Nitrosamine Risk-Assessment Toolkit
Since 2018 the discovery of N-nitrosamine impurities has forced recalls, import alerts, and supply disruptions across sartans, ranitidine, metformin, and a widening list of products — and the risk has since moved from a handful of small-molecule impurities to nitrosamine drug-substance-related impurities (NDSRIs) that can form from a drug substance's own amine structure. FDA now expects every applicant and manufacturer of chemically synthesised and certain biologic drugs to have run a documented three-step program — risk assessment, confirmatory testing, and reporting the changes made to control the risk. This toolkit decodes FDA's final guidance, maps each program step to the readiness it demands, and sequences the work into phases you can run against your portfolio and your reporting milestones.
What a toolkit is not
A toolkit is a readiness playbook SPEQ assembled, not a regulator’s checklist and not a guarantee of an outcome. Working through it is not evidence of readiness; your own quality system decides that.
What the nitrosamine problem is
N-nitrosamines are a class of compounds many of which are potent mutagenic carcinogens: several are classified as probable human carcinogens, and because they are DNA-reactive they fall under the cohort-of-concern in ICH M7(R2), where acceptable intakes are set far lower than for ordinary impurities. They can form whenever a secondary or tertiary amine meets a nitrosating agent (typically nitrite) under the right conditions — which can happen in the drug substance synthesis, from recovered solvents and reagents, from contaminated raw materials, in the drug product during manufacture or on storage, and even from nitrite present as a trace excipient impurity.
The regulatory response is FDA's final guidance, 'Control of Nitrosamine Impurities in Human Drugs' (September 2024, Revision 2). It is not a one-time notice: it defines an ongoing control program, recommends a risk-based process for finding and limiting nitrosamines, and has been reinforced by dedicated recommendations for NDSRI acceptable-intake limits. The obligation is a living one — acceptable intakes, the list of at-risk products, and the analytical expectations continue to evolve, so a nitrosamine program is maintained, not closed.
The three-step control strategy FDA expects
FDA recommends a recurring three-step process. Step 1 is a risk assessment: manufacturers identify which of their APIs and products are at risk of nitrosamine formation or contamination — explicitly including NDSRIs — using knowledge of the synthetic route, the manufacturing process, materials, and packaging. Step 2 is confirmatory testing wherever a risk is identified: manufacturers test the actual product using appropriately sensitive, validated analytical methods to confirm whether a nitrosamine is present and at what level relative to its acceptable intake. Step 3 is reporting changes: manufacturers report to FDA the changes they implement to prevent or reduce nitrosamines to acceptable levels, through the appropriate regulatory mechanism for an approved or pending application.
The steps are sequential but the program is iterative — a new NDSRI recommendation, a route change, or a new supplier reopens Step 1 for the affected products. FDA set an interim milestone recommending that applicants provide progress on implementing NDSRI control or mitigation by August 1, 2025; by now manufacturers should be engaged in Steps 2 and 3, moving from assessment into confirmatory testing and the reporting of controls.
NDSRIs, the CPCA, and why the limits keep moving
The hardest part of the current phase is NDSRIs — nitrosamines formed from the drug substance's own secondary or tertiary amine, so they are unique to each molecule and rarely have a compound-specific carcinogenicity dataset. Without such data an acceptable intake cannot be read from a table. To make the problem tractable FDA published a recommended framework, the Carcinogenic Potency Categorization Approach (CPCA), which uses structural features to place an NDSRI into a potency category carrying a recommended acceptable-intake limit; the Category 1 recommended AI limit is 26.5 ng/day for US marketing.
Two cautions matter. First, these limits are subject to update: CPCA categories, the NDSRI recommendations, and enhanced approaches such as read-across or in-vitro mutagenicity data can change an assigned limit, so a program must track the current recommendation rather than a remembered number. Second, an acceptable intake in nanograms per day is not a specification until it is converted to a product concentration limit against the maximum daily dose — which is exactly where the confirmatory-testing method's sensitivity has to reach. SPEQ presents the categorisation logic and the AI-to-ppm conversion transparently so a result can be reproduced in your own qualified system; it is not a substitute for the current FDA recommendation.
Have you identified every API and product at risk of nitrosamine formation or contamination — including NDSRIs derived from the drug substance's own structure — from the synthetic route, process, materials, and packaging? SPEQ synthesis: this is a structured, documented hazard identification, not a one-line statement; inspectors and reviewers expect a prioritised inventory with a rationale per product, and it must be re-opened whenever a route, supplier, or NDSRI recommendation changes.
Official name — FDA Guidance, Control of Nitrosamine Impurities in Human Drugs (Sept 2024, Rev. 2). Reading is SPEQ synthesis.
Where a risk was identified, have you tested the actual product with an appropriately sensitive, validated method and compared the result to the correct acceptable intake? SPEQ synthesis: the exposure here is method sensitivity and validation — the limit of quantitation has to reach the ppm limit derived from the AI and the maximum daily dose — plus the data integrity of the raw analytical data that underpins every 'not detected' claim.
Official name — FDA Guidance, Control of Nitrosamine Impurities in Human Drugs (Sept 2024, Rev. 2). Reading is SPEQ synthesis.
Have you reported to FDA the changes implemented to prevent or reduce nitrosamines to acceptable levels, through the right mechanism for an approved or pending application? SPEQ synthesis: this is a change-control and regulatory-reporting discipline — categorising each mitigation (route change, supplier change, specification, packaging, reformulation) at the correct reporting level and evidencing that the control actually works before or alongside the submission.
Official name — FDA Guidance, Control of Nitrosamine Impurities in Human Drugs (Sept 2024, Rev. 2). Reading is SPEQ synthesis.
SPEQ’s sequenced readiness synthesis across 5 phases, from first baseline to the post-inspection decision. Each phase carries its checklist and the record that proves each item was done.
Build a documented, prioritised inventory of every API and product at risk of nitrosamine formation or contamination, including NDSRIs.
- Compile the full inventory of chemically synthesised drug substances and products in scope, with maximum daily dose and route for eachEvidence: A product inventory listing MDD, dosage form, and marketing status per item
- Assess each synthetic route, process, recovered solvents/reagents, raw materials, and packaging for nitrosamine formation or contamination pathwaysEvidence: A per-product risk assessment documenting the formation/contamination rationale and risk factors
- Screen each drug substance's structure for a secondary or tertiary amine that could generate an NDSRI, and identify the predicted NDSRIEvidence: An NDSRI structural screen naming the potential NDSRI per molecule, or a justified no-risk conclusion
- Assign a provisional acceptable intake per identified nitrosamine, using the current CPCA category for NDSRIs (Category 1 recommended limit 26.5 ng/day) and confirming the value against the latest FDA recommendationEvidence: An AI-assignment record citing the source and CPCA category, dated to the recommendation in force
- Prioritise products for confirmatory testing by risk and exposure so the highest-risk products move firstEvidence: A ranked risk register with a defensible prioritisation rationale
- Every in-scope API and product has a documented risk assessment with a conclusion
- Each identified nitrosamine (including NDSRIs) has a provisional acceptable intake traceable to the current FDA recommendation
- Products are prioritised for confirmatory testing and the trigger for re-assessment is defined
Confirm whether a nitrosamine is actually present, and at what level relative to its acceptable intake, using an appropriately sensitive validated method.
- Convert each acceptable intake into a product concentration limit (ppm) against the maximum daily dose so the method target is explicitEvidence: An AI-to-ppm conversion record per product showing limit = AI / MDD
- Develop or transfer an analytical method whose limit of quantitation reaches the required ppm limit, and validate it for the matrixEvidence: A validated method with an LOQ at or below the target limit and a method validation report
- Test representative batches of the actual product and compare each result to the ppm limit with a margin-of-safety assessmentEvidence: Analytical results with raw data, compared to the limit, and a disposition per batch
- Preserve the data integrity of the confirmatory raw data — audit trails, original records, and access controls on the analytical systemsEvidence: Audit-trail review and access-control evidence for the systems holding the nitrosamine data
- Where more than one nitrosamine is possible, apply the total-nitrosamine consideration rather than only the individual limitsEvidence: A total-nitrosamine assessment documenting the combined-risk conclusion
- Every at-risk product has a defensible ppm limit derived from its acceptable intake and maximum daily dose
- Confirmatory testing uses a validated method sensitive to that limit, with data-integrity controls demonstrated
- Each tested product has a documented present/absent conclusion and margin of safety
Where a nitrosamine exceeds or approaches its limit, design and verify controls that prevent or reduce it to an acceptable level.
- Root-cause the formation or contamination pathway for each product over the limit, distinguishing API-derived, process-derived, and material/packaging sourcesEvidence: A root-cause investigation identifying the dominant nitrosamine source per product
- Select a mitigation — route/reagent change, nitrite-scavenger or antioxidant, supplier or specification change, packaging change, or reformulation — and justify itEvidence: A control-strategy update documenting the chosen mitigation and its scientific rationale
- Verify the mitigation actually reduces the nitrosamine below the limit at commercial scale, not just in the labEvidence: Confirmatory re-test data on mitigated batches demonstrating the level is controlled
- Set an ongoing control — specification limit, in-process control, or supplier control — and define stability monitoring where formation can occur on storageEvidence: Approved specifications/controls and a stability plan covering nitrosamine formation over shelf life
- Open change control for every mitigation so the reporting category can be determined in the next phaseEvidence: Change-control records linking each mitigation to the affected products and filings
- Every product over the limit has a root-caused, scientifically justified mitigation
- The mitigation is verified to control the nitrosamine at commercial scale with an ongoing control in place
- Each mitigation is captured in change control ready for regulatory categorisation
Report the implemented changes to FDA through the correct mechanism for each approved or pending application, and evidence that the control works.
- Categorise each change at the correct reporting level for the affected application (prior approval, changes-being-effected, or annual report, as applicable)Evidence: A change-reporting categorisation record per change with the rationale
- Assemble the supporting package — risk assessment, confirmatory data, mitigation and its verification — for each submissionEvidence: A submission dossier index linking each claim to its underlying record
- Meet the applicable NDSRI progress milestone and document the status of any product still in progressEvidence: A milestone-tracking record showing NDSRI control/mitigation progress and remaining actions
- Update approved specifications, methods, and the control strategy in the relevant filings to reflect the implemented controlsEvidence: Submitted amendments or supplements reflecting the new nitrosamine controls
- Maintain a register of what was reported, when, and through which mechanism for each productEvidence: A regulatory-reporting register maintained across the portfolio
- Every implemented mitigation is reported to FDA at the correct level for its application
- Each report is supported by the risk assessment, confirmatory data, and mitigation verification
- Products still in progress have a documented status against the applicable milestone
Keep the nitrosamine program live — re-assess on change, track evolving limits and recommendations, and monitor for formation over the product lifecycle.
- Define the triggers that re-open Step 1 — new NDSRI recommendation, route or supplier change, new raw-material source, or new stability signalEvidence: A documented re-assessment trigger list embedded in change control
- Monitor FDA and ICH updates to acceptable intakes, the CPCA, and NDSRI recommendations, and reconcile assigned limits when they changeEvidence: A horizon-scanning log with the reconciliation actions taken per update
- Run periodic stability and monitoring testing where nitrosamines can form on storage, and trend the resultsEvidence: Trended stability/monitoring data with an action rule for adverse trends
- Keep the risk register, control strategy, and reporting register current across the portfolioEvidence: A version-controlled risk register and control strategy with a review cadence
- Change-driven re-assessment triggers are defined and operating
- Evolving acceptable intakes and recommendations are tracked and reconciled against assigned limits
- Ongoing monitoring and the risk register are maintained across the lifecycle
Template outlines are free; editable downloads require the Professional entitlement.
- FDA — Information about Nitrosamine Impurities in Medications ↗
- FDA Guidance — Control of Nitrosamine Impurities in Human Drugs (Sept 2024, Revision 2) ↗
- FDA Guidance — Recommended Acceptable Intake Limits for Nitrosamine Drug Substance-Related Impurities (NDSRIs) ↗
SPEQ is not affiliated with the FDA. Program identifiers and dates are cited from the primary sources above and were verified before publish; the phased playbook and objective readings are SPEQ synthesis.
What is the three-step nitrosamine control strategy?
FDA recommends a recurring three-step process: Step 1 — a risk assessment identifying which APIs and products (including NDSRIs) are at risk of nitrosamine formation or contamination; Step 2 — confirmatory testing of the actual product with an appropriately sensitive validated method wherever a risk is identified; and Step 3 — reporting to FDA the changes implemented to prevent or reduce nitrosamines to acceptable levels through the appropriate regulatory mechanism.
What is an NDSRI and why is it harder to handle?
A nitrosamine drug-substance-related impurity (NDSRI) is a nitrosamine formed from the drug substance's own secondary or tertiary amine, so it is unique to each molecule and rarely has compound-specific carcinogenicity data. Without that data an acceptable intake cannot be read from a table, so FDA published the Carcinogenic Potency Categorization Approach (CPCA) to assign a category and a recommended acceptable-intake limit from structural features — with the Category 1 recommended limit at 26.5 ng/day for US marketing, subject to update.
Is the Category 1 acceptable-intake limit of 26.5 ng/day fixed?
No. The 26.5 ng/day figure is the current recommended acceptable-intake limit for CPCA Category 1 for US marketing, but nitrosamine acceptable intakes, the CPCA categories, and NDSRI recommendations continue to evolve, and enhanced approaches such as read-across or in-vitro mutagenicity data can change an assigned limit. A program must always reconcile assigned limits against the FDA recommendation in force rather than relying on a remembered number.
What milestone has FDA set for NDSRI mitigation?
FDA recommended that applicants provide progress on implementing NDSRI control or mitigation by August 1, 2025. By now manufacturers of at-risk products should have moved beyond the initial risk assessment and be actively engaged in Steps 2 and 3 — confirmatory testing and the reporting of implemented controls — with a documented status for any product whose mitigation is still in progress.