TOC and Conductivity Monitoring in Pharmaceutical Water Systems

A recurring inspection finding is not an out-of-specification result but its opposite: the WFI loop conductivity meter recorded eleven consecutive days of rising values, always within the limit; the weekly laboratory certificate of analysis says “complies”; nobody opened an investigation. Formally, nothing happened. Substantively, the system was degrading, the data showing it was already in SCADA, and nobody read it as a trend.

TOC and conductivity monitoring looks like the simplest part of a water system — two instruments, two numbers — and it is where the most expensive interpretation errors concentrate: using an online value for a decision it cannot support, or failing to use it for a decision it should have triggered. This article, part of the Pharmaceutical Water & WFI Systems cluster, is about that difference.

Why TOC and conductivity are not parameters like the others

The first reason is compendial. Conductivity and TOC are the two attributes controlled by the USP Purified Water and Water for Injection monographs. USP is explicit that microbiological requirements are not included in those monographs (“Because of the various uses of these waters, microbial requirements are not included in these monographs”), and pH, nitrates and heavy metals are no longer USP requirements for these waters. The consequence is blunt: water can fully comply with the monograph and at the same time have a serious microbiological problem. TOC and conductivity are not a surrogate for microbiological and endotoxin control: they cover a different family of failure modes.

The second reason is speed. A microbiological result arrives after incubation and therefore describes water that has already been used. TOC and conductivity can be measured continuously, which is why Annex 1 clause 6.15 states that WFI systems must include continuous monitoring of parameters such as TOC and conductivity: these are the two parameters that carry real-time alerting in a water system.

Four different activities we all call “monitoring”

Confusing these four activities produces errors in both directions: decisions taken on data that cannot support them, and decisions not taken because “that data is not official”.

The most misunderstood distinction is between the first and third rows. For conductivity the bridge exists and is built by the compendial chapter itself: USP <645> has a sequential three-stage structure and identifies Stage 2 as the offline route, which implies that the first stage can be performed on the in-line instrument. It is the only attribute in those monographs that a system can satisfy without drawing a sample — provided the instrument is qualified, calibrated and managed as a compendial instrument, not as a process sensor forgotten in an electrical cabinet.

For TOC the same bridge is not automatic: it has to be built and documented. If the online value is to be used as a compendial result, the site must formally establish and justify that the instrument performs the method and meets its requirements, system suitability included. Until that is demonstrated, online TOC remains an alerting and control tool — often a decisive one — but not a pharmacopoeial result.

Conductivity: what it actually measures

Conductivity measures the presence of ionic species. It is an aggregate, non-specific parameter: it does not say which ion, it does not distinguish a regeneration residue from ingress of atmospheric carbon dioxide, and it depends strongly on temperature.

USP <645> handles that nature with three stages applied in sequence: you move to the next stage only if the previous one is not met. Stage 2 is the offline route, where the sample is brought to defined conditions and measured off-line. Stage 3 adds a neutral electrolyte — potassium chloride — to raise ionic strength and allow accurate pH measurement, pH entering the assessment at that stage. The numerical values for each stage are not reproduced here: they must be read in the current version of the chapter, which is the only usable source for setting acceptance criteria. Ph. Eur. addresses conductivity in general chapter 2.2.38.

One configuration choice deserves explicit attention: temperature compensation. The displayed value may be the measured one or the value referred to a reference temperature through an algorithm. If the configured mode is not aligned with the method used to evaluate the result, comparison against the limit loses meaning. It must be defined in the specification, verified at qualification and protected from uncontrolled change: it is a GMP configuration parameter, not a convenience setting.

Whoever designs the monitoring must also know in advance which normal operating events move the signal: temperature transients, restart after a shutdown, the end of a sanitisation. That mapping is built from qualification data and system knowledge; without it every transient becomes a deviation and operators progressively defuse the alerting system.

TOC: what it measures and how the limit is built

TOC quantifies organic carbon by oxidising it to carbon dioxide and measuring the oxidation product. This too is an aggregate, non-specific parameter: it does not say which molecule, and it does not respond uniformly to all of them, because oxidation efficiency depends on the nature of the compound. That is why the compendial chapter does not merely require calibration but introduces an instrument system suitability test.

USP <643> sets a target limit response of 500 micrograms of carbon per litre. The technically relevant point is that the limit is not a number read off the display but a difference: Rs minus Rw, that is the instrument response to the standard solution minus the response to reagent water. That construction ties the criterion to the actual response of that instrument under those conditions.

On system suitability frequency USP is deliberately silent: the chapter “intentionally says nothing about how often the system suitability test should be run”. This is not a gap but an explicit referral to the user's risk assessment. From it follows a rule many sites apply backwards: the absence of a number in the chapter does not authorise the absence of a number in the site procedure. A defined frequency is needed, justified in writing and revisited when the data contradict it.

In Europe, TOC for water for pharmaceutical use is covered by Ph. Eur. general chapter 2.2.44. One change is already in force and must be checked against site documentation: in Ph. Eur. Issue 12.3, applicable from 1 July 2026, the TOC test replaces the oxidisable substances test in sterilised water for injections, affecting monographs 0169 and 0008 and chapter 2.2.44; 0169 and 0008 have been further revised in Issue 13.1, with implementation from 1 January 2027. Specifications, methods and tender documents still citing oxidisable substances must be aligned through change control, not through a silent editorial correction.

Online and offline do not answer the same question

The useful comparison is not “which of the two is more accurate” but “which question does each answer”: framed that way, the two measurements become complementary.

A system with continuous monitoring only has a blind spot on the compendial method; a system with periodic sampling only has a blind spot on time. The strategy must state which datum serves which decision, and online and offline points must be designed together, as parts of the same sampling plan, not by different functions at different times.

Sample conditioning and transport

An online analyser measures what reaches it, not what is in the loop. Between the tapping point and the measuring cell there is a line, often a pressure reduction, a flow regulation and sometimes a heat exchanger. Every element is a potential artefact:

• the sampling line is to all effects a branch of the system: if it is not correctly sized, drainable and sanitised together with the loop, it becomes a slow-flow dead leg and can generate local contamination that the instrument will then read as a loop problem;
• line materials, particularly polymeric ones, can leach or adsorb organics and shift TOC in either direction;
• cooling the sample changes gas solubility and interacts with temperature compensation: it can change the reading with nothing having changed in the water;
• transit time introduces a delay between event and alarm, and determines how much potentially out-of-control water may already have been drawn when the alarm trips;
• the fate of the sample discharge — return to loop or to drain — is a design choice with opposite consequences, to be justified rather than inherited from the supplier's drawing.

Where to install the analyser

Position determines what the data can say. Downstream of generation the instrument tells you whether the production unit is working: it is the right position for process control and for diversion to drain, but says nothing about what happens in the loop and at the points of use. On the loop return the instrument integrates the behaviour of the whole ring and is the most informative on progressive degradation, because it sees the sum of everything the loop has picked up: it is the typical position for the continuous monitoring required for WFI. On the supply side, downstream of the tank, the contribution of storage is separated from that of the distribution network.

A critical point of use may justify a dedicated instrument, but multiplying analysers multiplies sampling lines, calibrations, alarms and data to be reviewed. The question for every added instrument is one: which decision, not available today, does this instrument make possible? If there is no answer, it adds burden and not control.

Calibration, verification and system suitability are three distinct things

They are constantly confused and they are not interchangeable. Calibration refers the instrument to a traceable standard and, where necessary, adjusts it. Verification confirms between two calibrations that the instrument is still within the established criteria, without adjusting it. System suitability demonstrates that the method, on that instrument and at that moment, is capable of producing the required result: for TOC it is a compendial requirement, not an optional good practice. A valid calibration does not imply a satisfied system suitability, and vice versa.

Frequencies, tolerances, allowable drift and acceptance criteria are not set by the regulations and must not be invented. They are established by the site, and the justification is built from verifiable elements:

1. criticality of the water and consequence of a measurement error on the product, assessed through a quality risk management process consistent with ICH Q9(R1);
2. instrument qualification data: behaviour observed in OQ and PQ, repeatability, drift actually recorded;
3. historical data for that instrument or that family on site: how many out-of-criterion verifications, and of what magnitude;
4. exposure time: how much water is drawn between two verifications and what happens if the instrument is retrospectively found to have been out of criterion — the question the inspector will ask;
5. manufacturer recommendations, as an input and not as the final justification.

The last point is the most common shortcut: “the manual says so” is not a GMP justification, it is an input; the justification is the site's documented assessment. The case of a verification failing its criteria must also be designed before it happens: the procedure must establish what happens to the water produced since the last valid verification, who assesses it and how the outcome is documented. Without that part, the first out-of-criterion result generates an investigation without a route and an impact nobody can bound.

Alert levels, alarms and trends

Annex 1 clause 6.13 requires regular ongoing chemical and microbiological monitoring and establishes that alert levels are based on initial qualification data, periodically reassessed in the light of requalification, routine monitoring and investigations. An alert level is therefore not a number chosen to sit comfortably below the limit: it comes from the data and changes when the data change. Clause 6.14 closes the loop, requiring alert excursions to be documented, reviewed and investigated, distinguishing an isolated event from an adverse trend or system deterioration.

This is where the opening case fails: eleven rising points within the limit are not eleven non-events but a trend that the system must be able to detect and that someone must be formally tasked with looking at.

In configuration, four logical levels must be kept distinct and explicitly mapped.

The most frequent errors here are recognisable: using the compendial limit as the SCADA alarm threshold, so that the alarm trips when the problem is already a non-conformity; setting the alert level at a fixed percentage of the limit without looking at the actual data distribution; configuring filters and delays so long that the alarm becomes ineffective; masking alarms during sanitisation and maintenance without the masking being proceduralised, traced, time-limited and verifiably re-enabled.

Online data is GMP data

The computerised part of the monitoring is governed by Annex 11 in its January 2011 version, which is the one in force. The revision draft put to consultation in 2025 has not been adopted and has no published application date: knowing it in order to avoid architectural choices that would be expensive to undo is reasonable, using it to set requirements is not.

In practice you need attribution of actions, traceability of changes to thresholds and configurations, protection of raw data, backups and access control by level. Data handling rules must also be defined and justified — acquisition interval, instantaneous or averaged value, what is archived and what is discarded — because a value averaged over a long interval can hide exactly the transient you meant to detect. The subject is developed in the article on automation, SCADA and data integrity.

Data review, finally, is not reading the chart the week before an inspection. It is an activity with a defined frequency, an owner, a minimum content and a documented trace: excursions in the period and their outcome, behaviour against alert levels, trend analysis, correlation with system events (sanitisations, maintenance, replacements, shutdowns and restarts), calibration and verification status, open actions. Without correlation to events the chart is barely readable: a good share of excursions is explained by something that was done to the system.

Worked example: Site Delta

Site Delta is an illustrative example, not a real case. A hot WFI loop supplies a sterile line and a preparation area; continuous TOC and conductivity monitoring is on the loop return, while a second conductivity measurement downstream of generation governs diversion to drain. After maintenance on a point-of-use valve, TOC on the return shows a step change upwards: the value is always within the limit but consistently above the historical band. The weekly compendial sample complies.

Three options are on the table. Do nothing, because there is no out-of-specification result: this ignores clause 6.14, which requires an isolated event to be distinguished from a trend. Sanitise immediately “to be safe”: an action without a diagnosis, which destroys the evidence and does not prevent recurrence. Open the investigation: this is the defensible option, because the step change coincides with a known event and is a level shift, not noise. The alert level did what it exists for, and the correlation with maintenance already provides the hypothesis to test: residue, introduced material, incomplete reinstatement. Whatever the outcome, it must be documented: even “cause identified, no product impact” is a valid outcome, if it is argued.

Decision matrix: what to monitor online

The weighting column is deliberately empty. Assigning weights depends on the site context and is itself part of the decision to be documented.

Frequent errors and red flags

• Alert level coinciding with the compendial limit, or set at an arbitrary fraction of the limit with no data analysis.
• Online TOC used as a compendial result with no document attesting that the instrument performs the method.
• System suitability with no defined frequency, justified with “the chapter does not say”; alarms chronically masked or acknowledged with no action and no trace.
• Conductivity compared against a limit without documenting whether the value is temperature-compensated.
• Sampling line not managed as part of the system: not drainable, not sanitised with the loop.
• Implicit belief that compliant TOC and conductivity mean water is microbiologically under control.
• Site documents still citing the oxidisable substances test where Ph. Eur. Issue 12.3 has introduced TOC.

Operational checklist

• For each instrument it is stated whether the datum is process, alerting or compendial.
• The position of every analyser is justified against the decisions it must support.
• Sampling line, materials, conditioning, transit time and fate of the discharge are documented.
• Temperature compensation is specified, verified and protected from uncontrolled change.
• Calibration, verification and system suitability have distinct, justified frequencies, criteria and responsibilities, with retrospective impact proceduralised.
• Alert levels derive from qualification data, are reassessed on a documented basis, and excursions are classified as isolated event or trend.
• Alarm masking during planned activities is proceduralised, traced and time-limited.
• Data review has a frequency, an owner, a minimum content and correlation with system events; acquisition and archiving rules are defined and compliant with the Annex 11 in force.

If this level of operational detail is useful to you, The Pragmatic GMP is the newsletter where we publish technical analyses and regulatory updates in the same register, without noise.

Key takeaways

• TOC and conductivity are the attributes controlled by the USP PW and WFI monographs, which include no microbiological requirements: chemical compliance and microbiological control are two separate questions.
• Annex 1 clause 6.15 requires continuous monitoring of parameters such as TOC and conductivity for WFI systems; 6.13 ties alert levels to initial qualification data, 6.14 requires the isolated event to be distinguished from a trend.
• USP <645> has a sequential three-stage structure, with Stage 2 as the offline route and Stage 3 adding KCl to measure pH accurately; the numerical criteria must be read in the chapter in force.
• USP <643> sets a target limit response of 500 micrograms of carbon per litre and builds the limit as Rs minus Rw; system suitability frequency is left to the user's risk assessment and must still be defined by the site.
• Online data supports alarms, isolation and investigations; it supports a statement of compendial compliance only if the instrument is managed and documented as an instrument of the method.
• Frequencies, tolerances and allowable drift are not in the regulations: they are derived from qualification, historical data, risk assessment and the consequence of error.

Regulatory and technical references

• EudraLex Volume 4, Annex 1 (C(2022) 5938 final), in operation since 25 August 2023 — clauses 6.13, 6.14, 6.15. EudraLex Volume 4
• EudraLex Volume 4, Annex 11 Computerised Systems — January 2011 version, operative since 30 June 2011; the revision draft consulted from 7 July to 7 October 2025 has not been adopted.
• USP <645> Water Conductivity; USP <643> Total Organic Carbon; USP <1231> Water for Pharmaceutical Purposes (informational, non-binding); Purified Water and Water for Injection monographs.
• Ph. Eur. general chapters 2.2.38 Conductivity and 2.2.44 Total organic carbon in water for pharmaceutical use; monographs 0169 and 0008; Issue 12.3 applicable from 1 July 2026, Issue 13.1 with implementation from 1 January 2027.
• EMA Guideline on the quality of water for pharmaceutical use, EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021. EMA
• WHO TRS 1033, Annex 3 (2021) — alert and action levels established from reported historical data. WHO
• ICH Q9(R1) Quality Risk Management, Step 4 on 18 January 2023. ICH
• PIC/S Aide-Memoire PI 009-4 Inspection of Utilities, rev. 4, in force since 1 January 2021. PIC/S
• FDA Guide to Inspections of High Purity Water Systems (1993) — reference material for investigators, not a guidance for industry. FDA
• ISPE Baseline Guide Vol. 4 Water and Steam Systems, 3rd edition, September 2019 — industry guide, not a regulation.
• Note: no ISO, ASME, ASTM or CEN standard was identified governing the qualification of TOC and conductivity instrumentation for pharmaceutical water; USP <643> and <645> and the corresponding Ph. Eur. chapters remain the governing documents.