IRB Noncompliance Determination

An IRB noncompliance determination is the process and outcome by which an IRB — directly, or through an institution’s Human Research Protection Program (HRPP) or compliance office acting on the IRB’s behalf — investigates a report that an approved protocol, IRB requirement, or applicable regulation was not followed, and issues a formal, written finding classifying what happened. The determination itself is the procedural output: a decision that a given departure is either administrative/minor noncompliance handled at routine review, or serious or continuing noncompliance, together with whatever corrective action or IRB action the finding requires.

This term covers the process an IRB or its designated office runs to reach that classification — who reviews an allegation first, what an investigation typically involves, and what the IRB can require afterward. It is deliberately distinct from the IRB Violations term, which defines the regulatory threshold (“serious or continuing noncompliance”) a determination can land on and the reporting obligations that threshold triggers. Here, the focus is upstream of that threshold: how an IRB actually gets from a report to a decision.

What starts a noncompliance review

A noncompliance review is typically opened by a report from one of several sources: a self-report from the investigator or study team, a subject complaint, a finding during continuing review or a routine audit, a report from institutional compliance staff, or, less commonly, a whistleblower or an outside party. Institutional Human Research Protection Program policies generally route the initial intake to a designated office — often called something like an Office of Regulatory Affairs, IRB compliance office, or the IRB Chair — rather than sending every report straight to a convened board meeting; the initial intake step decides whether the matter needs full-board attention at all.

Step 1: initial review and categorization

The designated reviewing office (or IRB Chair) makes a preliminary assessment of the report and sorts it into one of two broad tracks:

Administrative or minor noncompliance — an isolated, promptly corrected departure with no realistic effect on subject safety, subject rights and welfare, or data integrity (for example, a single missed consent-form initialing, corrected before the next study visit). These are typically logged as routine reportable events and addressed administratively or at the next scheduled continuing review, without a formal noncompliance investigation.
Possible serious or continuing noncompliance — a report that, on its face, could involve a serious effect on subjects or data integrity, or a repeated/unaddressed pattern. These are escalated to a fuller investigation and, for non-exempt research, ultimately require action by the convened IRB rather than an individual reviewer, since disapproval-adjacent actions cannot be delegated to expedited review.

Neither 45 CFR 46 nor 21 CFR 56 prescribes the exact triage mechanics — each institution sets this out in its own written IRB/HRPP procedures, which the Common Rule already requires the IRB to maintain. What’s consistent across institutional practice is the underlying test described in the IRB Violations term: severity (effect on safety, rights and welfare, or data integrity) or a continuing pattern (repetition, or an unresolved response to prior IRB direction) is what moves a report out of the routine track and into a formal investigation.

Step 2: investigation

Where the initial review does not resolve the question, a fuller investigation typically follows. Common elements across institutional HRPP procedures include:

Gathering records: the approved protocol and consent documents, study records, prior IRB correspondence, and the original report itself.
Giving the investigator and study team notice of the allegation and an opportunity to respond and submit relevant information — institutional policies generally build this in as a matter of procedural fairness, not just courtesy.
Consulting institutional compliance offices, the Institutional Official, or general counsel where the facts warrant it, particularly for anything touching subject safety or potential misconduct.
Where warranted by severity, interviews with study staff or an on-site review of study conduct and records — more common in for-cause reviews of a serious allegation than in routine categorization.

The scope of investigation is calibrated to what’s at stake: a straightforward, low-severity report may be resolved on the documentary record alone, while a report suggesting a safety effect or a repeated pattern typically receives a more thorough, IRB-level review.

Step 3: the determination and possible corrective actions

The outcome is a written determination stating whether the IRB found noncompliance and, if so, at what level (administrative/minor, or serious or continuing) and what follows. For a finding that is not serious or continuing, the response is usually proportionate and corrective rather than punitive. For a finding of serious or continuing noncompliance, the convened IRB decides what the finding requires, drawing on a range of possible actions that commonly includes:

Requiring protocol or consent-form modifications going forward.
Requiring subject notification or re-consent where the noncompliance affected already-enrolled subjects.
Enhanced monitoring, such as more frequent continuing review or targeted audits of the study, or of the investigator’s other active protocols.
Mandatory retraining for the investigator or study staff.
Suspension or termination of IRB approval under the IRB’s own authority (45 CFR 46.113 for HHS-conducted/supported research; 21 CFR 56.113 for FDA-regulated research) — the most severe outcome, reserved for findings serious enough to warrant pausing or ending the study’s approval.
A recommendation to institutional leadership regarding sanctions against the investigator, separate from any action on the study’s IRB approval itself.

Federal regulation does not mandate any specific one of these remedies for a given fact pattern — it gives the IRB suspension/termination authority as a ceiling, not a required response, and leaves the graduated corrective-action toolkit below that ceiling to institutional policy and the IRB’s judgment on the facts.

Reporting obligations that follow a determination

A determination of serious or continuing noncompliance, or any suspension or termination of IRB approval, is not just an internal record — it activates a separate, mandatory reporting obligation. Institutions with an OHRP-approved Federalwide Assurance (FWA) must establish and follow written procedures for ensuring prompt reporting of (i) any unanticipated problems involving risks to subjects or others, or any serious or continuing noncompliance with the Common Rule or the requirements or determinations of the IRB, and (ii) any suspension or termination of IRB approval — to the IRB, appropriate institutional officials, the funding department or agency head, and the HHS Office for Human Research Protections (OHRP). This requirement sits at 45 CFR 46.108(a)(4) under the current (post-2018, revised Common Rule) numbering. FDA’s parallel provision for FDA-regulated research, requiring IRB written procedures for prompt reporting of unanticipated problems and noncompliance, is at 21 CFR 56.108(b).

This reporting step is what connects a single study’s noncompliance determination to institution-level oversight: OHRP’s own compliance review of an institution is frequently opened by exactly this kind of self-report, independent of any outside complaint. See IRB Violations for how OHRP evaluates a report once it receives one, and what its own determination-letter process looks like.

How this differs from “IRB Violations”

The two terms describe the same regulatory territory from different angles. IRB Violations (Serious or Continuing Noncompliance) defines the destination: what “serious or continuing noncompliance” means as a regulatory threshold, the IRB’s suspension/termination authority once that threshold is met, and OHRP’s institution-level compliance-oversight role. IRB noncompliance determination describes the route there: the intake, triage, investigation, and formal decision-making process an IRB or its HRPP runs on a specific report, before and up to the point a violation finding (or a decision that no violation occurred) is reached.

Frequently asked questions

Who actually investigates a noncompliance report — the full IRB board, or someone else?
Practice varies by institution, but a common pattern is a two-stage model: a designated compliance office or the IRB Chair handles initial intake and triage, and only reports that appear to involve possible serious or continuing noncompliance escalate to the convened IRB for a formal determination and any suspension/termination decision, since disapproval-level actions require full-board review at a convened meeting rather than expedited review.

Does every noncompliance investigation end in a “violation” finding?
No. Many investigations conclude that the reported conduct was administrative or minor, or that no noncompliance occurred at all. The determination process exists precisely to sort reports into those that need no more than routine, proportionate correction and the smaller subset that meet the serious-or-continuing threshold.

Is the investigator notified before a determination is made?
Institutional HRPP procedures generally provide the investigator and study team an opportunity to respond and submit relevant information as part of the investigation, before the reviewing office or IRB reaches its determination — federal regulation does not specify the exact notice mechanics, so this is set by each institution’s own written procedures.

Can an institution’s compliance office make the final call instead of the IRB?
A compliance office or HRPP staff commonly conducts the initial review and investigation, but the IRB itself — through convened, full-board action for non-exempt research — retains the authority to make the formal determination and to suspend or terminate approval, since that authority is assigned to the IRB directly by 45 CFR 46.113 / 21 CFR 56.113, not to institutional staff.