ICH Q3D(R2): Why an Elemental Impurities Risk Assessment Isn't a Test Report

ICH's Q3D(R2) guideline for elemental impurities, finalized at Step 4 in March 2022, asks sponsors for a documented risk assessment: identify every plausible source of elemental impurities in a drug product, evaluate the likely level from each, and use that evidence to choose a control strategy. What shows up in review files instead is frequently a finished-product test run against the guideline's default limits, with a risk-assessment narrative written around the results afterward. Reviewers who have seen enough of both can tell which one they are reading. Elemental impurities are a distinct question from DNA-reactive, mutagenic impurities, which ICH M7 governs separately.

What the risk assessment actually has to cover

Q3D applies the risk-management principles of ICH Q9(R1) to a specific question: which of the guideline's 24 elements of toxicological concern could plausibly end up in a finished drug product, and at what level. That question is broader than most default files answer. A compliant assessment evaluates the drug substance's synthetic route and starting materials, every excipient, process water, the manufacturing equipment train, and the container closure system — because any of them can introduce elements that never appear on an ingredients list. Testing the finished product tells you what showed up. It does not tell you why, or whether the next batch, made from a different excipient lot or through different equipment, would show the same result.

The element classes decide what gets assessed, not what gets skipped

Q3D sorts its 24 elements into four classes, and the class determines how the risk assessment has to treat each one. Class 1 elements — arsenic, cadmium, mercury, lead — are human toxicants with essentially no legitimate use in manufacturing, and the guideline requires evaluating them regardless of whether anyone intentionally added them. Class 2A elements carry a relatively high probability of occurring across raw materials and processes and get the same treatment. Class 2B elements only require evaluation if intentionally added somewhere in the process. Class 3 elements are lower-risk by the oral route but can still require assessment depending on the route of administration and whether they were intentionally introduced. A risk assessment that applies one rule — test everything, or worse, test only what was intentionally added — to all four classes is applying the wrong logic to at least two of them.

• Option 1. Apply the guideline's default concentration limits directly, assuming every component contributes at the maximum permitted level. Fastest to document; the most conservative on actual limits.
• Option 2a. Scale the default limits to the product's actual maximum daily dose at the component level — useful when a product's dose is well below the guideline's reference dose.
• Option 2b. Calculate a permitted-daily-exposure budget for the finished product first, then apportion it across components based on their expected contribution.
• Option 3. Measure elemental impurities directly in the finished product rather than predicting them from components — appropriate where component-level prediction is impractical or the assessment needs direct confirmation.

The options are a control strategy the risk assessment has to justify. They are not a substitute for having done the risk assessment. Why reviewers push back on default-Option-1 files

What Q3D(R2) actually changed

The 2022 revision did two concrete things to the PDE table sponsors build their assessments against: it added Permitted Daily Exposure values for the cutaneous and transcutaneous routes of administration, which the original guideline did not cover, and it corrected the PDEs for gold, silver, and nickel. FDA adopted the revised guideline later that year. Neither change touches the risk-assessment process itself — the source-by-source logic is unchanged from Q3D(R1) — but an assessment finalized before 2022, or one for a topical or transdermal product built on the old table, is now referencing limits the guideline no longer states. That is a straightforward gap to find and an easy one to miss, because nothing about the assessment's structure looks wrong on its face.

None of this is exotic regulatory CMC work — it is a bounded analysis that most quality and CMC teams already have the underlying data for. The gap is usually documentation discipline: treating the risk assessment as a risk management deliverable with a defensible source-by-source narrative, rather than a testing exercise with a risk-assessment cover page attached after the results come back. Teams that build it the first way rarely get a reviewer question on elemental impurities. Teams that build it the second way usually do, and the question arrives at the least convenient point in the review clock. If your GxP compliance and auditing program has not re-run this assessment against the current PDE table since before 2022, that is the place to start.