of compl iance.

An evaluation that EPA undertook when it decided not to require third

- party certification of greenhouse g as emissions reports provides a good example

. 419 EPA commissioned a re port that evaluated three options: (1) facility self

- certification and third

- party verification paid for by the reporting companies (i.e. third

- party certification); (2) Facility self

- certification with EPA

verification of submitted data (i.e. direct gover nmental compliance assessment) ; and (3) Facility

self

- certification with little or no independent verification of submitted data (i.e. self

- declaration of compliance)

.

There may be situations in which self

- declaration can serve the regulatory purpose at hand. 420
Some regulatory programs may involve “low to medium

- risk areas in which market

mechanisms... can mitigate the negative consequences associated with non

- compliances before those consequences are intolerable to society .” 421 Some voluntary regulatory pro grams that confer marketing l abels may fit this description well. However, i f an agency is considering a

third

- party program, there may have already been a determination that self

- declaration is insufficient. In the Energy Star program

, for example, self

- declaration had been used previously

and a GAO audit had revealed that the self

- declaration system opened the program to fraud and

abuse.

Also, self

- declaration with little or no verification is rarely considered sufficient for mandatory standards that r elate to public health and safety. Indeed, laws to protect health and safety

– and their effective enforcement

-- are often necessary precisely because market mechanisms are ineffective in protecting against harm. For example, consumers are generally

una ble to tell if children’s products contain lead or if food is infected by salmonella. Environmental protection and other societal interests are similar: consumers can’t tell if a product came from a highly polluting facility or an unsafe workplace.

As su ch, the question to be considered becomes whether the agency should directly assess compliance or rely on third parties . An agency should consider which would be less costly and which would provide greater benefits. The EPA report for example found that setting up a third

party program would imply significant costs to the agency. 422 Costs would be incurred in developi ng the program; approving third parties and training them; ensuring that conflicts of

419 Memorandum from Ruth Mead et al., ERG, to Suzanne Kocchi and Kong Chiu, USEPA Headquarters, Washington DC, Review of Verification Systems in Environmental Reporting Programs (Feb. 10, 2009) (on file with author) [ hereinafter “ EPA Verification System Memo ” ].

420 Cf. Johnson, supra note 6 , at 29 (stating that businesses prefer SDoC, and citing an economist who states that because SDoC “is surely the ch eapest form of conformity assessment, it is to be preferred except when it cannot be trusted”)

. 421 Gillerman, supra note 414

. 422 EPA Verification Sys tem Memo, supra note 419 , at 26.Third

- Party Programs to Assess Regulatory Compliance

60 interest were not present; and performing ongoing overs ight. The report also observed that, even

with third

- party certification, the EPA would probably need to develop specialized software to

receive and review the data and accompany third parties on site visits. In EPA’s decision not to require third

- party verification, EPA also emphasized that the activities necessary to set up a

third

- party program would “ slow down implementation of the [greenhouse gas reporting]

rule .” 423 Several of the third

- party programs reviewed above also suggest that program

establis hment may be costly and slow. 424

On the other hand, even if there are significant set

- up costs, they may be justified in light of cost saving s or benefits generated in later years. For example, with its reliance on TCBs, the

FCC now oversees the issuance of more than four times the number of equipment auth orizations annually as it did fifteen years ago with roughly the same number of staff (7

- 10 employees). 425
If the program had not been established, it can be expected that more staff would have been

hired. Also, even high set

- up costs might be justified if the long

- term alternative is not having the program at all. Due to EPA resource constraints, the Water Sense program might not have

been pursued without a third

- party approach

.

In some situations, set

- up costs m ay not be as high because third parties are already doing similar assessments for other purposes

. A n agency may not have to do as much in terms of identifying suitable third parties and training them. Also, the costs to industry may be lower because they are already contracting with these third parties. In Water Sense, for example, one of the most important ty pes of products

– toilets

- was already often the subject of private conformity assessment. Ma nufacturers were engaging third parties to certify that their products met certain operational standards set by the Canadian government or state and local governments

in the US. When WaterSense established its third

- party program to assess conformity with water efficiency standards, the existing conformity assessment networks could be leveraged. Similar

networks may already be present in the arena of food safety due to the prevalence of private conformity assessment. 426

423 74 F ed. R eg. 56282 (Oct. 30, 2009) (stating “developing the third party verification approach would require EPA to establish and develop emissions verification protocols and a system to qualify and accredit the third party verifiers, and to develop and administer a process to ensure that verifiers hired by reporting facilities do not have

conflicts of interest. Suc h a program could require EPA to review numerous individual conflict of interest screening determinations made each time a reporter hires a third party verifier. Even if EPA were to partner with an existing program or organization to accredit verifiers, EP A would still need to develop the criteria and systems described above to implement this rule and ensure high quality emissions verification given the unique reporting requirements of this rule. These efforts would slow down implementation of the rule and sharing of data” ).

424 See especially notes 332 to 340 and accompanying text (on the shrimp aquaculture pilot) and note 366 and accompanying text (o n the FDA AP Inspections program).

425 Interview (by phone) , George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. Between 2000 and 2011, the number of equipment authorization applications grew from 3,168 to 13,645. In the year 2000, FCC processed 83.5% of the applications (2,645 applications). In 2011, FCC processed only 1.6% of applications (218 applications), and TCBs proc essed the rest (13,427 applications). Id.

426 In terms of food safety and possibly other areas of product safety, it is important to note that the private conformity assessment processes that exist are often not considered to be reliable. See supra note 297 and accompanying text. An agency that seeks to incorporate existing networks into its compliance assessment program would need to be particularly careful to set t hird

- program rules that enhance the reliability of third

- party determinations and otherwise instill public confidence.Third

- Party Programs to Assess Regulatory Compliance

61 An agency should also consider the different benefits that derive from either directly verifying compliance or relying on third

- party verification. The outputs of the two approaches differ in ways that may be important. F or example, FDA staff does not view the compliance data acquire d thr ough the AP Inspections program as equivalent to the compliance data acquired directly through an FDA inspection of a medical device facility. I f the AP inspection suggests there may be violations, FDA must follow up with its own inspections to collect th e evidence

needed for a formal enforcement action. 427 Similarly in the PMAP, FDA’s pilot program for medical device facility inspections establis hed in coordination with Canada , FDA found that “the level of detail in the narrative needs to be greater in ord er for the regulators to have a more complete picture of the audit/inspection and the manufacturer’s organization and operation.” 428

The narrative portion of the auditors’ reports under the PMAP varied in length from three to
twenty pages, with large variab ility in the format and level of detail. 429

Direct governmental verification may also enable more consistency in compliance data and quicker release of data to the public. Rather than adopt a third

- party approach for greenhouse gas emission reporting, EPA decided to have facilities submit data electronically and to perform

a series of automated data checks with follow

- up questions to regulated entities and facility audits as necessary. EPA found that “the combination of comprehensive electronic review and a flexible and adaptive program on on

- site auditing will enable us to effectively target verification resources while also providing the necessary consistency and quality in the data.” 430 EPA also found that direct verification approach would enable it t o make data available to the public more quickly. W ith third

- party verification, three to six months might be needed for third

- party verifiers to perform their verification role, and EPA would still need to review the data and perform consistency checks a fter third

- party verification was complete

. 431

Third

- party programs generally have the drawback of adding complexity and principal

- agent problems to the regulatory process. With a third

- party program, many decisions must be made about the roles and respons ibilities of new actors, namely certification bodies, testing bodies, and accreditation bodies. The regulatory agency must also assume a new role in overseeing these actors. The new roles seem likely to make the regulatory framework more complicated, and possibly more difficult for the public to understand and participate in . Also, the introduction of

new actors creates a “principal

- agent problem. ” A principal

- agent problem arises when a principal (here, the regulatory agency) chooses an agent (the third party) to act on its behalf.

B ecause the two parties have different interests and the agent has more information, the principal has difficulty ensuring that the agent is acting in the principal’s best interest. 432 I n third

- party programs for regulatory purposes, such principal

- agent problems are likely to be exacerbated by

the fact that the third

- parties are not only agents of the regulatory agency but also paid agents of the regulated entities

. 433

427 Interview (by phone) , David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.

428 PMAP report, supra note 165 , at 3.

429 Id.

430 74 Fed. Reg. 56282 (Oct. 30, 2009)

. 431 Id. at 56283.

432 See A Glossary of Political Economic Terms: Agency Problem, http://www.au burn.edu/~johnspm/ gloss/agency_problem (last visited Sept. 12, 2012).

433 Cf. Amy Shapiro

, Who Pays the Auditor Calls the Tune? : Auditing Regulation and Clients ’ Incentives

, 35 S ETON
H ALL L. R EV

. 1029, 1031 (2005) (arguing that the problem of auditing in the financial sector is that auditors haveThird

- Party Programs to Assess Regulatory Compliance

62 4. If the use of third parties w ill be v oluntary, evaluate whether sufficient i ncentives exist to attract participation

If a third

- party program is being contemplated in which regulated entities would have the

c hoice of contracting with third parties or being assessed dir ectly by the agency, the agency

should consider whether regulated entities are likely to use the program. The low level of participation in the AP inspections program exemplifies the problem. The FDA invested significant resources into its establishment but it was seldom used by industry. 434 W hile the program offered several incentives for participation

, they were outweighed by a series of

disincentives includi ng the cost of hiring the third party and the perceived risk that FDA would ultimately take a harder look at its facility. 435

Agencies should evaluate whether sufficient incentives can be created for the use of a voluntary third

- party program in light of the costs and risks the program would impose

. A

program may attract more participation if the re gulated entity is able to avoid paying an agency

assessed user fee if it contracts with a third party. Another incentive would be provided if the

third

- party conformity would satisfy the regulatory requirements of other jurisdictions in which a

manufactur er operates or sells products. This would generally require a federal agency to coordinate with their counterparts in other countries to harmonize standards and assessments

proce dures

. In this vein, the FDA is currently developing a Medical Device Single Audit Program (MDSAP) in coordination with Canada, Brazil, and Australia. 436 The goal of the program is to enable a single audit/inspection o f a medical device manufacturer’ s quality management system would satisfy the regulatory requirements of all the juri sdictions.

B. E stablishing a Third

- Party Program

1. Calibrate the third

- party program to the level of risks associated with noncompliance

An important principle of private third

- party conformity assessment is that the design of the conformity assessment system should be driven by the degree of assurance its user needs. 437 In

some cases, a user

– such as a product purchaser

-- wants some independent assurance of conformity, but occasional instances of nonconfo rmity will not cause major problems to the purchaser’s manufacturing process or business interests. The purchaser might be satisfied with

occasional third

- party testing of the product. In other cases, a purchaser may be at risk of incurring high costs du e to a nonconformity in a purchased product. The purchaser might instead impose a variety of special requirements on the supplier and require third

- party certification.

two masters and that the law needs to be written “ so that auditors recognize proper incentives and serve only one master, a master whose own interests are aligned with those of the investing public ” )

.

434 Cf. FDA 1 3485 Program Guidance, supra note 38 , at 3 (stating that “FDA has committed significant resources to creating the AP for Inspections program and c ontinues to maintain it.) It is worth noting that this program wa s required by statute

. 435 See supra notes 383 to 389 and accompanying text.

436 Interview (by phone) , Kim Trautman, Associate Director, International Affairs, Office of the Center Director, Center for Devices and Radiological He alth, U.S. Food and Drug Administration, Jun. 5, 2012

. 437 See supra note 24 and accompanying text.Third

- Party Programs to Assess Regulatory Compliance

63 The same principle applies in third

- party programs for regulatory purposes. If the ris ks associated with noncompliance are very high , a third

- party program should be designed to provide a maximal degree of reliability in the determinations by third parties. This could be

acc omplished in a regulatory third

- party program through accreditation rules th at set high

standards for third parties to be accredited

, selection rules that carefully guard against conflicts

of interest and the use of subcontractors

, performance rules that require a rigorous and complete

set of assessm ent activities

, reporting rules that furnish ample information about the outcomes of

the assessment

, and a full array of governmental oversight and enforcement actions. Such rules can be expected to enhance the competence and independence of third

- party a ctivities and thus the reliability of their determinations.

Yet, such rules are also likely to entail high costs for both the regulatory agency and regulated entities. Such rules may, in some cases, represent an instance of “over

- design” that

adds costs to the system, and potentially to the products or processes assessed, without compensating benefits. 438 In some cases, the regulatory objective can be achieved with less intensive conformity assessment activ ities and with third parties who are not trained as thoroughly as they could be or who are not completely independent.

For example, in several programs detailed above, the agency does not require that the laboratory that tests products be completely independent of the manufacturer. Under the CPSC’s

ru les, manufacturers’ laboratories can test products if they meet certain “firewalled” criteria. For Energy Star and WaterSense , products can be tested in a manufacturer’s lab under certain

circumstances. More generally, the programs vary quite a bit in the extent they have adopted rigorous accreditation, selection, performance and reporting rules. In some, governmental oversight has been sporadic and little evidence exists of active enforcement of third

- party program rules.

It bears emphasis , however, that many types of regulations for which third

- pa rty programs are considered may be in the high risk category , where noncompliance implies risks to health, safety, and other valued regulatory goals

. F or such regulatory purposes, a relatively complete

thir d

- party conformity assessment may indeed be appropriate despite its costs.

2. Incorporate existing conformity assessment standards and activities when possibl e

Agencies should strongly consider relying on existing conformity assessment standards and

r elated activities when they establish third

- party programs. 439 Doing so can reduce the costs of

the program for both the regulatory agency and regulated entities. Relevant conformity assessment standards and activities may be occurring through other govern mental agencies or in the private sector.

Sometimes a new third

- party program may be able to rely on another governmental agency’s conformity assessment activities. During development of the WaterSense program, for example,

438 Gillerman, supra note 414

. 439 Cf. NIST Guidance, supra n ote 402 , § 287.4(c) (advising agencies to “Use the results of other governmental agency and private sector organization conformity assessment activ ities to enhance the safety and efficacy of proposed new conformity assessment requirements and measures”) ; id . at § 287.4(f) (advising agencies to “Consider using the results of other agencies’ confo rmity assessment procedures”).Third

- Party Programs to Assess Regulatory Compliance

64 companies were concerned that participation in WaterSense would require them to duplicate testing and reporting required for Department of Energy plumbing standard s and the Federal

Trade Commission appliance labeling standards

. 440 In response, t he WaterSense program mad e its reporting requirements similar or identical to what manufacturers already had do for DOE and

FTC.

Extensive p rivate sector conformity assessment standards and activities are also available to be incorporated into regulatory third

- party programs. 441 Most significan tly, as described above, ISO/IEC have developed a set of international conformity assessment standards and an international conformity assessment industry has emerged to conduct related activities. 442 These standards set forth how testing bodies, certificati on bodies, and accreditation bodies should

function.

Regulated entities have expressed a preference for agencies to incorporate private conformity standards and activities rather than creating “government

- unique” conformity assessment. 443
Regulated entitie s fear that government

- unique standards with be duplicative of private sector conformity assessment activities that they already engage undertake for business reasons. They also opine that government

- unique conformity assessment standards “may be expensiv e to develop and maintain, may impose additional costs on the private sector, and may not be recognized beyond national boundaries.” 444

Using international standards of conformity assessment enhances the possibility that the same conformity assessment might serve regulatory needs in other countries. For example, a federal agency may require that a certain product be tested by a lab accredited to ISO 17025 for conformity with a particular safety standard. If another country has the same safety standard or

ot herwise considers the US standard equivalent, and if respects the international accreditation of the lab, then the manufacturer may not need to undertake any further action to legally market its product in that other country.

440 EPA WaterSense, Comment s on the May 2007 Draft WaterSense Certification Scheme 14 (Nov. 2007), available

at http://www.epa.gov/WaterSense/docs/cert_scheme_comments508.pdf ; cf. FTC, Labeling FAQs, http://www.ftc.gov/bcp/conline/edcams/eande/faq.htm (last visited Sept. 12, 2012) ; DOE, Energy Efficiency and Renewable Energy, Building Technologies Program, http://www1.eere.energy.gov/buildings/appliance_standards/residential/plumbing_products.html (last visited Sept. 12, 2012).

441 Cf. NIST Guidance, supra note 402 , § 287.4(e) (directing agencies to “ Identify appropriate private sector conformity assessment practices and programs and consider the results of such practices and/or pr ograms as appropriate in existing regu latory and procurement actions.”)

442 NIST Guidance

, supra note 402 , § 287.4(d) (directing agencies to “Use relevant guides or standards for conformity assessment practices published by domestic and international standardizing bodies as appropriate in meeting regulatory and procurement objectives”).

443 See, e.g., Comment of Air

- Conditioning, Heating and Re frigeration Institute (AHRI) on Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities (Apr. 26, 2012 )

, available at https://law.resource.org/pub/us/cfr/regulations.gov.docket.02/0900006480ffd5af.pdf

. 444 See id . at 3; see also American National Standards Institute, ANSI Response to Request for Comments, Federal Participation in the Development an d Use of Voluntary Consensus Standards and in Conformity Assessment

Activities 5

, available at http://publicaa.ansi.org/sites/apdl/Documents/Standards%20Activities/Critical%20Issues/FederalRegister_OMBA11 9/ANSI%20Response%20OMB

- A119_FINAL.pdf (advocating solutions based on VCS to reduce the costs of compliance for industry)

.Third

- Party Programs to Assess Regulatory Compliance

65 A significant way in which an agency can rely on existing conformity assessment standards and activities is by recognizing private sector accreditation bodies to accredit certification and testing bodies rather than accrediting them directly. As in some existing programs, an agency may require that the private accreditation body operate in accordance with ISO/IEC 17011 and be a member of an international organization like IAF or ILAC that coordinates a peer

- review process to evaluate accredita tion bodies for membership. 445 When an agency relies on the ISO/IEC standards for recognition, it avoids having to set all such standards itself. Also, if the agency requires that the accreditation be a member of IAF or ILAC, those organizations conduct

pe riodic assessments of the accreditation body.

If an agency decides to accredit certification bodies directly , it may still find ISO 17011 to be useful as a guide for its own accreditation activities. The NOP regulations initially required that

the NOP ass emble a peer review panel pursuant to Federal Advisory Committee Act (FACA) to evaluate its accreditation procedures. 446 In its 2010 review of the program, USDA OIG found that the NOP had never established the panel , reportedly due to budget constraints

. I n response to the OIG report, the NOP proposed an alternative, namely that it would amend its regulations and instead develop “a quality management system that complies with the criteria set forth in NIST’s National Voluntary Conformity Assessment Evaluati on program (NVCASE) as well as the requirements of ISO/IEC 17011:2004.” 447

The FDA’s aquaculture pilot illustrated some of the challenges faced by agencies that directly accredit certification bodies, particularly in an international context. 448 FDA reports that after it announced the pilot, it received applications from candidate certification bodies. It found,

however

, that the candidate CBs did not reliably submit supporting documen tation in their application and determining whether CBs were qualified required a greater investment of resources than it had anticipated. FDA recommended that “in any future program, FDA should be clearer in its expectations for the amount and type of information needed to adequately evaluate a firm’s application.” 449

Notab ly, programs that anticipate reliance on certification bodies in other countries may be particularly well

- served by relying on private accreditation bodies. Such accreditation bodies may have more institutional competence than the agency in d ealing with f oreign companies and may even be located in that country or the same region of the world. Of course, t he issue then arises of how the agency will oversee the foreign activities of private accreditation bodies and the foreign certification bodies they accr edit.

Importantly, when an agency incorporates international standards into its requirements for certification, testing, or accreditation bodies, it can supplement those standards in various ways. An agency, for example, may require that a certificatio n body be accredited by an private accreditation body to ISO Guide 65 and also meet a certain set of requirements specific to a

third

- party program. The accreditation body might be given responsibility for assessing

445 See supra note s 19 to 23 and accompanying text.

446 USDA OIG, supra note 345

, at 3.

447 Id. at 19 ; Cf. USDA, AMS, GV Division, “Quality Manual for Accrediting Conformity Assessment Bodies

, ” http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5073714 (last visited Sept. 12, 2012).

448 Assessment of Pilot for Aquacultured Shrimp, supra note 298

. 449 Id. at 7

.Third

- Party Programs to Assess Regulatory Compliance

66 conformity with the program

- specific re quirements, or the agency might do its own assessment as part of “recognizing” an accredited certification body for participation in the program.

Through these program

- specific requirements, the agency can put flesh on the sometimes

bare

- bones requirements of the international standard. For example, ISO Guide 65 contains a basic requirement that certification bodies conduct surveillance of certified companies or products

. Through program

- specific requi rements for accreditation of the certification body, the agency could require it to undertake particular types of surveillance activities at particular times. Similarly, an agency might specify particular conflict of interest rules that supplement ISO Guide

65’s general requirement that certification bodies be independent and impartial.

3

. Ensure that the agency and the pub lic have appropriate access to information

Private third

- party conformity assessment systems differ from r egulatory third

- party programs in a key respect. In the latter, the user of the system is ultimately the public, and the regulatory agencies that establish third

- party programs are accountable to the public for their

outcomes. As a result, the responsibl e agency and the public should have access to a variety of types of information about the operation of the third

- party program.

T he public should have access to and input into the procedures by which a regulatory third

party program is run. The developme nt of program rules and guidance should include public notice and participation. When agencies incorporate international conformity assessment standards into their regulatory processes, important concerns arises about the public availability

of those stan dards. 450 Because ISO/IEC standards are copyright protected, they are not easily accessible to interested members of the public. ACUS has recommended that when an agency considers “incorporating copyrighted material by reference, the agency should work wit h the copyright owner to ensure the material will be reasonably available to regulated and other interested parties both during rulemaking and following promulgation.” 451

The public should also have a ccess to certain types of information about the compliance of regulate entities. If a third

- party program replaces a regulatory compliance program, the same types of information that were accessible to the public before the implantation of the third

- party program should remain accessible after. In some cases, h owever, it may be appropriate and desirable to provide additional compliance information to the public that was not systematically

available before the third

- party program came into effect.

T he public should have access to certain types of information about the third parties that participate in the regulatory program. The agency should make clear the roles and identities of

the various third

- party actor s

. In several programs d iscussed above, Congress has required that agencies maintain a public list of the private bodies associated with the program. Other information about the characteristics and activities of the private bodies may also be important to create public confidence in the integrity of the third

- party program.

For effecti ve oversight, the government agency will also need certain types of information from accreditation, certification and testing bodies. For example, testing and certification bodies

450 See especially Administrative Conference of the United States, supra note 413

. 451 Id. at 5.Third

- Party Programs to Assess Regulatory Compliance

67 might be required to report potential conflicts of interest before performi ng the conformity assessment. They might also be required to report the dates of their conformity assessment activities so that agency officials can conduct a site visit for oversight purposes. In addition to the positive or adverse determination that is the ultimate outcome of the conformity assessment process, bodies can be required to submit documents gathered or generated during the process that explain and support the determination. To the extent that information required of third parties constitute s confidential business information, it can be held back from the public in

accordance with the Freedom of Information Act and other applicable laws.

Information disclosure requirements may have the effect of enhancing the degree to which

third

- party ans wer directly to the agency rather than just the regulated agency that has contracted it. For example, FSMA requires that accredited labs send their test results directly to the

FDA. 452 One commentator has called this “a game

- changing requirement” that “alt ers the whole dynamic between labs and their clients,” making them “directly responsible to the public (i.e., the government) to ensure that information i s disclosed about their client.” 453

Importantly, international conformity assessment standards include confidentiality provisions that may prevent the flow of information in a regulatory third

- party program. When EPA requested comments on a d raft of its rules for the recognition of accreditation bodies that would accredit laboratories, it received comments to the effect that several types of information that it initially wanted from the accreditation bodies were contrary to the confidentiality provisions of

ISO 17011. 454 For exam ple, EPA initially wanted to be informed of t he results of ILAC ’s peer

e valuation . After being informed that such information was against ISO 17011's confidentiality

rules , EPA struck the requirement. 455

On the same basis, a commente r also objected to EPA’s requirement that recognized accreditation bodies provide EPA with cop ies of laboratory assessment documentation in cluding corrective action plans and documentation about the resolution of deficiencies. In this case, however, EPA responded that the release of this information by the AB is an integral aspect of EPA's recogni t ion of the laboratory and suggested that the AB should seek the laboratory’s

written consent to share this information with EPA. EPA’s response also indicates how an

agency can use program

- specific rules to essentially modify the default confidentiality rules

contained in the international standards.

While confidentiality provisions should not hinder the flow of information that is necessary for adequate regulatory oversight and public accountability, some would argue that certain confidentiality assuranc es ultimately serve regulatory goals. For example, t he FDA has provoked a negative reaction from industry by interpreting FSMA to require that accredited auditor must immediately notify the FDA if it “ discovers a condition that could cause or contribute to a

452 21 U.S.C. § 350k(b)(2).

453 Daniel R. Dwyer, Third

- P arty Accreditation under the FDA Food Safety Modernization Act (March 7, 2012), http://www.kkblaw.com/blog/archives/206.html (last visited Sept. 12, 2012).

454 See http://www.energystar.gov/ia/partners/downloads/mou/AB_Comment_Matrix.pdf (providing matrix that summarizes comments on the condition and criteria for recognition of accreditation bodies for Energy Star laboratory recognition); see also http://www.energystar.gov/index.cfm?c=partners.intro_conf_calls#accred (listing of stakeholder comments on draft accreditation body requirements).

455 Id. at 2.Third

- Party Programs to Assess Regulatory Compliance

68 serious risk to the public health ” during either a regulatory or a consultative audit. 456 As stated by one industry commenter, “ We disagree with this interpretation of the FSMA and maintain that such a position could undermine the purpose of the law, u ltimately dissuading manufacturers from using third party auditors

— a move that could negatively impact food safety and hinder FDA’s efforts to efficiently use its own resources.” 457 A gencies should consider pros and cons

of limiting the types of confidentiality that regulated en tities expect when they contract privately with third parties.

Information technology (IT) can play an important role in enabling the flow of information in

a third

- party program. Regulated entities, third

- p arty conformity assessment bodies, and accreditation bodies can be required to e

- report certain types of information. Also, w ith well

administered IT systems, information that should be public can be more promptly made public

. In its shrimp aquaculture pi lot, the FDA made a special note of the n eed for new “IT data systems to capture and report on results of assessments and audits.” 458

In sum
, a change in the “communicative energy” of third

- party conformity assessment is required in a regulatory context

. 459 Th e default in the private sector is for the third party to disclose

his audit report exclusively to his client. 460 If interested parties external to the contractual relationship are privy to the audit’s results at all, they are likely to be told little more than whether the subject of the audit conformed or not

. 461 For an assessment to serve public regulatory

purposes, much richer information about its process and outcomes is necessary

. 462

4

. Commit to undertaking appropriate oversight activities

When an agency establishes a regulatory third

- party prog ram, its role changes from being the guardian to guarding the guardians. 463 G overnmental oversight of third

- party programs is

essential to ensuring that the program is fulfilling its regulatory purpose

. In add ition to exercising direct oversight, a n agency can also require third parties to conduct and report

su rveillance activities that provide additional information to the agency about program operation

.

For a successful third

- party program, a regulatory agen cy must implement and enforce the

rules it es tablishes for program actors. In principal, the same enforcement strategies and tools would apply in enforcing third

- party program rules as apply in enforcing other regulatory rules. The agency must require cer tain types of reporting, conduct regulatory inspections to verify compliance, and impose sanctions as deemed necessary to respond to noncompliance. The

456 21 U.S.C. § 384d(c)(4)(A); see also FDA, Imports, http://www.fda.gov/Food/FoodSafety/FSMA/ucm2579 80.htm (answering in the affirmative the question, “I.4.2 Is the accredited auditor required to notify the FDA if a condition of concern is found during a consultative audit?”).

457 Comment of International Dairy Foods Association, Re: Docket Nos. FDA

- 2011

- N

- 0143, FDA

- 2011

- N

- 0144,

FDA

- 2011

- N

- 0145, FDA 2011

- N

- 0146; Food a nd Drug Administration; FDA Food Safety Modernization Act: Title

111

— A New Paradigm for Importers (Apr. 28, 2011), available at http://www.idfa.org/files/IDFA_FSMA_Import_Comments_042811.pdf

. 458 Assessment of Pilot for Aquacultured Shrimp, supra note 298 , at 26.

459 Christine Par ker, Regulator

- Required Corporate Compliance Program Audits , 25 L AW & P OL ’ Y 221, 235 (2003).

460 See id.

461 Id.

462 See id.

463 Martin Shapiro, W HO G UARDS THE G UARDIANS ? (1988).Third

- Party Programs to Assess Regulatory Compliance

69 difference is that the agency’s third

- party program rules apply to the private bodies that form the

thi rd

- party system rather than the regulated entities themselves.

An agency that establishes a third

- party program should set forth, to the extent possible, ho w it intends to conduct such oversight. The agency may determine, for example, that it will asse ss the performance of accreditation bodies every few years; that it will conduct a certain number of audits of accreditations or certifications; or that it will carry out a market surveillance program that will test a certain number of products off the she lf each year. Special rules may be necessary to ensure an oversight activity. In the shrimp aquaculture pilot, for example, FDA found that entities subject to certification were not always willing to allow an FDA official to accompany the certification b ody on a site visit. FDA concluded that it should “c onsider requiring, as a condition for accreditation, that CBs maintain agreements with establishments they certify to allow FDA to monitor or otherwise participate in certification audits as necessary.” 464

The agency would also retain enforcement authority over regulated entities, which could be

used when the agency discovers through the third

- party program or otherwise that a regulated entity is out of compliance

. In the NOP program, for example, AMS us es its traditional enforcement powers to respond to situations where organic operations knowingly market nonorganic food as organic. 465 Its enforcement actions “play a central role in maintaining the validity of the program and ensuring public trust” in the label. 466

A s in traditional regulatory programs, agencies should be equipped to receive and respond to information about potential noncompliances from the public. In an investigation of the NOP

program, the USDA OIG found that that “NOP officials did not have adequate procedures or a system for tracking the receipt, review, and disposition of complaints and any subsequent

enforcement actions.” 467 When third parties have played a role in assessing compliance, the agency might be able to direct a public compl aint to the relevant third

- party body for an initial investigation. The agency, however, would remain ultimately responsible for ensuring that the complaint was resolved. The agency could also require that employees of accreditation bodies and conformity assessment bodies be given information about how to anonymously contact an official within the regulatory agency to report any potential problems.

The agency may require certain activities of accreditation bodies and conformity assessment bodies that provi de information for oversight purposes. Accreditation bodies may be required for example, to conduct periodic audits of the certification bodies they accredit. Certification bodies may be required to conduct surveillance audits of the entities and produc ts they certify. 468
In both cases, the agency might also require that some or all of the audits be unannounced rather

464 Assessment of Pilot for Aquacultured Shrimp, supra note 298 , at 21.

465 USDA OIG, supra note 345

. 466 Id. at 8.

467 Id. at 1.

468 Energy Star requires CBs to operate a partner

- funded verification testing program to ensure products meet Energy Star standards. DOE, Energy Star Appliance Verification Testing

– Pilot Program Summary Report 22 (Feb. 3, 201 2), http://www1.eere.energy.gov/buildings/appliance_standards/pdfs/ energystar_pilotprogram_report_02_03_12.pdf (last visited Sept. 12, 2012).Third

- Party Programs to Assess Regulatory Compliance

70 than announced. 469 In its investigation of the NOP’s organic milk program

, the OIG milk found that certifying agents were not performing unannounced inspectio ns of organic dairy operations. 470 While unannounced inspections are not required by NOP regulations, OIG and other stakeholders consider them to play a “critical role” in ensuring compliance. 471 Notably, if

the rules of a th ird

- party program do not require unannounced audits, accreditatio n and

certification bodies will have little incentive to do them for fear of offending clients. Unannounced audits of facilities can be facilitated by requiring regulated entities to agree to

them as a condition of certification.

469 Albersmeier et al., supra note 3 , at 933 , tbl. 5 (showing that a superior risk

- oriented approach includes “randomly chosen audits without announcement” rather than “regula r audits with announcements”).

470 USDA Office of Inspector General, Agricultural Marketing Service, National Organic Program

– Organic Milk, Audit Report 01601

- 0001

- Te (2012), available at http://www.usda.gov/oig/webdocs/01601

- 0001

- Te.pdf?utm_source=Organic+Milk+Audit+Report+Published&utm_campaign=Organic+milk+audit+report&utm_m

edium=email

. 471 Id. at 17

.A

- 1 Appendix A: Interviews by Phone and Email

By Phone:

David Alderman, Standards Services Division, National Institute of Standards and Technology

Cheri Courtney, Director, Accreditation & International Activities Division, National Organic Program, U.S. Department of Agriculture

Bob Biersner, Office of the Solicitor, U.S. Department of Labor

Charlotte C h risten, U.S. Food and Drug Administration

Bridget Dooling, Office of Information and Regulatory Affairs, U.S. O ffice of Management and Budget

Sandra B. Eskin, Director, Food Safety Campaign, The Pew Health Group

Jim Estep, Occupational Safety & Health Administration , U.S. Department of Labor

Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and Technology

David Hinden, Office of Enforcement and Compliance Assurance

, U.S. Environmental

Protection Agency

Eamon Monahan

, Energy Star Program , U.S. Environmenta l Protection Agency

David Kalins

, Office of Compliance, Center for Devices and Radiological Health, U.S. Food and Drug Administration

Kevin Robinson, Occupational Safety & Health Administration

, U.S. Department of Labor

David Rostker, Assista nt Chief Counsel, Office of Advocacy

, U.S . Small Business

Administration

Ramona Saar, Standards Services Division, National Institute of Standards and Technology

Jasmeet Seehra, Office of Information and Regulatory Affairs, U.S. Office of Management and Budget

Jon Silberman, Office of Enforcement and Compliance Assurance

, U.S. Environmental Protection Agency

George Tannahill, Federal Communications CommissionA

- 2 Stephanie Tanner, WaterSense Program, U.S. Environmental Protection Agency

Kim Trautman, Associate Director, International Affairs, Office of the Center Director, Center for Devices and Radiological Health, U.S. Food and Drug Administration

Peter Unger, President & CEO, ILAC Chair, American Association for Laboratory Accreditation (A2LA)

Mike Zatz, Ch ief, Market Sectors Group, Energy Star Commercial and Industrial Branch

, Office of Air and Radiation, U.S. Environmental Protection Agency

B y Email:

Jean Cooper, Senior Staff Fellow

, U.S. Food and Drug Administration

Lauren Kavanaugh, Quality Management Branch Chief, Grading and Verification Division, Agricultural Marketing Service, U.S. Department of Agriculture

Linwood L. Rayford, III, Assistant Chief Counsel for Food, Drug and Health Policy, Office of Advocacy

, U.S . Small Business AdministrationA

- 3 Appendix B : ISO Standards for Conformity Assessment Activities

Conformity Assessment Activity Relevant International Standard Supplier’s Declaration of Conformity (SDoC) ISO/IEC 17050, “ Conformity assessment

- Suppl ier's declaration of conformity” Testing ISO/IEC 17025, “General requirements for the competence of testing and calibration

laboratories

. ” Inspection ISO/IEC 17020, “ Conformity assessment

-- Requirements for the operation of various types of bodies performing inspection ”

Certification ISO/IEC Guide 65, “General requirements for bodies operating product certification systems” (expected to be replaced by ISO/IEC 17065, “Conformity assessment

-- Requirements for bodies certifying products, processes and services”)

. Accreditation ISO/IEC 17011, “General requirements for accreditation bodies accrediting conformity

assessment bodies

. ”A

- 4 Appendix C: List of Abbreviations



### Abbreviation Description

AAMI Association for the Advancement of Medical Instrumentation

A2LA American Association for Laboratory Accreditation

AMS [USDA] Agricultural Marketing Service

ANSI American National Standards Institute

AP Accredited Person (s) AP Program I nspection by Accredited Persons P rogram ASTM American Society for Testing and Materials

CASCO toolbox Collective term for conformity assessment standards and guides developed by the ISO Committee on Conformity Assessment

CB Certification B ody

CMS/ITRI Center for Measurement Standards/Industrial Technology Research Institute (China)

CoP Medicare Conditions of Participation

CPSC Consumer Product Safety Commission

CPSIA Consumer Product Safety Improvement Act of 2008

CSL Curtis Straus LLC

DfE EPA Design for Environment label

DOE Department of Energy

EPA Environmental Protection Agency

FACA Federal Advisory Committee Act FAQs Frequently Asked Questions

FCC Federal Communications Commission

FDA Food and Drug Administration

FDAAA Food and Drug Administration Amendments Act of 2007

FDAMA FDA Modernization Act of 1997

FDCA Federal Food, Drug, and Cosmetic Act

FMRC Factory Mutual Research Corporation

FOIA Freedom of Information Act

FSMA Food Safety Modernization Act of 2011

GAO G overnment Accountability Office

GAP/GHP [USDA] Good Agricultural Practices/Good Handling Practices Audit Program

HVAC H eating, ventilation, and cooling equipment

IAF International Accreditation Forum

IAS International Accreditation Services Inc.

ICSP Interagency Committee on Standards Policy

IEC International Electrotechnical Commission

ILAC International Laboratory Accreditation Cooperation

IOM [FDA] Investigations Operations Manual

ISO International Organization for Standardization

ISO/IEC Int ernationa l Organization for Standardization/ Int ernational Electrotechnical

Commission

ISO/UNIDO International Organization for Standardization / United Nations Industrial Development Organization

IT I nformation technology

MDSAP Medical Device Single Audit Program

MDUFMA Medical Device User Fee and Modernization Act of 2002

MLA IAF Multilateral R ecognition AgreementA

- 5 

### Abbreviation Description

MRA ILAC Mutual Recognition Agreement

NIST National Institute of Standards and Technology

NOP National Organic Program

NRTL National Recognized Testing Laboratory

NTTAA National Technology Transfer and Advancement Act of 1995

NVCASE [NIST] National Voluntary Conformity Assessment Evaluation program

OIG Office of Inspector General

OMB Office of Management and Budget

OSHA Occupational Safety and Health Administration

PMAP Pilot Multi

- P urpose Audit Program

RF R adio frequency QMI Quality Management Institute (Canada) QS Quality System

SDoC S upplier’ s Declaration of C onformity

SMTL Supervised Manufacturers’ Testing Laboratory

TCB Telecommunication Certification Body

TPCAB Third Party Conformity Assessment Body

TPRB [ FDA ] Third Party Recognition Board

UL Underwriters Laboratories, Inc.

UNIDO United Nations Industrial Development Organization

USDA AMS USDA Agricultural Marketing Service

USTR Office of the United States Trade Representative

VCS V oluntary consensus standard VQIP Voluntary Qualified Importer Program

WMTL Witnessed Manufacturers’ Testing Laboratory