Protocol Deviation

A protocol deviation is any unplanned departure from the procedures, visit schedule, eligibility criteria, or other requirements defined in the version of a clinical trial protocol that the IRB/IEC has already approved, made without obtaining sponsor agreement and IRB/IEC approval first. Under ICH E6(R2) Good Clinical Practice, the investigator should not implement a deviation from — or a change to — the approved protocol without that prior agreement and documented approval, except in one specific circumstance: to eliminate an immediate hazard to trial subjects. In that case the safety action comes first and the report follows. This is the same logic FDA codifies for IND-regulated trials at 21 CFR 312.66: an investigator must promptly report to the IRB all changes in research activity and all unanticipated problems involving risk to subjects, and may not make changes without IRB approval except where necessary to eliminate an apparent immediate hazard.

Deviation, violation, and “important” deviation are not interchangeable

ICH E6(R2) does not formally define a two-tier “deviation vs. violation” vocabulary — it requires that any deviation be documented and explained, and, where indicated, reported to the sponsor, the IRB/IEC, and regulators. In practice, most sponsors, CROs, and sites layer a severity classification on top of that baseline requirement, commonly using three working categories:

• Minor / administrative deviation — an unplanned departure that does not affect subject rights, safety, or well-being, and does not compromise the reliability or integrity of study data. A visit conducted a few days outside its protocol-specified window for a routine, non-critical assessment is a typical example.
• Important (major / significant) deviation — a deviation that does affect subject safety, rights, or well-being, or the completeness, accuracy, or reliability of study data. Enrolling a subject who does not meet a key eligibility criterion, or failing to collect data needed to interpret a primary endpoint, are commonly cited examples. Important deviations generally require prompt reporting to the sponsor and, per the site’s IRB policy, to the IRB itself.
• Protocol violation — an industry-convention term, not an ICH-harmonized one, that many organizations reserve for the most serious deviations: those that are willful, that involve fraud or serious non-compliance, or that recur despite corrective action. Because the term isn’t standardized, its exact threshold varies by sponsor, CRO, and site standard operating procedure — always confirm what a specific protocol, sponsor, or institutional policy means by “violation” rather than assuming it matches another organization’s definition.

FDA has draft guidance specifically addressing this topic, Protocol Deviations for Clinical Investigations, aimed at helping sponsors and investigators identify, document, and report deviations consistently — a sign that inconsistent deviation classification across the industry is a recognized, live problem, not a settled one. HHS’s Office for Human Research Protections has also addressed the distinction through its advisory committee (SACHRP), which has published recommendations on categorizing and reporting protocol deviations in non-FDA-regulated human subjects research.

Reporting timelines

There is no single universal clock that applies to every deviation in every jurisdiction. What actually governs timing:

• To the IRB/IEC (US, Common Rule and FDA-regulated research): federal regulation requires prompt reporting rather than specifying a fixed number of days; the specific interval (commonly a handful of business days for important/reportable deviations) is set by each IRB’s own written policy. Always check the reviewing IRB’s own reporting requirements and forms rather than assuming a figure from another institution applies.
• To the sponsor: clinical trial agreements and sponsor SOPs typically require investigators/sites to report deviations promptly, often on a defined form, regardless of the deviation’s severity tier — severity classification usually affects urgency and downstream corrective-action requirements, not whether reporting happens at all.
• To regulators, EU/UK “serious breach”: EU Clinical Trials Regulation (EU) No 536/2014 and the equivalent UK framework use a related but distinct concept, a serious breach — a breach likely to significantly affect a subject’s safety or rights, or the reliability/robustness of the trial’s data. A sponsor who becomes aware of a serious breach is required to notify the relevant regulator without undue delay, commonly cited as no later than seven days from becoming aware of it. “Serious breach” and “important protocol deviation” overlap conceptually but are defined under different regulatory frameworks and shouldn’t be treated as synonyms across jurisdictions.

Why classification matters operationally

Deviation severity isn’t just a reporting-speed question — it feeds directly into risk-based monitoring programs, where clusters of important deviations at a site (rather than isolated minor ones) are a common trigger for targeted or for-cause monitoring visits, and into inspection readiness, since FDA and other regulators review a site’s deviation log and corrective/preventive action (CAPA) history as part of routine and for-cause inspections. A deviation log that only records events without an explained severity rationale and a documented root cause is a recurring inspection finding.

Worked examples

Example 1 (minor): A study visit protocol-specified for day 28 (+/- 3 days) is conducted on day 33 because of a subject scheduling conflict; the assessment performed is not time-critical and no safety or efficacy data are compromised. Logged as a minor/administrative deviation, no immediate IRB notification required under most site SOPs, included in routine periodic reporting.

Example 2 (important): A subject is enrolled and dosed despite a screening lab value that fell outside the protocol’s inclusion-criterion range, discovered after the fact during data review. Because this affects both subject safety (the subject may not have been an appropriate candidate for the investigational product) and data interpretability, it is classified as an important/major deviation, reported promptly to the sponsor and IRB, and typically triggers a documented CAPA.

Counter-example: A sponsor issues a formal protocol amendment, reviewed and approved in advance by the IRB/IEC, that changes the dosing schedule for all subjects going forward. This is not a protocol deviation — it’s a planned, prospectively approved modification to the protocol itself, the opposite of an unplanned departure from it.

Related CASRAI Dictionary terms

ICH GCP (Good Clinical Practice) · IRB (Institutional Review Board) · IRB/REC Approval Process · Common Rule (45 CFR 46) · Informed consent · Adverse Event (AE) · Risk-Based Monitoring (RBM) · Clinical Research Associate (CRA)