10.2 Protocol Deviations and Violations

Protocol Deviations and Violations

Defining Deviations and Violations

Despite the best efforts of the research team, clinical trials do not always go exactly as planned. When a departure from the IRB-approved protocol occurs, it is classified as either a protocol deviation or a protocol violation. While the terminology can sometimes vary depending on the sponsor or institutional policies, the general consensus in clinical research distinguishes them based on severity and impact.

• Protocol Deviation: A protocol deviation is generally considered any alteration, departure, or non-compliance from the IRB-approved study protocol, GCP, or applicable regulatory requirements. Deviations are often minor and do not significantly impact the subject's safety, rights, or the integrity of the study data. For example, a subject arriving for a study visit on Day 32 when the protocol window was Day 28 ± 3 days.
• Protocol Violation: A protocol violation is a major deviation. It is a significant departure from the protocol that compromises the safety, welfare, or rights of subjects, or compromises the scientific integrity of the study data. Examples include enrolling a subject who did not meet a critical inclusion criterion, or failing to report a Serious Adverse Event (SAE) within the required timeframe.

Exceptions vs. Deviations

It is important to differentiate between a deviation and an exception.

• Protocol Exception (or Waiver): A protocol exception is a prospective (prior) approval granted by the sponsor and the IRB to deviate from the protocol for a specific subject. For instance, if a subject's screening lab value is marginally outside the inclusion criteria, the PI might request an exception from the sponsor before enrolling the subject. If approved in advance, this is not a deviation.
• Protocol Deviation: A deviation is retrospective; it occurs after the fact, without prior approval.

Documenting and Reporting

Every protocol deviation, regardless of how minor, must be meticulously documented. Regulatory agencies and sponsors expect sites to maintain a comprehensive log of all deviations.

The Documentation Process

1. Identification: A deviation is identified by the CRC, PI, or by a CRA during a monitoring visit.
2. Immediate Action: The PI must assess the deviation immediately to determine if it impacts subject safety and if any urgent medical intervention is required.
3. Documentation: The deviation is recorded in the site's Protocol Deviation Log and often in the Clinical Trial Management System (CTMS). A Note to File (NTF) may be written to provide detailed context, although excessive use of NTFs is discouraged by regulators unless they provide meaningful corrective information.
4. Sponsor Reporting: The deviation is reported to the sponsor according to the timelines specified in the Clinical Trial Agreement or the protocol. Electronic Data Capture (EDC) systems often have a specific CRF page for capturing deviations.
5. IRB Reporting: Reporting requirements to the IRB vary significantly. Most IRBs only require expedited reporting for major deviations (violations) that affect safety or data integrity. Minor deviations are typically summarized and submitted during the annual continuing review.

Root Cause Analysis (RCA)

When a deviation occurs, simply documenting it is insufficient. The site must investigate why it happened to prevent a recurrence. This process is called Root Cause Analysis (RCA). A common tool for RCA is the "5 Whys" technique. By asking "why" repeatedly, the team can drill down past the superficial symptoms to the underlying systemic failure.

Example of the 5 Whys:

• Deviation: The subject did not receive the required ECG at Visit 4.
• Why? The CRC forgot to order it.
• Why? The CRC was relying on memory instead of the source document worksheet.
• Why? The source document worksheet for Visit 4 had not been printed.
• Why? The clinic was short-staffed and the CRC was rushing.
• Why? There is no cross-coverage plan for when a team member calls in sick.
• Root Cause: Lack of a standardized cross-coverage plan and failure to mandate the use of source worksheets prior to seeing subjects.

Corrective and Preventive Actions (CAPA)

Once the root cause is identified, the site must develop a CAPA plan.

• Corrective Action: The immediate action taken to fix the current problem. (e.g., Calling the subject back to the clinic the next day to perform the missed ECG).
• Preventive Action: The systemic change implemented to ensure the problem never happens again. (e.g., Creating a formal policy requiring all visit source documents to be pre-printed and reviewed the day before the visit, and cross-training staff for backup coverage).

Real-World Case Study: Temperature Excursion of IP

During a Phase III vaccine trial, the CRC arrives on Monday morning to find that the temperature monitoring system on the investigational product (IP) refrigerator alarmed over the weekend. The temperature spiked to 10°C for 4 hours, exceeding the protocol-mandated storage range of 2°C to 8°C.

• Immediate Action: The CRC immediately quarantines the IP, ensuring no doses are administered, and notifies the PI and the sponsor.
• Deviation Classification: This is a major deviation because administering out-of-range IP could compromise subject safety and data integrity.
• CAPA: The root cause was determined to be a power surge that tripped the refrigerator's breaker, and the clinic's backup generator failed to engage. The preventive action involves installing an Uninterruptible Power Supply (UPS) specifically for the IP refrigerator and setting up real-time text message alerts for the CRC and PI in case of future temperature fluctuations.