UUSOP-07: Deviations: Documentation and Reporting
Version Date: November 14, 2023
- Introduction and Purpose
- Definitions and Acronyms
- Identification of Protocol Deviations
- Documentation of Deviations
- Deviation Review and Reporting
- Materials Required
- Document Approval
- Revision History
Introduction and Purpose
Deviations from the clinical research protocol, Good Clinical Practice (GCP) guidelines,
or applicable federal regulations have the potential to place study participants at
risk and can undermine the scientific integrity of the study, thus jeopardizing the
justification for research. Therefore, deviations should be addressed and corrected
where possible, and preventative measures should be established to prevent future
occurrences from taking place.
Deviations must be documented according to the GCP guidelines, and must be reported
to the Institutional Review Board (IRB) according to the guidelines set forth in this
SOP and according to IRB policies & procedures. The IRB policies and procedures for
deviation reporting in this SOP are for studies overseen by the University of Utah
IRB. For studies using a central IRB (CIRB) or an IRB of record other than the University
of Utah, the deviation reporting requirements for that board must be followed as well
as the local reporting requirements for University of Utah Human Research Protections
The principal investigator (PI) is responsible for conducting clinical research in
accordance with the current IRB-approved protocol, GCPs and applicable federal regulations.
The PI may not make any changes to the protocol treatment or procedures without prior
approval from the IRB except when necessary to protect the safety, rights, or welfare
of study participants.
Definitions and Acronyms
Clinical Research: Clinical research includes all research involving human participants. It does not
include secondary studies using existing biological specimens or data collected without
identifiers or data that are publicly available.
Clinical Trial: Clinical trials are clinical research studies involving human participants assigned
to an intervention in which the study is designed to evaluate the effect(s) of the
intervention on the participant and the effect being evaluated is a health-related
biomedical or behavioral outcome.
|Corrective and Preventative Action
|Code of Federal Regulations
|Electronic Research Integrity and Compliance Administration program
|United States Food and Drug Administration
|Good Clinical Practice
|International Council on Harmonization
|Institutional Review Board
|Standard Operating Procedure
- Identification of Protocol Deviations
- Clinical research investigators and staff should be familiar with the study protocol,
GCPs, and applicable federal regulations and strive to ensure that these are followed
in the conduct of clinical research.
- Deviations should be identified by the PI or research staff member as they occur.
When a deviation is thought to have occurred, it should be verified against the study
protocol, applicable regulations or relevant GCP principles.
- Protocols will generally have visit windows established for completion of scheduled
procedures and assessments. Procedures and assessments that are completed outside
the established windows are considered deviations.
- If a protocol does not establish windows and does not explicitly state exact timelines
for procedures or assessments, then reasonable windows may be determined by the investigator,
rather than incurring multiple deviations.
- If a study sponsor or designated representative (e.g., Medical Monitor, Contract Research
Organization (CRO), other entity) approves an alternate process/procedure from what
is documented in the approved study protocol (for example, alternate treatment parameters),
an amended protocol or protocol administrative letter (or equivalent) must be provided
by the sponsor that includes the alternate procedure(s) and/or process(s). The amended
protocol or administrative letter must be submitted to and approved by the IRB of
record through amendment prior to changes being implemented. The requirement for prior
IRB-approval does not apply to deviations made for participant safety.
Note that performing any procedures or processes that are not included in the Sponsor-
and IRB-approved protocol, even with sponsor approval (e.g., by email or protocol
administrative letter), is considered a protocol deviation and will be treated accordingly
by federal, state, and institutional authorities. Study teams are required to request
an amended version of the protocol from the sponsor that includes all changes proposed
in the protocol administrative letter (or equivalent). Requests can be made via email,
or other method which provides clear documentation of the request. Repeat requests
may be necessary if the sponsor does not provide an amended protocol. Records of these
requests to the sponsor must be filed in the study’s regulatory binder as significant
- Deviations may be identified through routine monitoring visits or audits of the clinical
research records. These deviations should be verified as above and presented to the
PI for timely assessment and IRB reporting, if warranted.
- Documentation of Deviations
- All deviations, regardless of severity or outcome, must be documented. Deviations
may be documented electronically (OnCore, REDCap, Microsoft Excel database, etc.),
or written on a paper form (e.g. Protocol Deviation Log).
- A clear, yet concise description of the deviation should be recorded, including a
description of the regulatory requirement, GCP principle or protocol procedure that
was not followed.
- The deviation record should include adequate attribution, including: date of deviation,
identification of the study, subject ID, study visit, the date the deviation was identified,
and identity of the individual recording the information.
- If corrective action was taken to address the deviation, details describing the corrections
should also be added to the record.
- Deviation Review and Reporting
- All Deviations will be reviewed and assessed by the PI.
- Deviations noted by study staff or monitors will be communicated to the PI in a timely
- Study staff should notify the PI of serious deviations affecting subject safety within
48 hours, whenever possible. If the PI is not immediately available, study staff will
provide notification of serious deviations as soon as possible.
- Other deviations of less severity may be communicated to the PI at a monitoring visit
close-out meeting, or in a regular study team meeting following discovery of the deviation.
- For industry-sponsored clinical research, the protocol will typically contain requirements
for deviation documentation and reporting to the sponsor. Study-specific requirements
should be followed according to each protocol.
- The PI will determine whether the deviation meets one or more of the following IRB
- Intended to eliminate apparent immediate hazard to a research participant (such as changing the dose of a medication due to toxicity)
- Caused possible harm to participants or others, or places them at increased risk of
harm – including physical, psychological, safety, economic, or social harm, such as breach
- Possible serious or continued non-compliance
- Serious non-compliance are deviations that result in significant harm (physical, psychological, safety,
or privacy) or significantly increase the possibility or likelihood of harm to the
health, rights or welfare of study participants.
- Continuing non-compliance is a pattern of repeated actions or omissions to act (either serious or non-serious
in nature) that suggests a future likelihood of recurrence and that indicates a deficiency
in the ability or willingness to comply with the protocol, GCPs or regulations.
- The PI must determine whether the deviations meet the IRB-reporting criteria listed
above. The following scenarios are some examples (not an exhaustive list) that should
be used as a guide in making these determinations:
- Failure to obtain informed consent prior to performing protocol related tests or procedures. Prior to obtaining consent, administration of investigational drug/treatment, or
invasive study procedures, such as exposure to radiation, have enough risk of potential
physical harm to warrant reporting to the IRB. However, standard-of-care procedures
such as a routine blood test prior to obtaining consent may not be of sufficient risk
to be reported.
- Use of an outdated or incorrect informed consent document. This will generally require IRB reporting based upon the type of information that
was not provided or was provided incorrectly to the participant. The inadvertent use
of an outdated consent form having no differences with the current version may not
warrant IRB reporting. However, once this deviation is noticed, continued use of an
outdated consent form, or use of an outdated form when the current version contains
changes to the Risks or Study Procedures section should be reported to the IRB.
- Enrollment of a study subject who did not meet all inclusion criteria, or met one
or more exclusion criteria. Safety-based eligibility criteria such as ECG parameters, liver function test lab
values, or prohibited
concomitant medications, if not met, can place study participants at greater risk
of physical harm and deviations from these criteria should be reported to the IRB.
Deviations from eligibility criteria that establish baseline parameters such as body
mass index or that are slightly outside screening timeframes, however, may not increase
risk to study subjects and not warrant IRB reporting, unless missing data is needed
for assessment of the primary study objective.
- Additional examples of deviations that meet the requirements for IRB reporting are
- Administration of an incorrect investigational drug, assignment of an incorrect investigational
device, or dose error significantly greater than the protocol-specified dose
- Failure to implement a protocol-specified dose modification for safety/toxicity
- Treatment with drug/device or a treatment delay beyond the period allowed in the protocol
- Failure to perform a study visit or procedure that may affect subject safety or the
primary objective of the study
- Breach of confidentiality, as defined by IRB guideline
- Enrollment, treatment or data collection without IRB-approval of the study, after
IRB approval has expired, or after acknowledgement of study closure and Final Report
from the IRB
- Conducting study procedures at an unapproved site
- Minor deviations that may not individually require reporting, but that are continually
repeated without correction or implementation of a protocol amendment
- The PI will use his or her clinical expertise combined with careful consideration
of the clinical research protocol, subject safety, and applicable regulations to determine
if the deviation meets the IRB reporting requirements.
- The assessment for IRB reporting by the PI should be documented in the electronic
or paper-based record, and should be signed or initialed and dated by the investigator.
- If the deviation is determined reportable to the IRB, the study coordinator or clinical
research coordinator should work with the PI to complete the deviation report in ERICA.
- Each section of the report template should be completed with sufficient detail to
effectively describe the deviation to IRB administration and board reviewers.
- The report section to describe the plan to prevent the deviation from occurring in
the future is particularly important. Corrective and preventative action plans (CAPA)
should be carefully developed, so that when implemented, they address the root cause
of the problem and prevent further occurrences. If the CAPA involves re-training,
this training should be documented.
- The PI must submit the complete report in ERICA within 10 working days from the date
that the deviation is identified or the study team is notified of the deviation.
- If the deviation report is not submitted to the IRB within 10 working days, a written
explanation for its tardiness must accompany the report. Late reports may be assessed
by the IRB as additional non-compliance.
- The IRB will evaluate the deviation report to determine if it had a significant effect
on risk to study participants’ safety, rights or welfare, or had an effect on the
integrity of the scientific data.
- The IRB review may result in a request for additional information, which the PI must
respond to within the requested timeframe.
- After IRB review is complete, the PI will be notified of the outcome, which may include
the determination of “Serious Non-Compliance” and/or “Continued Non-Compliance”. Such
determinations may require additional corrective and preventative actions to be carried
out by the PI and study team.
- IRB deviation reports and supporting documents should be retained with the study records.
- If the study is under the review and approval authority of a CIRB or an IRB of record
other than the University of Utah, the deviation reporting requirements of that IRB
must be followed. Local deviations that meet the University of Utah IRB reporting
criteria for prompt reporting, must also be submitted according to that policy for
review by the University of Utah HRPP.
- IRB-approved protocol and informed consent form
- Protocol Deviation Log, or other department-specific or study-specific deviation documentation
form, or electronic data capture system
- Access to ERICA (IRB electronic application and document system)
- 45 CFR Part 46.103(b)(5)
- ICH Guidance for Industry E6(R2): Good Clinical Practice, Section 4.5
- University of Utah IRB SOP 902: Protocol Deviations
Erin Rothwell, Ph.D.
Vice President for Research, University of Utah
DATE: December 13, 2023
Printed or photocopied versions are considered unofficial copies unless it is the
original signed document.