IRB Violations (Serious or Continuing Noncompliance)

An IRB violation — in the precise regulatory sense used by IRBs, institutional Human Research Protection Programs (HRPPs), and OHRP — is a finding of serious or continuing noncompliance with the IRB’s requirements, the IRB-approved protocol, or applicable federal regulation. It is the threshold that activates the IRB’s own suspension/termination authority under IRB governing regulation (45 CFR 46.113 for HHS-conducted/supported research, 21 CFR 56.113 for FDA-regulated research), and, for any institution holding a Federalwide Assurance (FWA), an independent, non-optional obligation to self-report the finding directly to the HHS Office for Human Research Protections (OHRP).

This term is deliberately more specific than the broader IRB reportable event category, which also covers routine, low-severity items (a corrected transcription error, a single missed initialing on a consent form) that get logged and reviewed without rising to “noncompliance” in the regulatory sense. An IRB violation is the subset of that broader category serious or persistent enough to put the study’s approval, and potentially the institution’s FWA standing, at risk.

What makes a finding “serious” or “continuing”

Neither 45 CFR 46 nor 21 CFR 56 defines “serious” or “continuing” noncompliance with a fixed checklist — the determination is made by the reviewing IRB (and, for FWA self-reports, ultimately assessed by OHRP), based on the facts of the specific case. In practice, institutional IRB policies and OHRP’s own compliance-oversight guidance converge on two overlapping tests:

• Serious: the departure from the approved protocol or IRB requirements affected, or had the realistic potential to affect, subject safety, subject rights and welfare, or the scientific/data integrity of the study — as opposed to a technical or administrative lapse with no such effect.
• Continuing: the noncompliance is a repeated pattern rather than an isolated, self-corrected incident, or the investigator/site has failed to respond to or correct a problem the IRB already identified and communicated — evidence the existing corrective measures aren’t working.

A finding does not need to satisfy both prongs; either alone can support an IRB’s determination that it is dealing with noncompliance rather than a routine reportable event, and it is common for a for-cause review to identify a pattern that is both serious and continuing at once.

The IRB’s own suspension/termination authority (45 CFR 46.113 / 21 CFR 56.113)

Both the HHS Common Rule and FDA’s parallel human-subjects regulation give the IRB itself direct authority to act, independent of any outside agency:

“An IRB shall have authority to suspend or terminate approval of research that is not being conducted in accordance with the IRB’s requirements or that has been associated with unexpected serious harm to subjects. Any suspension or termination of approval shall include a statement of the reasons for the IRB’s action and shall be reported promptly to the investigator, appropriate institutional officials, and the department or agency head” (45 CFR 46.113) — with 21 CFR 56.113 using near-identical language for FDA-regulated research, substituting “the Food and Drug Administration” for “the department or agency head” as the required notification recipient.

Operationally, this gives the IRB two possible actions, distinguished by whether the study can eventually resume:

• Suspension: approval is paused while the IRB requires corrective action — new enrollment typically stops and, depending on the reason for the suspension, some or all study procedures for already-enrolled subjects may also pause — with the possibility of reinstatement once the IRB is satisfied the underlying problem is resolved.
• Termination: approval ends outright and does not resume; any continuation of the research would require a new IRB submission and approval, not a corrective-action review of the terminated one.

Either action requires the IRB to state its reasons in writing and to notify the investigator, appropriate institutional officials, and the relevant federal department/agency (or FDA) promptly — the regulation does not leave notification to institutional discretion.

OHRP’s compliance-oversight role

Suspension or termination of IRB approval is an institutional/IRB-level action; OHRP’s role sits one level up, overseeing the institution’s compliance with its FWA. OHRP compliance oversight runs on two tracks:

• Evaluations — not-for-cause, proactive reviews (institutions may be selected based on factors like HHS-supported research volume, reporting history, or accreditation status), not triggered by a specific complaint.
• Investigations — for-cause reviews triggered by a substantive written allegation or indication of noncompliance, from subjects, investigators, institutional officials, whistleblowers, or OHRP’s own awareness of a problem.

Critically, an institution’s own self-reporting is a separate, mandatory trigger for OHRP review, not merely a courtesy: an FWA commits the institution to report unanticipated problems, serious or continuing noncompliance, and IRB-approval suspensions/terminations directly to OHRP as they occur — independent of any outside complaint. This is why an IRB violation matters beyond the single study it originated in: it is often the specific event that opens an OHRP compliance review of the whole institution.

After reviewing the materials (and, where warranted, interviews or an on-site evaluation), OHRP issues a written determination letter to the institution and/or IRB, stating whether it found noncompliance and what corrective action, if any, is required to keep the FWA in good standing. Outcomes range from “no further action” through recommended improvements to required corrective action. OHRP’s enforcement remedies operate at the institutional/FWA level, not just the single study: it can require corrective action; restrict or attach conditions to some or all HHS-covered research under the institution’s FWA (which can force suspension of other, unrelated studies until the restriction is lifted); in rare subject-safety cases require an immediate halt; and, in the most serious cases, recommend to other HHS officials that an institution or investigator be suspended from a project or debarred from federal funding. Because the FWA covers the whole institution, a single serious enough IRB violation can put the institution’s entire HHS-funded human-subjects research portfolio at risk, not just the study where the violation originated.

How this differs from a routine reportable event or protocol deviation

Not every deviation from the approved protocol is an IRB violation in this sense. A single, minor, promptly-corrected protocol deviation with no effect on subject safety, rights, or data integrity is normally logged and addressed at the next continuing review — it is a routine reportable event, not a finding of noncompliance. What separates the two, again, is severity or pattern: an isolated, corrected lapse stays routine; a serious effect, or a repeated/unaddressed pattern, escalates it toward a formal noncompliance finding and the suspension/termination process described above.

FAQ

What is the difference between an IRB violation and a protocol deviation?

A protocol deviation is any departure, however minor, from the IRB-approved protocol. Most protocol deviations are minor, isolated, and promptly corrected, and are handled as routine reportable events. An IRB violation — serious or continuing noncompliance — is the subset of deviations (or other regulatory departures) serious enough in effect, or persistent enough in pattern, to trigger the IRB’s own suspension/termination authority and, for FWA-holding institutions, mandatory self-reporting to OHRP.

Can an IRB suspend a study without a full-board vote?

Federal regulation gives the IRB the suspension/termination authority under 45 CFR 46.113 / 21 CFR 56.113 without specifying the exact procedural mechanics for exercising it — those are set by each IRB’s own written procedures. Institutional practice varies, but many HRPP policies route a suspension/termination decision through full-board action given its severity, distinct from the expedited-review pathway available for other IRB determinations.

Does every IRB violation get reported to OHRP?

Only institutions holding a Federalwide Assurance are bound by the FWA’s self-reporting commitment, and that commitment specifically covers unanticipated problems, serious or continuing noncompliance, and IRB-approval suspensions/terminations — not every minor reportable event. A single corrected, non-serious deviation would not typically meet that threshold; a finding of serious or continuing noncompliance, or an actual suspension/termination of approval, does.

What happens to enrolled subjects if an IRB suspends a study?

This depends on the IRB’s specific determination and the reason for the suspension. New enrollment is stopped, and depending on subject-safety implications, the IRB may also require that study procedures for already-enrolled subjects pause, or may permit continuation of safety-related monitoring/treatment for currently enrolled subjects while new enrollment and other procedures remain halted — the IRB’s written suspension notice specifies the scope.

Related terms

See also IRB Reportable Events, Protocol Deviation, Federalwide Assurance (FWA), OHRP (Office for Human Research Protections), IRB (Institutional Review Board), and Human Research Protection Program (HRPP).