7.3 Protocol Compliance, Deviations, and Corrective Action Plans

7.3 Protocol Compliance, Deviations, and Corrective Action Plans

Protocol compliance is the foundation of patient safety, ethical conduct, and data integrity in clinical research. In accordance with ICH E6(R3) investigator protocol-compliance duties (formerly E6(R2) Section 4.5), the investigator must conduct the trial in strict agreement with the approved protocol. Despite rigorous planning, departures from the protocol—known as protocol deviations—frequently occur during study implementation. Sites must be able to identify, classify, report, and remediate these deviations using structured quality management frameworks.

1. Identifying Protocol Deviations

A protocol deviation is any departure from the study procedures, design, or requirements defined in the approved clinical trial protocol. Deviations are identified through multiple channels:

• Site Monitoring Visits: Clinical Research Associates (CRAs) verify source documents against the CRF and log deviations.
• Internal Audits/Quality Assurance: Site staff perform self-audits of subject records.
• Data Management Queries: Sponsor data management systems flag out-of-range dates, missing lab tests, or inconsistent entries.
• Regulatory Inspections: FDA or other regulatory inspectors review study files for compliance.

2. Classification of Deviations: Minor vs. Major

Not all deviations carry the same risk. Regulatory agencies and IRBs classify deviations based on their impact on subject safety and study data:

Minor Protocol Deviations

Minor deviations are administrative departures that do not compromise subject safety, rights, or the integrity of the clinical data. Examples include:

• Missing a follow-up visit window by a few days without clinical significance.
• A study coordinator signing a training log a day late.
• Performing a non-safety assessment out of order.

Major Protocol Deviations (Protocol Violations)

Major deviations (often called protocol violations) are significant departures that impact the safety, rights, or welfare of the subjects, or compromise the scientific integrity of the trial data. Examples include:

• Ineligible Subject Enrollment: Enrolling a subject who does not meet inclusion/exclusion criteria (e.g., incorrect lab values or age).
• Failure to Obtain Informed Consent: Performing study-specific assessments prior to obtaining the subject's signed informed consent.
• Incorrect Dosage: Administering the wrong dose of IP or dispensing expired IP.
• Prohibited Concomitant Medications: Allowing the use of medications that are contraindicated in the protocol.
• Delayed Safety Reporting: Failing to report a Serious Adverse Event (SAE) to the sponsor within 24 hours of discovery.

3. Reporting Obligations: Sponsor and IRB

Investigators are legally and ethically obligated to report deviations in a timely manner. Reporting pathways depend on the severity and nature of the deviation:

Reporting to the Sponsor

All deviations must be documented on a cumulative Protocol Deviation Log and in the case report forms (CRFs). Major deviations must be reported to the sponsor's medical monitor immediately or within the timeline specified in the protocol/clinical trial agreement.

Reporting to the IRB/IEC

Under 21 CFR 312.66 and 21 CFR 56.108(a)(4), investigators must report all changes in research activity and unanticipated problems involving risks to human subjects or others (UPIRSOs). IRBs have specific policies:

• Major Deviations/UPIRSOs: Must be reported promptly, typically within 5 to 10 working days of discovery.
• Minor Deviations: Tracked on a cumulative log and reported in summary format at the time of continuing review (annual renewal).
• Emergency Deviations: Under ICH E6(R3) (formerly E6(R2) Section 4.5.4), if a deviation is implemented to eliminate an immediate hazard to a subject, it must be reported to the sponsor and the IRB immediately, along with the reasons and proposed protocol amendment if applicable.

4. Continuing Review and Protocol Amendments During Implementation

Blueprint Study Implementation task 2a (Execute Research Strategy) requires sites and sponsors to keep the investigational plan current with IRB/IEC, sponsor, and regulatory authorities—not only when a deviation occurs.

Continuing Review

Under 21 CFR 56.109 and Common Rule 45 CFR 46.109, IRBs must conduct continuing review of research at intervals appropriate to the degree of risk, but not less than once per year unless the study qualifies for an exception under the revised Common Rule. The investigator (or designated regulatory coordinator) develops and submits the continuing-review package, which typically includes:

• A protocol status summary (enrollment, active subjects, completions, withdrawals).
• A cumulative safety summary (AEs/SAEs, unanticipated problems).
• A deviation/violation log summary.
• The currently approved informed consent document(s), with any requested changes tracked.
• Confirmation that investigator financial disclosures and training remain current.

Failure to obtain continuing approval before the IRB expiration date means no new subjects may be enrolled and ongoing research procedures may have to pause until re-approval is granted—except as needed to eliminate apparent immediate hazards.

Protocol Amendments

A protocol amendment is a written description of a change to, or formal clarification of, the currently approved protocol. Amendments that increase risk, add procedures, change eligibility, or alter the consent process generally require:

1. Sponsor (and medical monitor) review and approval of the amended protocol/IB text.
2. IRB/IEC review and approval before implementation (unless change is necessary to eliminate immediate hazards).
3. Submission to FDA when the change is an IND/IDE protocol amendment under 21 CFR 312.30 / 21 CFR 812.35 (for example, a new investigator under an IND, a significant protocol change, or a new study under an existing IND).
4. Retraining of delegated site staff and updates to the regulatory binder, CRFs/EDC, and recruitment materials as applicable.

Minor administrative clarifications may follow expedited IRB pathways where allowed, but sites must follow the reviewing IRB's written procedures—never local custom alone.

5. Corrective and Preventive Action (CAPA) Plans

When deviations are systemic, recurring, or classified as major, the site must implement a Corrective and Preventive Action (CAPA) plan. A CAPA is a structured quality management framework designed to fix the current issue and prevent its recurrence.

Step 1: Root Cause Analysis (RCA)

Before writing a CAPA, the site must conduct an RCA to find the underlying systemic failure rather than just the immediate symptom. A common methodology is the "Five Whys" Technique, where site staff repeatedly ask "why" to drill down through layers of symptoms to the root cause (e.g., a scheduling system error or lack of investigator oversight).

Step 2: Corrective Actions (CA)

Corrective actions are immediate fixes applied to address the current issue for the affected subject. Examples include:

• Performing a missed safety test immediately.
• Adjusting the dose of a subject who received the incorrect amount of IP.
• Submitting a missed SAE report to the sponsor.

Step 3: Preventive Actions (PA)

Preventive actions are systemic changes implemented to prevent the issue from happening again to this subject or any other subject in the trial. Examples include:

• Updating site SOPs.
• Retraining staff and documenting the training.
• Developing checklist templates for study visits.
• Configuring electronic medical record (EMR) alerts for study windows.

Step 4: Implementation and Verification

The CAPA must document who is responsible, the deadline for completion, and how the effectiveness of the preventive action will be measured (e.g., auditing the next 5 randomized subjects' files to ensure no visits were missed).