Related Substances and Unknown Impurities

Four stages, two actors, one clock that starts before the investigation is even finished. The firm reports and, in almost every case, recalls. FDA evaluates the hazard and assigns the classification. Confusing which actor performs which stage is the most common error this module exists to correct.

Figure C3.1

C3.1  The Field Alert Report — a three-working-day clock

Requirement A specification failure confirmed in a batch already distributed does not wait for the investigation to close before it becomes reportable. 21 CFR 314.81(b)(1) requires the applicant to notify FDA within three working days of a defined set of triggers:

“The applicant shall submit information of the following kinds about distributed drug products and articles to the FDA district office that is responsible for the facility involved within 3 working days of receipt by the applicant.”21 CFR 314.81(b)(1). source

Two triggers matter for this course. The first is narrow — a labeling or identity mix-up:

“Information concerning any incident that causes the drug product or its labeling to be mistaken for, or applied to, another article.”21 CFR 314.81(b)(1)(i). source

The second is the one an unknown-peak investigation actually triggers, and it is written broadly on purpose:

“Information concerning any bacteriological contamination, or any significant chemical, physical, or other change or deterioration in the distributed drug product, or any failure of one or more distributed batches of the drug product to meet the specification established for it in the application.”21 CFR 314.81(b)(1)(ii). source

Practice “Receipt by the applicant” is what starts the three-working-day clock — not the investigation's conclusion, not the quality unit's sign-off, and not confirmation that the result is genuinely OOS rather than a Phase I laboratory error. A firm that waits to file until it is certain is filing late. The practical answer is a Field Alert Report template and an internal escalation path that exist before they are needed, so day one of a three-day clock is not spent deciding who drafts the form.

C3.2  The Health Hazard Evaluation — not the firm's call

Requirement Once the Field Alert Report reaches the district office, the next stage belongs to FDA, not the firm:

“An evaluation of the health hazard presented by a product being recalled or considered for recall will be conducted by an ad hoc committee of Food and Drug Administration scientists…”21 CFR 7.41(a). source

This is the single most common error students bring into this module: assuming the firm's own risk assessment — the same kind of hazard reasoning built into the OOS investigation in Module C1 — is the Health Hazard Evaluation, or substitutes for it. It does not. The firm's investigation establishes what happened and why. FDA's ad hoc scientist committee separately assesses who is exposed, how likely, how severe, and for how long, and that assessment feeds directly into the next stage:

“…the Food and Drug Administration will assign the recall a classification, i.e., Class I, Class II, or Class III, to indicate the relative degree of health hazard…”21 CFR 7.41(b). source

The three classes are themselves defined in the regulation, not left to firm or agency discretion case by case:

“A situation in which there is a reasonable probability that the use of, or exposure to, a violative product will cause serious adverse health consequences or death.”21 CFR 7.3(m) — Class I. source

“A situation in which use of, or exposure to, a violative product may cause temporary or medically reversible adverse health consequences or where the probability of serious adverse health consequences is remote.”21 CFR 7.3(m) — Class II. source

“A situation in which use of, or exposure to, a violative product is not likely to cause adverse health consequences.”21 CFR 7.3(m) — Class III. source

C3.3  Executing the recall — voluntary in almost every case

Practice Classification is a description of risk, not an order to act. In the overwhelming majority of cases the firm has already initiated the recall voluntarily by the time FDA classifies it — recall classification tells everyone, including the public through the FDA Enforcement Report, how serious the already-moving recall is. The exception is narrow and exists as a backstop:

“That a product that has been distributed presents a risk of illness or injury or gross consumer deception.”21 CFR 7.45(a)(1) — grounds for an FDA-requested recall. source

“The Commissioner or his designee will notify the firm of this determination and of the need to begin immediately a recall of the product.”21 CFR 7.45(b). source

Section 7.45 exists for the firm that declines to recall voluntarily once the hazard is clear. It is not the normal path, and a training programme that teaches recall as something FDA orders by default has the sequence backwards.

C3.4  Filing the fix: change control under 21 CFR 314.70

Requirement A peak found in distributed product is, eventually, a specification question again — the same one Module C2 covered. Once the investigation and any recall are resolved, the specification itself may need to change, and how that change is filed is governed by 21 CFR 314.70, not by the urgency schedule that governed the Field Alert Report.

Figure C3.2

Requirement The filing category follows whether the change adds a new control or adjusts an existing one — not simply which direction the number moves:

“A supplement must be submitted for any change…that has a substantial potential to have an adverse effect on the identity, strength, quality, purity, or potency…”21 CFR 314.70(b)(1) — prior approval supplement (PAS). source

“A supplement must be submitted for any change…that has a moderate potential to have an adverse effect…”21 CFR 314.70(c)(1) — changes being effected in 30 days (CBE-30). source

Practice Adding a specification or test that was not there before — a new impurity limit, a new identification test — is what 314.70(c)(6)(i) treats as immediate, filed as a CBE-0 and distributed on filing rather than after a waiting period, because it is new assurance the application did not previously have. Simply narrowing the numeric range of a criterion the application already has is a different act, even though the everyday word for both is “tightening.” FDA's own guidance is explicit that the latter belongs at the other end of the reporting spectrum:

“An addition to a specification that provides increased assurance that the drug substance or drug product will have the characteristics of identity, strength, quality, purity, or potency that it purports or is represented to possess. For example, adding a new test and associated analytical procedure and acceptance criterion.”FDA, Changes to an Approved NDA or ANDA, Guidance for Industry, Revision 1 (April 2004), §VIII.C.2. Section VIII.C, “Moderate Changes (Supplement — Changes Being Effected),” splits in two: C.1 is the 30-day path (CBE-30); C.2, quoted here, is the immediate one (CBE-0). source

Relaxing an existing criterion, or adding a new limit that needs its own toxicological qualification, carries more risk of masking a real problem and is filed as CBE-30 or PAS accordingly. But tightening an acceptance criterion the application already has — narrowing an already-approved range using the same control, without adding anything new — is exactly the kind of minimal-impact change 314.70(d) reserves for the annual report, and FDA's guidance names it directly:

“Changes in the drug substance, drug product, production process…that have a minimal potential to have an adverse effect…must be documented by the applicant in the next annual report.”21 CFR 314.70(d)(1). source

“The following are examples of changes in specifications considered to have a minimal potential to have an adverse effect…” … “Tightening of acceptance criteria.”FDA, Changes to an Approved NDA or ANDA, §VIII.D, item 3. source

Practice The distinction is easy to lose because both acts get called “tightening” in casual speech. Only one of them — adding a control that was not there before — is new assurance in the sense 314.70(c)(6)(i) means. Narrowing a number inside a control the application already has does not meet that bar, however much safer the narrower number feels.

The annual report itself runs on a much longer, routine clock — the opposite end of the reporting spectrum from the Field Alert Report's three working days:

“The applicant shall submit each year within 60 days of the anniversary date of U.S. approval of the application…”21 CFR 314.81(b)(2). source

Return to the naive specification from Figure C2.2 — the one fit tightly to two development batches, which manufactured OOS investigations out of ordinary variation. Tightening that specification after the fact, once its flaw was recognised, is itself a change under 314.70. It is not urgent from FDA's perspective: the firm has been operating within a compliant, already-approved range the whole time, and narrowing that range calls on no new science and needs no prior blessing to take effect. It is simply documented in the next annual report — the bottom row of Figure C3.2, not the top. The regulation that governs how a bad specification gets fixed is the same one that governs every other specification revision; nothing about having gotten it wrong the first time changes which category it falls into.

Arc B introduced nitrosamines as a detection story: a class of mutagenic impurities most routine methods cannot see. This module returns to them as a process story — what a firm and its regulators actually do, at portfolio scale, once a class-wide impurity is confirmed, and why that response turned out to be reusable.

Figure C4.1

C4.1  One playbook, used twice in three years

The nitrosamine response that began with valsartan in 2018 was not designed as a template — it was an emergency response to one crisis. It became a template because the same four stages turned out to generalise: a risk assessment to identify which products could be affected and why; confirmatory testing against a validated method; the application changes — CBE-30 or PAS, per Module C3's framework — needed to bring an approved specification into line with a new limit; and CAPA to close the loop on affected products.

Practice The proof that it generalised is that nobody had to design it twice. In October 2020, manufacturers and Swissmedic identified a different impurity — an azido compound, azidomethyl-biphenyl- tetrazole (AZBT) — in sartan active substances, arising from the same tetrazole-ring chemistry Arc B already flagged as the sartans' shared vulnerability:

“In October 2020, pharmaceutical companies and Swissmedic found traces of azidomethyl-biphenyl-tetrazole (AZBT) in batches of the active substance irbesartan.”Swissmedic, Monitoring of sartan medicines stepped up: traces of a new foreign substance detected. source

EDQM issued an analytical method and Health Canada and TGA issued alerts within weeks. Manufacturers began revising limits, and the first precautionary withdrawals followed almost immediately:

“As early as November 2020, individual medicinal product batches were withdrawn from the market in Switzerland.”Swissmedic, Monitoring of sartan medicines stepped up. source

Same four boxes at the top of Figure C4.1, different chemistry underneath. The risk-assessment methodology, the regulatory filing categories, and the CAPA discipline nitrosamines forced into existence were already sitting there, ready to run again — which is why the AZBT response moved in weeks where the nitrosamine response had taken the better part of a year to organise.

Figure C4.2

C4.2  The clock that does not reset

Requirement A class-wide event does not resolve in one filing. Acceptable intake limits get revised as more toxicology becomes available, and a firm managing a large affected portfolio needs to know exactly what a revision does — and does not — do to its compliance deadline, and what happens once that deadline arrives. EMA's own Q&A answers this with a single provision doing three things at once: setting a temporary allowance for exposure above the AI while the fix is implemented, stating plainly when that allowance runs out, and stating separately what does not move the goalposts:

“The approach is applicable to all authorised products that have: CAPA implementation timeline of up to 3 years from the date of publication of the initial AI (nevertheless MAHs are expected to expedite CAPAs implementation)… The approach is not applicable to the below instances where other approaches may be considered on a case-by-case basis in consultation with the appropriate regulatory authority: CAPA implementation exceeding 3 years from the date of publication of the initial AI (this date which starts the 3-years period will not change if the AI is subsequently revised, even in case of publication of more restrictive AI).”EMA/CMDh, Nitrosamines EMEA-H-A5(3)-1490 — Questions and Answers for Marketing Authorisation Holders/Applicants, EMA/409815/2020, Rev.23, Q22, 10 October 2025. source

Practice Two distinct things are anchored to that same initial-AI date, not the most recent one. First, the temporary interim limits themselves — 13.3× the AI for treatment courses of up to twelve months, 6.7× for longer courses — are only available for a CAPA whose implementation timeline runs up to three years from that initial publication date; a firm is not entitled to keep relying on the interim multiplier indefinitely as further AI revisions arrive. Second, the three-year clock that sets that window is itself fixed to the same initial date and does not reset — including when the AI is revised to something stricter. Past three years from a given product's own initial AI, the Q&A does not extend the interim-limit table further; it hands that product to the authority for case-by-case handling instead.

A firm tracking twenty affected products across several years of revisions needs twenty individual clocks, each dated to when its own first limit was published, each with its own countdown on how long its interim limit remains available. Assuming a later, stricter AI restarts either the three-year clock or the interim allowance does not buy more time — for either one. It spends time that was already running.