This subpart establishes the audit requirements for third party conformity assessment bodies pursuant to section 14(i)(1) of the Consumer Product Safety Act (CPSA) (15 U.S.C. 2063(i)(1)). Compliance with these requirements is a condition of the continuing accreditation of such third party conformity assessment bodies pursuant to section 14(a)(3)(C) of the CPSA. However, this subpart does not apply to certifying organizations under the Labeling of Hazardous Art Materials Act, even if such organizations are third party conformity assessment bodies.

Except for certifying organizations described in 16 CFR 1500.14(b)(8), these audit requirements apply to third party conformity assessment bodies operating pursuant to section 14(a)(2) of the CPSA. Third party conformity assessment bodies must comply with the audit requirements as a continuing condition of the CPSC's acceptance of their accreditation.

(a) The reassessment portion of an audit must cover management requirements and technical requirements. Each reassessment portion of an audit also must examine the third party conformity assessment body's management systems to ensure that the third party conformity assessment body is free from any undue influence regarding its technical judgment.

(b) The third party conformity assessment body must have the reassessment portion of the audit conducted by the same accreditation body that accredited the third party conformity assessment body. For example, if a third party conformity assessment body was accredited by an accreditation body named AB-1, then AB-1 would conduct the reassessment. If, however, the same third party conformity assessment body changes its accreditation so that it becomes accredited by a different accreditation body named AB-2, then AB-2 would conduct the reassessment.

(c) The third party conformity assessment body must have the examination portion of the audit conducted by the CPSC. The examination portion of the audit will consist of resubmission of the “Consumer Product Conformity Assessment Body Acceptance Registration Form” (CPSC Form 223) by the third party conformity assessment body and the CPSC's examination of the resubmitted CPSC Form 223.

(1) For “firewalled” conformity assessment bodies, the CPSC's examination may include verification to ensure that the “firewalled” conformity assessment body continues to meet the criteria set forth in section 14(f)(2)(D) of the CPSA.

(2) For government-owned or government-controlled conformity assessment bodies, the CPSC's examination may include verification to ensure that the government-owned or government-controlled conformity assessment body continues to meet the criteria set forth in section 14(f)(2)(B) of the CPSA.

(a) At a minimum, each third party conformity assessment body must be reassessed at the frequency established by its accreditation body.

(b) For the examination portion of the audit, which is conducted by the CPSC:

(1) Each third party conformity assessment body must submit a CPSC Form 223 for audit purposes no less than every two years. When a CPSC Form 223 is submitted for audit purposes, the third party conformity assessment body must submit any accompanying documentation that would be required if it were a new application.

(2) Under § 1112.13(a)(1), a third party conformity assessment body must submit a new CPSC Form 223 whenever the information supplied on the form changes. In the event that the third party conformity assessment body submits a new CPSC Form 223 to provide updated information, the third party conformity assessment body may elect to have the new CPSC Form 223 satisfy the requirement of paragraph (b)(1) of this section. If the third party conformity assessment body intends to have the new CPSC Form 223 treated as its submission for audit purposes, the third party conformity assessment body must make that intention clear upon submission, and it must submit any accompanying documentation that would be required if it were a new application.

(3) At least 30 days prior to the date by which a third party conformity assessment body must submit a CPSC Form 223 for audit purposes, the CPSC will notify the body in writing, which may be electronic, of the impending audit deadline. A third party conformity assessment body may request an extension of the deadline for the examination portion of the audit, but it must indicate how much additional time is requested and explain why such an extension is warranted. The CPSC will notify the third party conformity assessment body whether its request for an extension has been granted.

(a) When the accreditation body presents its findings to the third party conformity assessment body, the third party conformity assessment body's quality manager must receive the findings and, if necessary, initiate corrective action in response to the findings.

(b) The quality manager must prepare a resolution report identifying the corrective actions taken and any follow-up activities. If findings indicate that immediate corrective action is necessary, the quality manager must document that they notified the relevant parties within the third party conformity assessment body to take immediate corrective action and also document the action(s) taken.

(c) If the accreditation body decides to reduce, suspend, or withdraw the third party conformity assessment body's accreditation, and the reduction, suspension, or withdrawal of accreditation is relevant to the third party conformity assessment body's activities pertaining to a CPSC regulation or test method, the quality manager must notify the CPSC. Such notification must be sent to the Assistant Executive Director, Office of Hazard Identification and Reduction, Consumer Product Safety Commission, 4330 East West Highway, Bethesda, MD 20814, within five business days of the accreditation body's notification to the third party conformity assessment body.

(d) If the CPSC finds that the third party conformity assessment body no longer meets the conditions specified in CPSC Form 223, or in the relevant statutory provisions applicable to that third party conformity assessment body, the CPSC will notify the third party conformity assessment body, identify the condition or statutory provision that is no longer met, and specify a time by which the third party conformity assessment body shall notify the CPSC of the steps it intends to take to correct the deficiency, and indicate when it will complete such steps. The quality manager must document that they notified the relevant parties within the third party conformity assessment body to take corrective action and also document the action(s) taken.

(e) If the third party conformity assessment body fails to remedy the deficiency in a timely fashion, the CPSC shall take whatever action it deems appropriate under the circumstances, up to and including withdrawing the CPSC's accreditation of the third party conformity assessment body or the CPSC's acceptance of the third party conformity assessment body's accreditation.

A third party conformity assessment body must retain all records related to an audit that it receives from an accreditation body regarding a reassessment and all records pertaining to the third party conformity assessment body's resolution of, or plans for, resolving nonconformities identified through a reassessment by an accreditation body or through an examination by the CPSC. A third party conformity assessment body also must retain such records related to the last three reassessments (or however many reassessments have been conducted, if the third party conformity assessment body has been reassessed less than three times) and make such records available to the CPSC, upon request.