Risk Assessment of Impurities: A Practical Guide to ICH Q3A, Q3B and M7
An unknown peak at 0.12% can hold up a filing for months. Here is how impurity risk assessment works, from Q3A thresholds to M7 classes and nitrosamine limits, and what regulators expect to see.
By Dr. Upendra K Jain · · 10 min read
It usually starts with a stability batch. The chromatogram comes back and there is a new peak at 0.12%, or an old one that has crept past the threshold. Now somebody has to answer the question every reviewer will ask: “Is this impurity safe at this level, and how do you know?”
That answer is the impurity risk assessment. Get it right and impurity is just a line in your specification. Get it wrong, or leave it vague, and it turns into a deficiency letter, a request for new studies, or a filing that sits for months.
In this guide we walk through how impurities are actually risk assessed, which guidelines apply when, and what a reviewer expects to see in the report. It draws on the 3,500+ impurity and genotoxicity assessments our toxicologists have delivered to 800+ clients across 64 countries.
What counts as an impurity?
An impurity is anything in the drug substance or drug product that isn’t the active ingredient or an intended excipient. In practice they falls into a few groups, and each group has its own ICH guideline:
| Type of impurity | Where it comes from | Main guideline |
|---|---|---|
| Organic impurities | Starting materials, intermediates, by-products, reagents and degradation products | ICH Q3A (drug substance), ICH Q3B (drug product) |
| Mutagenic impurities | Any organic impurity with a structure that may react with DNA | ICH M7 |
| Nitrosamines | Reaction of amines with nitrosating agents during synthesis, formulation or storage | ICH M7, plus FDA and EMA nitrosamine guidance |
| Residual solvents | Solvents used in synthesis or purification | ICH Q3C |
| Elemental impurities | Catalysts, equipment, excipients and container closure | ICH Q3D |
| Extractables and leachables | Packaging, tubing and other contact materials | Product and region specific, ISO 10993-17 for devices |
Residual solvents and elemental impurities mostly come down to comparing your levels against the PDEs already published in Q3C and Q3D. The real toxicology work sit with organic impurities, and especially with the ones that might be mutagenic. That’s what the rest of this article focuses on.
Step 1: Work out which threshold the impurity crosses
ICH Q3A sets three thresholds for impurities in a new drug substance. They depend on the maximum daily dose:
| Maximum daily dose | Reporting | Identification | Qualification |
|---|---|---|---|
| ≤ 2 g/day | 0.05% | 0.10% or 1.0 mg/day, whichever is lower | 0.15% or 1.0 mg/day, whichever is lower |
| > 2 g/day | 0.03% | 0.05% | 0.05% |
- Reporting threshold: above this, the impurity has to be reported in the batch data.
- Identification threshold: above this, you need to know its structure.
- Qualification threshold: above this, you need toxicological data or a justification that the proposed limit is safe.
ICH Q3B does the same job for degradation products in the finished product, but with its own dose bands, so the numbers are different. One thing we see often: teams assume the 0.15% threshold applies, but for a high dose product the 1.0 mg/day limit kicks in first and the real threshold is lower than expected. Its worth checking this before anything else.
Step 2: Screen every impurity for mutagenicity
Before an impurity is qualified under Q3A or Q3B, it has to be screened under ICH M7. The reason is simple. Ordinary impurities are safe below a certain level. Mutagenic ones can damage DNA and raise cancer risk even at very low levels, so a percentage threshold isnt protective enough.
The screening starts with a computational assessment. ICH M7 accepts two complementary (Q)SAR methods, one expert rule-based and one statistical, followed by an expert review of what the models predict. Where the models disagree, or a structure falls outside what a model has been trained on, the toxicologist has to look at analogues, published Ames data and the chemistry behind the alert to reach a conclusion.
The result is one of five ICH M7 classes:
| Class | What it means | How it’s controlled |
|---|---|---|
| Class 1 | Known mutagenic carcinogen | Compound-specific acceptable intake |
| Class 2 | Known mutagen, carcinogenic potential unknown | TTC-based limit, or a compound-specific one if data allows |
| Class 3 | Structural alert, no mutagenicity data | TTC-based limit, or an Ames test to resolve it |
| Class 4 | Alert shared with the API or a related compound that tested negative | Treated as non-mutagenic, goes to Q3A/Q3B |
| Class 5 | No structural alert, or an alert with enough data to show no mutagenicity | Treated as non-mutagenic, goes to Q3A/Q3B |
Most impurities end up in Class 4 or 5, and the QSAR assessment is enough on its own. When an impurity lands in Class 3 and you can’t control it at the TTC, an Ames test usually settles it. A negative result moves it to Class 5. A positive result makes it Class 2, and sometimes calls for in vivo follow-up.
Step 3: Set the acceptable intake
The TTC and less-than-lifetime limits
For Class 2 and Class 3 impurities, the default limit is the threshold of toxicological concern (TTC): 1.5 µg/day for lifetime exposure. That corresponds to a theoretical excess cancer risk of about 1 in 100,000.
Not every medicine is taken for a lifetime, and ICH M7 allows higher intakes for shorter treatment:
| Duration of treatment | Acceptable intake per impurity |
|---|---|
| ≤ 1 month | 120 µg/day |
| > 1 to 12 months | 20 µg/day |
| > 1 to 10 years | 10 µg/day |
| > 10 years to lifetime | 1.5 µg/day |
These limits don’t apply to the so-called cohort of concern: aflatoxin-like, N-nitroso and alkyl-azoxy compounds. These are potent enough that TTC might not protect the patients, so they needs compound-specific limits.
Compound-specific limits for Class 1
When an impurity is a known carcinogen with good data, the acceptable intake is calculated from its carcinogenic potency, usually the TD50 from rodent studies, linearly extrapolated to a 1 in 100,000 risk. Where a published acceptable intake already exists, the assessment checks whether it is still the right value and whether newer data changes it.
Turning an intake into a specification
The acceptable intake is a daily dose, but your specification is a concentration. The conversion is straightforward:
So a Class 3 impurity at 1.5 µg/day in a drug with a 500 mg maximum daily dose gives a limit of 3 ppm. That’s the number your analytical team needs a method sensitve enough to measure.
Step 4: Qualify the non-mutagenic impurities
Impurities in Class 4 and 5 that sit above the Q3A or Q3B qualification threshold still need a justification. This is the toxicological qualification step, and there are a few ways to get there:
- The impurity was present in your safety studies. If batches used in toxicology or clinical studies contained the impurity at the same or higher level, it is considered qualified at that level. This is often the quickest route, but it need the batch data to line up.
- It’s a significant metabolite. An impurity that is also a major human metabolite of the API is generally considered qualified.
- Published data supports it. Literature, regulatory assessments or existing toxicology data on the impurity, or a close structural analogue, can show the proposed level is safe.
- New studies are needed. When none of the above works, a general toxicity study (typically 14 to 90 days) on material spiked with the impurity may be required. This is the slow and expensive route, which is why a good literature search comes first.
Nitrosamines: the special case
Since 2018, nitrosamines have been the most talked about impurity class in the industry. They belong to the cohort of concern, so the standard TTC doesn’t apply.
For nitrosamines with good carcinogenicity data, regulators publish compound-specific acceptable intakes. For the many that don’t have data, including most nitrosamine drug substance related impurities (NDSRIs), the FDA and EMA use the Carcinogenic Potency Categorization Approach (CPCA). The toxicologist scores the structure on features that raise or lower its potency, and it lands in one of five categories:
| CPCA category | Acceptable intake |
|---|---|
| Category 1 | 26.5 ng/day |
| Category 2 | 100 ng/day |
| Category 3 | 400 ng/day |
| Category 4 | 1,500 ng/day |
| Category 5 | 1,500 ng/day |
A nitrosamine risk assessment has two halves. The first looks at whether a nitrosamine could form at all: the amines in your API and excipients, nitrite levels, the process and the packaging. The second sets the limit for anything that could be present. Regulators expect both, and the first one get missed more often then you’d think.
What goes into an impurity risk assessment report
A reviewer reading your report wants to follow the reasoning without having to rebuild it. A complete report from Indivirtus covers:
- Identity of the impurity: name, structure, CAS number where available, and its origin in the process
- The product context: route of administration, maximum daily dose and treatment duration
- Which thresholds the impurity crosses under Q3A or Q3B
- The ICH M7 assessment, with both (Q)SAR predictions, model versions and the expert review
- A literature and database search for mutagenicity, carcinogenicity and general toxicity data
- The ICH M7 class or the qualification route, with a written justification
- The acceptable intake, how it was derived, and the resulting specification limit
- A suggested control option under ICH M7 where it helps, for example whether the impurity can be controlled upstream instead of in the final API
- References and a signed expert statement
How Indivirtus handles impurity risk assessment
We have been doing this long enough to know that the number in the report is only half the job. The other half is making sure a reviewer accepts it. Here’s how the work usually goes:
- Share the structures and contextSend us the impurity structures (or SMILES), the API, the maximum daily dose, the route and treatment duration, and the batch levels you’re seeing. Everything is covered under NDA.
- Threshold and M7 screeningWe confirm which thresholds apply and run the two complementary (Q)SAR models. Our toxicologists review every prediction and resolve the ones that disagree.
- Literature and data reviewWe search for experimental data on the impurity and close analogues, and check for existing regulatory acceptable intakes.
- Limit and strategyWe derive the acceptable intake and the specification limit. If testing is needed, we tell you as soon as that becomes clear, not after the report is issued.
- Signed reportYou recieve an inspection ready report with the reasoning written out. A QSAR assessment typically takes 3 to 5 working days per structure, and related impurities from one route usually move faster.
We also help when a regulator comes back with questions on an impurity, and when an older assessment needs updating because new data or new guidance has come out.
A few mistakes that cause trouble
From the deficiency letters our clients bring to us, same issues comes up again and again:
- Only one (Q)SAR model was used, or both models were run but nobody reviewed the output.
- The daily dose used was wrong, often the starting dose instead of the maximum daily dose.
- The cohort of concern was ignored, and an N-nitroso compound was given the 1.5 µg/day TTC.
- Qualification was claimed from tox batches that didn’t actually contain the impurity at the claimed level.
- The assessment was never updated after a process change introduced new reagents or by-products.
None of these are hard to avoid, they just need somone to look at the impurity with a toxicologist’s eye before the dossier goes out.
Have a peak that needs explaining before your next submission? Request a quote or explore our genotoxic impurity assessment service.