Direct comparison
Protocol Deviation vs. Violation: Key Differences
How ICH E6/FDA distinguish an unplanned protocol deviation from a serious violation, and what each triggers for IRB and sponsor reporting.
Side-by-side comparison
| Dimension | Protocol Deviation | Protocol Violation |
|---|---|---|
| What it is | An unplanned, unintentional departure from the approved protocol -- a visit outside its window, a missed non-critical assessment, a minor procedural slip. | A more serious departure from the approved protocol -- often affecting safety, rights, or data integrity, or involving willful non-compliance or a recurring pattern. |
| Effect on subject safety/rights | By definition, does not significantly affect subject safety, rights, or well-being. | Does affect, or has the potential to affect, subject safety, rights, or well-being. |
| Effect on data integrity | Does not compromise the completeness, accuracy, or reliability of study data. | Compromises, or risks compromising, the completeness, accuracy, or reliability of study data. |
| Intent / pattern | Unintentional, typically a one-off, isolated event. | May be willful, deliberate, or fraudulent -- or an unintentional deviation that recurs despite prior corrective action. |
| ICH E6(R2) / FDA regulatory status | Falls under the general requirement (ICH E6(R2); 21 CFR 312.66 for IND trials) that the investigator not implement any unapproved deviation and must promptly report changes and unanticipated problems to the IRB. | Not a formally defined regulatory term under ICH E6(R2) -- an industry/site convention for the most serious end of the same reporting requirement, sometimes called an 'important' or 'major' deviation instead. |
| IRB/IEC notification urgency | Minor deviations are typically logged and included in routine periodic reporting to the IRB, per the site's own SOP and the reviewing IRB's written policy. | Typically requires prompt, often expedited, IRB notification -- commonly on a shorter timeline set by IRB policy, given the direct safety/rights or data-integrity impact. |
| Sponsor notification | Reported to the sponsor per the clinical trial agreement and sponsor SOP, usually via a deviation log or standard form, regardless of severity tier. | Reported to the sponsor promptly and typically escalated -- may trigger sponsor-led root-cause review, site retraining, or a for-cause monitoring visit. |
| Regulator notification (EU/UK 'serious breach') | Generally does not meet the threshold for a formal regulator notification on its own. | May meet the EU Clinical Trials Regulation (EU) No 536/2014 'serious breach' threshold -- a breach likely to significantly affect subject safety/rights or the reliability of trial data -- which requires sponsor notification to the relevant regulator without undue delay, commonly cited as within 7 days of becoming aware of it. |
| CAPA (corrective and preventive action) | May or may not trigger a formal CAPA, depending on site SOP and whether the deviation is isolated. | Typically requires a documented CAPA and root-cause analysis, and repeated violations are a common trigger for targeted or for-cause monitoring under a risk-based monitoring program. |
| Inspection significance | Reviewed as part of the routine deviation log during FDA/regulator inspections; expected as a normal feature of trial conduct if properly documented. | A recurring or unaddressed pattern of violations is a common and more serious inspection finding, and can factor into a site's or investigator's eligibility for future trials. |
Common questions
FAQ
Is "protocol violation" an official ICH or FDA term?+
No. ICH E6(R2) and FDA regulation require that any deviation from the approved protocol be documented, explained, and, where indicated, reported -- but neither formally defines a two-tier "deviation vs. violation" vocabulary. The deviation/violation split (and the related "minor" vs. "important" deviation split) is an industry convention that individual sponsors, CROs, and sites define in their own SOPs, which is why the exact threshold for calling something a "violation" varies between organizations.
Does every protocol deviation need to be reported to the IRB immediately?+
No. Federal regulation requires prompt reporting, not a fixed universal deadline, and the specific interval is set by each IRB's own written policy. Most sites report minor/administrative deviations through routine periodic reporting, while important deviations and violations are escalated faster, per the reviewing IRB's specific requirements.
Can a pattern of protocol deviations become a protocol violation?+
In common industry practice, yes -- many site and sponsor SOPs reserve the term "violation" specifically for deviations that recur despite documented corrective action, in addition to those that are willful or that directly affect subject safety, rights, or data integrity on their own.
How does a protocol deviation differ from a protocol amendment?+
A protocol deviation is an unplanned, after-the-fact departure from the currently approved protocol. A protocol amendment is the opposite: a planned, prospective change to the protocol itself, reviewed and approved by the IRB/IEC (and, for IND-regulated US trials, generally submitted to FDA) before it takes effect. See the CASRAI comparison of protocol amendment vs. administrative change for how that separate distinction works.
What is the EU "serious breach" and how does it relate to a protocol violation?+
Under EU Regulation (EU) No 536/2014, a "serious breach" is a breach of the protocol or of Good Clinical Practice likely to significantly affect a subject's safety or rights, or the reliability and robustness of the trial's data. It's a related but formally distinct regulatory concept from a site's internal "protocol violation" classification, defined under EU/UK regulation specifically and requiring sponsor notification to the relevant national regulator without undue delay, commonly cited as within 7 days of the sponsor becoming aware of it.
