Third-Party Programs to 

Assess Regulatory 

Compliance

Lesley K. McAllister

University of San Diego School of Law

October 22, 2012

 This report was prepared for the consideration of the Administrative Conference of the United States. The views 

 expressed are those of the author and do not necessarily reflect those of the members of the Conference or its 

 committees.

ADMINISTRATIVE CONFERENCE 

OF THE UNITED STATES

i

Report Prepared for the Administrative Conference of the United States*

Lesley K. McAllister1

Table of Contents

I. Introduction ................................................................................................................................. 1

II. Conformity Assessment in a Regulatory Context...................................................................... 2

III. Review of Federal Third-Party Programs................................................................................. 7

A. Programs for Mandatory Standards..................................................................................... 10

1. FDA, Imported Food Programs ........................................................................................ 10

2. CPSC, Children’s Product Safety Rule............................................................................. 15

3. FDA, Medical Device Inspections.................................................................................... 21

4. FCC, Telecommunication Certification Body Program ................................................... 28

B. Programs for Voluntary Standards....................................................................................... 31

1. OSHA, National Recognized Testing Laboratories Program........................................... 31

2. AMS, National Organic Program ..................................................................................... 33

3. EPA/DOE, Energy Star Program...................................................................................... 35

4. EPA, WaterSense Program ............................................................................................... 38

IV. Evaluating Third-Party Programs........................................................................................... 40

A. Metrics of Success ............................................................................................................... 40

1. Reliability of Third-Party Determinations........................................................................ 40

2. Rates of Compliance ......................................................................................................... 44

3. Agency Capacity to Administer the Third-Party Program................................................ 45

4. Public Acceptance............................................................................................................. 48

5. Industry Acceptance.......................................................................................................... 49

B. Incentives to Participate When Use of Third Parties is Voluntary ...................................... 52

V. Recommendations to Federal Agencies................................................................................... 54

A. Deciding Whether to Use a Third-Party Program................................................................ 55

1. Consult governmental and non-governmental resources relating to third-party conformity 

assessment............................................................................................................................. 55

2. Consider the characteristics of the regulatory standards and the regulatory target .......... 57

3. Compare the benefits and drawbacks of third-party programs with other approaches..... 59

4. If the use of third parties will be voluntary, evaluate whether sufficient incentives exist to 

attract participation ............................................................................................................... 62

B. Establishing a Third-Party Program..................................................................................... 62

1. Calibrate the third-party program to the level of risks associated with noncompliance... 62

2. Incorporate existing conformity assessment standards and activities when possible....... 63

3. Ensure that the agency and the public have appropriate access to information................ 66

 * This draft report was prepared for consideration of the Administrative Conference of the United States. The views 

expressed are those of the author and do not necessarily reflect those of the members of the Conference or its 

committees.

1 Stanley Legro Professor in Environmental Law, University of San Diego School of Law; Associate Adjunct 

Professor, University of California San Diego, School of International Relations & Pacific Studies. J.D., Stanford 

Law School, 2000; Ph.D., University of California Berkeley, 2004. The author may be contacted at 

mcallister@sandiego.edu or (619) 260-7999.
ii

4. Commit to undertaking appropriate oversight activities................................................... 68

Appendix A: Interviews by Phone and Email............................................................................. A-1

Appendix B: ISO Standards for Conformity Assessment Activities.......................................... A-3

Appendix C: List of Abbreviations............................................................................................. A-4

Tables

Table 1: Federal Regulatory Third-Party Programs with Selected Program Attributes................. 9

Figures

Figure 1: General Structure of Third-Party Programs to Assess Regulatory Compliance ............ 7

Figure 2: Structure of Third-Party Program for Imported Food Certifications........................... 12

Figure 3: Structure of Third-Party Program for Food Safety Testing ......................................... 13

Figure 4: Structure of Third-Party Program for Children’s Product Testing................................ 16

Figure 5: Structure of Third-Party Program for Medical Device Facilities.................................. 24

Figure 6: Structure of Third-Party Program for Telecommunication Equipment ........................ 30

Figure 7: Structure of Third-Party Program for Workplace Product Safety................................. 32

Figure 8: Structure of Third-Party Program for Organic Food Label........................................... 35

Figure 9: Structure of Third-Party Program for Energy Star Product Label ................................ 36

Figure 10: Structure of Third-Party Program for WaterSense Product Label .............................. 38
1

I. Introduction

Federal agencies in diverse areas of regulation are using private third parties to carry out 

inspections and verify that regulated entities are in compliance with federal standards and other 

requirements. With oversight by the responsible federal agency, third parties are charged with 

assessing the safety of imported food, children’s products, medical devices, cell phones and other 

telecommunications equipment, and electrical equipment used in workplaces. Third parties also 

ensure that products labeled as organic, energy-efficient, and water-efficient meet applicable 

federal standards. In these regulatory third-party programs, third parties carry out product 

testing, facility inspections, and other regulatory compliance activities in the place of regulatory

agencies. Regulatory agencies take on new roles in coordinating and overseeing these private 

actors.

Third-party programs operated by federal agencies for regulatory purposes vary in important 

ways. In many cases, Congress provided legislative authority for the third-party program and set 

forth certain design elements in statute. In other cases, agencies have implemented third-party 

programs under existing statutory authority. Several programs are a decade or two old, but most 

have been established more recently. Depending on the program, third parties assess compliance 

with mandatory or voluntary regulatory standards, and regulated entities may either be required 

or may have the option to contract with third parties for such assessment.

There are several reasons why third-party programs are being increasingly incorporated into 

regulation. Some regulatory problems are difficult to address using traditional regulatory 

approaches such as ensuring the safety or correct labeling of food and other products 

manufactured in complex international chains of production. Third-party programs may extend 

the reach of regulators by enabling third parties around the globe to participate in compliance 

assessment. Another motivating factor is that agency resources are often inadequate to address 

the ever-growing number of problems and entities subject to regulation. Third-party programs 

may have the effect of shifting some regulatory costs to private parties and thereby conserving

governmental resources.

 

Regulatory third-party programs raise a host of significant theoretical and practical questions. 

Representing a partial privatization of the public function of implementing and enforcing 

regulatory law, they are a form of “public-private governance,” in which private actors play roles 

that are traditionally viewed as governmental in nature.2 While they may enable innovation, 

efficiency, and quality in the provision of governmental services, third-party programs may also 

jeopardize the fulfillment of public purposes and commitments. Difficult issues are presented 

regarding considerations such as the competence and independence of third-party actors, the 

extent of governmental control and oversight, and the management and coverage of third-party 

 2 Jody Freeman, Private Parties, Public Functions and the New Administrative Law, in RECRAFTING THE RULE OF 

LAW: THE LIMITS OF LEGAL ORDER 331 (David Dyzenhaus ed., Hart, 1999); Martha Minow, Public and Private 

Partnerships: Accounting for the New Religion, 116 HARV. L. REV. 1229, 1230 (2002-2003); Jody Freeman, 

Extending Public Law Norms through Privatization, 116 HARV. L. REV. 1285, 1286-87 (2002-2003); William J. 

Novak, Public-Private Governance: A Historical Introduction, in GOVERNMENT BY CONTRACT: OUTSOURCING AND 

AMERICAN DEMOCRACY (Freeman and Minow, eds., Harvard University Press, 2009).
Third-Party Programs to Assess Regulatory Compliance

2

program costs.

A variety of sources inform this paper. Information about particular programs was gathered 

primarily from relevant statutes, regulations, agency guidance documents, and agency reports. 

The author also conducted twenty phone interviews, mostly with agency staff responsible for, or 

otherwise very knowledgeable about, third-party programs (see Appendix A). The paper also 

draws from relevant academic literature.3

The rest of the paper is divided into four sections. Section II introduces the language of 

conformity assessment. Many regulatory third-party programs, particularly newer ones, 

explicitly incorporate terminology and concepts from private-sector conformity assessment

systems. Older programs do not as much, but the vocabulary of conformity assessment remains 

helpful in understanding their structure.

 

Section III surveys eight programs in which federal agencies rely on private third parties to 

provide information about the compliance of regulated entities. The programs are diverse. They 

are operated by six different regulatory agencies. Half assess compliance with mandatory 

standards, and the other half assesses compliance with voluntary standards. The use of third 

parties is required in six and optional in two.

 

Section IV identifies five metrics to assess the success of third-party programs. These 

metrics include the reliability of third-party determinations, the rate of compliance, agency 

capacity to administer the third-party program, public acceptance, and industry acceptance. They

are discussed with examples drawn from the surveyed programs.

In the final section, recommendations are made to federal agencies. The first set of 

recommendations regards how an agency should consider whether or not to establish a thirdparty program. The second set of recommendations is directed towards agencies that have 

decided to establish such a program.

II. Conformity Assessment in a Regulatory Context

Regulatory third-party programs are often built using the terminology and practices of a 

broad “conformity assessment” framework that has been developed by standards bodies in the 

private sector. Conformity assessment is defined as “demonstration that specified requirements 

relating to a product, process, system, person, or body are fulfilled.” 4 It is commonly used in the 

private sector by purchasers who want to verify that a potential supplier’s product or service 

 3 See especially Lesley K. McAllister, Regulation by Third-Party Verification, 53 B.C. L. REV. 1 (2012); Friederike 

Albersmeier et al., The Reliability of Third-Party Certification in the Food Chain: From Checklists to Risk-Oriented 

Auditing, 20 FOOD CONTROL 927, 930 (2009); Stepan Wood, Voluntary Environmental Codes and Sustainability, in

ENVIRONMENTAL LAW FOR SUSTAINABILITY 229, 230 (2006); Errol E. Meidinger, The New Environmental Law: 

Forest Certification, 10 BUFF. ENVTL. L.J. 211, 284 (2002). 4 American National Standards Institute (ANSI), National Conformity Assessment Principles for the United States, 

3, available at http://publicaa.ansi.org/sites/apdl/Documents/News%20and%20Publications/Brochures/

NCAP%20second%20edition.pdf.
Third-Party Programs to Assess Regulatory Compliance

3

conform to their requirements.

5

Given the importance of conformity assessment to business transactions, the International 

Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 

have published a series of standards relating to conformity assessment. Also, a large number of 

private organizations have been established to perform conformity assessment-related services. 

As federal agencies have recognized that verifying compliance with regulatory requirements can 

be viewed as a form of conformity assessment, they have built relevant international standards 

and the work of related organizations into their compliance programs.

 

The vocabulary of conformity assessment has thus become essential to understanding thirdparty programs operated by federal agencies. Indeed, the term “third party” is part of that 

vocabulary. International standards divide conformity assessment into three major types. 6 Firstparty conformity assessment is performed by the manufacturer or supplier itself and is also 

referred to as “supplier’s declaration of conformity” (SDoC). 7 Second-party conformity 

assessment is performed by the purchaser or customer. Third-party conformity assessment is 

performed by an independent entity, which may (in this general terminology) be a government 

agency or a private party.8 This report is concerned with third-party conformity assessment 

conducted by private parties under the direction of federal agencies for regulatory purposes. 

Definitions of the various types of activities and organizations related to conformity 

assessment are also set forth in international standards.9 “Testing” means the “determination of 

one or more characteristics of an object of conformity assessment, according to a procedure.”10

“Certification” means “third party attestation related to products, processes or persons that 

conveys assurance that specified requirements have been demonstrated.”11 Testing is usually 

conducted by laboratories (which may also be referred to as testing bodies), while certifications

are conducted by certification bodies (which may also be laboratories). Both testing bodies and 

certification bodies are referred to as conformity assessment bodies.12

 5 Margaret M. Blair et al., The New Role for Assurance Services in Global Commerce, 33 J. CORP. L. 325, 329-30 

(2008) (tracing the origins of the third-party assurance industry and many of its most important firms back to the 

1800s when marine insurance companies hired private inspectors to make sure that ships carrying insured goods 

were seaworthy).

6 Christopher Johnson, U.S. International Trade Commission, Technical Barriers to Trade: Reducing the Impact of 

Conformity Assessment Measures 4 (2008), available at http://www.usitc.gov/publications/332/working_papers/cadft-rev-final082008.pdf. 7 Id. (defining SDoC as a procedure by which a manufacturer (or other supplier) provides written assurance of the 

conformity of its products to specified requirements.)

8 Id. at 7. 9 ISO/IEC 17000 sets out standard definitions of conformity assessment terms. 10 ISO/UNIDO, Building Trust: The Conformity Assessment Toolbox 34 (2010),

http://www.iso.org/iso/casco_building-trust.pdf. 11 ANSI, supra note 4, at 5. 12 Another type of conformity assessment body that could be relevant to third-party programs for regulatory 

purposes is an inspection body. ISO/IEC 17000 defines inspection as an “Examination of a product design, product, 

process or installation and determination of its conformity with specific requirements or, on the basis of professional 

judgment, with general requirements.” ISO/UNIDO, supra note 10, at 35. The international standard for inspection 

bodies is ISO/IEC 17020, General criteria for the operation of various bodies performing inspection. None of the 

third-party programs surveyed in this report have incorporated the standard for inspection bodies.
Third-Party Programs to Assess Regulatory Compliance

4

In the language of conformity assessment, testing is often necessary for certification but it is 

distinct. Unlike testing, certification is always performed by a third party, and it requires that the

third party conduct not just initial testing but also the surveillance necessary to attest to the 

continuing conformity of a product, process, system, or person.

13 “Surveillance” is defined by 

ISO as a “systematic iteration of conformity assessment activities as a basis for maintaining the 

validity of the statement of conformity.”14 Market surveillance is a particular form of 

surveillance used in some certification schemes where samples of certified products in the 

marketplace are tested to determine whether they conform to specified requirements.

15

Accreditation is another important element of private conformity assessment systems. 

“Accreditation” is defined as “third party attestation related to a conformity assessment body 

conveying formal demonstration of its competence to carry out specific conformity assessment 

tasks.”16 Accreditation bodies decide whether to accredit conformity assessment bodies by using 

auditing techniques to assess their organizational and technical capabilities.17 They are often 

appointed by national governments, but not all countries have a national accreditation body and 

some countries have one or more private accreditation bodies in addition to or instead of a 

national accreditation body.

18

Accreditation bodies are often members of an international association of accreditation 

bodies, such as the International Accreditation Forum (IAF) or the International Laboratory 

Accreditation Cooperation (ILAC).19 IAF is comprised of accreditation bodies that accredit 

certification bodies whereas ILAC is comprised of accreditation bodies that accredit laboratories. 

Both IAF and ILAC have established voluntary agreements through which member accreditation 

bodies agree to adhere to international standards when accrediting testing and certification 

bodies: the IAF Multilateral Recognition Agreement (MLA) and the ILAC Mutual Recognition 

Agreement (MRA).

20 IAF and ILAC use a system of peer evaluation to assess accreditation 

bodies for membership and to perform reassessments every four years.

21 Their objective is that 

conformity assessment bodies accredited by member accreditation bodies would be recognized 

 13 Interview (by phone), Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and 

Technology, Aug. 15, 2012. See also IAF FAQ, http://www.iaf.nu/articles/FAQ/288 (last visited Sept. 11, 2012) 

(stating that ISO/IEC defines certification as a “third-party attestation related to products, processes, systems or 

persons”); ISO/UNIDO, supra note 10, at 52-55 (setting forth various systems that include surveillance and meet the 

definition of product certification). 

14 ISO/UNIDO, supra note 10, at 44. 15 Id. at 45. 16 ANSI, supra note 4, at 5; ISO/UNIDO, supra note 10, at 24. 17 ISO/UNIDO, supra note 10, at 44. 18 ISO/UNIDO, supra note 10, at 25, 86-88.

19 See e.g., International Laboratory Accreditation Cooperation, https://www.ilac.org/. 20 Office of the United States Trade Representative (USTR), Technical Barriers to Trade (TBT Report) 28 (2012), 

http://www.ustr.gov/about-us/press-office/reports-and-publications/2012/technical-barriers-trade-tbt-report (last 

visited Sept. 11, 2012). See also IAF/ILAC Multi-Lateral Mutual Recognition Arrangements (Arrangements): 

Narrative Framework for Reporting on the Performance of an Accreditation Body (AB) A Tool for the Evaluation 

Process, IAF/ILAC-A3:07/2011 (2011), http://www.compad.com.au/cms/iafnu/workstation/upFiles/

IAFILACA3072011.pdf (last visited Sept. 11, 2012). 21 Id. 
Third-Party Programs to Assess Regulatory Compliance

5

as competent in multiple jurisdictions and markets.22 In the words of the accreditation industry, 

“tested or certified once - accepted everywhere.”23 

It is useful to understand that private conformity assessment encompasses a spectrum of rigor 

and independence.24 Depending on the level of confidence or assurance required, the technical 

activities of conformity assessment may be more or less rigorous, and the organizations that 

conduct conformity may be more or less independent. When the user of a conformity assessment 

system—for example a purchaser—needs just a basic level of assurance, an SDoC based on the 

manufacturer’s own inspection or testing may be adequate. When the purchaser needs more 

assurance, it may require an SDoC supported by testing in an accredited third-party laboratory. 

When the purchaser needs much more assurance, it may require certification by an accredited 

third party, perhaps with testing conducted in an accredited third-party laboratory. 

Importantly, conformity assessment imposes costs on a manufacturer or other entities that are 

subject to conformity assessment requirements.

25 These costs tend to be higher in conformity 

assessment systems that are more rigorous and independent.26 In other words, a conformity 

assessment system that requires third-party certification will tend to be more costly to the entities 

that must show conformity than a system that only requires sDoC.27 Redundancy in 

accreditation has also been observed to add costs to conformity assessment: a laboratory or 

certification body may need to get different accreditations to perform similar assessment in 

different localities, states and countries.28 These costs may then result in higher market prices 

for products and services subject to conformity assessment requirements. Also, differences in 

conformity assessment requirements across global markets can act as non-tariff barriers, a type 

of technical barrier to trade.29 The Agreement on Technical Barriers to Trade requires that 

 22 ISO/UNIDO, supra note 10, at 89. See also USTR, supra note 20, at 28 (explaining that by demonstrating the 

equivalence of the accreditation bodies that accredit testing and certification bodies, they aim to “provide 

governments, as well as suppliers, assurances that a body – regardless of its location – is competent to test and 

certify products for relevant markets.”). 23 United Kingdom Accreditation Service, IAF: What is the International Accreditation Forum, INC.?, 

http://www.ukas.com/technical-information/international-role/iaf.asp (last visited Sept. 11, 2012); see also

http://www.iaf.nu/ (showing the slogan “certified once, accepted everywhere” in the bottom right hand corner of the 

page).

24 Interview (by phone), Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and 

Technology, Aug. 15, 2012.

25 ISO/UNIDO, supra note 10, at 48. 26 Interview (by phone), Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and 

Technology, Aug. 15, 2012. 27 In contrast, a conformity assessment system based on sDoC may be more costly to the party that seeks to rely on 

the conformity assessment determination (for example a purchaser or a regulatory agency) because that party may 

need to conduct its own inspections or other surveillance to assure conformity. See especially OSHA, Notice: 

Nationally Recognized Testing Laboratories; Supplier’s Declaration of Conformity, 75 Fed. Reg. 79035, 79047

(Dec. 17, 2010) (stating, “OSHA estimated that implementing an SDoC system in the U.S. could cost the Agency 

approximately $360 million annually. In contrast, the current budget associated with operating the NRTL Program is 

approximately $1 million per year. Based on this estimate, operating an effective SDoC program would require 

OSHA to incur substantial additional costs.”). 28 National Research Council, Standards, Conformity Assessment, and Trade: Into the 21st Century (1995, National 

Academy Press), available at http://www.nap.edu/openbook.php?record_id=4921. 29 Johnson, supra note 6.
Third-Party Programs to Assess Regulatory Compliance

6

conformity assessment procedures adopted by the US and other member governments be nondiscriminatory and avoid creating unnecessary obstacles to international trade.30 

Federal agencies have often incorporated ISO standards and terminology relating to 

conformity assessment into their third-party programs. Agencies have most often relied on 

international standards that concern how testing bodies should conduct testing (ISO/IEC 17025); 

how certification bodies should conduct certifications (ISO/IEC Guide 65, to be replaced by 

ISO/IEC 17065); and how accreditation bodies should conduct accreditations (ISO/IEC 17011)

(see Appendix B).

31 Agencies have also tapped into the international networks of accreditation 

bodies, certification bodies, and testing bodies that seek to operate in conformity with these 

standards and do the work of conformity assessment. 

In regulatory third-party programs, third parties determine whether the products or 

production processes of regulated entities conform to certain standards. Most often these 

standards are established by the responsible governmental agencies, referred to as “governmentunique” standards. In other regulatory programs, agencies have required compliance with 

privately-established “voluntary consensus standards.” Voluntary consensus standards are 

standards developed or adopted by domestic or international voluntary consensus standardsetting bodies, such as the American Society for Testing and Materials (ASTM) or ISO.32 

Pursuant to the National Technology Transfer and Advancement Act of 1995 and OMB Circular 

A-119, federal agencies are required to adopt voluntary consensus standards instead of

government-unique standards when available and appropriate.33 Also, since the passage of the 

NTTAA, federal employees have become much more involved in the private sector 

organizations that establish voluntary consensus standards. In FY2010, more than 2,800 federal 

agency staff participated in more than 500 private-sector standards organizations.34

In most of the programs reviewed below, regulatory agencies rely on third parties that serve 

the function of certification bodies. Regulatory agencies have used a variety of names for these 

third parties, such as Third-Party Auditors, Telecommunication Certification Bodies, and 

Accredited Persons. The programs tend to share the same basic structure (see Figure 1). 

Regulated entities contract with a third-party certification body to assess and certify whether they 

are in conformity with an applicable regulatory standard. The certification bodies are generally

private entities that have been accredited to perform this task by an accreditation body that has 

been approved or recognized by the regulatory agency. The applicable standard may be a 

mandatory standard, such as a product safety rule, or a voluntary standard, as for an organic 

 30 Agreement on Technical Barriers to Trade, Apr. 15, 1994, Marrakesh Agreement Establishing the World Trade 

Organization, Annex 1A, Legal Instruments--Results of the Uruguay Round, available at

http://www.wto.org/english/docs_e/legal_e/17-tbt_e.htm . 31 See Appendix A. 32 OMB Circular No A-119-Revised (Feb. 10, 1998), available at http://www.whitehouse.gov/omb/circulars_a119. 33 Id.; National Technology Transfer and Advancement Act of 1995, Pub. L. No. 104-113, 110 Stat. 775 (1996) 

(codified in scattered sections of 15 U.S.C.).

34 First Responder Technologies - Ensuring a Prioritized Approach for Homeland Security Research and 

Development: Hearing Before the Subcomms. on Emergency Preparedness, Response and Communications

& Cybersecurity, Infrastructure Protection, and Security Technologies of the H. Comm. on Homeland Security, 

112th Cong. (May 9, 2012) (testimony of Mary H. Saunders, Director, Standards Coordination Office, National 

Institute of Standards and Technology), http://homeland.house.gov/sites/homeland.house.gov/files/TestimonySaunder.pdf (last visited Sept. 11, 2012). 
Third-Party Programs to Assess Regulatory Compliance

7

labeling scheme. In some programs, regulated entities are required to contract with a third party; 

in others, they have an option to do so.

However, this general structure varies. In some programs, for example, the regulatory 

agency itself accredits the certification bodies directly, without reliance on an accreditation body. 

Or the regulatory agency may require the certification body to be accredited by an accreditation 

body, but the agency may not explicitly approve or recognize accreditation bodies. Also, several 

of the programs rely on a combination of certification bodies and testing bodies. 

Figure 1: General Structure of Third-Party Programs to Assess Regulatory Compliance

III. Review of Federal Third-Party Programs

This paper surveys the most significant regulatory third-party programs implemented by 

federal agencies.35 In these programs, federal agencies directly rely on private third parties to 

provide information about regulatory compliance with mandatory or voluntary standards. 

Several types of programs that share some similarities but do not meet this description are 

outside the scope of this report. Examples include: (1) where a federal agency places

responsibility for inspecting and providing information about compliance directly on regulated 

entities;36 (2) where a federal agency relies on state agency personnel to inspect and provide 

information about compliance;37 (3) where a federal agency takes into account whether a 

 35 A significant program is one that is large, long-standing, well-documented, or some combination thereof. Several 

other programs implemented by the EPA may fall within the scope of this report but are relatively small and/or very 

recent. These include EPA’s requirement of attest engagements in its regulation of fuels (see 

http://www.epa.gov/otaq/fuels/reporting/attestengage.htm); EPA’s program regarding formaldehyde in wood (see 

http://www.epa.gov/opptintr/chemtest/formaldehyde/); and its Design for Environment label (DfE) 

(http://www.epa.gov/dfe/ ). 36 See, e.g., USDA’s proposed rule, Modernization of Poultry Slaughter Inspection, 77 Fed. Reg. 4408 (Jan. 27, 

2012).

37 An example is provided by USDA’s Good Agricultural Practices/Good Handling Practices (GAP/GHP) Audit 

Program, in which auditors from USDA and related state agencies certify on a fee-for-service basis the compliance 

A Regulatory Agency

Accreditation Bodies

approves 

that accredit

Conformity Assessment Bodies

that assess whether

Regulated Entities or Regulated Products

A Regulatory Standard

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

8

regulated entity is certified as meeting an ISO/IEC standard or another similar privatelyestablished standard in determining its inspection priorities;38 and (4) where an agency uses 

private third parties to assess compliance with its own procurement or federal assistance 

policies.

39

The eight third-party programs that are surveyed have been implemented by six different 

federal agencies (see Table 1). In four of the programs, third parties are called upon by 

regulatory agencies to assess compliance with mandatory regulatory standards. In the other four, 

third parties assess compliance with voluntary regulatory standards. In two of the eight 

programs, regulated entities have a choice about whether or not to use third parties to assess their 

compliance. In the others, the regulated entity has no choice but to contract with a third party if it 

wants to show compliance with the mandatory or voluntary standard. Four of the third-party 

programs were established before 2003 (with one dating to the late 1980s), and four others have 

been established since 2008. 

The reviewed programs are discussed with attention to the following questions: What is the 

overall purpose of the third-party program and the nature of the standard applied (voluntary or 

mandatory, governmentally-set or privately-set)? What is the authorizing law for the program? 

Who are the regulated entities that are subject to the third-party program? Who are the third 

parties and how are they accredited? What measures are in place to prevent conflicts of interest 

between third parties and regulated entities? How does the agency exercise oversight? And what 

funding exists for the administration of the third-party program? For each program, Table 1 

summarizes program attributes such as the assessment activities that third parties perform; 

whether the applicable standard is set by the government or privately (i.e. a voluntary consensus 

standard); and whether the agency directly accredits the third parties or relies on private 

accreditation bodies.

 

of farms and food facilities with voluntary standards set by FDA. See USDA, Fresh Fruit and Vegetable Audit 

Programs, http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=

TemplateN&page=GAPGHPAuditVerificationProgram (last visited Sept. 11, 2012). 38 An example is provided by a program in which FDA intends to use the results of a voluntary ISO 13485 audit as 

part of its risk assessment to determine whether that establishment can be removed from FDA’s routine inspection 

work plan for one year from the last day of the audit. See FDA, Guidance for Industry, Third Parties and Food and 

Drug Administration Staff, Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program 

(March 19, 2012),

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM212798.

pdf [hereafter “FDA 13485 Program Guidance”]. The program is authorized by statute at 21 U.S.C. § 374(g)(7)(F) 

(providing that “For the purpose of setting risk-based inspectional priorities, the Secretary shall accept voluntary 

submissions of reports of audits assessing conformance with appropriate quality system standards set by the 

International Organization for Standardization (ISO) and identified by the Secretary in public notice.”)

39 Since 1965, the Department of Health and Human Services has relied on third parties such as the Joint 

Commission on Accreditation of Hospitals (now the Joint Commission) to certify that hospitals meet the Medicare 

Conditions of Participation (CoP) and are thus eligible to receive providing Medicare-funded services. See generally

Eleanor D. Kinney, Private Accreditation as a Substitute for Direct Government Regulation in Public Health 

Insurance Programs: When Is It Appropriate? 57 LAW & CONTEMP. PROBS. 47 (1994); Timothy Stoltzfus Jost, 

Medicare and the Joint Commission on Accreditation of Healthcare Organizations: A Healthy Relationship? 57 

LAW & CONTEMP. PROBS. 15 (1994); Jody Freeman, The Private Role in Public Governance, 75 N.Y.U. L. REV. 543 

(2000).
Third-Party Programs to Assess Regulatory Compliance

9

Table 1: Federal Regulatory Third-Party Programs with Selected Program Attributes

Federal Agency Program Name

Authorizing 

Legislation and/or 

Year Established 

Regulated 

Product or 

Activity

Third-Party Assessment 

Activities

Use of Third 

Parties: 

Required or 

Voluntary

Standard-setting 

Entity: 

Government or 

Private

Accreditation Entity: 

Agency or Accreditation 

Bodies

Programs to Assess Compliance with Mandatory Standards

Food & Drug 

Administration 

(FDA)

Import Certification 

Program and Voluntary 

Qualified Importer 

Program (VQIP)

Food Safety 

Modernization Act of 

2011 

Imported Food

- Certification of foreign 

food facilities; 

- Laboratory testing of 

imported food products

Required Government

Accreditation Bodies (for 

both certification bodies 

and laboratories)

Consumer Product 

Safety Commission 

(CPSC)

Third Party Testing 

and Certification

Consumer Product 

Safety Improvement 

Act of 2008

Children’s 

Products

- Laboratory testing of 

children’s products Required Government and 

Private

Accreditation Bodies (for 

laboratories)

FDA

Premarket Notification 

510(k) Third Party 

Review Program/

Inspections by 

Accredited Persons 

(AP) Program

FDA Modernization 

Act of 1997 

(premarket program)/

Medical Device User 

Fee and Modernization 

Act of 2002 

(inspection program)

Medical Devices

- Review of premarket 

notifications/

- Inspection of medical 

device production 

facilities

Voluntary Government Agency

Federal 

Communications 

Commission (FCC)

Telecommunication 

Certification Body 

(TCB) Program

N/A (established by 

regulation in 1999)

Telecommunication

Equipment

- Certification of telecom 

products Voluntary Government Accreditation bodies (for 

certification bodies) 

Programs to Assess Compliance with Voluntary Standards

Occupational Safety 

& Health 

Administration 

(OSHA)

National Recognized 

Testing Laboratory 

(NRTL) Program

N/A (established by 

regulation in 1988)

Labeling of 

electrical and 

other types of

equipment in 

workplaces 

- Certification of 

equipment 

- Inspection of equipment 

production facilities

Required Private Agency

Agricultural 

Marketing Service 

(USDA AMS)

National Organic 

Program (NOP)

Organic Foods 

Production Act of 

1990 (implemented by 

regulation in 2000)

Labeling of 

Organic Products

- Inspection and 

certification of organic 

production facilities

Required Government Agency

Environmental 

Protection Agency 

(EPA)/ Department 

of Energy (DOE)

Energy Star

N/A (established 

through agency 

guidance in 2011)

Labeling of 

Energy Efficient 

Products

- Certification of products 

- Laboratory testing of 

products

Required Government

Accreditation Bodies (for 

both certification bodies 

and laboratories)

EPA WaterSense

N/A (established 

through agency 

guidance in 2009)

Labeling of 

Water 

Conservation 

Products

- Certification of products Required Government Accreditation Bodies (for 

certification bodies) 
Third-Party Programs to Assess Regulatory Compliance

10

A. Programs for Mandatory Standards

Several federal laws enable regulatory agencies to rely on third parties to assess compliance 

with mandatory standards. Mandatory standards must be complied with in order for a regulated 

entity to legally operate or sell a regulated product. In two of the programs—imported food 

programs administered by the Food & Drug Administration’s (FDA) and children’s product

safety rules administered by the Consumer Product Safety Commission’s (CPSC)—the thirdparty certifier is an obligatory part of the compliance process: the regulated company is required 

to contract with the third party for compliance assessment. In FDA’s programs for medical 

devices, in contrast, the use of a third party is optional: companies have the choice of hiring a 

third party or having the agency conduct the review or inspection instead. In the FCC’s program 

for telecommunications equipment, the use of a third party is optional for most types of 

equipment. 

1. FDA, Imported Food Programs 

As amended by the Food Safety Modernization Act of 2011 (FSMA), the Federal Food,

Drug, and Cosmetic Act (FDCA) enables the FDA to rely on third-party audits in its regulation 

of imported foods.

40 Overall, the FDA is responsible for ensuring the safety of about 80% of US 

food supply.41 Increasingly, much of this food supply is imported, including 80% of seafood, 

50% of fresh fruits, and 20% of fresh vegetables.42 

FSMA significantly strengthened FDA’s authority to regulate imported food, 43 and it relies 

on accredited third-party auditors in two different ways. First, the law requires FDA to create a 

Voluntary Qualified Importer Program (VQIP) through which participating importers may

receive expedited importation if the facility from which the imported food comes is certified by a 

third-party auditor.

44 Second, the law provides that the FDA may require that an importer 

present a certification from a third-party auditor in order to import food into the United States.

45

The third-party auditors that issue these certifications have to be accredited by either an 

accreditation body recognized by FDA or by the FDA directly.46 

In both programs, the third-party auditors would be responsible for performing an audit to 

assess and certify compliance with the mandatory requirements of the law.47 While VQIP is a 

voluntary program in the sense that importers are not required to participate, it is likely that for 

 40 See FDA Food Safety Modernization Act (FSMA), Pub. L. No. 111-353, 124 Stat. 3885 (2011). 41 Silliker, Inc., FDA Food Safety Modernization Act: Marking a New Era in U.S. Food Safety, available at

http://www.foodsafetymagazine.com/article.asp?id=4005&sub=sub2. 42 Dina ElBoghdady, Taking New Look at Food Inspection, WASH. POST, March 5, 2012, at A1. 43 Id. 44 21 U.S.C. § 384b (also known as FDCA § 806 and FSMA §302). 45 21 U.S.C. § 381(q) (also known as FDCA § 801(q) and FSMA § 303). 46 21 U.S.C. § 384d (also known as FDCA § 808 and FSMA § 307). 47 In the case of the import certification program, certification involves an assessment of whether a food satisfies the 

requirements of section 801(q) [21 U.S.C. § 381(q)]. See 21 U.S.C. § 384d(c)(2)(B)(i). In the case of the VQIP 

program, certification involves an assessment of whether a facility is eligible to be part of the program. See 21 

U.S.C. § 384d (c)(2)(B)(ii). 
Third-Party Programs to Assess Regulatory Compliance

11

an importer to participate, it will be required to contract with a third-party auditor.48 Similarly, it 

is likely that the import certification program will also require the participation of a third party, 

which in this case may be the government of the country from which the food originated.

49 

The structure of the third-party program contemplated by FSMA is shown in Figure 2. The 

law provides that the FDA will recognize accreditation bodies that will, in turn, accredit thirdparty auditors to audit and certify foreign food facilities or imports.

50 Under the law, an 

accreditation body is “an authority that performs accreditation of third-party auditors,” and a 

third-party auditor refers to a foreign government (or an agency thereof), a foreign cooperative, 

or any other third party as deemed appropriate by the FDA in its regulations.”51 Private thirdparty auditors can be single individuals, but are more likely to be companies that employ “audit 

agents.”52 FDA is required by law to establish the system for the recognition of accreditation 

bodies by January 4, 2013 (two years after the enactment of the law).

53 If the FDA has not 

recognized any accreditation bodies within two years of the establishment of such system, it may 

directly accredit third-party auditors.54

The law directs FDA to develop model standards for becoming an accredited third-party 

auditor and for preparing audit reports by July 4, 2012 (18 months after the enactment of the 

law).55 The statute itself contains several relevant requirements, including that the FDA should 

look to standards already in place (existing voluntary consensus standards, for example)56 and an 

audit report should be submitted within 45 days of conducting an audit.57 As of May 2012, FDA 

was in the process of drafting such regulations.58 

 48 The law provides that the FDA may provide the certification, 21 U.S.C. § 384d(c)(2)(C)(ii), but based on the 

experience of other federal third-party programs it seems likely that forthcoming regulations will generally require 

the use of an accredited third-party auditor.

49 21 U.S.C. § 381(q)(3). It should be noted that the law also allows the FDA to provide the certification, per 21 

U.S.C. § 384d (c)(2)(C)(ii), but it seems likely that forthcoming regulations will generally require the use of a third 

party.

50 21 U.S.C. § 384d(b)(1)(A)(i). 51 Id. § 384d(a)(3). 52 The law provides that a third-party auditor may be a single individual. 21 U.S.C. § 384d (a)(3).The law also states 

that third-party auditors may employ “audit agents,” defined as “an individual who is an employee or agent of an 

accredited third-party auditor and, although not individually accredited, is qualified to conduct food safety audits on 

behalf of an accredited third-party auditor.” 21 U.S.C. § 384d(a)(1). 53 21 U.S.C. § 384d(b)(1)(A)(i). 54 Id. § 384d(b)(1)(A)(ii). 55 Id. § 384d(b)(2). 56 Id. § 384d(b)(2). 57 Id. § 384d(c)(3)(A). 58 Interview (by phone), Charlotte Christen, U.S. Food and Drug Administration, May 16, 2012.
Third-Party Programs to Assess Regulatory Compliance

12

Figure 2: Structure of Third-Party Program for Imported Food Certifications 

It is also important to note that FSMA also requires the establishment of a system for the 

accreditation of laboratories to conduct food safety tests. 59 Figure 3 illustrates the third-party 

structure for laboratories. Accredited labs must be used to satisfy a variety of testing 

requirements, such as testing required by FDA to address an identified or suspected food safety 

problem and testing to support admission of an imported food.60 The law directs FDA to 

establish a program for the testing of food by accredited laboratories and a public registry of 

accreditation bodies and accredited laboratories by January 4, 2013.61 The law also states that 

the FDA shall develop model accreditation standards that include, for example, appropriate 

sampling methods, quality system requirements, and employee training requirements.62 

Importers may choose to seek certification from a third-party auditor in order to participate in 

the VQIP program, or they may be required to seek certification because FDA imposes an import 

certification requirement on the food they import. Under the statute, the audits for such 

certifications are termed “regulatory audits.”63 Importers and other regulated entities may also 

contract with an accredited third-party auditor to conduct a “consultative audit,” defined in the 

law to be for internal purposes only.64 

 59 21 U.S.C. § 350k. 60 Id. § 350k(b)(1). 61 Id. §350k(a)(1). 62 Id. § 350k(a)(6). 63 Id. § 384d (a)(7). 64 Id. § 384d (a)(5).

FDA

Accreditation Bodies

recognizes

that accredit

Third-Party Auditors

that audit and certify

Foreign Food Facilities or Imports

Requirements of the FDCA

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

13

Figure 3: Structure of Third-Party Program for Food Safety Testing 

Importers that import foods from facilities that have received certification from a third-party 

auditor may request to have that food become part of the VQIP.65 The law directs the FDA to 

consider a range of factors to make a determination on whether the food should receive 

expedited review and importation through the VQIP, including the safety risks of the food, the 

compliance history of the suppliers used by the importer, and the capability of the exporting 

country’s regulatory system.66 

With its import certification authority, the FDA may require that certain food imports be 

accompanied by a certification that they comply with the requirements of U.S. food safety law.

67 

To determine that a food import requires certification, the law instructs FDA to consider factors 

such as the safety risks of the food and its place of origin, and to make a scientifically-supported 

finding that the “food safety programs, systems, and standards in the country, territory, or region 

of origin of the food are inadequate to ensure that the article of food is as safe as a similar article 

of food that is manufactured, processed, packed, or held in the United States in accordance with 

the requirements of this Act.”68

Recognized accreditation bodies ensure that third-party auditors and their audit agents meet 

the accreditation standards.69 The law defines the types of entities that can become third-party 

auditors and sets forth certain requirements for their accreditation. In particular, the law states 

that foreign governments may be accredited based on a review of their food safety programs to 

 65 An importer “means the person that brings food, or causes food to be brought, from a foreign country into the 

customs territory of the United States.” 21 U.S.C. § 384b (g). Elsewhere the law defines an importer as “the US 

owner or consignee of the food article at the time of entry,” or if none, “the US agent of a foreign owner or 

consignee at the time of entry.” 21 U.S.C. § 384a.

66 21 U.S.C. § 384b(d). See also Silliker, supra note 41. 67 See generally 21 U.S.C. § 381(q). 68 21 U.S.C. § 381(q) (2). 69 Id. § 384d (b)(2).

FDA

Accreditation Bodies

recognizes

that accredit

Laboratories

that test whether

Food Products

Food Safety Standards

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

14

ensure that the foreign government is capable of determining that U.S. requirements are met.

70

Foreign cooperatives and other third parties may be accredited based on a review of internal 

systems and the training and qualifications of their audit agents to ensure conformity with the 

model standards to be issued by the FDA.71 

The law addresses the potential of conflicts of interest between accredited third-party 

auditors and the companies that contract with them to perform audits. It sets forth several 

specific provisions and also requires FDA promulgate regulations to further protect against 

conflicts of interest. The law directly provides that third-party auditors may not perform a 

regulatory audit of an entity for which it has performed a consultative audit or a regulatory audit 

in the previous 13 months.72 It also states that third-party auditors cannot be owned or operated 

by the same person as the entities they certify, must have procedures to protect against financial 

conflicts of interest, and must annually disclose to the FDA how they have complied with 

conflicts-of-interest rules and procedures.73 Similarly, audit agents cannot own or operate the 

entity they certify, must have procedures to protect against financial conflicts of interest, and 

must make an annual disclosure.74 

According to the statute, FDA’s conflict of interest regulations shall require that audits 

performed by accredited third-party auditors be unannounced and shall place limits on the extent 

to which there may be financial affiliations between auditors and audit agents and the entities 

they certify.75 The regulations must also establish timing, disclosure, fee payment and other 

rules that decrease the potential for conflicts of interest.76

The law contains several specific provisions regarding how the FDA should oversee 

accreditation bodies and accredited third-party auditors and what audit information must be made 

available to the agency and to the public. Accreditation bodies are required to provide a list of 

all third-party auditors they have accredited and their audit agents,

77 and the FDA is required to 

establish a public registry of all accreditation bodies and accredited third-party auditors.

78 FDA 

must reevaluate accreditation bodies at least once every four years79 and must revoke the

recognition of an accreditation body that is out of compliance with its rules.

80

Accredited third-party auditors are directly answerable to FDA in a variety of ways. The 

FDA may at any time require an accredited auditor to submit an onsite audit report from a 

regulatory audit and any related reports or documents.81 In contrast, the FDA may not directly 

require an auditor to submit the reports from a consultative audit, but can still access the results 

of such audits based on its general authority to inspect records when FDA has a reasonable belief 

 70 Id. § 384d (c)(1)(A). 71 Id. § 384d (c)(1)(B). 72 Id. § 384d (c)(4)(C)(i). 73 Id. § 384d(c)(5)(A). 74 Id. § 384d(c)(5)(B). 75 Id. § 384d(c)(5)(C)(i) and (iii). 76 Id. § 384d(c)(5)(C)(ii). 77 Id. § 384d(b)(1)(B). 78 Id. § 384d (g). 79 Id. § 384d (f)(1) 80 Id. § 384d(b)(1)(C). 81 Id. § 384d(c)(3)(B).
Third-Party Programs to Assess Regulatory Compliance

15

that an article of food “presents a threat of serious adverse health consequences or death to 

humans or animals.”82 Also, an accredited auditor must immediately notify the FDA if it 

“discovers a condition that could cause or contribute to a serious risk to the public health” during 

either a regulatory or a consultative audit.

83 

In addition, FDA is required to evaluate the performance of each accredited third-party 

auditor at least once every four years, which should include the review of its regulatory audit 

reports and the compliance history of its certified entities.

84 The FDA may also conduct its own 

onsite audit of any certified entity whether or not the certifying third-party auditor is present.85

The FDA may withdraw accreditation from an auditor if food from a facility it has certified is 

linked to a serious outbreak of foodborne illness, if FDA evaluates it and finds it to be out of 

compliance with accreditation requirements, if it refuses to allow the government to conduct 

necessary audits and investigations, or if FDA revokes the recognition of the accreditation bodies 

which accredited it.86 Also, false statements or representations made to an accredited third-party 

auditor by a regulated entity or to the FDA by an accredited third-party auditor are subject to 

criminal penalties.87

The law provides that FDA will establish a user-fee program to make operating the 

accredited third-party auditor program revenue neutral.88 With the user fees, accredited thirdparty auditors and audit agents are to reimburse the FDA for “the work performed to establish 

and administer the accreditation system.”89

2. CPSC, Children’s Product Safety Rule

Pursuant to the Consumer Product Safety Improvement Act of 2008 (CPSIA), the CPSC 

requires manufacturers and importers of children’s products to demonstrate that they meet 

mandatory product safety standards through third-party testing. 90 Testing must be conducted by 

a ‘‘Third Party Conformity Assessment Body” (TPCAB), defined by regulation as “a testing 

laboratory whose accreditation has been accepted by the CPSC to conduct certification testing on 

children’s products.”91 Based on the results of the third-party testing, the manufacturer or 

 82 21 U.S.C. § 384d(c)(3)(C) (referring to FDA’s authority to inspect records at 21 U.S.C. § 350c). 83 Id. § 384d(c)(4)(A); see also FDA, Imports, http://www.fda.gov/Food/FoodSafety/FSMA/ucm257980.htm (last 

visited Sept. 11, 2012) (answering in the affirmative the question, “I.4.2 Is the accredited auditor required to notify 

the FDA if a condition of concern is found during a consultative audit?”).

84 21 U.S.C. § 384d(f)(2). 85 Id. § 384d(f)(3). 86 Id. § 384d(c)(6)(A) and (B). 87 Id. § 384d(e). See also Charles F. Woodhouse, Imported Food Provisions of the Food Safety Modernization Act, 

2001, http://www.food-label-compliance.com/Sites/5/Downloads/White-Paper-FSMA-IMPORT-PROVISIONSWoodhouse-Nov-8-2011.pdf (last visited Sept. 11, 2012) (a white paper emphasizing the significance of specific 

inclusion of provisions relating to False Statements). 88 21 U.S.C. § 384d(c)(8).

89 Id.

90 Pub. L. No. 110-314, 122 Stat. 3016 (2008); 15 U.S.C. § 2063(a)(2). The law defines a “children’s product” as a 

consumer product designed or intended primarily for children 12 years of age or younger. 15 U.S.C. § 2052(a)(2).

91 Testing and Labeling Pertaining to Product Certification, 76 Fed. Reg. 69482 (Nov. 8, 2011) (codified at 16 

C.F.R. Part 1107); see also 15 U.S.C. § 2063(f)(2)(A) (defining a “third party conformity assessment body” to mean 

a conformity assessment body that is not owned, managed, or controlled by the manufacturer or private labeler of a 

product assessed by the laboratory, unless such a laboratory has satisfied certain statutory criteria.”) It is worth 
Third-Party Programs to Assess Regulatory Compliance

16

importer submits a Children’s Product Certificate indicating compliance.

92 Under the law, thirdparty testing is mandatory; manufacturers cannot opt-out of the third-party testing system and 

rely instead on CPSC to assess compliance. The structure of this third-party program is shown in 

Figure 4. 

Different rules and standards apply depending on the product. For example, the CPSC has 

promulgated safety rules with standards for products such as bicycle helmets,

93 bunk beds,94

infant bath seats,

95 and electrically operated toys or articles.96 CPSC product safety rules 

containing standards for flammability,

97 small parts,98 and lead content99 may also apply. In 

addition, CPSC has mandated compliance with a variety of toy safety standards established by 

the ASTM regarding, for example, toy chests, stuffing materials, and sound producing toys.100 

Figure 4: Structure of Third-Party Program for Children’s Product Testing

The CPSIA established a schedule for implementing third-party testing and included a 

timeline for the accreditation of third party conformity assessment bodies.101 The law specifies 

that third-party testing requirements apply to any children’s product manufactured more than 90 

days after the CPSC has published requirements for accreditation of third-party testing 

 

noting that while the statute uses the term certification, the third-party program that it requires is a third-party testing 

program rather than a certification program under the definitions of international standards. 

92 15 U.S.C. § 2063(a)(2). See also Certificates of Compliance, 73 Fed. Reg. 68328 (Nov. 18, 2008); 16 C.F.R. Part 

1110, Certificates of Compliance. 

93 16 C.F.R. pt. 1203, Bicycle Helmets (effective date Feb. 10, 2010).

94 Id. pt. 1513, Bunk Beds (effective date Feb. 10, 2010).

95 Id. pt. 1216, Infant Walkers (effective date Dec. 21, 2010). 96 Id. pt. 1505, Electrically Operated Toys or Articles (effective date Jul. 29, 2010). 97 Id. pts. 1610, 1611, 1615, 1616, 1630, 1631, 1632, and 1633.

98 Id. pt. 1501. 99 Test Method CPSC-CH-E1001-08 and/or CPSC-CH-E1001-08.1 100 ASTM F963 Standard Consumer Safety Specifications for Toy Safety, http://www.cpsc.gov/cgibin/labsearch/Default.aspx (last visited Sept. 11, 2012) (list of rules that require third-party testing and certification). 101 15 U.S.C. § 2063(a)(3).

CPSC

Accreditation Bodies

accredit

Third Party Conformity Assessment Bodies (laboratories)

that test whether

Children’s Products

CPSC safety rules and/or ASTM standards

are in conformity with

Accepts the accreditation of
Third-Party Programs to Assess Regulatory Compliance

17

laboratories to assess conformity with a children’s product safety rule.102 For example, the CPSC 

published such a notice of requirements for the lead paint rule on September 22, 2008 and the 

third-party testing requirement for lead paint became effective December 22, 2008 for products 

manufactured on or after that date.103 In total, CPSC published 19 notices of requirements 

between August 14, 2008 and August 14, 2011.104 However, there have been delays and stays of 

enforcement that have led to departures from the statutory schedule. For example, the CPSC 

stayed the enforcement of testing and certification requirements that would have gone into effect 

on February 10, 2009 for new total lead content limits, phthalates limits for certain products, and 

mandatory toy standards, among other things.105 As of January 1, 2012, almost all stays had 

been lifted, and third-party certification and testing was required for nearly all the children’s 

product safety rules.106

Rulemaking for the CPSC third-party program has also progressed. On November 8, 2011, 

the CPSC issued a final rule establishing protocols and standards for certification and testing of 

children’s products and also detailing requirements for the labeling of certified products.107 The 

final rule applies to products manufactured after February 8, 2013.108 On May 24, 2012, the 

CPSC published its final rule, “Audit Requirements for Third Party Conformity Assessment 

Bodies.” Also on May 24, 2012, the CPSC published a proposed rule, “Requirements Pertaining 

to Third Party Conformity Assessment Bodies.”109 The proposed rule, if finalized, would 

establish the requirements related to CPSC acceptance of the accreditation of laboratories for 

purposes of testing children’s products.110 The proposed requirements are largely the same as 

the requirements that the CPSC has set forth in the various notices of requirements that it has 

published since August 2008.

Nearly all children’s products are required to undergo third-party testing.111 In 2011, 

Congress enacted amendments to the CPSIA that, among other things, provided an exemption 

from third-party testing for “small batch manufacturers.”112 Small batch manufacturers are those 

that produced fewer than 7500 units and collected less than $1 million in consumer products 

 102 15 U.S.C. § 2063(a)(3)(A) (stating that the third-party testing requirement does not commence “more than 90 

days” after the Commission publishes a notice of requirements pertaining to the regulation or standard to which the 

children’s product is subject.). 103 In brief at http://www.cpsc.gov/library/foia/foia10/brief/102testing.pdf . 104 In brief at http://www.cpsc.gov/library/foia/foia12/brief/tprequirements.pdf at 6. 105 Press release at http://www.cpsc.gov/cpscpub/prerel/prhtml09/09115.html; see Notice of Stay of Enforcement of 

Testing and Certification Requirements, 74 Fed. Reg. 6396 (staying the enforcement of certain provisions of section 

14(a) of the CPSA); 74 Fed. Reg. 68588 (Dec. 28, 2009) (revising the terms of stay of enforcement); Consumer 

Product Safety Act: Notice of Commission Action on the Stay of Enforcement of Testing and Certification 

Requirements, 76 Fed. Reg. 6765 (Feb. 8, 2011) (continuing the stay of enforcement for testing and certification of 

children’s products for which a notice of requirements for accreditation of laboratories had not yet been published).

106 CPSC, FAQs: Certification and Third Party Testing, http://www.cpsc.gov/info/toysafety/3ptfaq.html#foot1 (last 

visited Sept. 11, 2012).

107 Testing and Labeling Pertaining to Product Certification, 76 Fed. Reg. 69482 (Nov. 8, 2011) (codified at 16 

C.F.R. pt. 1107). 108 Id. at 69482.

109 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31087-88 (May 24, 

2012), available at http://www.gpo.gov/fdsys/pkg/FR-2012-05-24/pdf/2012-10923.pdf. 110 Id. 111 Id. 112 Pub. L. No. 112-28, § 2(a)(4), 125 Stat. 273 (2011) (codified at 15 U.S.C. 2063(d)).
Third-Party Programs to Assess Regulatory Compliance

18

revenues in the previous year. According to CPSC, small batch manufacturers are still required 

to third-party test for compliance with some children’s product safety rules but not others.113 An 

exemption was also provided for ordinary books for children aged 4 to 12.114 

There are three types of third-party testing: (1) initial certification testing (2) material change 

testing; and (3) periodic testing.115 Initially, each children’s product must be third-party tested 

by a CPSC-accepted laboratory for compliance with all applicable children’s product safety 

rules. Material change testing by a third-party CPSC-accepted laboratory is required if a material 

change is subsequently made to any component part of that children’s product. Periodic testing 

applies to continuing production of a children’s product. If a children’s product initially is 

certified, and then additional production continues, periodic testing is required for all the 

applicable children’s product safety rules, even if there are no material changes. The 

requirements to test children’s product when there is a material change and to undertake periodic 

testing become effective on February 8, 2013.116

The law provides that accreditation of TPCABs may be conducted either by the CPSC or by 

a designated accreditation body.

117 Three types of TPCABs are contemplated by the law: (1) 

those that are not owned, managed, or controlled by a manufacturer or private labeler of a 

children’s product to be tested for certification purposes (“independent” laboratories); (2) those 

that are owned, managed, or controlled by a manufacturer or private labeler of the children’s 

product (“firewalled conformity assessment bodies”)

118; and (3) those owned or controlled, in 

whole or in part, by a government (“governmental laboratories”).119

For a TPCAB to be accepted to test children’s products for conformity with children’s 

product safety rules, it must be accredited by an accreditation body that is a signatory to the 

ILAC MRA.

120 To be an ILAC-MRA signatory, an accreditation body must, inter alia, operate 

in accordance with ISO/ IEC 17011.

121 To make an accreditation determination, the 

accreditation body assesses the laboratory’s conformity with ISO/IEC 17025. As described by 

CPSC, ISO/IEC 17025 includes technical requirements relating to the competence of laboratory 

staff, suitability and maintenance of test equipment, and quality assurance of test data.122 It also 

includes management requirements relating to organization, management systems, document 

 113 CPSC, Small Batch Manufacturers and Third Party Testing, http://www.cpsc.gov/info/toysafety/smallbatch.html

(last visited Sept. 11, 2012).

114 15 U.S.C. § 2063(i)(5)(A)(i). 115 CPSC, FAQs: Certification and Third Party Testing, http://www.cpsc.gov/info/toysafety/3ptfaq.html#foot1 (last 

visited Sept. 11, 2012).

116 Id. 117 15 U.S.C. § 2063(a)(3)(C). 118 See infra notes 130 - 132 and accompanying text.

119 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31087-88 (May 24, 

2012); see also 15 U.S.C. § 2063(f)(2). 120 Third Party Conformity Assessment Body Accreditation Requirements for Testing Compliance with 16 C.F.R. 

pt. 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22, 2008), available in unpublished form at 

http://www.cpsc.gov/library/foia/foia09/brief/smallparts.pdf; see also Requirements Pertaining to Third Party 

Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31088 (May 24, 2012). 121 ILAC, ILAC MRA and Signatories, http://www.ilac.org/ilacarrangement.html (last visited Sept. 11, 2012). 122 Id.
Third-Party Programs to Assess Regulatory Compliance

19

controls, audits, and management reviews. 123 

Laboratories are accredited with a defined “scope of accreditation,” which indicates the 

children’s product safety rules and/or test methods for which it is accredited to test.

124 As 

required by the CPSIA, the commission maintains an online listing of accredited TCPABs and 

their scopes of accreditation.

125 The current list includes hundreds of laboratories in about 35 

countries.126 For example, the U.S.-based laboratory NSF International is accredited by 

International Accreditation Services Inc. (IAS) and its scope of accreditation includes about 45 

different product safety rules and ASTM standards.

127 

Several measures exist to address conflicts of interest that might raise doubt about the 

impartiality of product certifications. As part of being accredited to ISO/IEC 17025, laboratories 

must “have policies and procedures to avoid involvement in any activities that would diminish 

confidence in its competence, impartiality, judgment, or operational integrity.”128 A laboratory 

must “demonstrate that it is impartial and that its personnel are free from any undue commercial, 

financial, and other pressures that might influence their technical judgment.” CPSC has also 

stated in its Notices of Requirements that accredited laboratories are subject to either an on-site 

surveillance or a full reassessment every two years to ensure that they maintain their standards of 

independence and technical expertise.129

In addition to the baseline accreditation requirements, firewalled laboratories and 

governmental laboratories seeking CPSC approval must meet additional requirements that relate 

to their impartiality and independence. The CPSIA specifies that the CPSC may approve a 

firewalled laboratory if the laboratory has established procedures to ensure that

(I) its test results are protected from undue influence by the manufacturer, private labeler 

or other interested party;

(II) the Commission is notified immediately of any attempt by the manufacturer, private 

labeler or other interested party to hide or exert undue influence over test results; and

(III) allegations of undue influence may be reported confidentially to the Commission.130

In CPSC’s published Notices of Requirements, the CPSC has required that firewalled labs 

seeking approval submit copies, in English, of their training documents showing how employees 

are trained to notify the CPSC immediately and confidentially of any attempt by the 

 123 Id. 124 See CPSC, CPSC Form 223 - Lab Accreditation, http://www.cpsc.gov/cgibin/labregentry/ (last visited Sept. 11, 

2012).

125 15 U.S.C. § 2063(a)(3)(E) (requiring that the Commission maintain on its website an up-to-date list of entities 

that have been accredited to assess conformity with children’s product safety rules.) 

126 CPSC, List of CPSC-Accepted Testing Laboratories, http://www.cpsc.gov/cgi-bin/labsearch/ (last visited Sept. 

11, 2012).

127 Id. (detailed information displayed by highlighting the laboratory name and clicking “submit”). 128 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31093 (May 24, 

2012).

129 See, e.g., Third Party Conformity Assessment Body Accreditation Requirements for Testing Compliance with 16 

C.F.R. Part 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22, 2008), available in unpublished form at 

http://www.cpsc.gov/library/foia/foia09/brief/smallparts.pdf

130 15 U.S.C. § 2063(f)(2)(D)(ii).
Third-Party Programs to Assess Regulatory Compliance

20

manufacturer, private labeler, or other interested party to hide or exert undue influence over the 

TCPAB’s test results.131 This additional requirement applies to any laboratory in which a 

manufacturer or private labeler of a children’s product to be tested by it owns an interest of ten 

percent or more.132 

Similarly, the CPSIA contains five criteria that a governmental laboratory must satisfy for its 

accreditation to be accepted by the CPSC.133 The CPSC must determine that to the extent 

practicable, manufacturers located in any nation are permitted to choose a laboratory that is not 

owned or controlled by the government of that nation; that the testing results are not subject to 

undue influence by any other person; that the governmental laboratory and its testing results do 

not receive more favorable treatment than other accredited laboratories in the same nation; and 

that the governmental laboratory does not exercise undue influence on the decisions of other 

governmental authorities that make decisions affecting its operation or controlling distribution of 

products.134 The CPSC’s proposed rule requires governmental labs seeking CPSC acceptance to 

submit a variety of relevant information to assist it in making these determinations.135 

The CPSIA requires the CPSC to establish “requirements for the periodic audit of third party 

conformity assessment bodies as a condition for the continuing accreditation of such conformity 

assessment bodies.”136 CPSC’s final rule, “Audit Requirements for Third Party Conformity 

Assessment Bodies,” implements this provision.137 It provides that the periodic audit of 

TCPABs consists of two parts.138 The first part is a reassessment by the same accreditation body 

that it received its initial accreditation from to determine whether it continues to meet 

accreditation criteria. The second part is the resubmission to the CPSC of the CPSC’s 

“Consumer Product Conformity Assessment Body Acceptance Registration Form” and its review 

by the CPSC. The rule does not specify the frequency of the periodic audit but rather says that it 

must occur at a minimum “at the frequency established by its accreditation body.”139 CPSC 

observes that according to ISO/IEC 17011 a full reassessment must occur at least every two 

years, unless an accreditation body undertakes less comprehensive surveillance visits every six 

months.140 In this case, the time between reassessments must be no more than 5 years.141 

 131 Third Party Conformity Assessment Body Accreditation Requirements for Testing Compliance with 16 C.F.R. 

Part 1501 (Small Parts Regulations), 73 Fed. Reg. 54564 (Sept. 22, 2008), available in unpublished form at 

http://www.cpsc.gov/library/foia/foia09/brief/smallparts.pdf ; see also Requirements Pertaining to Third Party 

Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31088, 31133 (May 24, 2012) (stating that the requirement is 

that the laboratory “train employees that they may notify the CPSC immediately, and that a report to the CPSC may 

be confidential.”)

132 Id. 133 15 U.S.C. § 2063(f)(2)(B); summarized in Requirements Pertaining to Third Party Conformity Assessment 

Bodies, 77 Fed. Reg. 31086, 31088, 31133 (May 24, 2012). 134 Id. 135 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086, 31133-34 (May 24, 

2012).

136 15 U.S.C. § 2063(i)(1) (before amendments in H.R. 2715, this provision was located instead at 15 U.S.C. 

§ 2063(d)(1)). 137 Audit Requirements for Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31074 (May 24, 2012). 138 Id. at 31083.

139 Id. at 31085. 140 Id. at 31083. 141 Id.
Third-Party Programs to Assess Regulatory Compliance

21

The law provides that the CPSC may withdraw its acceptance of a TPCAB if it finds that 

“(A) a manufacturer, private labeler, or governmental entity has exerted undue influence on such 

conformity assessment body or otherwise interfered with or compromised the integrity of the 

testing process with respect to the certification of a children’s product under this section; or (B) 

such conformity assessment body failed to comply with an applicable protocol, standard, or 

requirement established by the Commission....”142 The law also provides that the CPSC may 

suspend a laboratory’s accreditation if it fails to cooperate with the CPSC in an investigation 

regarding its certification activities.143 In May 2012, CPSC published a proposed rule, 

“Requirements Pertaining to Third Party Conformity Assessment Bodies,” which would 

implement these provisions.144 The rule would establish whether, when and how the CPSC may 

deny a TCPAB’s application; suspend accreditation; and withdraw accreditation.145 It would 

also establish how a person may submit to the CPSC information alleging a ground for denial, 

suspension, or withdrawal.146

The CPSC’s third-party program has been funded with appropriated funds. The statute 

contains no provisions regarding the assessment of user fees to cover the costs of program 

development and implementation.

3. FDA, Medical Device Inspections

In fulfillment of statutory requirements, the FDA has developed two programs through which 

regulated entities can opt to have third parties perform compliance assessment tasks related to 

medical devices that the regulatory agency would otherwise perform. Through the first program, 

manufacturers of certain medical devices may have third parties review their 510(k) premarket 

notifications. Through the second program, third parties may conduct inspections of facilities 

that manufacture certain medical devices. In both, third-party organizations recognized by FDA

evaluate a manufacturer’s compliance with mandatory standards in the Federal Food, Drug, and 

Cosmetic Act (FDCA). 147

Premarket Notification 510(k) Third Party Review Program

The FDA Modernization Act of 1997 (FDAMA) directed the FDA to accredit third parties 

(referred to as either Accredited Persons or Recognized Third Parties) in the private sector to 

conduct the 510(k) pre-market review for low risk (Class I) and certain moderate risk (Class II) 

devices.148 Pursuant to this authorization, the FDA established accreditation criteria (including 

 142 15 U.S.C. § 2063(e)(1). See also 15 U.S.C. § 2063(e)(2) (setting forth procedures for accreditation withdrawals). 143 15 U.S.C. § 2063(e)(3). 144 Requirements Pertaining to Third Party Conformity Assessment Bodies, 77 Fed. Reg. 31086 (May 24, 2012). 145 Id. at 31119. 146 Id. 147 As used in the program, the term “Persons” refers to organizations. See GAO, Report to Congressional 

Committees, Medical Devices: Status of FDA’s Program for Inspections by Accredited Organizations 3 (January 

2007) [hereinafter “Status of FDA’s Program”]. 148 See generally FDA, Guidance for Third Parties and FDA Staff; Third Party Review of Premarket Notifications, 

(Sept. 28, 2004), http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/

GuidanceDocuments/ucm082191.htm; FDA, Implementation of Third Party Programs under the FDA 

Modernization Act of 1997; Final Guidance for Staff, Industry and Third Parties (February 2, 2001), 

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/
Third-Party Programs to Assess Regulatory Compliance

22

criteria to prevent conflicts of interest) and conducted accreditations,149 published a list of 

Accredited Persons,

150 and conducted a training program for Accredited Persons.151 By creating 

this option for device manufacturers, Congress intended “to enable FDA to use its scientific 

review resources for higher-risk devices, while maintaining a high degree of confidence in the 

review of low-to-moderate risk devices by Accredited Persons, and to provide manufacturers of 

eligible devices an alternative review process that may yield more rapid 510(k) decisions.”152 

Post-Market Inspections by Accredited Persons Program

The rest of this section provides an in depth discussion of the post-market Inspections by APs

Program, in part because it involves facility inspections in addition to document review, and in 

part because information was more readily about this program. The overall structure of the thirdparty program for medical device facility inspections is shown in Figure 5. 

The Medical Device User Fee and Modernization Act of 2002 (MDUFMA) authorized FDA 

to establish the “Inspection by Accredited Persons” program (AP Program).153 Under the AP 

Program, certain manufacturers of Class II (medium-risk) and Class III (high-risk) medical 

devices may voluntarily contract with an AP to conduct a “Third-Party Inspection” of their 

facility. FDA considers an inspection by an AP to be “an alternative to the traditional inspection 

by an FDA official.”154 With the AP Program, accredited third parties may conduct these 

inspections “in lieu” of the FDA.155 In requiring its establishment, Congress sought to address 

the FDA’s inability to meet its inspection burden.156 The program also purported to offer an 

advantage to manufacturers that produce for both the US market and foreign markets by 

providing the opportunity to undergo a single inspection process that satisfies multiple 

jurisdictions.157

 

ucm094459.pdf (noting that FDA’s policy permitted third party review of class II devices only if device-specific 

guidance or recognized consensus standards existed) [hereinafter Implementation of Third Party Programs]; see also

21 U.S.C. §360m (containing the statutory requirement).

149 Medical Devices; Implementation of Third Party Review Under the Food and Drug Administration 

Modernization Act of 1997; Emergency Processing Request Under OMB Review, 63 Fed. Reg. 28388 (May 22, 

1998) (publishing these criteria); Implementation of Third Party Programs Under the FDA Modernization Act of 

1997 - Final Guidance for Staff, Industry and Third Parties (Feb. 2, 2001),

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm094450.htm (last 

visited Sept. 9, 2012).

150 Current List of Accredited Persons for 510(k) Review under the FDA Modernization Act of 1997 (updated Sept. 

5, 2012), http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfthirdparty/accredit.cfm (last visited Sept. 9, 2012). 151 Implementation of Third Party Programs, supra note 148. 152 Id. 153 Medical Device User Fee and Modernization Act of 2002, Pub. L. No. 107–250, § 201, 116 Stat. 1588 (2002)

(codified at 21 U.S.C. § 374 (g)) (amended section 704 of the Federal Food, Drug, and Cosmetic Act by adding 

subsection (g)). 154 See FDA, Medical Devices, Accredited Persons Inspection Program, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 11, 2012). 155 Id. 156 Medical Devices - Challenges for FDA in Conducting Manufacturer Inspections: Hearing Before the Subcomm.

on Oversight and Investigations of the H. Comm. on Energy and Commerce, 110th Cong. (Jan. 29, 2008) (statement 

of Marcia Crosse, Director, Health Care, United States General Accountability Office) (citing H.R. Rep. No. 107-

728, pt. 1, at 35-36 (2002)) [hereinafter “Challenges for FDA”]. 157 Id.
Third-Party Programs to Assess Regulatory Compliance

23

The mandatory standard that applies in such inspections is the Quality System (QS) 

regulation and other device requirements in the FDCA and its regulations.158 The QS regulation 

requires that domestic and foreign manufacturers establish a quality system that implements 

current good manufacturing practices relevant to the “design, manufacture, packaging, labeling, 

storage, installation, and servicing of finished medical devices intended for human use” in the 

United States.159 In a QS inspection, FDA inspectors examine manufacturing controls, 

processes, and records.160 When a manufacturer participates in the AP program, the AP prepares 

and submits its reports to FDA, which remains responsible for making a final compliance 

assessment.161 

FDA has also implemented the MDUFMA’s third-party inspection provisions through its 

Pilot Multi-purpose Audit Program (PMAP).162 PMAP was established in 2006 in partnership 

with FDA’s Canadian counterpart Health Canada, which also had a third-party certification and 

inspection program for medical devices.163 PMAP aimed to include 10 inspections in which 

manufacturers would hire a single accredited third party to conduct an audit that would serve the 

regulatory purposes of both FDA and Health Canada. 164 In total, eleven such inspections were 

conducted, and the agencies produced a final joint report to summarize lessons learned.165

Importantly, the AP by Inspections program is completely voluntary. Eligible manufacturers 

may choose to utilize an AP to conduct an inspection or they may continue to have FDA perform 

inspections.166 If a manufacturer is inspected by an AP, FDA removes the manufacturer from its 

routine inspection work plan for two years.167 In effect, the manufacturer receives a two-year 

 158 21 C.F.R. pt. 820 (2007).

159 Id. § 820.1(a)(1). 160 Status of FDA’s Program, supra note 147, at 1. 161 See FDA, Medical Devices, Accredited Persons Inspection Program, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 11, 2012). See also 21 U.S.C. § 374(g)(7)(A) (stating that APs shall prepare an 

inspection report and that “any official classification of the inspection shall be determined by the Secretary.”) 162 FDA, Pilot Multi-Purpose Audit Program (PMAP) - Questions and Answers Related to the Pilot, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125453.htm (last visited Sept. 11, 2012) [hereinafter PMAP Q&A]; see also Challenges for FDA, supra note 

156, at 9, 19-21. 163 Pilot Multi-Purpose Audit Program, supra note 162 (stating that Health Canada’s CMDCAS was established 

several years before FDA established the AP Program). 164 On international cooperation in regulation, see Administrative Conference of the United States, Recommendation 

2011-6, International Regulatory Cooperation (Dec. 8, 2011), available at http://www.acus.gov/acusrecommendations/international-regulatorycooperation/. 165 FDA, Medical Devices, Final Joint Report of the Pilot Multipurpose Audit Program (PMAP), 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm232806.htm (also available in PDF format at http://www.hc-sc.gc.ca/dhp-mps/alt_formats/pdf/mdim/activit/int/md_pmap_rep_im_ppafm_rap-eng.pdf ) [hereinafter PMAP report]; Interview (by phone), Kim 

Trautman, Associate Director, International Affairs, Office of the Center Director, Center for Devices and 

Radiological Health, U.S. Food and Drug Administration, Jun. 5, 2012 (reporting that eleven PMAP inspections 

were conducted). 

166 See FDA, Medical Devices, Accredited Persons Inspection Program, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 9, 2012). 167 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.
Third-Party Programs to Assess Regulatory Compliance

24

“inspection holiday” from regular FDA inspections unless FDA receives a complaint or has other 

cause to inspect. 

Figure 5: Structure of Third-Party Program for Medical Device Facilities

Only certain manufacturers are eligible to participate in the program. The manufacturer must 

manufacture a Class II or Class III device.168 Further, it must market at least one of these 

medical devices in the United States and also market or plan to market at least one of these 

medical devices in a foreign country that certifies, accredits, or otherwise recognizes the chosen 

AP as having the authority to conduct device inspections.169 Also, the program was “limited to 

establishments whose most recent inspection was classified by FDA as either ‘No Action 

Indicated’ or ‘Voluntary Action Indicated.’”170 The Food and Drug Administration 

Amendments Act (FDAAA) of 2007 streamlined the Accredited Person for Inspection Program 

by eliminating the requirement that a device establishment must seek prior FDA approval for a 

Third-Party Inspection and by eliminating the limit of two consecutive Third-Party Inspections 

unless FDA granted a waiver.171 After the amendments, eligible manufacturers may simply 

submit notification of their intent to use the program.172

 168 FDA, Guidance for Industry, FDA Staff, and FDA-Accredited Third Parties - Manufacturer's Notification of the 

Intent to Use an Accredited Person under the Accredited Persons Inspection Program Authorized by Section 228 of 

the Food and Drug Administration Amendments Act of 2007 (FDAAA), 4 (Mar. 2, 2009), 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm085187.htm , 169 Id. (stating “At least one foreign country where you market or intend to market your class II or class III device 

must certify, accredit, or otherwise recognize the AP you have chosen as a person authorized to conduct device 

inspections.” Id. at 6). See also 21 U.S.C. § 374(g)(6)(A)(ii)(IV)(bb). 170 21 U.S.C. § 347(g)(6)(A)(i). See also Status of FDA’s Program, supra note 147, at 6 (stating “Based upon its 

findings during inspection, FDA classifies completed inspections into one of three categories based on the extent to 

which the establishment deviates from applicable requirements of the quality system regulation: No action indicated 

(which indicates no deviations or only minor deviations), voluntary action indicated (which indicates minor to 

significant deviations), or official action indicated (which indicates significant deviations and warnings).”); FDA, 

Guidance for Industry, FDA Staff, and Third Parties - Inspection by Accredited Persons Under The Medical Device 

User Fee and Modernization Act of 2002 and the FDA Amendments Act of 2007; Accreditation Criteria (Aug. 6, 

2009), http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm089702.htm 

(last visited Sept. 9, 2012) [hereinafter “Guidance for Industry”]. 171 Guidance for Industry, supra note 170, at 4. 172 Agency Information Collection Activities; Proposed Collection; Comment Request; Manufacturer’s Notification 

of the Intent To Use an Accredited Person Under the Accredited Persons Inspection Program Authorized by Section 

FDA (Third Party Recognition Board)

Accredited Persons (APs)

accredits

that inspect

Medical Device Facilities

to assess conformity with

Quality System (QS) regulation and other requirements
Third-Party Programs to Assess Regulatory Compliance

25

Unlike the two programs reviewed above, FDA does not utilize independent accreditation 

bodies in this program. Rather, accreditation determinations are made by FDA’s Third Party 

Recognition Board (TPRB), which was established in 1998 to make accreditation determinations 

for the 510(k) pre-market review program.173 MDUFMA required FDA to establish criteria for 

the accreditation of Accredited Persons and to conduct further activities to approve their 

employees to conduct inspections.174 Under the law, an applicant for accreditation must not be a 

federal government employee and must be a legally-constituted independent entity with no 

organizational, material or financial affiliation with a manufacturer, supplier or vendor of articles 

regulated under the act.175 

According to FDA guidance, the applicant must agree to operate in accordance with 

generally accepted professional and ethical business practices and agree in writing to, inter alia, 

limiting its work to that for which competence and capacity are available; promptly responding 

and attempting to resolve complaints regarding accredited activities; and protecting against 

officer and employee financial conflicts of interest.176 FDA also requires that APs have 

sufficiently trained personnel, including at least one individual with supervisory capability and 

authority, and the necessary infrastructure to interface with FDA’s electronic data systems and to 

protect confidential information.177

After an organization is approved as an AP, its employees must complete classroom training 

conducted by the Association for the Advancement of Medical Instrumentation (AAMI) and the 

FDA.178 Upon successfully completing the classroom training, AP employees must then 

successfully complete three joint inspections with FDA including a collaborative inspection (in 

which the trainee acts primarily as an observer of the FDA inspector); a modified performance 

inspection (in which the trainee conducts the inspection with the assistance of an FDA 

inspector); and a full performance inspection (in which the trainee independently performs an 

 

228 of the Food and Drug Administration 76 Fed. Reg. 29764 (May 23, 2011); see also Guidance for Industry, 

supra note 170, at 4 (noting the specific information that the notice must include). 173 Guidance for Industry, supra note 170, at 5. The Third Party Recognition Board is situated within the FDA’s 

Center for Devices and Radiological Health and chaired by William Sutton. Id. at 22. On how the TPRB interacts 

with applicants and reviews applications, see Implementation of the Inspection by Accredited Persons Program 

Under the Medical Device User Fee and Modernization Act of 2002; Accreditation Criteria: Guidance for Industry, 

FDA Staff, and Third Parties; Availability, 68 Fed. Reg. 22400, 22402-03 (Apr. 28, 2003). On the 510(k) program 

generally, see supra notes 148 - 151 and accompanying text. 174 21 U.S.C. § 374(g)(2). These criteria were published at 68 Fed. Reg. 22400 (Apr. 28, 2003). On October 4, 

2004, FDA published revised accreditation criteria at 69 Fed. Reg. 59250 to incorporate changes to MDUFMA 

made by the Medical Devices Technical Corrections Act (MDTCA), Pub. L. No. 108-214, signed into law on April 

1, 2004. 

175 21 U.S.C. § 374(g)(3); see also Guidance for Industry, supra note 170. 176 Guidance for Industry, supra note 170, at 6-8. 177 Id.; see also 21 U.S.C. § 374(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third 

Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and 

Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250 (Oct. 4, 2004) (providing that 

the qualifications for APs’ personnel will be equivalent to that of FDA personnel); see also 21 U.S.C. 

§ 374(g)(3)(E)(iii) (providing that an AP must protect from public disclosure trade secret, confidential commercial 

or financial information, and private personal identifier information in records, except that such information may be 

made available to FDA). 178 Guidance for Industry, supra note170, at 9-10.
Third-Party Programs to Assess Regulatory Compliance

26

inspection that is observed and evaluated by an FDA inspector).179 

FDA instructs APs to prepare an inspection report to be submitted to both the manufacturer 

and the FDA using the format defined in its Investigations Operations Manual (IOM).

180 The 

report must describe in detail each significant non-conformity found and identify any other 

matters that relate or that may influence compliance with the Act.181 The report must also 

describe any recommendations made by the AP to the manufacturer during the inspection or at 

the closing meeting and describe any promised corrective actions or other discussions with the 

manufacturer at the conclusion of the inspection.182 APs are required to maintain certain records 

regarding their initial and continuing qualifications to be APs and regarding each inspection.183

The law requires also an AP that discovers a condition that it believes could cause or contribute 

to an unreasonable risk to public health to report the problem to FDA immediately.184 

Since 2003, the FDA has accredited 16 organizations as APs and conducted classroom 

training for the AP auditors.185 FDA maintains a list of Accredited Persons with contact 

information online.186 For example, US-based organizations that have been recognized as APs 

include: Intertek Testing Services; Lloyd’s Register Quality Assurance, Inc.; TUV Rheinland of 

North America, Inc.; and Underwriters Laboratories, Inc. (UL).

187 Some of the recognized firms

based outside the U.S. include AMTAC Certification Services Limited, in the United Kingdom; 

Center for Measurement Standards/Industrial Technology Research Institute (CMS/ITRI), in 

China; and Quality Management Institute (QMI), in Canada.188 The list sets forth the types of 

device manufacturing facilities that each AP is recognized to inspect (often “all medical 

devices”) and the foreign countries that certify, accredit, or otherwise recognize the AP as having 

the authority to conduct device inspections.

189

MDUFMA and its regulations require that APs and their employees (including contract 

employees) be free from conflicts of interest and the appearance of conflicts of interest that could 

 179 Id. See also 21 U.S.C. § 347(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third 

Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and 

Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59291 (providing that APs are 

not eligible to conduct independent inspections until they successfully complete FDA’s training program and 

perform a satisfactory inspection under FDA’s observation). 180 See FDA, Inspections, Compliance, Enforcement, and Criminal Investigations, Investigations Operation Manual, 

http://www.fda.gov/ora/inspect_ref/iom/ (last updated March 2, 2012); see also 21 U.S.C. § 374(g)(7)(A) (stating 

that APs are required to prepare inspection reports in the form and manner designated by FDA). 

181 Guidance for Industry, supra note 170, at 12-13. 182 Id. 183 Id. at 13-14. 184 21 U.S.C. § 374(g)(7)(E). 185 Guidance for Industry, supra note 170, at 3-4 (noting that the law required that no more than 15 firms be 

accredited during the first year of the AP Program).

186 See FDA, Medical Devices, Accredited Persons Inspection Program, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequirements/ThirdPartyInspection/

ucm125410.htm (last visited Sept. 9, 2012). 187 Id. 188 Id.

189 Id.
Third-Party Programs to Assess Regulatory Compliance

27

affect the inspection process or the preparation of reports.190 APs may not be owned, operated or 

controlled by a manufacturer, supplier or vendor of any article regulated under the Act, and no 

personnel of an AP involved in inspections, nor their spouses or minor children, may have 

ownership of or other financial interest in any product, manufacturer, supplier or vendor 

regulated under the Act.191 Potential conflicts of interest are also present if the AP or any of its 

inspection personnel provides consultative services to any manufacturer, supplier, or vendor of 

products regulated under the Act; if inspection personnel participate in an inspection of a firm 

they were employed by within the last 12 months; or if the fees charged or accepted are 

contingent or based upon the observations in the report made by the AP.192

When applying to become APs, organizations are required to submit a copy of the written 

policies, procedures and sample certification/compliance statements established to prevent 

conflicts of interest. FDA uses a rating criteria checklist to evaluate whether APs have 

established, documented, and executed policies and procedures to prevent individual and 

organizational conflicts of interest.193 FDA states that APs should either adopt the conflict of

interest standards that apply to federal agency employees,

194 use the Model Conflict of Interest 

Policy that it provides in guidance,

195 or “explain alternative equivalent procedures” to safeguard 

against conflicts of interest. 

FDA is also required by statute to monitor manufacturers’ requests to use a particular AP, 

and it can stop inspections by APs who may have developed inappropriate business relationships 

with manufacturers.196 As described by FDA, business relationships that may undermine the 

independence or objectivity of an AP include contracts between a manufacturer and an AP that 

represent a significant share of the AP’s income such that continuation or termination of the 

contract may create undue financial influence or at least the appearance of such influence.197

Evidence of a financial conflict of interest between the AP and the owner or operator of the 

inspected device establishment may constitute cause for withdrawal of the AP’s accreditation.198 

Finally, the statute requires each AP to annually make available to the public the extent to which 

the AP complies with conflict of interest requirements.199

The Act sets forth several prohibited acts including the knowing failure of an AP to

 190 See 21 U.S.C. § 374(g)(2) and (3); Guidance for Industry, Food and Drug Administration Staff, and Third 

Parties; Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and 

Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59252 (Oct. 4, 2004). 191 21 U.S.C. § 374(g)(2); Guidance for Industry, Food and Drug Administration Staff, and Third Parties; 

Implementation of the Inspection by Accredited Persons Program Under the Medical Device User Fee and 

Modernization Act of 2002; Accreditation Criteria; Availability, 69 Fed. Reg. 59250, 59252 (Oct. 4, 2004). 192 Guidance for Industry, supra note170. 193 Id. (see especially the checklist contained in Appendix 3.) 

194 See “Standards of Ethical Conduct for Employees of the Executive Branch,” available at

http://www.oge.gov/Laws-and-Regulations/Employee-Standards-of-Conduct/Standards-of-Ethical-Conduct-forEmployees-of-the-Executive-Branch-(PDF)/ (last visited Sept. 11, 2012) (compiling ethics standards codified in 5 

C.F.R. pt. 2635 as amended at 76 Fed. Reg. 38547 (July 1, 2011)). 195 Guidance for Industry, supra note 170 (see especially the Model Conflict of Interest Policy contained in 

Appendix 2).

196 Guidance for Industry, supra note 170. 197 Id.

198 21 U.S.C. § 374(g)(5).

199 Id. § 374(g)(3)(E).
Third-Party Programs to Assess Regulatory Compliance

28

immediately notify FDA of a condition noted during an inspection that could cause or contribute 

to an unreasonable risk to the public health, the knowing inclusion by an AP of false information 

in an inspection report, and the knowing failure of an AP to include material facts in such a 

report.200 With respect to public disclosure, FDA states that inspection records and information 

collected from the manufacturer and submitted to FDA by APs will generally be available for 

disclosure after the agency issues a compliance decision, unless such information is exempt from 

disclosure by law.201 The law provides that FDA will audit APs on a periodic basis, and the 

FDA states in guidance that it will make onsite visits on a periodic basis to each AP to audit 

performance and inspect records, correspondence, and other materials relating to AP Program

inspections.

202 

FDA may withdraw accreditation when an AP is substantially not in compliance with the 

standards of accreditation, poses a threat to the public health, or fails to act in a manner 

consistent with the Act. 203 FDA may also withdraw accreditation where FDA determines that 

there is a financial conflict of interest between the AP and the owner or operator of a device 

establishment that the AP has inspected.204 Before FDA withdraws an AP’s accreditation, it

notifies the AP and provides an opportunity for an informal hearing.205

The FDA’s design and implementation of the AP program has been funded with appropriated 

funds. The statute contains no provisions regarding the assessment of user fees to cover the costs 

of program development and implementation. As of 2012, the program was largely inactive and 

a single FDA employee administered the program as a collateral duty.

206 Also as of 2012, the 

510(k) premarket review program had no full-time positions committed to it. Administrative 

responsibilities are spread over three employees as part of their other workload.207 

4. FCC, Telecommunication Certification Body Program

In 1998, the FCC adopted rules for the establishment of Telecommunication Certification 

Bodies (TCBs) that have the authority to certify that equipment meets the FCC’s requirements 

and issue a written grant of equipment authorization.

208 FCC requirements generally apply to all 

 200 21 U.S.C. § 331(gg). See also 21 U.S.C. § 374(g)(7)(E); Guidance for Industry, supra note 170, at 13 (providing 

that “If at any time during an inspection the AP discovers a condition that it believes could cause or contribute to an 

unreasonable risk to public health, the AP must report the problem to FDA immediately”). 201 Guidance for Industry, supra note 170, at 13. Applicable disclosure laws include the Freedom of Information Act 

(5 U.S.C. § 552) , the Trade Secrets Act (18 U.S.C. § 1905), relevant provisions of the FDCA (21 U.S.C. § 331(j)) 

and FDA regulations implementing these statutes (see e.g., the FDA regulations implementing the Freedom of 

Information Act in 21 C.F.R. pt. 20 and FDA’s FOIA web page at http://www.fda.gov/RegulatoryInformation/foi/

default.htm). 202 21 U.S.C. § 374 (g)(5)(A)(i); Guidance for Industry, supra note 170, at 5, 11 (further stating that it audits APs on 

a periodic and “for cause” basis). 203 21 U.S.C. § 374(g)(5); Guidance for Industry, supra note 170, at 14. 204 Id. 205 Guidance for Industry, supra note 170, at 14. 206 Email from Jean Cooper, Senior Staff Fellow, U.S. Food and Drug Administration, July 17, 2012 (on file with 

author). 207 Id. 208 64 Fed. Reg. 4995 (Feb. 2, 1999); 47 C.F.R. §§ 2.960-2.962 & 68.160-68.162. The applicable 

telecommunications equipment regulations are at 47 CFR pts. 0 through 101. The requirements for 

Telecommunication Certification Bodies (TCBs) were specified in the Commission’s Report and Order (R&O) in 
Third-Party Programs to Assess Regulatory Compliance

29

devices that generate radio frequency (RF) energy to ensure that they operate effectively without 

causing harmful interference to radio communications. Certain devices must also be evaluated 

for radiofrequency radiation exposure to protect human health.

209

Only certain types of equipment require certification, and often the certification can be 

conducted by either a TCB or the FCC.210 Examples of devices which may be submitted to 

either include, but are not limited to cell phones, RF lights, microwave ovens, RC transmitters,

family radios, telemetry transmitters, wireless phones, and walkie talkies.211 Some devices may 

only be submitted to the FCC (such as certain new technologies) or TCBs (all computers and 

computer peripherals). When a manufacturer seeks certification directly from the FCC, 

equipment authorization fees apply.212 

Figure 6 shows the third-party structure of the TCB program. TCBs are required to be 

accredited as operating in accordance with ISO/IEC Guide 65 (1996), General Requirements for 

Bodies Operating Product Certification Systems and FCC’s technical requirements for TCBs.

213 

Under its National Voluntary Conformity Assessment Evaluation (NVCASE) program, National 

Institute of Standards and Technology (NIST) is responsible for recognizing the private 

accreditation bodies that accredit TCBs in the United States. The two recognized accreditation 

bodies are American National Standards Institute (ANSI) and the American Association for 

Laboratory Accreditation (A2LA).214 Certification bodies located outside the US may be 

recognized by the FCC as a TCB when there is a government to government Mutual Recognition 

Agreement between the country they are located in and the US. In that case, the TCB is 

accredited by appropriate authorities in that country.215 An online list of recognized TCBs is 

maintained by FCC.216 The TCB program went into effect in June 2000 with 13 recognized 

TCBs, and as of 2012, there are 34 recognized TCBs.217 

The task of the TCB has two steps: first, to evaluate the product (which involves laboratory 

testing or reliance on testing conducted by the manufacturer); and second, to make the 

certification decision.218 TCBs are accredited with certain scopes, which indicate the product 

types they may approve (e.g., Scope A: Unlicensed Radio Frequency Devices; Scope B: 

 

GEN Docket 98-68 (FCC 98-338), adopted on December 17, 1998. Further guidance on the requirements for TCBs 

was given in Public Notice DA 99-1640, FCC Provides Further Information on the Accreditation Requirements for 

Telecommunication Certification Bodies GEN Docket 98-68, released on August 17, 1999. 

209 47 CFR §§ 2.1091, 2.1093; see also http://transition.fcc.gov/oet/rfsafety/ (last visited Sept. 11, 2012). 210 See 47 CFR § 2.907 (on “certification”). Equipment with a low risk of causing harmful interference may 

generally satisfy FCC requirements through a manufacturer’s “verification,” 47 CFR § 2.902, or “Declaration of 

Conformity,” 47 CFR § 2.906. 211 See http://transition.fcc.gov/oet/ea/procedures.html (last visited Sept. 11, 2012). 212 See http://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=41712&switch=P (last visited Sept. 11, 

2012) (showing fees ranging from $490-$1265 for certification of devices). 213 TCB Program Rules and Responsibilities, FCC Office of Engineering and Technology (OET) Laboratory 

Division, (Jan. 6, 2011). See also 47 CFR § 68.160(b). 214 Id. 215 Id. See also 47 CFR § 68.160(b). 216 See https://apps.fcc.gov/tcb/index.html (last visited Sept. 11, 2012). 217 David A. Case & William Graff, Approval Options: A Look at the FCC and TCB Approval Processes (2001), 

http://www.ce-mag.com/archive/01/09/case.html (for 2001 number); Interview (by phone), George Tannahill, FCC 

Office of Engineering and Technology, August 27, 2012 (for 2012 number). 218 TCB Program Rules, supra note 213, at 3; see also 47 C.F.R. § 68.162(b)(2). 
Third-Party Programs to Assess Regulatory Compliance

30

Licensed Radio Service Equipment). For accreditation, TCBs must demonstrate expert 

knowledge of the regulations for the product types in each of their scopes. Also, the TCB must

have the technical expertise and capability to test the equipment it will certify and shall also be 

accredited in accordance with ISO/IEC 17025 to demonstrate it is competent to perform such 

tests.219 Testing of products may be performed by subcontractors of TCBs, but the TCB must 

maintain oversight and remains responsible for the test results.220 The FCC has not established 

conflict-of-interest rules for TCBs beyond what is required for accreditation to ISO Guide 65.221 

Figure 6: Structure of Third-Party Program for Telecommunication Equipment

Before a TCB can grant an equipment authorization, it must submit all required information 

to the FCC’s online system.222 After the system automatically performs certain validity checks, 

it can be used to grant the authorization. FCC reserves to itself 30 days to review the completed 

action and set aside the authorization if necessary. Much of the information that is uploaded 

such as pictures of the product, pictures of the label and certain testing data becomes publicly 

available. Other information entered into the system may be considered proprietary and kept 

confidential. 

Also, the FCC requires TCBs to conduct certain surveillance testing of equipment they 

certify.

223 TCBs must test additional equipment samples for at least 5% of the grants they issue 

 219 47 C.F.R. § 68.162(b)(3), TCB Program Rules, supra note 213, at 2. 220 Id. § 68.162(d). 221 Guide 65 states that a certification body should “ensure that activities of related bodies do not affect the 

confidentiality, objectivity and impartiality of its certifications, and it shall not 1) supply or design products of the 

type it certifies, 2) give advice or provide consultancy services to the applicant as to methods of dealing with matters 

which are barriers to the certification requested, 3) provide any other products or services which could compromise 

the confidentiality, objectivity or impartiality of its certification process and decisions.”

222 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. 223 47 C.F.R § 2.962(g)(2); see Federal Communications Commission, Office of Engineering and Technology

Laboratory Division, TCB Post-Market Surveillance, 1 610077 D01 TCB Post Market Surveillance v05r03

NVCASE

Accreditation Bodies

recognizes

that accredit

Telecommunication Certification Bodies (TCBs)

that certify

Products

FCC requirements

are in conformity with

FCC

recognizes
Third-Party Programs to Assess Regulatory Compliance

31

and electronically submit an annual surveillance report. If a TCB finds that a certified product 

fails to comply, it must notify FCC and the manufacturer, which will be asked to take actions to 

correct the situation.224 Subject to certain procedural requirements, the FCC retains authority to 

withdraw its recognition of TCBs and revoke the certification of products by TCBs.225 FCC 

itself also conducts market surveillance activities that may include pre-grant testing, post-grant 

testing, and off-the-shelf product testing. Upon receiving a complaint from a TCB or the public 

about a problem with another TCB or certified equipment, FCC may pursue the complaint itself, 

request an assessment by the relevant accreditation body, or require further testing by the 

relevant TCB.226 

B. Programs for Voluntary Standards

In four programs, federal agencies rely on third parties to assess and certify compliance with 

voluntary standards established or endorsed by the agency. All these programs offer companies 

the opportunity to display a label on their products attesting to their compliance. In all of them, 

the use of third parties is obligatory: to participate in the program, the company that sells the 

labeled product has to contract with a third party. 

1. OSHA, National Recognized Testing Laboratories Program

Since 1988, the Occupational Safety & Health Administration (OSHA) has operated a thirdparty program through which it ascertains that specified equipment and materials (products) used 

in OSHA-regulated workplaces meet safety standards.227 The program’s structure is illustrated 

in Figure 7. Under OSHA’s Nationally Recognized Testing Laboratory (NRTL) Program, 

private sector organizations approved by OSHA are hired by manufacturers of specified products

to test and certify them. The NRTL then authorizes the manufacturer to affix a label (or mark) on 

the products, which is visible to the OSHA workplace inspector. 

The standards that the products must meet to be certified by a NRTL are voluntary consensus

standards, rather than government-unique OSHA standards.228 OSHA requires NRTL 

certification for many different types of products, such as printers and copiers, electric heater and 

air conditioners, alarm systems, fire extinguishers, acetylene torches, and liquefied petroleum gas 

ovens.

229 These standards are set by national standards-producing organizations such as 

 

(Oct. 25, 2011), http://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=20540&switch=P (last visited 

Sept. 11, 2012).

224 47 C.F.R § 68.162(g)(3). 225 Id. § 68.162(f)(6). 226 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. 227 53 Fed. Reg. 12102 (Apr. 12, 1988); 29 CFR § 1910, subpart S. See also Bernard Pasquet, OSHA Requirements 

for Nationally Recognized Testing Laboratory Approval of Products, 

http://www.osha.gov/dts/otpca/nrtl/NRTLarticle.html (last visited Sept. 11, 2012) (stating that workplaces subject to 

OSHA’s jurisdiction include the “vast majority” of private employers in the United States and its territories; most 

federal government places of employment; and state and local government places of employment in states that have 

received OSHA approval to administer their own occupational safety and health program). 

228 See 29 C.F.R. § 1910.7(c) (defining the test standards used in the NRTL program). 

229 See Pasquet, supra note 227; OSHA, Type of Products Requiring NRTL Approval, 

http://www.osha.gov/dts/otpca/nrtl/prodcatg.html (setting forth 37 product categories, of which electrical equipment 

is the largest, and citing to General Industry Standards, 29 C.F.R. pt. 1910).
Third-Party Programs to Assess Regulatory Compliance

32

American National Standards Institute (ANSI), American Society for Testing and Materials 

(ASTM), Factory Mutual Research Corporation (FMRC), and UL.

230 In effect, manufacturers 

are not required by law to meet these standards to market their products, but workplaces that are 

regulated by OSHA are required to utilize certified products. 

Figure 7: Structure of Third-Party Program for Workplace Product Safety

NRTLs are private organizations that are recognized by OSHA to be qualified to perform 

safety testing and product certification.231 OSHA regulations set forth the requirements for 

NRTLs.232 NRTLs must be capable of performing the proper testing, meaning that they must 

have the proper equipment and facilities, staff, procedures, and quality control programs.233 They 

shall, as necessary, implement control procedures; inspect the production of items at factories; 

and conduct field inspections to monitor the proper use of their marks on products.234 They must 

be “completely independent” of both the manufacturers and vendors of equipment subject to 

testing and the employers subject to the tested equipment requirements.235 NRTLs must maintain 

effective procedures for producing objective and unbiased reports and for fairly handling 

complaints and disputes.236 

If its application is approved by OSHA, a NRTL’s initial recognition is valid for five 

years.237 OSHA approves NRTLs with certain “scopes of recognition” by specifying the test 

 230 Occupational Safety & Health Administration, Nationally Recognized Testing Laboratory Program

Application Guidelines, at 1, http://www.osha.gov/dts/otpca/nrtl/applguid.pdf (last visited Sept. 11, 2012)

[hereinafter “OSHA Application Guidelines”]. A list of standards recognized by OSHA is at 

http://www.osha.gov/dts/otpca/nrtl/allstds.html. 231 See OSHA, Frequently Asked Questions (FAQs), http://www.osha.gov/dts/otpca/nrtl/faq_nrtl.html#1 (last visited 

Sept. 11, 2012) (stating that “OSHA’s recognition is not a government license or position, or a delegation or grant of 

government authority. Instead, the recognition is an acknowledgment that an organization has necessary 

qualifications to perform safety testing and certification of the specific products covered within its scope of 

recognition).

232 29 C.F.R. § 1910.7. 233 Id. § 1910.7(b)(1). 234 Id. § 1910.7(b)(2). 235 Id. § 1910.7(b)(3). 236 Id. §§ 1910.7(b)(4)(i) & (ii). 237 OSHA Application Guidelines, supra note 230 at 1.

OSHA

National Recognized Testing Laboratories (NRTLs)

recognizes

that test and certify

Certain products used in OSHA-regulated workplaces

Voluntary Consensus Standards for Product Safety 

(i.e. ASTM standards)

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

33

standards with which they can certify conformity. OSHA maintains an online registry of NRTLs 

and their scopes of recognition.238 Currently, 15 NRTLs are recognized by OSHA.239 Twelve 

are headquartered in the United States, and three NRTLs are headquartered in other countries.

240 

Some NRTLs are based in one country but also have offices in others. For example, CSA 

International is based in Toronto, Canada and also has offices in Ohio and California, and UL is 

based in Illinois and also has offices in four other U.S. states and 10 foreign countries.

NRTLs and applicants for NRTL recognition must pay fees.241 OSHA assesses fees for 

processing applications for “initial recognition, expansion of recognition, or renewal of 

recognition, including on-site reviews; review and evaluation of the applications; and preparation 

of reports, evaluations and Federal Register notices; and audits of sites.”242 Fees first went into 

effect on October 1, 2000.243 They were revised in 2002, 2007 and 2011.244 A current listing of 

the applicable fees is maintained online.245 For example, currently, total fees to become 

recognized as a NRTL amount to over $40,000 (including an initial application review fee of

$17,750; an assessment fee of $4,440 plus travel expenses; and a final report and Federal 

Register notice fee of $19,520).

246 Substantial fees also apply when a NRTL expands or renews 

its recognition. For the audits that OSHA requires of recognized NRTLs, OSHA charges at least 

$4,400 plus travel expenses for an on-site audit and $1,120 for an office audit.247 Audit fees are 

significantly higher if non-conformances are found or if more than one day is required.

2. AMS, National Organic Program

The National Organic Program (NOP), administered by the United States Department of 

Agriculture’s Agricultural Marketing Service (AMS), relies on a system of third-party 

certification. The Organic Foods Production Act of 1990, the authorizing legislation for the 

NOP, states that the “Secretary shall implement the program . . . through certifying agents.”248

In regulations promulgated in 2000, AMS set the organic standards that cover the production, 

postharvest handling, and processing of organic foods and specified the third-party certification 

 238 List of NRTLs is available at http://www.osha.gov/dts/otpca/nrtl/ (last visited Sept. 11, 2012).

239 Email from Kevin Robinson, Occupational Safety & Health Administration, U.S. Department of Labor, October 

11, 2012.

240 Id. 241 29 C.F.R. § 1910.7(f). 242 Id. § 1910.7(f)(1)(i) & (ii) (describing how fees are determined and stating that the fees reflect the full cost of 

performing the listed activities). 243 OSHA, Fee Payment Instructions and Information, http://www.osha.gov/dts/otpca/nrtl/nrtlfees.html; see also 

Nationally Recognized Testing Laboratories -- Fees; Public Comment Period on Recognition Notices, 65 Fed. Reg. 

46798 (July 31, 2000), available at

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=FEDERAL_REGISTER&p_id=15480. 244 Nationally Recognized Testing Laboratories Fees, 76 Fed. Reg. 10500 (Feb. 25, 2011) 

http://www.gpo.gov/fdsys/pkg/FR-2011-02-25/html/2011-3937.htm (last visited Sept. 11, 2012) (revising the fee 

regulations).

245 OSHA, Fee Schedule (effective March 28, 2011), http://www.osha.gov/dts/otpca/nrtl/nrtlschedule.html (last 

visited Sept. 11, 2012).

246 Id. 247 Id. 248 7 U.S.C. § 6503(d).
Third-Party Programs to Assess Regulatory Compliance

34

system that would determine whether a certain product met those standards.249 

These regulatory standards are voluntary in that food producers or handlers are only required 

to conform to them if they label their products as organic. However, if food producers or 

handlers label their products as organic, it is mandatory that they use an accredited third party to 

provide the required certification. 250 The certifying agents are responsible for all aspects of the 

certification process: conducting inspection as necessary to verify compliance with regulatory 

requirements, issuing certification decisions, issuing notices of noncompliance, and suspending 

or revoking the certification of clients that are out of compliance.251

As shown in Figure 8, third-party certifying agents are directly accredited by the AMS. They 

may be private or governmental entities, and under certain circumstances, the agency may accept 

a foreign government’s accreditation of foreign certifying agents.252 To be accredited, the entity 

must have sufficient expertise and adequately trained personnel to comply with the terms of the 

organic certification program.

253 Certifying agents must also conduct an annual program review 

of their certification activities and correct any noncompliances,254 and they must maintain 

records of certification processes and make them available for inspection upon request.255 As of 

2012, 91 entities – 51 domestic and 40 foreign – were accredited by the NOP to act as certifying 

agents.256 Examples of domestic certifying agents include private organizations like Global 

Organic Alliance, Inc., based in Ohio, and the Idaho State Department of Agriculture’s Division 

of Plant Industries.257 Overall, state agencies constituted 17 of the 51 domestic organic 

certifiers.258 Examples of foreign domestic certifying agents include Argencert S.A., based in

Argentina, and CAAE Certification Service, based in Spain.259

The NOP regulations include several provisions to avoid potential conflicts of interest.260 

Certifying agents are required to prevent conflicts of interest by not certifying operations that 

they have any commercial interest in, excluding the participation of employees or contractors 

that have any such commercial interests, not permitting employees or contractors to accept any 

payment or gifts other than prescribed fees for certification, not providing consultation services 

to certified operations, requiring employees and contractors to complete annual conflict of 

interest disclosure reports, and requiring that the decision to certify be made by someone 

 249 The final organic rule was published on December 21, 2000, and the regulations implementing the NOP became 

effective October 21, 2002. See 7 C.F.R. pt. 205. 250 USDA, National Organic Program, Organic Certification & Accreditation, 

http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateN&navID=NationalOrganicPro

gram&leftNav=NationalOrganicProgram&page=NOPAccreditationandCertification&description=Accreditation%20

and%20Certification&acct=nopgeninfo (last visited Sept. 11, 2012). 251 7 C.F.R §§ 205.403 - 205.406. 252 Id. § 205.500(c) 253 Id. § 205.501(a)(1)-(6). 254 Id. § 205.501(a)(7). 255 Id. § 205.501(a)(9). 256 USDA, National Organic Program, Organic Certification & Accreditation, supra note 250. 257 See the list of domestic certifying agents at 

http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5074486 (last visited Sept. 11, 2012). 258 Id.

259 See the list of foreign certifying agents at 

http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5074487 (last visited Sept. 11, 2012). 260 7 C.F.R. § 205.501(a)(11).
Third-Party Programs to Assess Regulatory Compliance

35

different from those conducting prior certification activities.261 

Figure 8: Structure of Third-Party Program for Organic Food Label

The regulations provide that AMS will conduct on-site reviews of accredited certifying 

agents. Such reviews encompass “the certifying agent’s certification procedures, decisions, 

facilities, administrative and management systems, and production or handling operations 

certified by the certifying agent.”262 Such reviews should occur before or soon after initial 

accreditation, before renewal of accreditation, and one or more times during the five year period 

of accreditation.263 NOP reports that 56 such onsite reviews or inspections occurred in 2012.264

The authorizing legislation stated that the NOP should provide for the “collection of 

reasonable fees from producers, certifying agents and handlers who participate in such 

program.”265 The NOP regulations specify that the cost of the program’s accreditation services 

will be collected from applicants for initial accreditation and accredited certifying agents for 

review of annual reports and accreditation renewal.

266 In 2010, the average cost to a domestic 

certifying agent applicant was $4,428, and the average cost to a foreign certifying agent was 

$24,082.267 

3. EPA/DOE, Energy Star Program 

The Energy Star Program was established by the Environmental Protection Agency (EPA) in 

 261 Id. 262 Id. § 205.508(a). 263 See 7 C.F.R. §§ 205.508 (b), 205.500 (specifying that the duration of accreditation is five years) 264 Interview (by phone), Cheri Courtney, Acting Director, Accreditation and International Activities Division, NOP 

(August 16, 2012). Some audit reports and corrective action reports can be found on the NOP website at 

http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateJ&page=NOPReadingRoomHo

me (last visited Sept. 9, 2012). 265 7 U.S.C. § 6506(a)(10). 266 7 C.F.R. § 205.640. 267 USDA, National Organic Program, FAQ: Becoming a Certifying Agent, 

http://www.ams.usda.gov/AMSv1.0/ams.fetchTemplateData.do?template=TemplateN&navID=NOPFAQsHowAccr

edited&topNav=&leftNav=NationalOrganicProgram&page=NOPFAQsHowAccredited&description=FAQ:%20%2

0Becoming%20a%20Certifying%20Agent&acct=nopgeninfo (last visited Sept. 9, 2012).

AMS

Third-Party Certifying Agents

accredits

that certify

Food Products marketed as Organic

Organic Standards

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

36

1992 to provide a labeling system for products that voluntarily meet certain energy efficiency 

standards. The Department of Energy (DOE) has jointly administered the program since 1995, 

when labeled products expanded from computers and monitors to additional office equipment 

and residential heating, ventilation, and cooling (HVAC) equipment.268 Over 60 product 

categories may now carry the Energy Star label including major appliances, office equipment,

lighting, home electronics, new homes, and commercial and industrial buildings. 269 As of 2010, 

more than 40,000 individual product models made by over 1,600 manufacturers had earned the 

Energy Star label.270 

Effective in 2011, after a critical report by the Government Accountability Office, Energy 

Star was significantly restructured by EPA to require that products carrying the label be certified 

by third parties.271 The new third-party structure for the program is shown in Figure 9. 

Previously, manufacturers self-declared that their products met the Energy Star requirements. 

With the new third-party certification requirement, product testing must be conducted in an EPArecognized laboratory and the results have to be certified and submitted to EPA by an EPArecognized certification body. EPA recognition, in turn, generally depends on accreditation to an 

appropriate ISO standard by an EPA-recognized accreditation body. 

Figure 9: Structure of Third-Party Program for Energy Star Product Label

Accreditation bodies play the role of providing the accreditation that certification and 

 268 US Government Accountability Office (GAO), ENERGY STAR PROGRAM: COVERT TESTING SHOWS THE ENERGY 

STAR PROGRAM CERTIFICATION PROCESS IS VULNERABLE TO FRAUD AND ABUSE, 3 GAO-10-470 (March 2010),

available at http://www.gao.gov/products/GAO-10-470. 269 For general information see Energy Star, History of Energy Star, 

http://www.energystar.gov/index.cfm?c=about.ab_history (last visited Sept. 11, 2012) (noting that labeled products 

include major appliances, office equipment, lighting and home electronics, among others).

270 USEPA, ENERGY STAR® and Other Climate Protection Partnerships 2010 Annual Report 4, available at

http://www.energystar.gov/ia/partners/publications/pubdocs/2010%20CPPD%204pgr.pdf. 271 See GAO, supra note 268; see generally EPA Energy Star, Third-Party Certification, 

http://www.energystar.gov/index.cfm?c=third_party_certification.tpc_index.

EPA

Accreditation Bodies

recognizes

that accredit

Laboratories

that test

Products

Energy Star Label Requirements

for conformity with

Certification Bodies

Accreditation Bodies

that certify

Products

are in conformity with

Energy Star Label Requirements

accredit

recognizes recognizes
Third-Party Programs to Assess Regulatory Compliance

37

laboratories require to become EPA-recognized. To accredit certification bodies, an 

accreditation body must be a signatory to the IAF MLA.

272 As of April 2012, there were 54 

signatories to the IAF MLA based in about 50 different countries.273 In the U.S., there are four 

IAF MLA signatories, including A2LA, IAS and ANSI.

To accredit laboratories, an accreditation body must be itself recognized by the EPA. For 

recognition, the accreditation body must operate its accreditation program in accordance with 

ISO/IEC 17011 and maintain an affiliation with ILAC.

274 By May 2012, EPA had recognized 27

accreditation bodies around the world, including A2LA, IAS, and three others in the U.S.

275 

EPA-recognized certification bodies (CBs) play the role of certifying that eligible products 

meet the requirements of the Energy Star label. A key requirement for recognition is 

accreditation to ISO/IEC Guide 65 by an accreditation body that is an IAF MLA signatory. 

ISO/IEC Guide 65 requires, for example, that the CB make certification decisions impartially 

and based on information gathered during the evaluation process.276 EPA also imposes a variety 

of other requirements regarding how CBs determine whether a product qualifies for the Energy 

Star label and how CBs must conduct a verification testing program to verify that their certified 

products continue to meet Energy Star requirements.277 More specifically, CBs are required to 

annually select and test at least 10% of all models they have certified, with half the models being 

randomly selected and half selected based on EPA referrals. As of August 2012, Energy Star had 

recognized 21 certification bodies around the world.278 

In general, Energy Star qualifying products should be tested in an EPA-recognized 

laboratory. For recognition, laboratories must be accredited to ISO/IEC 17025 by an EPArecognized accreditation body. ISO/IEC 17025 requires, for example, that a laboratory employ 

experienced personnel with adequate training; have adequate physical plant facilities and test 

equipment; and ensure that measuring equipment is accurate.279 Recognized labs must also agree 

to a variety of other requirements such as reporting to EPA and otherwise enabling EPA 

oversight.280 Recognized labs need not be independent; they may be owned by the 

manufacturers of the products they test.

 272 Energy Star, Accreditation Body Resources, 

http://www.energystar.gov/index.cfm?c=third_party_certification.tpc_accred_bodies (last visited Sept. 11, 2012). 273 See full list at http://www.iaf.nu/articles/IAF_MEM_USA__all/112, accessible from IAF, IAF MLA, 

http://www.iaf.nu/articles/IAF_MLA/14 (last visited Sept. 9, 2012). 274 See EPA, Conditions and Criteria for Recognition of Accreditation Bodies for ENERGY STAR® Laboratory 

Recognition, http://www.energystar.gov/ia/partners/downloads/mou/Criteria_Accreditation_Bodies_Labs.pdf?e75eee91 (last visited Sept. 11, 2012). 275 See Energy Star, EPA-Recognized Accreditation Bodies, 

http://www.energystar.gov/index.cfm?c=partners.epa_recognized_accreditation_bodies (last visited Sept. 9, 2012). 276 See EPA, Conditions and Criteria for Recognition of Certification Bodies for the ENERGY STAR program, 

http://www.energystar.gov/ia/partners/downloads/mou/Conditions_and_Criteria_for_Recognition_of_Certification_

Bodies.pdf (last visited Sept. 11, 2012). 277 Id. 278 Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012.

279 EPA, Conditions and Criteria for Recognition of Laboratories for the ENERGY STAR program, at 

http://www.energystar.gov/ia/partners/downloads/mou/Criteria_Laboratories.pdf (last visited Sept. 9, 2012). 280 Id. 
Third-Party Programs to Assess Regulatory Compliance

38

Manufacturers’ laboratories that are not accredited may also be used for testing under the 

Energy Star’s Witnessed Manufacturers’ Testing Laboratory (WMTL) or Supervised 

Manufacturers’ Testing Laboratory (SMTL) programs.281 Under these programs, a CB may

operate a testing program to accept test data from such a lab if the CB commits to exercising and 

documenting a high degree of oversight, including on-site assessment and monitoring to ensure 

the laboratory’s compliance with ISO 17025 and applicable test methods. As of August 2012, 

Energy Star testing was being conducted in 463 laboratories: 224 accredited labs; 180 supervised 

labs; and 59 witnessed labs.282 About 200 of these labs were located in the Asia-Pacific region, 

most of which were fully accredited.283

EPA does not assess any user fees for participation in the Energy Star program. Funding for 

its development and maintenance has come from appropriated funds. 

4. EPA, WaterSense Program

EPA’s WaterSense product certification program, which provides a label for highperforming, water-efficient products, also relies on third-party certification as shown in Figure 

10. Modeled after Energy Star, WaterSense was launched in 2006 and has required third-party 

certification since 2009.284 All products bearing the WaterSense label must be assessed for 

conformity with the WaterSense product specification by an accredited third-party certifying 

body. The certifying bodies, in turn, are accredited by an accreditation body approved by EPA. 

Figure 10: Structure of Third-Party Program for WaterSense Product Label

 281 Id. at 6-7. 282 Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012. 283 Id. 284 See EPA WaterSense, Comprehensive List of all Frequent Questions, 

http://www.epa.gov/watersense/full_list.html (last visited Sept. 11, 2012). EPA issued the first WaterSense product 

certification system in 2009. WaterSense Product Certification System (March 23, 2009), 

http://www.epa.gov/watersense/docs/cert_system_revised508.pdf. EPA issued a revised version in 2009. EPA 

WaterSense, WaterSense®, Version 2.0 Product Certification System (Sep. 29, 2011), 

http://www.epa.gov/watersense/docs/cert_system_508.pdf [hereinafter “WaterSense 2.0”].

EPA

Accreditation Bodies

approves

that accredit

Third-Party Certifying Body

that certify

Products

WaterSense Product Specifications

are in conformity with
Third-Party Programs to Assess Regulatory Compliance

39

The applicable standards in WaterSense are EPA’s “product specifications,” which are 

currently finalized for five product categories: Tank-Type Toilets, Lavatory Faucets, Flushing 

Urinals, Showerheads, and Weather-Based Irrigation Controllers.285 Manufacturers seeking to 

use the WaterSense label on products in these categories first enter into a WaterSense partnership 

agreement with EPA and then have their product(s) certified for conformance to the WaterSense 

specification by an EPA-licensed certifying body.286 Manufacturers apply directly to the licensed 

certifying body for certification and to obtain the WaterSense label.287

To be approved by EPA, an accreditation body must be domiciled in the U.S. and show that 

it operates in accordance with the requirements of ISO/IEC 17011.

288 Also it must offer

accreditation services to ISO/IEC Guide 65 and the IAF Guidance on the Application of ISO/IEC 

Guide 65 and be an IAF-MLA signatory for products.289 As of 2012, EPA had approved three

accreditation bodies: A2LA, ANSI, and IAS.

290

Product certifying bodies must be accredited by an approved accreditation body in 

accordance with ISO/IEC Guide 65 and the IAF Guidance on the Application of ISO/IEC Guide 

65 to operate the WaterSense product certification system and certify products to the relevant 

WaterSense product specifications. The accreditation body determines the certifying body’s 

scope of accreditation by accrediting it for any or all of the WaterSense product specifications

established by EPA. Accredited certifying bodies also sign a licensing agreement with EPA to 

certify and label products for WaterSense.

291 As of May 2012, EPA had licensed seven

certification bodies to provide product certifications for one or more of the five product 

categories.292 Examples of licensed certification bodies include Intertek, NSF International, and

UL, based in the U.S.; and CSA International, based in Canada. 

In addition, certifying bodies must have procedures in place to ensure that the testing data 

that they rely on is reliable. Independent testing labs that are used by certifying bodies must 

demonstrate compliance with ISO/IEC 17025 and the relevant WaterSense product 

specification.293 If a certifying body relies on testing data from a manufacturer’s laboratory, 

 285 WaterSense, Compendium of Product & Program Specifications, 

http://www.epa.gov/watersense/partners/product_program_specs.html#final (last visited Sept. 9, 2012). 286 WaterSense, Product Certification & Labeling, 

http://www.epa.gov/watersense/about_us/product_certification_labeling.html (last visited Sept. 9, 2012). 287 Id. 288 WaterSense 2.0, supra note 284, at 4. The requirement that the accreditation body be domiciled in the U.S. is not 

present in EPA’s Energy Star program or other programs included in this review.

289 Id. (noting that references to ISO/IEC Guide 65 will be superseded by ISO/IEC 17065 once ISO/IEC 17065 is 

published.)

290 WaterSense, Accreditation & Licensed Certifying Bodies, 

http://www.epa.gov/watersense/about_us/cert_bodies.html#accreditation (last visited Sept. 9, 2012).

291 WaterSense 2.0, supra note 284, at 4-5.

292 WaterSense, Accreditation & Licensed Certifying Bodies, 

http://www.epa.gov/watersense/about_us/cert_bodies.html (last visited Sept. 9, 2012).

293 WaterSense 2.0, supra note 284, at 8. See also EPA, Response to Public Comments Received on June 2011 

WaterSense Draft Revised Product Certification System (September 29, 2011) (clarifying that WaterSense does not 

require ISO/IEC 17025 accreditation for testing laboratories; it only requires that labs “demonstrate compliance 

with” ISO/IEC 17025”).
Third-Party Programs to Assess Regulatory Compliance

40

additional requirements are imposed.294 To the extent that a certification body outsources its 

evaluation process to contractors, it must have “documented policies and procedures for 

qualifying, assessing, and monitoring” them, and it must make a list of them available to the 

EPA or accreditation body to review.295

EPA does not assess any user fees for participation in the WaterSense program. Funding for 

its development and maintenance has come from appropriated funds. 

IV. Evaluating Third-Party Programs

Given the growing prevalence of third-party programs in regulatory contexts, it is important

to evaluate which work well and why. This section first sets forth five metrics to assess success. 

They include the reliability of third-party determinations; compliance rates; agency capacity to 

administer the third-party system; public acceptance; and industry acceptance. The second part

discusses the incentives that are necessary to attract participation in programs where regulated 

entities may choose whether to contract with a third party or rely on regulatory agency for 

verification of regulatory compliance.

A. Metrics of Success 

1. Reliability of Third-Party Determinations

A key metric of success of third-party programs is whether the third-party assessment

produces determinations that are sufficiently reliable and accurate for the regulatory purpose at 

hand. This metric allows for some variation. It may be acceptable to the agency, for example, 

for the reliability of third-party determinations regarding conformity with voluntary standards to 

be lower than the reliability of those regarding conformity with mandatory standards. Similar to

private conformity assessment systems that may vary depending on the needs of the purchaser, 

regulatory third-party systems may also be allowed to vary depending on regulatory needs.

296 

To a large degree, the reliability of determinations made by third parties will depend on their 

competence and independence. Generally, third parties must be competent to perform the 

required assessment tasks and independent (or unbiased) in their assessment. In addition, 

programs should be designed to enhance the consistency of third-party determinations and avoid 

problems that have undermined the reliability of similar assessments in non-regulatory contexts. 

In some areas of regulation in which regulatory third-party programs are being constructed, 

third parties have been used by private parties to assess conformity for many years. However, 

these private systems have sometimes suffered from a lack of reliability. For example, in the 

food safety area, corporate purchasers have required suppliers to conduct independent third-party 

audits of their facilities. Newsworthy failures in these systems have suggested problems with the 

 294 Id. at 8-10.

295 Id. 296 Cf. infra notes 437 to 438 and accompanying text (recommending that agencies calibrate the design of third-party 

programs to the level of risks associated with noncompliance).
Third-Party Programs to Assess Regulatory Compliance

41

reliability of these audit determinations. In the case of the Peanut Corporation of America and 

the salmonella outbreak with which it is associated, third-party auditors had given the 

manufacturer a “superior rating” but later investigation by FDA showed that product testing had 

revealed instances of salmonella contamination.297 In cases like this, questions have been raised 

about both the competence and the independence of third-party auditors.

To ensure competence, an agency may have to give serious attention to the training of third 

parties. Two recent pilot programs undertaken by FDA have underscored the importance of such

training. In a pilot program conducted by the FDA in which certification bodies (CBs) were 

selected to inspect establishments in the aquacultured shrimp industry for compliance with US 

food safety standards, the agency’s audits of the CBs found that some were not using the correct 

standards in their inspections even though they had been instructed to do so.298 Rather, they 

were using standards of other countries, which they had presumably used in other audits.299 

FDA concluded that it would have to conduct additional training to implement a full-scale thirdparty program.300 Similarly, in PMAP, FDA’s pilot program with Canada for medical device 

facility inspections, FDA found that training was needed to ensure that “additional regulatory 

requirements outside of the ISO 13485:2003 standard and the QS regulation are adequately 

covered during audits/inspections.”301

Despite the training issues, however, the FDA concluded in PMAP that the use of third-party 

auditors held promise. FDA gave an overall vote of confidence in its workability, stating that 

“Health Canada and FDA have confidence in the ability of a qualified and competent auditing 

organization to plan, carry out, and report on the audit/inspection according to basic Health 

Canada and FDA requirements.”302 In a similar vein, an FDA staffer who has worked with the 

AP Inspections program indicated that he perceived AP inspectors to be very competent, 

particularly in performing ISO 13485 facility inspections.

303 He noted, however, that because 

they do not usually do AP inspections, the information provided to the FDA through such

inspection is generally not adequate to support an enforcement action. He opined that if the AP 

inspectors conducted a lot of inspections – for example, if the program were mandatory or 

otherwise attracted high participation by regulated entities – an entire industry of competent 

inspectors could emerge. 

In the shrimp aquaculture pilot, in contrast, the FDA’s conclusions were more pessimistic. It 

found that the agency needed “to more fully explore communication, logistic, administration, 

and training options for conducting future third-party programs.”304 Indeed, FDA noted 

significant deficiencies when it observed and assessed third parties to see if they met eleven 

 297 Andrew Martin, Peanut Plant says Audits Declared it in Top Shape, New York Times (Feb. 4, 2009), available 

at http://www.nytimes.com/2009/02/05/business/05peanuts.html?_r=1&ref=peanutcorporationofamerica. 298 FDA, Assessment of the Third-Party Certification Pilot for Aquacultured Shrimp (July 2011). See also 73 Fed. 

Reg. 39704 (Jul. 10, 2008) (announcing the pilot program and calling for applications from certification bodies).

299 Id. at 7. 300 Id. at 26. 301 PMAP report, supra note 165, at 2. Note that Canada and many other countries rely directly on “ISO 13485: 

Medical devices -- Quality management systems -- Requirements for regulatory purposes” in their regulation of 

medical devices. The QS regulation of the US is similar, but not the same.

302 Id. at 4. 303 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012. 304 FDA, supra note 298, at 26. 
Third-Party Programs to Assess Regulatory Compliance

42

“critical audit performance elements.” These critical audit performance elements were defined as 

“key knowledge, skills, and abilities that, if not demonstrated by the auditor, could result in the 

failure of the auditor to detect the processing of potentially unsafe food.”305 FDA conducted 28 

audits and found that only 3 out of 11 of its critical elements were met in the majority of the 

audits and only one was met in all of the audits. For example, only 4 out of the 28 audits met 

such critical elements as: “Did the auditor demonstrate an understanding of how to identify, 

evaluate and control the food safety hazards associated with the product and process being 

audited?” and “Did the auditor recognize, through in-plant observations, deficiencies in the 

identification and control of hazards?”306

Another prevalent concern about third-party auditors relates to their independence. When an 

auditor is paid by a regulated entity to assess that entity’s compliance, concerns about the 

objectivity of the third party arise. As discussed in the literature on financial auditing, in addition 

to potentially conscious motivations, a variety of unconscious biases can affect an auditor’s 

judgment.307 For example, the standards with which the auditor must assess conformity may have 

ambiguities, and “[b]ias thrives wherever there is the possibility of interpreting information in 

different ways.”308 Also, an “attachment bias” results from the fact that the auditor has strong 

business reasons to please the client and equates his own interests with those of the client.309 Also, 

the certain and immediate beneficial consequences of giving a positive audit opinion may outweigh 

the uncertain and distant negative consequences of not doing so.

310 Another threat to 

independence occurs when auditors provide their clients with additional “non-audit” consulting 

and tax services.311 In this case, an auditor that renders a negative audit opinion risks losing not just 

the audit engagement but the additional business as well. 

Similar issues of auditor independence can be expected to appear in third-party programs for 

regulatory purposes. An example of an issue involving third-party independence is provided by the 

NRTL program. Curtis Straus LLC (CSL) was recognized as a NRTL in 1999 and applied to 

have its recognition renewed in 2004.312 In 2007, OSHA informed Curtis Straus by letter that it 

did not appear to meet the NRTL program policy on independence because of a change in its 

ownership in 2005.313 After the change in ownership, the investment firm (Wendel) owned 58% 

of CSL as well as 32% of Legrand, a manufacturer of electrical products that require NRTL 

testing and certification. 

Over the next several years, CSL sought OSHA approval by providing more information and 

making some changes to its business structure. For example, it sought to convince OSHA that a 

firewall existed to assure the independence of its certification process and that it would use 

 305 Id. 306 Id. at 31, app. B. 307 Max H. Bazerman et al., Why Good Accountants Do Bad Audits, HARV. BUS. REV. 97-98 (Nov. 2002). 308 Id. at 98.

309 Id. at 99; see also Amy Shapiro, Who Pays the Auditor Calls the Tune?: Auditing Regulation and Clients’ 

Incentives, 35 SETON HALL L. REV. 1029, 1040 (2005) (discussing the attachment bias and explaining that working 

for a client creates a tendency for an auditor to make judgment calls that favor a client). 310 Id. 311 Keith A. Houghton & Christine A. Jubb, The Market for Financial Report Audits: Regulation of and Competition 

for Auditor Independence, 25 L. & POL’Y 299, 308–09 (2003). 312 OSHA, Curtis-Straus LLC, Application for renewal of Recognition, 76 Fed. Reg. 62850 (Oct. 11, 2011). 313 Id.
Third-Party Programs to Assess Regulatory Compliance

43

external and internal audits to ensure its independence.314 In 2010, however, OSHA made a 

negative finding of renewal based in part on concerns that OSHA would not be able to 

effectively monitor CSL’s efforts, given the extent and complexity of Wendel’s and Legrand’s 

business operations.315 In its continued efforts to persuade OSHA to renew, Wendel decreased 

its ownership stake in Legrand to11% in 2011. 

In 2011, OSHA published notice of its preliminary finding to deny renewal, and a final 

finding is expected to be published in September 2012.316 In the preliminary finding, OSHA 

explains that the NRTL program requires “complete independence,” meaning that NRTLs “must 

be free from commercial, financial and other pressures that could compromise” its testing and 

certification.317 CSL’s substantial relationship with Legrand deriving from Wendel’s partial 

ownership of both violates this independence requirement. OSHA’s final determination on 

CSL’s renewal has still not been published, suggesting that a lengthy process is required when an 

agency seeks to terminate the accreditation of a certification body. 

In addition to questions of competence and independence, agencies should be concerned 

about the consistency of third-party determinations. If third-party firms and individuals are able 

to conduct the required assessment tasks in different ways, their determinations may be less 

consistent than governmental determinations, particularly if the latter would be centralized. For 

example, when the Environmental Protection Agency decided to verify greenhouse gas 

emissions data itself rather than require emitters to contract with a third-party verifier, it 

suggested that this would allow it to comprehensively review the data and provide the necessary 

consistency and quality.318 If EPA had opted to incorporate third-party verification, it “would 

still need to review and perform consistency checks after the third party verification was 

complete.”319

Aside from competence and independence, there are other characteristics common in 

auditing that may also be preventing reliable and accurate results. One scholar of private thirdparty systems in the food sector found that auditors focus their review on the records kept by 

companies rather than actual company practices. In a study of audits performed to check the 

compliance of agricultural suppliers with buyers’ standards, the scholar observes that “what are 

mostly audited are not the practices of suppliers, but their records. Put differently, auditors 

largely rely on proxy measures to verify compliance.”320 As such, the audit may verify that there 

is documentation showing that a certain standard was met but not actually verify that the 

standard was met. 

Other scholars have pointed out that audits may verify compliance with many detailed 

performance specifications while failing to assess true risks.321 To standardize their task, 

 314 Id. 315 Id. 316 Id.; Interview (by phone), Robert Biersner, Department of Labor, Office of the Solicitor (Aug. 10, 2012). 317 Id. 318 Mandatory Reporting of Greenhouse Gases; Final Rule, 74 Fed. Reg. 56260, 56282 (Oct. 30, 2009).

319 Id. at 56283. 320 Maki Hatanaka, Certification, Partnership, and Morality in an Organic Shrimp Network: Rethinking 

Transnational Alternative Agrifood Networks, 38(5) World Development 706, 710 (2010). 321 Albersmeier et al., supra note 3, at 930-933.
Third-Party Programs to Assess Regulatory Compliance

44

auditing organizations may develop detailed checklists, so there is lots of “ticking the boxes” but 

“crucial quality risks can go unnoticed at the same time because they are not specifically 

provided for on the checklist of technical requirements.”322 Moreover, there are reasons that the 

checklists may be favored in third-party programs run by federal agencies. Namely, it removes 

discretion from the auditor, and it may be perceived as more standardized and fair.323 

When constructing third-party programs to serve regulatory purposes, agencies have many 

ways to respond to these various concerns and increase the reliability of third-party 

determinations. 324 With rules regarding how third parties are accredited and how regulated 

entities select third parties, the agency can create a high bar for third-party competence and 

independence. With rules regarding how assessment tasks are performed, an agency can further 

enhance the reliability and consistency of third-party determinations. Importantly, agencies can 

also employ a variety of oversights mechanisms to make sure that third parties comply with 

program rules. 

2. Rates of Compliance

Another metric to assess third-party programs for regulatory purposes can be found in the 

extent to which a program ensures and enhances regulatory compliance. When third-party 

programs are used for regulatory purposes, they should increase– not reduce– rates of 

compliance. A third-party program that enables a greater degree of noncompliance, and thereby

eviscerates or dilutes valuable regulatory protections, cannot be considered a success. 

In many existing regulatory programs, compliance inspections occur infrequently and 

compliance rates are hard to determine. For example, in 2011, about 254,000 foreign food 

facilities and 167,000 domestic food facilities were registered with the FDA.325 With limited 

inspectorial resources (about 1,000 inspectors), FDA inspected only 6% of the 421,000 

registered facilities in 2010.326 Also, according to the FDCA, domestic manufacturers of a class 

II or III medical device shall be inspected by the FDA at least once in every two-year period.327 

However, with limited resources, FDA had not satisfied this biennial inspection mandate. As 

reported by the U.S. General Accountability Office (GAO) in 2008, domestic high-risk facilities 

receive inspections only once every three years and medium-risk facilities only once every five

years.328 While the law does not impose an inspection frequency for foreign manufacturers, those 

that are high-risk are reportedly inspected only once every six years and medium-risk only once 

every 27 years.329 

Third-party programs designed for regulatory purposes can enable more frequent inspections 

and more complete data about compliance. A program may be designed, for example, to require 

 322 Id. at 933. 323 Id. 324 Cf. McAllister, supra note 3. 325 Kathy Gombas & Howard Seltzer, Regulatory Report, The Reportable Food Registry: A Valuable New Tool for 

Preventing Foodborne Illness, FOOD SAFETY MAGAZINE (June/July 2011), available at

http://www.foodsafetymagazine.com/article.asp?id=4117&sub=sub1. 326 ElBoghdady, supra note 42. 327 Guidance for Industry, supra note 170. See also 21 U.S.C §360(h) (containing the statutory requirement). 328 Challenges for FDA, supra note 156, at 1st page (unnumbered).

329 Id.
Third-Party Programs to Assess Regulatory Compliance

45

an assessment of the compliance status of all regulated entities or products each year or every few 

years. Importantly, the mere knowledge that a third party will inspect their activities can change 

the behavior of regulated firms. Evidence suggests that when managers expect outside observers, 

they tend to change how they perform their jobs and how they relate to other managers in ways 

that favor adherence.330 As such, the performance of an individual or group improves when it is 

singled out for observation and study by an outsider.331 Also in third-party assessment processes,

there may be opportunities for third parties to educate and persuade the regulated entity to comply.

Indeed, many third-party programs have been implemented by federal agencies in response 

to a perceived deficit in the agency’s ability to inspect regulated entities. The low inspection 

rates of foreign food facilities by FDA led to the new third-party programs for imported food in 

FSMA. A decade earlier, Congress mandated the AP program due to concern about FDA’s 

inability to conduct inspections every three or five years as legally required. Also, EPA

introduced its third-party program for Energy Star in 2011 after a GAO inspection revealed the 

possibility of fraud and abuse in the previous system of self-declaration. In these programs and 

others, legislators and regulators appear to hope that third-party programs will lead to higher 

compliance rates, and ultimately better regulatory outcomes. 

3. Agency Capacity to Administer the Third-Party Program

Another metric for evaluating third party programs in regulatory contexts is the sufficiency 

of agency resources for establishing and maintaining a program. Judging from existing 

programs, a great deal of agency resources may be required to set up a program. Also, without 

effective governmental oversight, third-party programs may lack transparency and accountability 

and ultimately erode public confidence in regulation and compromise public welfare. Although 

private actors may carry out many tasks in a third-party program, the agency must have the 

strength and resources to ensure that the program is effectively serving regulatory purposes.

Depending to some extent on how a third-party program is designed, a large investment of 

time and resources may be necessary to get it up and running. In particular, if an agency 

approves certification bodies itself instead of delegating this to an accreditation organization, it 

will need to do all the work of establishing the relevant rules and implementing them to verify 

the qualifications of the third parties. Even if an accreditation organization is used, the agency 

will have to establish the relevant rules and oversee the accreditation organization’s 

implementation of them. 

Several existing programs illustrate the challenges involved in accrediting certification 

bodies. In the FDA AP Inspections program, selection and training of APs took many years to 

complete. FDA’s aquacultured shrimp pilot further demonstrates the resource requirements of 

verifying the qualifications of third-parties, particularly when they are outside the US. As part of 

the application process, FDA asked candidate certification bodies (CBs) to assess their own 

conformity with certain attributes that FDA determined were necessary for CB certification 

programs.332 These included, for example, that auditors should understand the food safety issues 

 330 See ASEEM PRAKASH & MATTHEW POTOSKI, THE VOLUNTARY ENVIRONMENTALISTS: GREEN CLUBS, ISO 14001,

AND VOLUNTARY REGULATIONS 60 (2006) (explaining that third-party inspections “mitigate shirking by creating 

incentives for managers within the firm to adhere to program obligations”).

331 Id. at 61–62, 181. 332 Assessment of Pilot for Aquacultured Shrimp, supra note 298.
Third-Party Programs to Assess Regulatory Compliance

46

related to the processes and products they audit; the CB should have a quality assurance program 

that monitors its auditors and audits; and the CB should have sufficient resources, such as 

equipment and infrastructure. The FDA developed self-assessment checklists, and participants 

reported with few exceptions that they met most of the attributes. However, when FDA 

performed its onsite certification program assessments, it found the information in the checklist 

responses was often unsupported by source documents and that the self-assessment checklists 

themselves were not sufficient to assure attainment of the attributes. Ultimately, FDA found that 

most CBs did not fully meet the majority of attributes.333 The FDA concluded that the onsite 

program assessments and associated discussions with CB personnel were critical to FDA’s 

evaluation of the CB programs.334

Through this pilot, moreover, the FDA realized the difficulty of performing such onsite 

assessments. FDA reports that onsite assessments required at least four people to spend three to 

five days at the headquarters of each of the six CBs, four of which were outside the US.335 It also 

found that not all supporting documentation and relevant personnel were available at the 

headquarters and, in this situation, “FDA’s ability to make a full assessment of one or more of 

the program attributes was limited.”336 For the CBs located outside the US, the overseas travel 

and need for translation services further complicated FDA’s assessment efforts.337 

In the final phase of the pilot, FDA observed CBs conducting audits of shrimp processors and 

farms and conducted its own audits of the laboratories CBs used. Spread across seven foreign 

countries, FDA confronted problems in coordinating the schedules of multiple stakeholders (i.e. 

FDA, the CB, the competent authorities in foreign countries, and the processors, farms, and labs 

being audited) and in receiving permission to observe some processors, farms and labs.338 In 

addition, some changes in FDA’s plans were necessitated by international crises and civil unrest 

in countries where audits had been planned.339 Given the difficulties, some CBs conducted 

“mock audits” to accommodate the FDA. FDA concluded that the “coordination among multiple 

stakeholders demanded significant time and resources.”340

Finally, the pilot made clear that agencies that implement third-parties program are likely to 

need to provide training to their own personnel and develop new information technology (IT) 

systems. FDA concluded that operationalizing a third-party certification program in the future 

would require “establishing robust formal training for Agency personnel involved in on-site 

program assessments and performance audits of CB auditors and supporting laboratories.”341 The 

pilot, which involved only six CBs, taxed existing FDA infrastructure and indicated “that an 

operating program in the future would need additional resources to be successful, as well as a 

 333 Id. at 13, tbl. 3 334 Id. at 11. 335 Id. at 11, 6 tbl. 1 336 Id. at 12. 337 Id. at 25 (“Language barriers and different operating models and paradigms (i.e. industry vs. regulatory) made 

understanding between FDA and the CBs challenging and clear communication even more critical” and “It should 

be noted that the number of interpreters needed for a full-scale third-party certification program are likely to be 

substantial.”)

338 Id. at 16. 

339 Id. at 16 340 Id. at 24. 341 Id. at 25.
Third-Party Programs to Assess Regulatory Compliance

47

central coordinating point within the Agency.”342 Moreover, FDA reported that “current IT 

systems and databases were not designed to accommodate third-party certification audits” and 

“more in-depth evaluation, updating, and the potential development of new systems and 

databases” would be required for FDA to operationalize a third-party certification program.343 

Energy Star provides an example of a program in which the agency delegates accreditation to 

private accreditation bodies. The accreditation bodies that accredit laboratories must themselves 

be approved by EPA. EPA relies extensively on that accreditation and does little oversight of 

accredited labs. The accreditation bodies that accredit CBs do not need specific EPA approval; 

any accreditation body that is a signatory to the IAF MLA may accredit Energy Star CBs. The 

accreditation bodies are responsible for conducting periodic assessments of the CBs they 

accredit, and the Energy Star program itself conducts additional oversight including audits of 

product certifications.

344 

Existing programs show that agencies may have difficulty maintaining the resources needed 

to provide adequate oversight. In 2010, the USDA Office of Inspector General (OIG) found 

deficiencies in AMS’s oversight of NOP certifying agents and organic operations.345 OIG also 

found that NOP officials did not make required onsite assessments and did not identify 

inconsistencies in implementation of NOP regulations.346 Lacking sufficiently specific rules and 

adequate oversight, certification agents developed different criteria for determining whether noncompliances were present and whether they were major or minor.347 OIG concluded that “AMS 

did not ensure consistent oversight of organic operations by its certifying agents.”348 This lack of 

oversight, in turn, undermined the overarching goal of NOP “to assure consumers that products 

meet consistent, uniform standards.”349 

The OIG found even more serious deficiencies in AMS’s oversight of foreign certifying 

agents.350 AMS is required to make onsite reviews of foreign certifying agents, but 5 of 44 never 

received such a review and 24 of 44 received reviews more than two years after receiving their 

conditional accreditation. The NOP had underestimated the number of applications they would

receive when the program began in 2002 and had failed to develop a policy to handle the review 

of certifying agents located in countries with travel warnings issued by the Department of 

State.351 When NOP reviews were performed, NOP officials often found that certifying agents 

 342 Id. at 23. 343 Id. at 24-25. 344 See EPA, Conditions and Criteria for Recognition of Certification Bodies, supra note 276, at 1(i) (authorizing 

EPA to conduct audits at its discretion); Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 

6, 2012 (mentioning that Energy Star picked at random some product categories and had CBs send all related 

certification files).

345 USDA Office of the Inspector General (OIG), Oversight of the National Organic Program, Audit Report 01601-

03-Hy (March 2010), at 29-30. 346 USDA OIG, supra note 345, at 3. 347 Id. at 21-27 (describing how NOP lacked clear and sufficiently focused rules and did not oversee their 

implementation). 

348 Id. at 21.

349 Id. 350 Id. at 28-29. 351 Id.
Third-Party Programs to Assess Regulatory Compliance

48

committed major noncompliances such as failing to identify mislabeled products, maintain 

complete certification files, and complete annual conflict of interest disclosures.352

The response of AMS to the OIG report indicates that the root of the problem was that the 

NOP program lacked sufficient resources. AMS stated that the NOP budget had increased in 

2009 to $3.87 million and its staff to 16, and that a 3.1 million dollar budget increase in 2010 

would enable the program to grow to 31 staff members.

353 In 2007, the NOP had just nine staff 

members and an annual budget of $1.5 million.354

It is worth noting that the international scope of many third-party programs interacts with the 

issue of governmental oversight. The international dimensions of certain regulatory objectives 

like food safety may make third-party programs particularly attractive, but these same 

international dimensions complicate oversight. Not only may effective oversight be more costly, 

but the agency may not have the authority in foreign jurisdiction to do the kinds of oversight it 

would do in a domestic context. 

4. Public Acceptance

Another metric of success is the support and acceptance that the third-party program receives 

from stakeholders. The most relevant stakeholders are the concerned public (the beneficiaries of 

regulation) and the regulated industry (the target of regulation). Issues relevant to the industry’s 

acceptance of a program are discussed in the section that follows.

One gauge of public support for regulatory change consists of the comments received by 

agencies in response to rulemaking processes and other requests for comments. The public is 

often represented by non-governmental organizations. While most third-party programs 

described in this report have garnered little public attention, there are a couple exceptions.

 

First, NGOs concerned with food safety have been very wary of the introduction of thirdparty auditors into the FDA’s regulatory framework. In comments to the agency, one NGO 

acknowledged that FSMA authorizes third-party certification for imported food, but emphasizes 

that “the law does not permit it for domestic facilities.”355 The commenter then stresses the need 

for the agency to rigorously apply conflict-of-interest requirements and otherwise conduct 

oversight of third-party auditors. Another NGO criticizes the legislative decision to allow FDA 

to rely on third-party auditors for regulatory audits, regretting that FDA will “expend precious 

resources” developing conflict-of-interest standards and overseeing third parties. It cites failures 

in the National Organic Program356 and private food safety audits357 to support its conclusion 

 352 Id. 353 Id. at appended back pages (AMS response). 354 Uncle Matt’s Organic Blog, http://unclematts.com/dev/how-to-add-oomph-to-organic/ (last visited Sept. 11, 

2012).

355 Comment of Make Our Food Safe and Safe Food Coalition, Docket Nos. FDA-2011-N-0145, § 303, Authority to 

require import certifications for food & FDA-2011-N-0146, § 307, Accreditation of Third-Party

Auditors (Apr. 29, 2011).

356 Cf. USDA OIG, supra note 345 (finding that AMS fails to adequately oversee NOP third parties). 357 A prominent such failure involved the salmonella outbreak caused by peanuts processed by Peanut Corporation 

of America in a facility that had received a superior rating in a private food safety audit required by a buyer, Kellogg 
Third-Party Programs to Assess Regulatory Compliance

49

that FDA “should invest its resources into doing as many as the imported food inspections itself 

and should avoid at all costs a reliance on a privatized inspection system.”358

In the product safety arena, NGOs have been more supportive of third-party testing. Major 

consumer NGOs such as the Consumer Federation of America and US PIRG expressed strong

support for “a CPSC-administered, third party safety certification program for monitoring the 

safety of all products” before the passage of the CPSIA in 2008.359 In the aftermath of its 

passage, they have participated in the regulatory process to voice support for a strong third-party 

testing system.360 

A common concern of NGOs regarding the use of third-party inspection and certification 

systems is that they will weaken governmental accountability and transparency. A food-safety 

NGO, for example, expresses a preference for inspections performed by FDA, other US 

agencies, or foreign governments (in that order) over inspections by third-party auditors, as the 

latter “may not have the same public health objective or may not be supported by the same level 

of expertise, training, resources, and accountability as are FDA inspectors.”361 When the Energy

Star program announced its intention to establish a third-party verification and testing program, 

an environmental NGO expressed strong support but stressed the need for “complete 

transparency of the program’s procedures and testing results.”362

5. Industry Acceptance

The other major group of stakeholders consists of the regulated entities. A very common 

reaction to an agency’s announcement that it is implementing a third-party verification program 

is industry concern about costs. Indeed, a third-party program will often shift some of the costs 

of inspection and compliance assessment from the government to industry.363 To augment 

industry support, third-party programs should reduce the burden on industry as much as possible

while still achieving regulatory objectives. Third-party programs may also be able to provide 

benefits to industry, for example, by reducing the processing times of product approvals 

 

Corp. See Jim Prevor’s Perishable Pundit, Lessons From The Peanut Salmonella Outbreak: Audit System Broken, 

http://www.perishablepundit.com/index.php?date=02/19/09&pundit=1 (last visited Sept. 11, 2012). 358 Comment of Food & Water Watch, Docket Nos. FDA-2011-N-0145, § 303, Authority to require import 

certifications for food & FDA-2011-N-0146, § 307, Accreditation of Third-Party

Auditors (Apr. 29, 2011).

359 Letter from Consumers Union to The Honorable Daniel K. Inouye (Oct. 26, 2007), available at

http://www.consumersunion.org/pub/2007/10/005073print.html (last visited Sept. 11, 2012). 360 Comments of Consumers Union, Consumer Federation of America, Kids in Danger, and the U.S. Public Interest 

Research Group to the U.S. Consumer Product Safety Commission on “Notice of Requirements for Accreditation of 

Third Party Conformity Assessment Bodies to Assess Conformity with Part 1215 of Title 16, Code of Federal 

Regulations” (July 6, 2010), available at

http://www.consumerfed.org/elements/www.consumerfed.org/file/Comments%20on%203PT%20Bath%20Seats%2

0(Final)%20(2).pdf (last visited Sept. 11, 2012). 361 Comment of Make Our Food Safe and Safe Food Coalition, supra note 355. 362 Comment of Natural Resources Defense Council, NRDC’s Comments on Energy Star’s Proposed Enhanced 

Testing and Verification Program 4 (April 30, 2010) (emphasis on “complete transparency” removed from original), 

available at 

http://www.energystar.gov/ia/partners/downloads/mou/Natural_Resources_Defense_Council_Comments.pdf. 363 See McAllister, supra note 3, at 27.
Third-Party Programs to Assess Regulatory Compliance

50

applications and by creating a single approval process that satisfies various national jurisdictions. 

Notably, third-party programs raise special concerns about costs for small businesses. 

One important way to contain costs in a third-party program is to ensure that there are a 

sufficient number of third parties to create competition among them.364 A representative of the 

Energy Star program stated that the primary way that the program responded to industry 

concerns about third-party certification was by encouraging the rapid development of a strong 

market of certification bodies and laboratories.365 In contrast, in the FDA’s AP program, it took 

the agency many years to get APs through all required training and cleared to conduct 

independent inspections. By May 2008, four years after the program was established, only 8 APs 

out of 16 had completed all training.366 Because of the delays, few APs were available to 

conduct independent inspections in the early years of the program. 

As an agency seeks to encourage a competitive market, however, certain precautions need to 

be taken. First, an agency should not unduly lower its requirements for competence and 

independence in order to accredit more third parties. In the AP program, for example, the 

training that was given may have been essential for APs to adequately carry out their tasks. 

Second, an agency should establish program rules to ensure that third parties cannot compete in 

ways that compromise the quality of the assessment. The agency can require in its program 

rules, for example, that third parties inspect a certain number of product samples or make a 

certain number of site visits to a manufacturing facility. 

The CPSC’s third-party program for the testing of children’s products has provoked 

substantial industry resistance. As the CPSC has developed regulations, product manufacturers 

have repeatedly expressed concerns about the cost of the required third-parting testing. It was 

clear that these concerns had reached Congress when it amended the CPSIA in August 2011. 367

The amendments gave the CPSC new authority to exempt qualifying small batch manufacturers 

(mostly small businesses) from third-party testing. They also required the CPSC to issue a 

request for public comments on opportunities to reduce the cost of third-party testing 

requirements. 

Manufacturers expressed many concerns about the costs of third-party testing in their 

comments.368 They recommended for example that CPSC exempt more individual products and 

categories of products by regulation; that CPSC make additional attempts to reduce testing 

requirements based on the actual likelihood of exposure; and that CPSC increase efforts to 

 364 Cf. Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012 (discussing that Energy 

Star sought to keep costs low for regulated entities by encouraging the participation of a sufficient number of CBs 

and labs to create the possibility for competition among them). 365 Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012. 366 U.S. Gov’t Accountability Office, GAO-08-780T, Medical Devices: FDA Faces Challenges in Conducting 

Inspections of Foreign Manufacturing Establishments 19 (May 14, 2008), available at

http://www.gao.gov/products/GAO-08-780T. 367 H.R. 2715, Pub. L. No. 112-28 (Aug. 12, 2011) (creating a new section 14(i)(3)(A) of the CPSA); 15 U.S.C.

§ 2063(i)(3); Application of Third Party Testing Requirements; Reducing Third Party Testing Burdens, 76 Fed. 

Reg. 69596 (Nov. 8, 2011); Public Comments in response are available at regulations.gov, Docket No. CPSC–2011-

0081 (listing 22 comments).

368 Comments on Application of Third Party Testing Requirements; Reducing Third Party Testing Burdens, COSC 

Docket No. CPSC-2011-0081; available at www.regulations.gov. 
Third-Party Programs to Assess Regulatory Compliance

51

harmonize federal, international and state laws applicable to consumer products. Other 

suggestions included decreasing the frequency of retesting and allowing more retesting to be 

done by the manufacturers themselves rather than a third-party lab.369 

Small manufacturers have been most concerned about the new third-party testing 

requirements. A trade association of small jewelry makers complains of the unreasonable cost 

burdens imposed by the CPSIA.370 It reports that almost one quarter of its members “have 

reduced their children’s products offerings, and 16% have exited the children’s jewelry market 

entirely.”371 A European maker of heirloom quality toys calls third-party testing of its small 

batches “prohibitive and impossible” and warns that “specialized toys with high playing value 

will disappear from the US market” if the CPSIA is not amended. 372 This manufacturer and 

others small manufacturers from Europe request that the CPSA exempt products tested to the

European safety standards from CPSIA’s third-party testing requirements.373 Also, a 

manufacturer that describes itself as “medium-sized” expressed that the exemption for smallbatch manufacturers does not cover all low-volume manufacturers, even though they too are 

considerably different from large volume manufacturers.374 

In Energy Star, manufacturers also voiced concerns about the cost of third-party certification. 

As reported in a 2011 study of Energy Star by the GAO, “Almost all the manufacturing partners 

we spoke with stated the cost to participate in the program had increased. Some manufacturing 

partners—particularly small manufacturers or manufacturers with few Energy Star products—

also told us the increasing costs could discourage their participation.”375 Energy Star program 

staff, however, perceive widespread acceptance of the new rules and have not noticed a drop in 

applications for the Energy Star label.376

As in the case of the CPSC rule, small businesses have been particularly concerned about the 

new costs of certification. If they are not able to afford certification for their products, their 

consumer base may be reduced. Also delays in getting products to market may be more 

prejudicial to small than large companies. As stated by one commenter on the Watersense 

program, “High cost will discourage manufacturers, especially small ones, from participating in 

the process at all.”377 In effect, the costs of third-party certification may benefit larger 

companies at the expense of smaller ones. 

 369 Id. (see especially comments submitted by the Society of the Plastics Industry, Inc.; the Toy Industry 

Association; and Libbey). 370 Id. (see comments submitted by the Fashion Jewelry and Accessories Trade Association). 371 Id. at 11. 372 Id. (see comments of Glueckskaefer). 373 Id. (see comments of Fagus and Grimm’s). 374 Id. (see comments of Orbit Baby, Inc.). 375 Comment, McGowan to Vokes (April 28, 2010) (in which the American Lighting Association reported that it had 

surveyed its members and 3/19 said the changes would cause them to end their participation in Energy Star and 

15/19 said the changes would cause them to limit the number of fixtures they submit for certification). 376 Interview (by phone), Eamon Monahan, EPA Energy Star Program, August 6, 2012. 377 EPA Watersense, Comments on the May 2007 Draft WaterSense Certification Scheme 19 (Nov. 2007), available 

at http://www.epa.gov/WaterSense/docs/cert_scheme_comments508.pdf. 
Third-Party Programs to Assess Regulatory Compliance

52

The Small Business Administration’s Office of Advocacy has been concerned about thirdparty programs.378 One concern is that once agencies shift the costs of inspection to industry, the 

government will not be as limited in imposing regulatory requirements. Also, whereas many 

governmental programs establish a lower fee for small businesses, third parties are not as likely 

to be as concerned with the affordability to small businesses. The Office of Advocacy suggests 

that when agencies establish third-party programs, they should consider mechanisms to help 

reduce the burden on small businesses.

While a third-party program is likely to impose costs, it may also impart benefits that were 

not available without the program. The TCB program, for example, cut the approval time of 

telecommunications equipment from 30 to 90 days in the late 1990s to often just a few days.

379 

In addition, a program may be designed such that a third-party assessment satisfies the regulatory 

requirements of both the US and other countries. FDA reports that it is currently developing a 

“single audit program” for medical devices that would result in “a saving of audit/inspection time 

in person days (and associated costs) and less disruption of the manufacturer’s day-to-day 

operations; and greater control over the scheduling of regulatory audits/inspections.”380

Factors aside from costs and benefits may also play a role in how industry reacts to a thirdparty program. A third-party program may be well-explained and well-implemented by an 

agency, or it may not be. In the latter case, industry is more likely to find the program to be 

overly complex and objectionable. 

B. Incentives to Participate When Use of Third Parties is Voluntary

Programs in which regulated entities have a choice as to whether to contract with a third 

party have an additional metric of success: the rate of regulated entity participation. If regulated 

entities do not use a program, then the resources an agency used to create it may seem wasted. 

Differences in participation in three programs described in this paper illustrate the situation: 

FDA’s AP Inspections program for medical device production facilities; FDA’s 510(k) ThirdParty Review program for medical devices; and FCC’s TCB program. 

The FDA’s Inspections by AP program has had a very low rate of participation. Despite an 

estimated 8,000 manufacturers that could use the program,

381 only 80 independent inspections 

(i.e. unaccompanied by FDA inspectors) have been conducted by APs in eight years of program 

operation.

382 The FDA had hoped that manufacturers would be attracted by the possibility that a 

single AP inspection might satisfy regulatory requirements in multiple jurisdictions.383 

 378 Interview (by phone), David Rostker, Assistant Chief Counsel, Office of Advocacy, U.S. Small Business 

Administration, Aug. 17, 2012.

379 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. 380 PMAP report, supra note 165, at 4. 381 Agency Information Collection Activities; Proposed Collection; Comment Request; Manufacturer’s Notification 

of the Intent To Use an Accredited Person Under the Accredited Persons Inspection Program Authorized by Section 

228 of the Food and Drug Administration Amendments Act of 2007, 76 Fed. Reg. 29764, 29765 (May 23, 2011) 

(reporting FDA’s estimate that there are 4,000 domestic manufacturers and 4,000 foreign manufacturers that are 

eligible for inclusion in the AP program). 382 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012. 383 Status of FDA’s Program, supra note 147, at 13. This could occur if the same inspection could serve to both 

verify the manufacturer’s compliance with the FDA’s QS regulation and the manufacturer’s conformity with “ISO 
Third-Party Programs to Assess Regulatory Compliance

53

However, the effect of this incentive has been limited because manufacturers have had doubts 

that APs could cover the multiple requirements of various standards in a single inspection.384

Also, the program allows manufacturer to control the scheduling of inspections385 and offers a 

two-year inspection holiday from regular FDA inspections. 

Many disincentives to participation also exist. Under the AP Program, manufacturers have to 

bear the cost of the inspection, whereas FDA inspections are free. Moreover, the manufacturer 

may not think an FDA inspection will occur in the near future, and an AP inspection may result 

in further regulatory action.386 As reported by the GAO, “one industry representative questioned 

why manufacturers would ask for—and pay for—inspections when the result could be that FDA 

closes them down.”387 Manufacturers expressed concern that, because FDA makes the final 

determination of compliance with its requirements, FDA might want to conduct an additional 

inspection after reading the report prepared by the third-party inspector.388 Observing the very 

small number of AP inspections in 2008, the GAO stated it raised “questions about the 

practicality and effectiveness of establishing similar programs that rely on third parties to help 

FDA fulfill other responsibilities”389

The FDA’s 510(k) pre-market third-party review program has attracted more participation 

than the AP Inspections program. As described above, this program enables certain 

manufacturers to contract with third parties to certify that products they intend to market. The 

FDA reported in July 2012 that about 8% of all 510(k) submissions are received from third 

parties, which is close to 300 submissions annually.390 One difference between the AP 

inspection and pre-market programs is that in the latter, device manufacturers pay FDA a user 

fee if they do not go through an AP. In FY 2012, the fee is $4,049 ($2,024 for qualified small 

businesses).

391 However, it is likely that the user fee is lower than the amount that the 

manufacturer pays to a private third party.392

Another incentive that is present in the premarket program but not in the AP inspections 

program is that manufacturers want this review to happen expeditiously in order to get their 

products to market more quickly. According to the FDA, 510(k)s reviewed by APs in 2002 

received FDA marketing clearance 29% faster compared to 510(k)s reviewed entirely by 

 

13485: Medical devices -- Quality management systems -- Requirements for regulatory purposes,” which many 

other countries use as their standard. See also infra note 434 and accompanying text. 384 Id. By being able to schedule inspections, they are able to minimize facility disruptions and ensure that the 

necessary personnel and documentation is on hand at the right time. Also, FDA may only give a week of notice of 

an inspection, but AP inspections can be scheduled months in advance. See Interview (by phone), David Kalins, 

Office of Compliance, CDRH, FDA, July 31, 2012.

385 Status of FDA’s Program, supra note 147, at 13. 386 Id. at 15. 387 Id. at 16. 388 Id.

389 Challenges for FDA, supra note 156, at 6-7 (reporting 7 inspections between Mar. 2004 and Jan. 2008).

390 Email from Jean Cooper, Senior Staff Fellow, U.S. Food and Drug Administration, July 17, 2012. 391 FDA, Premarket Notification [510(k)] Review Fees, 

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/HowtoMarketYourDevice/PremarketSubmissio

ns/PremarketNotification510k/ucm134566.htm (last visited Sept. 11, 2012). MDUFMA, enacted in 2002, gave 

FDA authorization to charge manufacturers fees for premarket review. See id. 392 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012.
Third-Party Programs to Assess Regulatory Compliance

54

FDA.393 FDA also highlights that the APs generally “have specialized expertise in areas that 

may be helpful to 510(k) submitters, such as device testing, standards, or foreign regulatory 

requirements” and that they have locations throughout the world “so they often can provide local 

service.”394

In the FCC’s TCB program, there is a very high participation rate for eligible products and 

third-party review has become the norm. In 2011, 98.5% of equipment authorization 

certifications (13,427 out of 13,645) were issued by TCBs rather than the FCC.395 FCC staff 

explains that companies prefer going to TCBs because their products are approved more quickly 

and they can get to market faster.396 In the late 1990s, product certifications were all conducted 

by the FCC and processing times tended to range from 30 to 90 days. Presently, certifications 

conducted by TCBs may take just a few days. The 1.5% of certifications that continue to be 

conducted by FCC tend to involve new technology that the FCC excludes from TCB approval 

until it published a measurement procedure.397 Also, given that the FCC charges fees for 

certifications, the costs of using a TCB may be lower. In 2011, the FCC’s device certification 

fees ranged from $490 to $1265.398

In sum, voluntary programs have varied greatly in terms of the costs and benefits of 

participation, and participation rates have reflected this variation. As illustrated by the AP 

Program, if the costs to participate are high and the offsetting benefits are not clear, firms will 

not participate. On the other hand, the TCB program shows that in different circumstances, 

optional third-party certification may become the industry’s preference.

V. Recommendations to Federal Agencies

This section sets forth recommendations to federal agencies regarding the use of private third 

parties for regulatory purposes. Regulatory third-party programs pose risks. If third party 

programs are not well-conceived and well-operated, they may both undermine the achievement 

of regulatory goals and impose high costs on regulated entities. Yet, third-party programs also 

offer benefits. By harnessing conformity assessment expertise in the private sector, they may 

extend the reach of regulatory agencies in ways that increase regulatory compliance and 

otherwise improve the performance of regulated entities and products. The recommendations

discussed below seek to help agencies minimize the risks and maximize the benefits of thirdparty programs. 

The first important question that agencies face may be whether or not to establish a thirdparty program. Alternatively, Congress may have directed the agency to develop a third-party 

program. Of the eight programs surveyed in this report, four were explicitly required by 

 393 FDA, Medical Devices, Third-Party Review, http://www.fda.gov/MedicalDevices/Device

RegulationandGuidance/HowtoMarketYourDevice/PremarketSubmissions/ThirdParyReview/default.htm#3 (last 

visited Sept. 11, 2012).

394 Id.

395 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012 (data on 

file with author).

396 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. 397 Id.; see also TCB Program Rules, supra note 213, at 4.

398 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012; see also 

http://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=41712&switch=P.
Third-Party Programs to Assess Regulatory Compliance

55

Congress.399 The first set of recommendations below is targeted to situations in which agencies 

are themselves deciding whether to establish a third-party program. However, aspects of the 

recommendations will also be useful when agencies are required to do so.

Agencies that are charged with or make the choice to establish a third-party program will 

need to write the rules by which the program will operate. The key rules of a third-party program 

can be categorized into several types: accreditation rules, which determine who may be approved 

as a third party; selection rules, which govern how regulated entities select third parties; 

performance rules, which specify how third-party testing and certification should be performed; 

and reporting rules, which set forth what information is provided to the regulatory agency by 

various program actors.400 Moreover, the agency must make decisions about how it will conduct 

oversight and enforce these rules.401 

When a third-party program is required by statute, certain characteristics of the third-party 

program may already be determined. Yet, within the constraints of the statute, agencies are still 

likely to have many options regarding program design. The second set of recommendations 

regards how to establish a third-party program, with most relevance to program aspects that have 

not been statutorily determined. 

A. Deciding Whether to Use a Third-Party Program

1. Consult governmental and non-governmental resources relating to third-party conformity 

assessment 

There are several important governmental and nongovernmental resources available to 

agencies considering third-party programs. The federal government has developed expertise in 

conformity assessment since the passage of the National Technology Transfer and Advancement 

Act of 1995 (NTTAA). Most importantly, the NTTAA directed NIST to coordinate the 

conformity assessment activities of governmental and private sector entities with the goal of 

eliminating unnecessary duplication and complexity.

402 Also, in 1998, the Office and 

Management and Budget’s Circular A-119 instructed NIST to write guidance for agencies to 

ensure effective coordination of governmental and private conformity assessment activities.403

NIST published this guidance in 2000.404

The Standards Services Division of NIST is available to consult with agencies interested in 

incorporating third-party conformity assessment processes into their regulatory processes. Upon 

the request of an agency, NIST staff can become involved in helping an agency design a thirdparty program. For example, in the WaterSense program, the chief of the Standards Services 

Division essentially functioned as part of WaterSense staff for a few months to explain the 

 399 The four that were required explicitly by Congress are the FDA programs for food imports, the CPSC program 

for children’s products, the FDA programs for medical devices, and the USDA National Organic Program. 400 Cf. McAllister, supra note 3, at 47-59. 401 Id. at 59-61. 402 P.L. 104-113, § 12(d)(1) (codified at 15 U.S.C. § 272); see also NIST, Guidance on Federal Conformity 

Assessment Activities, 65 Fed. Reg. 48894 (Aug. 10, 2000). 403 OMB Circular A-119 Revised §§ 8, 13(e) (Feb. 10, 1998). 404 NIST Guidance, supra note 402.
Third-Party Programs to Assess Regulatory Compliance

56

relevant ISO standards and help establish the third-party program.405 NIST coordinates the 

Interagency Committee on Standards Policy (ICSP), which consists of one principal 

representative from each federal executive agency, who is referred to as the “agency standards 

executive.” According to NIST’s guidance, agency standards executives are responsible for, 

inter alia, promoting the development of agency positions on conformity assessment related 

issues that are in the public interest; ensuring that agency participation in conformity assessment 

related activities is consistent with agency missions, authorities, priorities, and budgets; and 

establishing an ongoing process for identifying efficiencies that can be achieved through 

coordination with other agency and private sector conformity assessment activities.406

NIST also runs the NVCASE program, which has responsibility for recognizing the private 

accreditation bodies that accredit TCBs for the FCC. To confer recognition, NVCASE performs 

an initial assessment of the accreditation body and then performs a reassessment every two years 

to ensure that it continues to operate in accordance with ISO/IEC 17011.

407 Under its 

regulations, NIST accepts requests to perform these functions only in certain situations.408 

Otherwise, private accreditation bodies can be recognized directly by federal agencies, and the 

assessment role played by NVCASE may be performed instead by an international organization 

like the IAF (for certification bodies) or ILAC (for laboratories).409

OMB and NIST are both currently considering revising their guidance to agencies regarding 

conformity assessment. In March 2012, OMB issued a request for information and notice of 

public workshop regarding, inter alia, whether A-119 should be revised to set out relevant 

principles on conformity assessment.

410 NIST has also expressed an interest in revising its 2000 

guidance.411 

Agencies can also tap into expertise about conformity assessment that exists in private 

standards organizations. Most significantly, agencies should become familiar with ISO’s

 405 Interview (by phone), Stephanie Tanner, WaterSense Program, U.S. Environmental Protection Agency, Aug. 10, 

2012.

406 NIST Guidance, supra note 402, § 287.5. See also OMB Circular A-119, supra note 403, § 15 (setting forth the 

roles of the ICSP and standards executives). 407 Interview, Ramona Saar (by phone), Standards Services Division, National Institute of Standards and 

Technology, Aug. 24, 2012 (explaining that NVCASE ensures that the accreditation bodies operate in accordance 

with ISO/IEC17011 in accrediting TCBs to ISO/IEC Guide 65 and the FCC’s technical requirements for TCBs). 408 15 C.F.R. § 286.2, available at http://gsi.nist.gov/global/docs/NVCASE_CFR.pdf (stating that NIST accepts 

requests for recognition of accreditation bodies “when (i) directed by U.S. law; (ii) requested by another U.S. 

government agency; or (iii) requested to respond to a specific U.S. industrial or technical need, relative to a 

mandatory foreign technical requirement, if it has been determined after public consultation that (A) there is no 

satisfactory accreditation alternative available and the private sector has declined to make acceptable accreditation 

available, and (B) there is evidence that significant public disadvantage would result from the absence of any 

alternative”). 409 Interview (by phone), Ramona Saar, Standards Services Division, National Institute of Standards and 

Technology, Aug. 24, 2012 (explaining that NVCASE does a reassessment every two years whereas the IAF and 

ILAC do a reassessment every 4 years). See also supra notes 19 - 21 and accompanying text. 410 77 Fed. Reg. 19357 (Mar. 30, 2012). 411 Id.
Third-Party Programs to Assess Regulatory Compliance

57

conformity assessment standards and guides, referred to collectively as the conformity 

assessment (or CASCO) toolbox.412

It is important to note, however, that ISO standards and guides are ordinarily subject to 

copyright restrictions. Some have suggested that this could potentially present a barrier to wider 

use of standardized conformity assessment in regulatory programs if the cost of purchasing 

copyrighted standards is high and other reasonable means of accessing the materials are not 

available to regulated entities and other stakeholders.

413 Several documents that provide context 

for and explain these standards are publicly available.414

2. Consider the characteristics of the regulatory standards and the regulatory target

Different types of regulatory standards and environments entail different considerations 

about the suitability of a third-party program. While particular characteristics may not preclude 

or determine suitability, they may weigh in favor or against. 

The regulatory standards used in a third-party program should facilitate the objective 

assessment of conformity. When possible, standards should be quantitative and the qualities of 

interest should be measurable.415 In the absence of objective standards, the risk of unreliability 

and inconsistency in the determinations of third parties becomes higher. Notably, the majority of 

programs surveyed above involve product standards that lend themselves to objective 

measurement (e.g. the CPSC program, FDA’s premarket program, the FCC Program, the OSHA 

program, and the EPA Energy Star and WaterSense programs). 

When noncompliance with the regulatory standard implies significant risks to health, safety 

or other highly valued regulatory interests, a third-party program may also be less suitable. 

Inherently, reliance on third parties reduces the agency’s control over regulatory implementation. 

 412 ISO/UNIDO, supra note 10, at 170-174 (providing a chart of all standards and guides related to conformity 

assessment). 413 See Administrative Conference of the United States, Recommendation 2011-5, Incorporation by Reference, 77 

Fed. Reg. 2,257 (Jan. 17, 2011), available at http://www.acus.gov/research/the-conference-currentprojects/incorporation-by-reference/ (recommending best practices for federal agencies that incorporate by reference 

extrinsic materials, including voluntary consensus standards, into regulations); see also Emily S. Bremer, 

Incorporation by Reference in Federal Regulations, Report to the Administrative Conference 26-32 (Oct. 19, 2011) 

(discussing ways agencies have increased public access to copyrighted standards); Comments of Scott Rafferty in 

Response to Request for Information OMB-2012-0003 at 10-11 (posted May 18, 2012) (noting high cost of ISO 

standards and suggesting that “lack of meaningful access is a particularly serious barrier to wider use of standardized 

conformity assessment in federal regulatory programs... Agencies can be reluctant to delegate inspection or audit 

functions if the procedural and operational principles are not openly posted on the internet.”). 414 See especially ISO/UNIDO, supra note 10; ANSI, National Conformity Assessment Principles for the United 

States (2007), available at

http://publicaa.ansi.org/sites/apdl/Documents/News%20and%20Publications/Brochures/NCAP%20second%20editio

n.pdf; USTR, supra note 20; Johnson, supra note 6; Gordon Gillerman, Making the Confidence Connection: 

Conformity Assessment System Design, ASTM Standardization News (December 2004), available at 

http://www.astm.org/SNEWS/DECEMBER_2004/gillerman_dec04.html; Maureen A. Breitenberg, NIST, The 

ABC’s of the U.S. Conformity Assessment System (April 1997), available at

http://gsi.nist.gov/global/docs/pubs/NISTIR_6014.pdf; National Research Council, supra note 28. 415 Hatanaka, supra note 320, at 708 (emphasizing the importance of measurability and stating that “that which is 

being audited must be clearly identifiable, that is, it must be objective in the sense that it is (at least in principle) 

independently verifiable”).
Third-Party Programs to Assess Regulatory Compliance

58

If it is of paramount importance that a certain negative regulatory outcome be prevented, then the 

agency should retain full regulatory control. Moreover, if the risks associated with 

noncompliance are high, a more complete and costly conformity assessment system is warranted. 

At some point, the costs of operating and overseeing the third-party program may be so high as 

to exceed the costs of direct regulatory implementation and enforcement. As explained by a 

NIST official, the more control that is needed, the greater the resources that are required.

416

Along these lines, voluntary regulatory standards established to confer a marketing label may 

be more suited to a third-party program than mandatory standards that directly protect public 

health and safety. Among the programs surveyed, the NOP, Energy Star, and WaterSense are 

the best examples of the former.417 When a program confers a marketing label, a failure in the 

compliance assessment system has a more limited impact than when a program is established 

directly to protect health and safety. Of course, the impact may still be significant and there is an 

important governmental interest in the integrity of the marketing labels that agencies establish. 

The CPSC program and the various FDA programs, in contrast, involve mandatory standards

designed to protect public health and safety. In some ways, this represents the most difficult case 

for third-party compliance assessment. Notably, these programs were all created directly by 

Congress in response to perceived deficiencies in the ability of the responsible agencies to 

conduct an adequate level of testing or inspections directly. 

Relatedly, a third-party program may be more suitable when the standard is a voluntary 

consensus standard (VCS) rather than a governmental-unique standard. In the NRTL program, 

the standards are all VCSs; in the CPSC program, some of the standards are VCSs. When the 

standard is a VCS, private sector bodies may already familiar with it and have relevant 

experience testing or certifying to it. Also, if the standard to be applied in the program is an 

international standard, it becomes more likely that regulated entities will be able to utilize a 

single third-party conformity assessment process to satisfy multiple regulatory jurisdictions.418

Finally, when the regulated product or activity (the regulatory target) is international in scope 

because of international trade, it may be better suited to a third-party program. Many of the 

existing programs have regulatory targets with significant international dimensions. FDA’s 

program for food safety is specifically focused on imported food. Children’s products, medical 

devices, telecommunications equipment, electrical equipment, organic food, and energy- and 

water-efficient products are all often manufactured in an international production chain. Thirdparty programs enable regulatory agencies to extend their reach outside national borders by 

incorporating private actors around the globe. On the other hand, a new challenge arises:

agencies may have difficulty overseeing the private actors operating in other countries. 

 416 Interview (by phone), Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and 

Technology, Aug. 15, 2012. 

417 The NRTL program similarly confers a label, but it is different in that OSHA-regulated workplaces are required 

to use labeled products and that the label is more related to health and safety than the other three programs. 

418 An example is provided by ISO 13485, which by its name explicitly sets forth standards for quality management 

systems for regulatory purposes. An FDA official explained that ISO 13485 is directly used in the regulation of 

many other countries and could become the US regulatory standard in the future. Interview (by phone), David 

Kalins, Office of Compliance, CDRH, FDA, July 31, 2012. The official further explained that FDA’s current QS 

regulation is similar in many ways but demands more evidence that the quality system is being effectively 

implemented. Id.
Third-Party Programs to Assess Regulatory Compliance

59

3. Compare the benefits and drawbacks of third-party programs with other approaches

Agencies that are considering third-party compliance assessment programs to achieve 

regulatory goals should compare this approach with others. Most importantly, the agency should 

compare a third-party approach with direct governmental compliance assessment and with 

requiring regulated entities to make a self-declaration of compliance.

An evaluation that EPA undertook when it decided not to require third-party certification of 

greenhouse gas emissions reports provides a good example.

419 EPA commissioned a report that 

evaluated three options: (1) facility self-certification and third-party verification paid for by the 

reporting companies (i.e. third-party certification); (2) Facility self-certification with EPA 

verification of submitted data (i.e. direct governmental compliance assessment); and (3) Facility 

self-certification with little or no independent verification of submitted data (i.e. self-declaration 

of compliance). 

There may be situations in which self-declaration can serve the regulatory purpose at hand.420 

Some regulatory programs may involve “low to medium-risk areas in which market 

mechanisms... can mitigate the negative consequences associated with non-compliances before 

those consequences are intolerable to society.”421 Some voluntary regulatory programs that 

confer marketing labels may fit this description well. However, if an agency is considering a 

third-party program, there may have already been a determination that self-declaration is 

insufficient. In the Energy Star program, for example, self-declaration had been used previously 

and a GAO audit had revealed that the self-declaration system opened the program to fraud and 

abuse. 

Also, self-declaration with little or no verification is rarely considered sufficient for 

mandatory standards that relate to public health and safety. Indeed, laws to protect health and 

safety – and their effective enforcement -- are often necessary precisely because market 

mechanisms are ineffective in protecting against harm. For example, consumers are generally 

unable to tell if children’s products contain lead or if food is infected by salmonella. 

Environmental protection and other societal interests are similar: consumers can’t tell if a 

product came from a highly polluting facility or an unsafe workplace. 

As such, the question to be considered becomes whether the agency should directly assess 

compliance or rely on third parties. An agency should consider which would be less costly and 

which would provide greater benefits. The EPA report for example found that setting up a thirdparty program would imply significant costs to the agency.422 Costs would be incurred in 

developing the program; approving third parties and training them; ensuring that conflicts of 

 419 Memorandum from Ruth Mead et al., ERG, to Suzanne Kocchi and Kong Chiu, USEPA Headquarters, 

Washington DC, Review of Verification Systems in Environmental Reporting Programs (Feb. 10, 2009) (on file 

with author) [hereinafter “EPA Verification System Memo”]. 420 Cf. Johnson, supra note 6, at 29 (stating that businesses prefer SDoC, and citing an economist who states that 

because SDoC “is surely the cheapest form of conformity assessment, it is to be preferred except when it cannot be 

trusted”). 421 Gillerman, supra note 414. 422 EPA Verification System Memo, supra note 419, at 26.
Third-Party Programs to Assess Regulatory Compliance

60

interest were not present; and performing ongoing oversight. The report also observed that, even 

with third-party certification, the EPA would probably need to develop specialized software to 

receive and review the data and accompany third parties on site visits. In EPA’s decision not to 

require third-party verification, EPA also emphasized that the activities necessary to set up a 

third-party program would “slow down implementation of the [greenhouse gas reporting] 

rule.”423 Several of the third-party programs reviewed above also suggest that program 

establishment may be costly and slow.424 

On the other hand, even if there are significant set-up costs, they may be justified in light of 

cost savings or benefits generated in later years. For example, with its reliance on TCBs, the 

FCC now oversees the issuance of more than four times the number of equipment authorizations 

annually as it did fifteen years ago with roughly the same number of staff (7-10 employees).425 

If the program had not been established, it can be expected that more staff would have been 

hired. Also, even high set-up costs might be justified if the long-term alternative is not having 

the program at all. Due to EPA resource constraints, the Water Sense program might not have 

been pursued without a third-party approach. 

In some situations, set-up costs may not be as high because third parties are already doing 

similar assessments for other purposes. An agency may not have to do as much in terms of 

identifying suitable third parties and training them. Also, the costs to industry may be lower 

because they are already contracting with these third parties. In Water Sense, for example, one of 

the most important types of products – toilets - was already often the subject of private 

conformity assessment. Manufacturers were engaging third parties to certify that their products 

met certain operational standards set by the Canadian government or state and local governments 

in the US. When WaterSense established its third-party program to assess conformity with water 

efficiency standards, the existing conformity assessment networks could be leveraged. Similar 

networks may already be present in the arena of food safety due to the prevalence of private 

conformity assessment.426 

 423 74 Fed. Reg. 56282 (Oct. 30, 2009) (stating “developing the third party verification approach would require EPA

to establish and develop emissions verification protocols and a system to qualify and accredit the third party 

verifiers, and to develop and administer a process to ensure that verifiers hired by reporting facilities do not have 

conflicts of interest. Such a program could require EPA to review numerous individual conflict of interest screening 

determinations made each time a reporter hires a third party verifier. Even if EPA were to partner with an existing 

program or organization to accredit verifiers, EPA would still need to develop the criteria and systems described 

above to implement this rule and ensure high quality emissions verification given the unique reporting requirements 

of this rule. These efforts would slow down implementation of the rule and sharing of data”). 424 See especially notes 332 to 340 and accompanying text (on the shrimp aquaculture pilot) and note 366 and 

accompanying text (on the FDA AP Inspections program). 425 Interview (by phone), George Tannahill, FCC Office of Engineering and Technology, August 27, 2012. Between 

2000 and 2011, the number of equipment authorization applications grew from 3,168 to 13,645. In the year 2000, 

FCC processed 83.5% of the applications (2,645 applications). In 2011, FCC processed only 1.6% of applications 

(218 applications), and TCBs processed the rest (13,427 applications). Id. 426 In terms of food safety and possibly other areas of product safety, it is important to note that the private 

conformity assessment processes that exist are often not considered to be reliable. See supra note 297 and 

accompanying text. An agency that seeks to incorporate existing networks into its compliance assessment program 

would need to be particularly careful to set third-program rules that enhance the reliability of third-party 

determinations and otherwise instill public confidence. 
Third-Party Programs to Assess Regulatory Compliance

61

An agency should also consider the different benefits that derive from either directly 

verifying compliance or relying on third-party verification. The outputs of the two approaches 

differ in ways that may be important. For example, FDA staff does not view the compliance data 

acquired through the AP Inspections program as equivalent to the compliance data acquired 

directly through an FDA inspection of a medical device facility. If the AP inspection suggests 

there may be violations, FDA must follow up with its own inspections to collect the evidence 

needed for a formal enforcement action.427 Similarly in the PMAP, FDA’s pilot program for 

medical device facility inspections established in coordination with Canada, FDA found that “the 

level of detail in the narrative needs to be greater in order for the regulators to have a more 

complete picture of the audit/inspection and the manufacturer’s organization and operation.”428 

The narrative portion of the auditors’ reports under the PMAP varied in length from three to 

twenty pages, with large variability in the format and level of detail.429

Direct governmental verification may also enable more consistency in compliance data and 

quicker release of data to the public. Rather than adopt a third-party approach for greenhouse 

gas emission reporting, EPA decided to have facilities submit data electronically and to perform

a series of automated data checks with follow-up questions to regulated entities and facility

audits as necessary. EPA found that “the combination of comprehensive electronic review and a 

flexible and adaptive program on on-site auditing will enable us to effectively target verification 

resources while also providing the necessary consistency and quality in the data.”430 EPA also 

found that direct verification approach would enable it to make data available to the public more 

quickly. With third-party verification, three to six months might be needed for third-party 

verifiers to perform their verification role, and EPA would still need to review the data and 

perform consistency checks after third-party verification was complete.

431

Third-party programs generally have the drawback of adding complexity and principal-agent 

problems to the regulatory process. With a third-party program, many decisions must be made 

about the roles and responsibilities of new actors, namely certification bodies, testing bodies, and 

accreditation bodies. The regulatory agency must also assume a new role in overseeing these 

actors. The new roles seem likely to make the regulatory framework more complicated, and

possibly more difficult for the public to understand and participate in. Also, the introduction of 

new actors creates a “principal-agent problem.” A principal-agent problem arises when a 

principal (here, the regulatory agency) chooses an agent (the third party) to act on its behalf. 

Because the two parties have different interests and the agent has more information, the principal 

has difficulty ensuring that the agent is acting in the principal’s best interest.432 In third-party 

programs for regulatory purposes, such principal-agent problems are likely to be exacerbated by 

the fact that the third-parties are not only agents of the regulatory agency but also paid agents of

the regulated entities.

433

 427 Interview (by phone), David Kalins, Office of Compliance, CDRH, FDA, July 31, 2012. 428 PMAP report, supra note 165, at 3.

429 Id. 430 74 Fed. Reg. 56282 (Oct. 30, 2009). 431 Id. at 56283. 432 See A Glossary of Political Economic Terms: Agency Problem, http://www.auburn.edu/~johnspm/ 

gloss/agency_problem (last visited Sept. 12, 2012). 433 Cf. Amy Shapiro, Who Pays the Auditor Calls the Tune?: Auditing Regulation and Clients’ Incentives, 35 SETON 

HALL L. REV. 1029, 1031 (2005) (arguing that the problem of auditing in the financial sector is that auditors have
Third-Party Programs to Assess Regulatory Compliance

62

4. If the use of third parties will be voluntary, evaluate whether sufficient incentives exist to 

attract participation

If a third-party program is being contemplated in which regulated entities would have the 

choice of contracting with third parties or being assessed directly by the agency, the agency 

should consider whether regulated entities are likely to use the program. The low level of 

participation in the AP inspections program exemplifies the problem. The FDA invested 

significant resources into its establishment but it was seldom used by industry.434 While the 

program offered several incentives for participation, they were outweighed by a series of 

disincentives including the cost of hiring the third party and the perceived risk that FDA would 

ultimately take a harder look at its facility.435

Agencies should evaluate whether sufficient incentives can be created for the use of a 

voluntary third-party program in light of the costs and risks the program would impose. A

program may attract more participation if the regulated entity is able to avoid paying an agencyassessed user fee if it contracts with a third party. Another incentive would be provided if the

third-party conformity would satisfy the regulatory requirements of other jurisdictions in which a 

manufacturer operates or sells products. This would generally require a federal agency to 

coordinate with their counterparts in other countries to harmonize standards and assessments 

procedures. In this vein, the FDA is currently developing a Medical Device Single Audit 

Program (MDSAP) in coordination with Canada, Brazil, and Australia.436 The goal of the 

program is to enable a single audit/inspection of a medical device manufacturer’s quality 

management system would satisfy the regulatory requirements of all the jurisdictions.

B. Establishing a Third-Party Program

1. Calibrate the third-party program to the level of risks associated with noncompliance

An important principle of private third-party conformity assessment is that the design of the 

conformity assessment system should be driven by the degree of assurance its user needs.437 In 

some cases, a user – such as a product purchaser -- wants some independent assurance of 

conformity, but occasional instances of nonconformity will not cause major problems to the 

purchaser’s manufacturing process or business interests. The purchaser might be satisfied with 

occasional third-party testing of the product. In other cases, a purchaser may be at risk of 

incurring high costs due to a nonconformity in a purchased product. The purchaser might instead 

impose a variety of special requirements on the supplier and require third-party certification.

 

two masters and that the law needs to be written “so that auditors recognize proper incentives and serve only one 

master, a master whose own interests are aligned with those of the investing public”).

434 Cf. FDA 13485 Program Guidance, supra note 38, at 3 (stating that “FDA has committed significant resources to 

creating the AP for Inspections program and continues to maintain it.) It is worth noting that this program was 

required by statute. 435 See supra notes 383 to 389 and accompanying text. 436 Interview (by phone), Kim Trautman, Associate Director, International Affairs, Office of the Center Director, 

Center for Devices and Radiological Health, U.S. Food and Drug Administration, Jun. 5, 2012. 437 See supra note 24 and accompanying text.
Third-Party Programs to Assess Regulatory Compliance

63

The same principle applies in third-party programs for regulatory purposes. If the risks 

associated with noncompliance are very high, a third-party program should be designed to 

provide a maximal degree of reliability in the determinations by third parties. This could be 

accomplished in a regulatory third-party program through accreditation rules that set high 

standards for third parties to be accredited, selection rules that carefully guard against conflicts 

of interest and the use of subcontractors, performance rules that require a rigorous and complete 

set of assessment activities, reporting rules that furnish ample information about the outcomes of 

the assessment, and a full array of governmental oversight and enforcement actions. Such rules 

can be expected to enhance the competence and independence of third-party activities and thus 

the reliability of their determinations. 

Yet, such rules are also likely to entail high costs for both the regulatory agency and 

regulated entities. Such rules may, in some cases, represent an instance of “over-design” that 

adds costs to the system, and potentially to the products or processes assessed, without 

compensating benefits.438 In some cases, the regulatory objective can be achieved with less 

intensive conformity assessment activities and with third parties who are not trained as 

thoroughly as they could be or who are not completely independent. 

For example, in several programs detailed above, the agency does not require that the 

laboratory that tests products be completely independent of the manufacturer. Under the CPSC’s 

rules, manufacturers’ laboratories can test products if they meet certain “firewalled” criteria. For 

Energy Star and WaterSense, products can be tested in a manufacturer’s lab under certain 

circumstances. More generally, the programs vary quite a bit in the extent they have adopted 

rigorous accreditation, selection, performance and reporting rules. In some, governmental 

oversight has been sporadic and little evidence exists of active enforcement of third-party 

program rules. 

It bears emphasis, however, that many types of regulations for which third-party programs 

are considered may be in the high risk category, where noncompliance implies risks to health, 

safety, and other valued regulatory goals. For such regulatory purposes, a relatively complete 

third-party conformity assessment may indeed be appropriate despite its costs. 

2. Incorporate existing conformity assessment standards and activities when possible

Agencies should strongly consider relying on existing conformity assessment standards and 

related activities when they establish third-party programs.439 Doing so can reduce the costs of 

the program for both the regulatory agency and regulated entities. Relevant conformity 

assessment standards and activities may be occurring through other governmental agencies or in 

the private sector. 

Sometimes a new third-party program may be able to rely on another governmental agency’s 

conformity assessment activities. During development of the WaterSense program, for example, 

 438 Gillerman, supra note 414. 439 Cf. NIST Guidance, supra note 402, § 287.4(c) (advising agencies to “Use the results of other governmental 

agency and private sector organization conformity assessment activities to enhance the safety and efficacy of 

proposed new conformity assessment requirements and measures”); id. at § 287.4(f) (advising agencies to “Consider 

using the results of other agencies’ conformity assessment procedures”).
Third-Party Programs to Assess Regulatory Compliance

64

companies were concerned that participation in WaterSense would require them to duplicate 

testing and reporting required for Department of Energy plumbing standards and the Federal 

Trade Commission appliance labeling standards.

440 In response, the WaterSense program made 

its reporting requirements similar or identical to what manufacturers already had do for DOE and 

FTC. 

Extensive private sector conformity assessment standards and activities are also available to 

be incorporated into regulatory third-party programs. 441 Most significantly, as described above, 

ISO/IEC have developed a set of international conformity assessment standards and an 

international conformity assessment industry has emerged to conduct related activities.442 These 

standards set forth how testing bodies, certification bodies, and accreditation bodies should 

function. 

Regulated entities have expressed a preference for agencies to incorporate private conformity 

standards and activities rather than creating “government-unique” conformity assessment.443

Regulated entities fear that government-unique standards with be duplicative of private sector 

conformity assessment activities that they already engage undertake for business reasons. They 

also opine that government-unique conformity assessment standards “may be expensive to 

develop and maintain, may impose additional costs on the private sector, and may not be 

recognized beyond national boundaries.”444

Using international standards of conformity assessment enhances the possibility that the 

same conformity assessment might serve regulatory needs in other countries. For example, a 

federal agency may require that a certain product be tested by a lab accredited to ISO 17025 for 

conformity with a particular safety standard. If another country has the same safety standard or 

otherwise considers the US standard equivalent, and if respects the international accreditation of 

the lab, then the manufacturer may not need to undertake any further action to legally market its 

product in that other country. 

 440 EPA WaterSense, Comments on the May 2007 Draft WaterSense Certification Scheme 14 (Nov. 2007), available 

at http://www.epa.gov/WaterSense/docs/cert_scheme_comments508.pdf; cf. FTC, Labeling FAQs, 

http://www.ftc.gov/bcp/conline/edcams/eande/faq.htm (last visited Sept. 12, 2012); DOE, Energy Efficiency and 

Renewable Energy, Building Technologies Program, 

http://www1.eere.energy.gov/buildings/appliance_standards/residential/plumbing_products.html (last visited Sept. 

12, 2012).

441 Cf. NIST Guidance, supra note 402, § 287.4(e) (directing agencies to “Identify appropriate private sector 

conformity assessment practices and programs and consider the results of such practices and/or programs as 

appropriate in existing regulatory and procurement actions.”) 442 NIST Guidance, supra note 402, § 287.4(d) (directing agencies to “Use relevant guides or standards for 

conformity assessment practices published by domestic and international standardizing bodies as appropriate in 

meeting regulatory and procurement objectives”). 

443 See, e.g., Comment of Air-Conditioning, Heating and Refrigeration Institute (AHRI) on Federal Participation in 

the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities (Apr. 26, 

2012 ), available at https://law.resource.org/pub/us/cfr/regulations.gov.docket.02/0900006480ffd5af.pdf. 444 See id. at 3; see also American National Standards Institute, ANSI Response to Request for Comments, Federal 

Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment 

Activities 5, available at 

http://publicaa.ansi.org/sites/apdl/Documents/Standards%20Activities/Critical%20Issues/FederalRegister_OMBA11

9/ANSI%20Response%20OMB-A119_FINAL.pdf (advocating solutions based on VCS to reduce the costs of 

compliance for industry).
Third-Party Programs to Assess Regulatory Compliance

65

A significant way in which an agency can rely on existing conformity assessment standards 

and activities is by recognizing private sector accreditation bodies to accredit certification and 

testing bodies rather than accrediting them directly. As in some existing programs, an agency 

may require that the private accreditation body operate in accordance with ISO/IEC 17011 and 

be a member of an international organization like IAF or ILAC that coordinates a peer-review 

process to evaluate accreditation bodies for membership.445 When an agency relies on the 

ISO/IEC standards for recognition, it avoids having to set all such standards itself. Also, if the 

agency requires that the accreditation be a member of IAF or ILAC, those organizations conduct 

periodic assessments of the accreditation body.

If an agency decides to accredit certification bodies directly, it may still find ISO 17011 to be 

useful as a guide for its own accreditation activities. The NOP regulations initially required that 

the NOP assemble a peer review panel pursuant to Federal Advisory Committee Act (FACA) to 

evaluate its accreditation procedures.446 In its 2010 review of the program, USDA OIG found 

that the NOP had never established the panel, reportedly due to budget constraints. In response 

to the OIG report, the NOP proposed an alternative, namely that it would amend its regulations 

and instead develop “a quality management system that complies with the criteria set forth in 

NIST’s National Voluntary Conformity Assessment Evaluation program (NVCASE) as well as 

the requirements of ISO/IEC 17011:2004.”447 

The FDA’s aquaculture pilot illustrated some of the challenges faced by agencies that 

directly accredit certification bodies, particularly in an international context.448 FDA reports that 

after it announced the pilot, it received applications from candidate certification bodies. It found,

however, that the candidate CBs did not reliably submit supporting documentation in their 

application and determining whether CBs were qualified required a greater investment of 

resources than it had anticipated. FDA recommended that “in any future program, FDA should 

be clearer in its expectations for the amount and type of information needed to adequately 

evaluate a firm’s application.”449

Notably, programs that anticipate reliance on certification bodies in other countries may be 

particularly well-served by relying on private accreditation bodies. Such accreditation bodies 

may have more institutional competence than the agency in dealing with foreign companies and

may even be located in that country or the same region of the world. Of course, the issue then

arises of how the agency will oversee the foreign activities of private accreditation bodies and 

the foreign certification bodies they accredit. 

Importantly, when an agency incorporates international standards into its requirements for 

certification, testing, or accreditation bodies, it can supplement those standards in various ways. 

An agency, for example, may require that a certification body be accredited by an private 

accreditation body to ISO Guide 65 and also meet a certain set of requirements specific to a 

third-party program. The accreditation body might be given responsibility for assessing 

 445 See supra notes 19 to 23 and accompanying text. 446 USDA OIG, supra note 345, at 3. 447 Id. at 19; Cf. USDA, AMS, GV Division, “Quality Manual for Accrediting Conformity Assessment Bodies,”

http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5073714 (last visited Sept. 12, 2012). 448 Assessment of Pilot for Aquacultured Shrimp, supra note 298. 449 Id. at 7. 
Third-Party Programs to Assess Regulatory Compliance

66

conformity with the program-specific requirements, or the agency might do its own assessment 

as part of “recognizing” an accredited certification body for participation in the program.

Through these program-specific requirements, the agency can put flesh on the sometimes 

bare-bones requirements of the international standard. For example, ISO Guide 65 contains a 

basic requirement that certification bodies conduct surveillance of certified companies or 

products. Through program-specific requirements for accreditation of the certification body, the 

agency could require it to undertake particular types of surveillance activities at particular times. 

Similarly, an agency might specify particular conflict of interest rules that supplement ISO Guide 

65’s general requirement that certification bodies be independent and impartial. 

3. Ensure that the agency and the public have appropriate access to information

Private third-party conformity assessment systems differ from regulatory third-party 

programs in a key respect. In the latter, the user of the system is ultimately the public, and the 

regulatory agencies that establish third-party programs are accountable to the public for their 

outcomes. As a result, the responsible agency and the public should have access to a variety of 

types of information about the operation of the third-party program. 

The public should have access to and input into the procedures by which a regulatory thirdparty program is run. The development of program rules and guidance should include public 

notice and participation. When agencies incorporate international conformity assessment 

standards into their regulatory processes, important concerns arises about the public availability 

of those standards.450 Because ISO/IEC standards are copyright protected, they are not easily 

accessible to interested members of the public. ACUS has recommended that when an agency 

considers “incorporating copyrighted material by reference, the agency should work with the 

copyright owner to ensure the material will be reasonably available to regulated and other 

interested parties both during rulemaking and following promulgation.”451

The public should also have access to certain types of information about the compliance of 

regulate entities. If a third-party program replaces a regulatory compliance program, the same 

types of information that were accessible to the public before the implantation of the third-party 

program should remain accessible after. In some cases, however, it may be appropriate and 

desirable to provide additional compliance information to the public that was not systematically 

available before the third-party program came into effect. 

The public should have access to certain types of information about the third parties that 

participate in the regulatory program. The agency should make clear the roles and identities of 

the various third-party actors. In several programs discussed above, Congress has required that 

agencies maintain a public list of the private bodies associated with the program. Other 

information about the characteristics and activities of the private bodies may also be important to 

create public confidence in the integrity of the third-party program. 

For effective oversight, the government agency will also need certain types of information 

from accreditation, certification and testing bodies. For example, testing and certification bodies 

 450 See especially Administrative Conference of the United States, supra note 413. 451 Id. at 5.
Third-Party Programs to Assess Regulatory Compliance

67

might be required to report potential conflicts of interest before performing the conformity 

assessment. They might also be required to report the dates of their conformity assessment 

activities so that agency officials can conduct a site visit for oversight purposes. In addition to 

the positive or adverse determination that is the ultimate outcome of the conformity assessment 

process, bodies can be required to submit documents gathered or generated during the process 

that explain and support the determination. To the extent that information required of third 

parties constitutes confidential business information, it can be held back from the public in 

accordance with the Freedom of Information Act and other applicable laws. 

Information disclosure requirements may have the effect of enhancing the degree to which 

third-party answer directly to the agency rather than just the regulated agency that has contracted 

it. For example, FSMA requires that accredited labs send their test results directly to the 

FDA.452 One commentator has called this “a game-changing requirement” that “alters the whole 

dynamic between labs and their clients,” making them “directly responsible to the public (i.e., 

the government) to ensure that information is disclosed about their client.”453 

Importantly, international conformity assessment standards include confidentiality provisions 

that may prevent the flow of information in a regulatory third-party program. When EPA 

requested comments on a draft of its rules for the recognition of accreditation bodies that would 

accredit laboratories, it received comments to the effect that several types of information that it 

initially wanted from the accreditation bodies were contrary to the confidentiality provisions of 

ISO 17011.454 For example, EPA initially wanted to be informed of the results of ILAC’s peer 

evaluation. After being informed that such information was against ISO 17011's confidentiality 

rules, EPA struck the requirement.455 

On the same basis, a commenter also objected to EPA’s requirement that recognized 

accreditation bodies provide EPA with copies of laboratory assessment documentation including 

corrective action plans and documentation about the resolution of deficiencies. In this case, 

however, EPA responded that the release of this information by the AB is an integral aspect of 

EPA's recognition of the laboratory and suggested that the AB should seek the laboratory’s 

written consent to share this information with EPA. EPA’s response also indicates how an 

agency can use program-specific rules to essentially modify the default confidentiality rules 

contained in the international standards.

While confidentiality provisions should not hinder the flow of information that is necessary 

for adequate regulatory oversight and public accountability, some would argue that certain 

confidentiality assurances ultimately serve regulatory goals. For example, the FDA has provoked 

a negative reaction from industry by interpreting FSMA to require that accredited auditor must 

immediately notify the FDA if it “discovers a condition that could cause or contribute to a 

 452 21 U.S.C. § 350k(b)(2). 453 Daniel R. Dwyer, Third-Party Accreditation under the FDA Food Safety Modernization Act (March 7, 2012), 

http://www.kkblaw.com/blog/archives/206.html (last visited Sept. 12, 2012). 454 See http://www.energystar.gov/ia/partners/downloads/mou/AB_Comment_Matrix.pdf (providing matrix that 

summarizes comments on the condition and criteria for recognition of accreditation bodies for Energy Star 

laboratory recognition); see also http://www.energystar.gov/index.cfm?c=partners.intro_conf_calls#accred (listing 

of stakeholder comments on draft accreditation body requirements).

455 Id. at 2.
Third-Party Programs to Assess Regulatory Compliance

68

serious risk to the public health” during either a regulatory or a consultative audit.456 As stated 

by one industry commenter, “We disagree with this interpretation of the FSMA and maintain that 

such a position could undermine the purpose of the law, ultimately dissuading manufacturers 

from using third party auditors—a move that could negatively impact food safety and hinder 

FDA’s efforts to efficiently use its own resources.”457 Agencies should consider pros and cons 

of limiting the types of confidentiality that regulated entities expect when they contract privately 

with third parties.

Information technology (IT) can play an important role in enabling the flow of information in 

a third-party program. Regulated entities, third-party conformity assessment bodies, and 

accreditation bodies can be required to e-report certain types of information. Also, with welladministered IT systems, information that should be public can be more promptly made public. 

In its shrimp aquaculture pilot, the FDA made a special note of the need for new “IT data 

systems to capture and report on results of assessments and audits.”458

In sum, a change in the “communicative energy” of third-party conformity assessment is 

required in a regulatory context.

459 The default in the private sector is for the third party to disclose

his audit report exclusively to his client.460 If interested parties external to the contractual 

relationship are privy to the audit’s results at all, they are likely to be told little more than whether 

the subject of the audit conformed or not.

461 For an assessment to serve public regulatory 

purposes, much richer information about its process and outcomes is necessary.

462

4. Commit to undertaking appropriate oversight activities 

When an agency establishes a regulatory third-party program, its role changes from being the 

guardian to guarding the guardians.463 Governmental oversight of third-party programs is 

essential to ensuring that the program is fulfilling its regulatory purpose. In addition to 

exercising direct oversight, an agency can also require third parties to conduct and report 

surveillance activities that provide additional information to the agency about program operation. 

For a successful third-party program, a regulatory agency must implement and enforce the 

rules it establishes for program actors. In principal, the same enforcement strategies and tools 

would apply in enforcing third-party program rules as apply in enforcing other regulatory rules. 

The agency must require certain types of reporting, conduct regulatory inspections to verify 

compliance, and impose sanctions as deemed necessary to respond to noncompliance. The 

 456 21 U.S.C. § 384d(c)(4)(A); see also FDA, Imports, http://www.fda.gov/Food/FoodSafety/FSMA/ucm257980.htm

(answering in the affirmative the question, “I.4.2 Is the accredited auditor required to notify the FDA if a condition 

of concern is found during a consultative audit?”).

457 Comment of International Dairy Foods Association, Re: Docket Nos. FDA-2011-N-0143, FDA-2011-N-0144, 

FDA-2011-N-0145, FDA 2011-N-0146; Food and Drug Administration; FDA Food Safety Modernization Act: Title 

111—A New Paradigm for Importers (Apr. 28, 2011), available at

http://www.idfa.org/files/IDFA_FSMA_Import_Comments_042811.pdf. 458 Assessment of Pilot for Aquacultured Shrimp, supra note 298, at 26.

459 Christine Parker, Regulator-Required Corporate Compliance Program Audits, 25 LAW & POL’Y 221, 235 (2003). 460 See id. 461 Id. 462 See id. 463 Martin Shapiro, WHO GUARDS THE GUARDIANS? (1988).
Third-Party Programs to Assess Regulatory Compliance

69

difference is that the agency’s third-party program rules apply to the private bodies that form the 

third-party system rather than the regulated entities themselves. 

An agency that establishes a third-party program should set forth, to the extent possible, how 

it intends to conduct such oversight. The agency may determine, for example, that it will assess 

the performance of accreditation bodies every few years; that it will conduct a certain number of 

audits of accreditations or certifications; or that it will carry out a market surveillance program 

that will test a certain number of products off the shelf each year. Special rules may be 

necessary to ensure an oversight activity. In the shrimp aquaculture pilot, for example, FDA 

found that entities subject to certification were not always willing to allow an FDA official to 

accompany the certification body on a site visit. FDA concluded that it should “consider 

requiring, as a condition for accreditation, that CBs maintain agreements with establishments 

they certify to allow FDA to monitor or otherwise participate in certification audits as 

necessary.”464

The agency would also retain enforcement authority over regulated entities, which could be 

used when the agency discovers through the third-party program or otherwise that a regulated 

entity is out of compliance. In the NOP program, for example, AMS uses its traditional 

enforcement powers to respond to situations where organic operations knowingly market 

nonorganic food as organic.465 Its enforcement actions “play a central role in maintaining the 

validity of the program and ensuring public trust” in the label.466 

As in traditional regulatory programs, agencies should be equipped to receive and respond to 

information about potential noncompliances from the public. In an investigation of the NOP 

program, the USDA OIG found that that “NOP officials did not have adequate procedures or a 

system for tracking the receipt, review, and disposition of complaints and any subsequent 

enforcement actions.”467 When third parties have played a role in assessing compliance, the 

agency might be able to direct a public complaint to the relevant third-party body for an initial 

investigation. The agency, however, would remain ultimately responsible for ensuring that the 

complaint was resolved. The agency could also require that employees of accreditation bodies 

and conformity assessment bodies be given information about how to anonymously contact an 

official within the regulatory agency to report any potential problems.

The agency may require certain activities of accreditation bodies and conformity assessment 

bodies that provide information for oversight purposes. Accreditation bodies may be required 

for example, to conduct periodic audits of the certification bodies they accredit. Certification 

bodies may be required to conduct surveillance audits of the entities and products they certify.468 

In both cases, the agency might also require that some or all of the audits be unannounced rather 

 464 Assessment of Pilot for Aquacultured Shrimp, supra note 298, at 21. 465 USDA OIG, supra note 345. 466 Id. at 8. 467 Id. at 1. 468 Energy Star requires CBs to operate a partner-funded verification testing program to ensure products meet 

Energy Star standards. DOE, Energy Star Appliance Verification Testing – Pilot Program Summary Report 22 (Feb. 

3, 2012), http://www1.eere.energy.gov/buildings/appliance_standards/pdfs/

energystar_pilotprogram_report_02_03_12.pdf (last visited Sept. 12, 2012). 
Third-Party Programs to Assess Regulatory Compliance

70

than announced.469 In its investigation of the NOP’s organic milk program, the OIG milk found 

that certifying agents were not performing unannounced inspections of organic dairy 

operations.470 While unannounced inspections are not required by NOP regulations, OIG and 

other stakeholders consider them to play a “critical role” in ensuring compliance.471 Notably, if 

the rules of a third-party program do not require unannounced audits, accreditation and 

certification bodies will have little incentive to do them for fear of offending clients.

Unannounced audits of facilities can be facilitated by requiring regulated entities to agree to

them as a condition of certification. 

 469 Albersmeier et al., supra note 3 , at 933, tbl. 5 (showing that a superior risk-oriented approach includes 

“randomly chosen audits without announcement” rather than “regular audits with announcements”). 470 USDA Office of Inspector General, Agricultural Marketing Service, National Organic Program – Organic Milk, 

Audit Report 01601-0001-Te (2012), available at http://www.usda.gov/oig/webdocs/01601-0001-

Te.pdf?utm_source=Organic+Milk+Audit+Report+Published&utm_campaign=Organic+milk+audit+report&utm_m

edium=email. 471 Id. at 17.
A-1

Appendix A: Interviews by Phone and Email

By Phone:

David Alderman, Standards Services Division, National Institute of Standards and Technology

Cheri Courtney, Director, Accreditation & International Activities Division, National Organic 

Program, U.S. Department of Agriculture

Bob Biersner, Office of the Solicitor, U.S. Department of Labor

Charlotte Christen, U.S. Food and Drug Administration

Bridget Dooling, Office of Information and Regulatory Affairs, U.S. Office of Management and 

Budget

Sandra B. Eskin, Director, Food Safety Campaign, The Pew Health Group

Jim Estep, Occupational Safety & Health Administration, U.S. Department of Labor

Gordon Gillerman, Chief, Standards Services Division, National Institute of Standards and 

Technology 

David Hinden, Office of Enforcement and Compliance Assurance, U.S. Environmental 

Protection Agency

Eamon Monahan, Energy Star Program, U.S. Environmental Protection Agency

David Kalins, Office of Compliance, Center for Devices and Radiological Health, U.S. Food and 

Drug Administration

Kevin Robinson, Occupational Safety & Health Administration, U.S. Department of Labor

David Rostker, Assistant Chief Counsel, Office of Advocacy, U.S. Small Business 

Administration

Ramona Saar, Standards Services Division, National Institute of Standards and Technology 

Jasmeet Seehra, Office of Information and Regulatory Affairs, U.S. Office of Management and 

Budget

Jon Silberman, Office of Enforcement and Compliance Assurance, U.S. Environmental 

Protection Agency

George Tannahill, Federal Communications Commission
A-2

Stephanie Tanner, WaterSense Program, U.S. Environmental Protection Agency

Kim Trautman, Associate Director, International Affairs, Office of the Center Director,

Center for Devices and Radiological Health, U.S. Food and Drug Administration

Peter Unger, President & CEO, ILAC Chair, American Association for Laboratory Accreditation 

(A2LA)

Mike Zatz, Chief, Market Sectors Group, Energy Star Commercial and Industrial Branch,

Office of Air and Radiation, U.S. Environmental Protection Agency

By Email:

Jean Cooper, Senior Staff Fellow, U.S. Food and Drug Administration

Lauren Kavanaugh, Quality Management Branch Chief, Grading and Verification Division, 

Agricultural Marketing Service, U.S. Department of Agriculture

Linwood L. Rayford, III, Assistant Chief Counsel for Food, Drug and Health Policy, Office of 

Advocacy, U.S. Small Business Administration
A-3

Appendix B: ISO Standards for Conformity Assessment Activities

Conformity Assessment Activity Relevant International Standard

Supplier’s Declaration of Conformity (SDoC) ISO/IEC 17050, “Conformity assessment -

Supplier's declaration of conformity”

Testing ISO/IEC 17025, “General requirements for the 

competence of testing and calibration 

laboratories.”

Inspection ISO/IEC 17020, “Conformity assessment --

Requirements for the operation of various 

types of bodies performing inspection”

Certification ISO/IEC Guide 65, “General requirements for 

bodies operating product certification systems” 

(expected to be replaced by ISO/IEC 17065, 

“Conformity assessment -- Requirements for 

bodies certifying products, processes and 

services”).

Accreditation ISO/IEC 17011, “General requirements for 

accreditation bodies accrediting conformity 

assessment bodies.”
A-4

Appendix C: List of Abbreviations

Abbreviation Description

AAMI Association for the Advancement of Medical Instrumentation

A2LA American Association for Laboratory Accreditation

AMS [USDA] Agricultural Marketing Service

ANSI American National Standards Institute

AP Accredited Person(s)

AP Program Inspection by Accredited Persons Program

ASTM American Society for Testing and Materials

CASCO toolbox Collective term for conformity assessment standards and guides developed by 

the ISO Committee on Conformity Assessment 

CB Certification Body

CMS/ITRI Center for Measurement Standards/Industrial Technology Research Institute 

(China)

CoP Medicare Conditions of Participation

CPSC Consumer Product Safety Commission

CPSIA Consumer Product Safety Improvement Act of 2008

CSL Curtis Straus LLC

DfE EPA Design for Environment label

DOE Department of Energy

EPA Environmental Protection Agency

FACA Federal Advisory Committee Act

FAQs Frequently Asked Questions

FCC Federal Communications Commission

FDA Food and Drug Administration

FDAAA Food and Drug Administration Amendments Act of 2007

FDAMA FDA Modernization Act of 1997

FDCA Federal Food, Drug, and Cosmetic Act

FMRC Factory Mutual Research Corporation

FOIA Freedom of Information Act

FSMA Food Safety Modernization Act of 2011

GAO Government Accountability Office

GAP/GHP [USDA] Good Agricultural Practices/Good Handling Practices Audit Program

HVAC Heating, ventilation, and cooling equipment

IAF International Accreditation Forum

IAS International Accreditation Services Inc.

ICSP Interagency Committee on Standards Policy

IEC International Electrotechnical Commission

ILAC International Laboratory Accreditation Cooperation

IOM [FDA] Investigations Operations Manual

ISO International Organization for Standardization

ISO/IEC International Organization for Standardization/ International Electrotechnical 

Commission

ISO/UNIDO International Organization for Standardization / United Nations Industrial 

Development Organization

IT Information technology

MDSAP Medical Device Single Audit Program

MDUFMA Medical Device User Fee and Modernization Act of 2002

MLA IAF Multilateral Recognition Agreement
A-5

Abbreviation Description

MRA ILAC Mutual Recognition Agreement

NIST National Institute of Standards and Technology

NOP National Organic Program

NRTL National Recognized Testing Laboratory

NTTAA National Technology Transfer and Advancement Act of 1995

NVCASE [NIST] National Voluntary Conformity Assessment Evaluation program

OIG Office of Inspector General

OMB Office of Management and Budget

OSHA Occupational Safety and Health Administration

PMAP Pilot Multi-Purpose Audit Program

RF Radio frequency

QMI Quality Management Institute (Canada)

QS Quality System

SDoC Supplier’s Declaration of Conformity

SMTL Supervised Manufacturers’ Testing Laboratory

TCB Telecommunication Certification Body

TPCAB Third Party Conformity Assessment Body

TPRB [FDA] Third Party Recognition Board

UL Underwriters Laboratories, Inc.

UNIDO United Nations Industrial Development Organization 

USDA AMS USDA Agricultural Marketing Service

USTR Office of the United States Trade Representative

VCS Voluntary consensus standard

VQIP Voluntary Qualified Importer Program

WMTL Witnessed Manufacturers’ Testing Laboratory