Related Substances and Unknown Impurities

In November 2018 the FDA wrote to a manufacturer whose valsartan had been recalled worldwide. Buried in the letter is one sentence that explains how an impurity contaminated a global drug supply for seven years.

“you told our investigators you were aware of a peak that eluted after the (b)(4) peak in valsartan API residual solvent chromatograms where the presence of NDMA was suspected to elute. At the time of testing, you considered this unidentified peak to be noise and investigated no further.”Zhejiang Huahai Pharmaceutical — Warning Letter 320-19-04, 29 November 2018. fda.gov

The peak was N-nitrosodimethylamine. It had been visible in the firm's own chromatograms. Somebody looked at it, classified it as noise, and moved on — and because “noise” is not a category that carries any obligation, nothing further happened for seven years.

That is a vocabulary failure before it is anything else. The analyst had a peak and needed a word for it. The word chosen determined the obligation, and the wrong word produced no obligation at all. This module is about getting the words right.

A1.1  Four words for overlapping things

• Impurity The term used by ICH. An impurity is any component of the drug substance that is not the drug substance itself, or — in a drug product — any component that is neither the drug substance nor an excipient. It is the broadest of the four words and the one the regulatory framework is built on. Requirement ICH Q3A(R2) and Q3B(R2)
• Degradation product A subset of impurities: those arising by chemical change to the drug substance during manufacture or storage. ICH Q3B addresses only these. It does not cover process impurities carried through from the drug substance, and it does not cover impurities originating in the excipients. Requirement ICH Q3B(R2), scope
• Related substance A pharmacopoeial term, not an ICH one. It is the heading under which a monograph places its organic impurities test. If your specification says “Related substances” you are almost certainly reading a compendial monograph or something modelled on one. The set of compounds it covers is defined by that monograph, not by a general principle. Requirement USP and Ph. Eur. monograph convention
• Unknown peak Not a regulatory term at all. It appears in no ICH guideline and no compendial chapter. It is laboratory vernacular for a signal nobody has yet accounted for, and its usefulness is precisely that it is provisional — it describes the state of your knowledge, not a property of the compound. Practice Laboratory usage; see the FDA letters quoted throughout this course, where the agency itself adopts the phrase

Two consequences follow immediately. First, “related substances” and “impurities” are not synonyms, even though they are used interchangeably in most laboratories. One is the name of a test in a monograph; the other is a regulatory category. Second, “unknown peak” is a statement about you, not about the molecule. It is the only one of the four that can be resolved by doing work.

A1.2  Two axes, not one

The regulatory framework classifies an impurity along two axes that people routinely collapse into one. They are independent, and all four combinations occur.

Specified or unspecified asks whether the impurity has its own individual acceptance criterion. Identified or unidentified asks whether anyone knows what it is.

Figure A1.1

The box that surprises people is the lower left. An impurity can be specified and unidentified at the same time — it appears in every batch at a consistent level, it has been given its own named limit in the specification, and nobody has ever established its structure. It is usually designated by its relative retention time, which is why specifications contain entries that read like coordinates rather than compounds.

That box is where a great deal of risk accumulates. A specified unidentified impurity looks controlled — it has a limit, it passes, the batch releases — while the one question that would determine whether the limit is appropriate has never been asked. The Huahai peak was, in effect, in a fifth box: seen, unnamed, and not even given a limit.

A1.3  Reading one chromatogram in this vocabulary

Below is a single chromatogram containing four impurity peaks. Every peak is genuine; the percentages are area-normalised against the total integrated area of the trace.

Figure A1.2

Nothing in the chromatogram tells you which is which. The detector produces four numbers. The status of each peak comes from the specification and the development history, not from the instrument. This is why an analyst cannot classify a peak alone, and why “it is just noise” is a judgement that requires evidence rather than a shrug.

A1.4  How the percentage was calculated

Every number in the table above is a percentage, and so is every impurity limit in every specification you will ever read. But a percentage is not a measurement until you say what was divided by what. Three methods are in routine use, they give different answers for the same peak, and the difference is frequently large enough to change what you are obliged to do.

Method 1 — area normalisation

Also called area percent or % area. The impurity peak area is divided by the sum of all peak areas in the chromatogram.

Take the worked example used throughout this section. A drug substance sample is prepared at 1.000 mg/mL and the chromatogram gives these areas, in arbitrary detector units:

Impurity B = ( 5,820 ÷ 4,859,380 ) × 100 = 0.1198%

No reference standard is required, which is why this method is popular and why it is the default in early development. Its cost is an assumption: that every component responds to the detector in proportion to its mass, identically to the drug substance. Practice For a UV detector this is only true when the impurity has essentially the same chromophore as the parent. An impurity that has lost a conjugated system, gained a saturated centre, or is being measured away from its absorbance maximum will respond quite differently — and the number above will be wrong by whatever that difference is.

Method 2 — external standard against a diluted drug-substance standard

The impurity peak is compared not to the other peaks in its own chromatogram, but to a separately injected standard of known concentration. Where no standard of the impurity itself exists — which is the usual situation for a newly observed peak — the standard used is the drug substance reference standard, diluted to roughly the impurity's expected level. Here it is prepared at 1.00 µg/mL, which is 0.1% of the test concentration, and the reference standard is assigned 99.6% purity.

The diluted standard gives a peak area of 4,910. Correcting the nominal standard concentration for purity gives 0.0010 × 0.996 = 0.000996 mg/mL, so:

Impurity B = ( 5,820 ÷ 4,910 ) × ( 0.000996 ÷ 1.000 ) × 100 = 1.1853 × 0.0996 = 0.1181%

Close to the area-normalised figure — and it carries exactly the same flaw, for exactly the same reason. Comparing the impurity against a drug substance standard still assumes the impurity responds like the drug substance. The method has changed; the assumption has not.

Method 3 — correcting with a relative response factor

The relative response factor (RRF) is the detector response of the impurity divided by the detector response of the drug substance, at equal concentration. An RRF of 1.0 means they respond identically. An RRF of 0.5 means the impurity gives half the signal for the same mass — so measuring it against a drug-substance standard would report half of what is really there.

Impurity B has an established RRF of 0.62. The correction divides:

Corrected % = uncorrected % ÷ RRF = 0.1181 ÷ 0.62 = 0.1904%

The reported level rises from 0.1181% to 0.1904% — an increase of 61%, without anything about the sample changing. Practice Many laboratories apply the convention that an RRF between roughly 0.8 and 1.2 may be treated as 1.0 and no correction applied. That is a defensible working practice, not a rule, and it is only defensible when the RRF has actually been determined and found to lie in that band. Assuming an RRF of 1.0 because nobody measured it is a different thing entirely, and it is the more common of the two.

Method 4 — external standard against an authentic impurity standard

The most direct method, and the one available only once you have a characterised, purity-assigned reference standard of the impurity itself. Same equation as Method 2, but the standard is now the impurity. Prepared at 1.00 µg/mL nominal with an assigned purity of 98.2%, it gives a peak area of 3,045:

Impurity B = ( 5,820 ÷ 3,045 ) × ( 0.000982 ÷ 1.000 ) × 100 = 1.9113 × 0.0982 = 0.1877%

Notice that the two standards themselves reveal the RRF. The impurity standard and the drug substance standard were prepared at the same nominal concentration, and their areas were 3,045 and 4,910 — a ratio of 0.6202, which is the RRF of 0.62 used in Method 3. That is where an RRF comes from: you measure it. Methods 3 and 4 agree to within 1.45%, and the residual difference is the two standards' assigned purities (99.6% against 98.2%), not the chemistry.

What the four methods do to the same peak

Figure A1.3

For a drug substance dosed at 2 g/day or less, the identification threshold is 0.10% and the qualification threshold is 0.15%. Methods 1 and 2 put Impurity B between them: identify it, but no safety justification required. Methods 3 and 4 put it above 0.15%: identify it and qualify it — a toxicological exercise, with real cost and real timeline.

Area normalisation under-reports this impurity by 36.2% relative to the authentic standard. That is not an unusual magnitude. It is the direct consequence of an RRF of 0.62 and an unexamined assumption of 1.0.

Peak integration itself — where the baseline goes, and therefore what A_impurity actually is — is treated in the companion Veritas course on peak integration. Every calculation above takes the areas as given. Whether those areas are right is a separate question, and an equally consequential one.

A1.5  The word that was retired

Older specifications and older analysts use disregard limit for the level below which a peak is not reported. The term has been retired in favour of reporting threshold, and USP treats the two as the same thing, stating that impurities above the reporting threshold — “i.e., the disregard limit” — shall be reported. Requirement

The change was not cosmetic. “Disregard” describes what the analyst does; “reporting threshold” describes what the specification requires. The first invites the reading that below the line the peak does not matter. The second says only that below the line it is not reported — which is a much narrower claim, and leaves intact the obligation to notice if such a peak starts to grow.

Two further cautions on legacy vocabulary. Practice Specifications written before the ICH thresholds were harmonised often express limits in ways that no longer map cleanly onto the current framework; before applying a modern threshold to an old specification, confirm which document the number came from. And a monograph limit and an ICH threshold are different instruments — meeting one does not automatically satisfy the other.

A1.6  Why the words carry the obligation

The reason to be pedantic about this vocabulary is that regulators are. When FDA writes up an impurity finding, the language it uses is the language of the framework, and the finding is usually that a firm applied the wrong category.

“Your investigation concluded that the unknown peaks ‘could be due to sample solution contamination during preparation.’ However, the investigation lacked scientific and thorough root cause analysis, failing to identify the contaminant, its origin, or the cause of its presence within your samples.”Cdymax India Pharma — Warning Letter 320-26-18, 13 November 2025. fda.gov

And where a firm assigns an identity the data does not support, the assignment itself becomes the finding:

“this conclusion was not scientifically justified because the retention time of (b)(4) did not match that of the unknown impurity peak.”Sun Pharmaceutical Industries — Warning Letter 320-24-48, 18 June 2024. fda.gov

Between them these two letters mark the boundary of honest practice. Calling a peak unknown when you do not know what it is, is correct. Calling it known when you do not, is a finding. Calling it noise, as Huahai did, is the most expensive option of the three.

---

Knowing what a peak is matters less than most analysts expect. Knowing where it came from is what determines whether it can be controlled, whether it will grow, and whether it will still be there next year.

Figure A2.1

A2.1  Process impurities

Anything introduced or generated by the synthesis: unreacted starting materials, intermediates, by-products of the intended reaction, reagents, catalysts, ligands, and the residues of solvents used along the way. They are characteristically consistent — the same route produces the same profile batch after batch, which is why a stable impurity profile is evidence that a process is under control, and a shifting one is evidence that something has changed.

The corollary is the lesson of the Huahai case. A process change can introduce an impurity class that the existing method was never designed to see. FDA's language on this is unusually direct:

“You are responsible for developing and using suitable methods to detect impurities when developing, and making changes to, your manufacturing processes.”Zhejiang Huahai Pharmaceutical — Warning Letter 320-19-04, 29 November 2018. fda.gov

The process change in that case was made in November 2011 to improve yield and lower cost — an ordinary, well-intentioned optimisation. Requirement Under ICH Q3A the impurity profile of the drug substance must be re-examined when the route changes; the requirement is not new and was not obscure. What failed was the assumption that an existing, validated method would reveal whatever the new route produced.

A2.2  Degradation products, and how you prove one

Degradation products arise by chemical change to the drug substance — hydrolysis, oxidation, photolysis, thermal decomposition, and reaction with excipients or with the container. Their signature is that they grow with time, which distinguishes them from process impurities and makes stability data the place they are found.

The way you establish that a peak is a degradant rather than a process impurity is forced degradation: stress the material deliberately, harder than it will ever be stressed in storage, and see what appears.

Figure A2.2

In the study above the main peak lost 6.90% of its area under stress, and the 4 new peaks account for 6.66%. Those two numbers are not equal, and there is no reason they should be. 0.24% of the original main peak is unaccounted for — a mass balance of 99.76%.

That gap is itself a result. It means some of what the drug substance turned into is not being seen: it may not elute in the run time, it may not absorb at the detection wavelength, it may have precipitated, or it may have volatilised. Practice A mass balance materially short of complete is a signal that the method is not seeing everything, and is a conventional trigger to extend the run, add a second detector, or change the detection principle entirely. No guideline states a numerical mass-balance acceptance criterion; the convention that a shortfall requires explanation is exactly that — a convention, and a sound one.

The stakes of not doing this properly are visible in enforcement:

“Your implemented method was unable to detect multiple unknown impurities that your CTL’s validated method identified.”Almon Healthcare — Warning Letter 320-26-102, 13 July 2026. fda.gov

Two methods, one sample, different answers. The impurities were always there; only one method could see them.

A2.3  Excipient interaction and leachables

A drug product introduces two origins a drug substance does not have. Excipients react — and they also carry their own reactive species, so an impurity can arise from the excipient rather than in it. Containers, closures and delivery devices leach, and what migrates into the product depends on the formulation, the contact time and the storage conditions.

Requirement Leachables have until recently been governed by a patchwork of regional guidance. ICH Q3E, Guideline for Extractables and Leachables, reached Step 2 on 1 August 2025 and is in public consultation, with Step 4 anticipated in 2027. It introduces an Analytical Evaluation Threshold — a reporting threshold for leachables above which identification and quantitation are expected. Anyone building an impurity control strategy for a drug product now should read it, while recognising that a Step 2 draft is not yet binding.

A2.4  Contamination, and the different threat model

The fifth origin is not a property of the molecule at all. Cross-contamination, carry-over from shared equipment, recovered solvent, and — at the far end — deliberate adulteration.

This category behaves unlike the other four, and the difference is worth stating plainly. Process impurities and degradants are consistent: they appear at similar levels in every batch, so sampling a few batches characterises them. Contamination is not. FDA put this better than any textbook:

“Cross-contamination cannot be assumed to be uniformly distributed and testing alone is insufficient to mitigate the observed contamination hazards.”Mylan Laboratories, Unit 8 — Warning Letter 320-20-06, 5 November 2019. fda.gov

That sentence is the strongest available argument for why a risk assessment cannot be replaced by end-product testing. If a contaminant is unevenly distributed, a passing result on the sample you drew tells you about the sample, not the batch.

In the same episode FDA found NDEA at 3.38 ppm in a recovered solvent against a limit of 0.08 ppm — more than forty times over — and a related firm was cited for a gap that belongs in every laboratory's procedures:

“Your firm failed to implement a procedure for investigating unknown peaks in recovered solvent chromatograms observed during analytical testing.”Lantech Pharmaceuticals — Warning Letter 320-19-34, 8 August 2019. fda.gov

Adulteration is a threat model, not an impurity class

Deliberate adulteration deserves separating out because the adversary is choosing what you will find. In 2008 heparin was adulterated with oversulfated chondroitin sulfate, a compound that behaves enough like heparin to pass the compendial assay of the day. It was detected by proton NMR and capillary electrophoresis — techniques outside the monograph — because it was designed to survive the techniques inside it.

The general principle is one every analyst should carry: a specification is a description of what you looked for, not a guarantee of what is present. Practice Where economic incentives to substitute exist — high-value materials, commodity excipients with cheap toxic analogues, complex naturals — orthogonal identity testing is a proportionate control, and increasingly an expected one.

The most persistent example is the simplest. Diethylene glycol and ethylene glycol are cheap and structurally similar to glycerin and propylene glycol. Requirement FDA's May 2023 final guidance requires specific identity testing of glycerin, propylene glycol, sorbitol solution and other high-risk components for DEG and EG, resting on 21 CFR 211.84's requirement that specific identity tests be used where they exist. The failure mode FDA describes is not exotic:

“FDA has observed with prior instances of DEG poisoning that many cases have involved manufacturers relying on a supplier’s certificates of analysis as evidence of testing.” FDA, Importing Liquid Cough and Cold Medicine from India, page dated 21 January 2026. fda.gov

A certificate of analysis is a claim about a test somebody else says they performed. It is not a test.

A2.5  Why origin decides control

Read the table backwards and it explains why misassigning origin is costly. Treat a degradant as a process impurity and you will tighten a synthesis that was never the problem while the level keeps climbing on stability. Treat a contaminant as a process impurity and you will characterise a batch profile that does not predict the next batch. Practice Origin is established from process knowledge, forced degradation and stability behaviour together — never from retention time alone.

---

Ask an experienced analyst what the limit is for an unspecified impurity and you will usually hear “0.10%”. It is a reasonable answer for one dose bracket of one guideline, and wrong everywhere else.

A3.1  Three thresholds, and they stack

Figure A3.1

Requirement ICH Q3A(R2) and Q3B(R2) define three thresholds, each adding an obligation without removing the one beneath it.

• Reporting threshold — above this level the impurity is reported in the analytical result. Below it, it is not reported.
• Identification threshold — above this level the structure must be established.
• Qualification threshold — above this level the safety of the impurity at that level must be justified.

They are cumulative. An impurity above the qualification threshold must also be identified and reported. There is no level at which you skip a rung.

Both guidelines carry the same footnote, and it is the most frequently overlooked sentence in either document: “Lower thresholds can be appropriate if the impurity is unusually toxic.” Requirement The tables are defaults, not entitlements.

A3.2  The two tables are not the same table

ICH Q3A(R2), drug substance. Two dose brackets, split at 2 g/day. Requirement

ICH Q3B(R2), drug product — degradation products only. Four brackets, and the reporting threshold splits at 1 g/day rather than 2. Requirement

Reporting thresholds for the drug product: 0.1% below 1 g/day, 0.05% at or above it. Note that the low-dose drug-product reporting threshold (0.1%) is higher — more permissive — than the drug-substance one (0.05%). That inversion trips people who assume the product is always held to the tighter standard.

A3.3  The same peak, five doses

Here is what dose-dependence actually does. The peak below is held constant at 0.12% throughout. Only the maximum daily dose changes.

Figure A3.2

The identical impurity, at the identical level, requires identification in the drug substance at 5 of 5 doses and in the drug product at 1 of 5. Nothing about the molecule changed. Nothing about the measurement changed.

Two consequences worth committing to memory.

The 1.0 mg/day cap bites above 1 g/day. For a drug substance, the identification threshold is 0.10% or 1.0 mg/day intake, whichever is lower. At 1.5 g/day, 1.0 mg is 6.67% of the daily dose — so the threshold is 0.0667%, not 0.10%. Anyone applying 0.10% to a high-dose drug substance is applying a limit roughly 1.5 times too permissive.

Identification and qualification converge, and can be equal. Because both are capped at 1.0 mg/day intake, above about 667 mg/day the qualification cap starts to bind, and above 1 g/day both thresholds are the same number. At 1.5 g/day the identification and qualification thresholds are both 0.0667%. The common intuition that qualification always sits above identification is a property of the low-dose bracket, not a general truth.

A3.4  What qualification actually means

Reporting is arithmetic and identification is chemistry, but qualification is toxicology. To qualify an impurity is to establish that the biological safety of that impurity, at the level present, is acceptable. Requirement

It can be satisfied several ways: the impurity may be a known human metabolite of the drug; it may have been present in the material used in the toxicology and clinical studies, at that level or higher, in which case the existing safety data already covers it; there may be published safety data; or new studies may be needed. Practice The first two routes are much cheaper than the last, which is why laboratories keep careful records of the impurity profile of clinical and toxicology batches — those batches define what has already been qualified, and that is an asset.

Qualification is also the point at which the framework hands off to a different discipline. An analyst can identify an impurity. Whether the level is acceptable is a toxicological judgement, and the specification is where that judgement is recorded.

A3.5  Where this framework does not apply

Two important carve-outs, both covered in later arcs but flagged here so nobody applies the tables where they do not belong.

Mutagenic impurities are governed by ICH M7, not by the Q3A/Q3B thresholds. Requirement An impurity that is DNA-reactive is controlled against a threshold of toxicological concern of 1.5 µg/day for lifetime exposure — an absolute daily intake, not a percentage — which for most products is far below the Q3A identification threshold. Applying the percentage tables to a mutagenic impurity will produce a limit that is comfortably met and completely wrong.

The cohort of concern sits outside even M7's default. Requirement M7 excludes aflatoxin-like, N-nitroso and alkyl-azoxy compounds from the generic threshold; these require compound-specific assessment at substantially lower intakes. Nitrosamine limits are set in nanograms per day. Against those, a percentage threshold is not merely the wrong number — it is the wrong unit.

This is precisely why the Huahai peak mattered. Judged as an ordinary unspecified impurity it would have been unremarkable. Judged as what it was, it was orders of magnitude out. FDA's own guidance makes the detection problem explicit: “Typical routine tests (e.g., high performance liquid chromatography) for API purity, identity, and known impurities are unlikely to detect the presence of nitrosamine impurities.”

A3.6  The compendial layer

Where a monograph exists, it adds a layer on top of ICH. Requirement USP General Chapter ⟨476⟩ Control of Organic Impurities in Drug Substances and Drug Products requires monograph acceptance criteria to address four categories: each specified identified impurity, each specified unidentified impurity, any unspecified impurity, and total impurities.

The instructive part is how it sets the default for the third. USP does not state a fixed number. It sets the criterion for any unspecified impurity at not more than the identification threshold — which sends you straight back to the ICH tables, and straight back to dose-dependence. The familiar 0.10% is not a USP constant either. It is the same cell of the same table, reached by a different route.

---