UPIRSO (Unanticipated Problem Involving Risks to Subjects or Others)

An Unanticipated Problem Involving Risks to Subjects or Others (UPIRSO) is the formal Institutional Review Board (IRB) reporting category, defined by U.S. Office for Human Research Protections (OHRP) guidance under the Common Rule (45 CFR 46) and referenced in FDA’s IRB regulations (21 CFR 56.108(b)), for an incident, experience, or outcome arising in human subjects research that meets a specific three-part test. UPIRSO is a broader, compliance-facing category than Adverse Event and is analytically distinct from a Protocol Deviation, even though the three concepts frequently overlap in practice.

The Three-Part Test

Per OHRP’s 2007 guidance (“Reviewing and Reporting Unanticipated Problems Involving Risks to Subjects or Others and Adverse Events”), an incident, experience, or outcome is a UPIRSO only if it meets all three of the following criteria:

1. Unexpected — in nature, severity, or frequency, given (a) the research procedures described in the protocol-related documents (protocol, informed consent, investigator’s brochure) and (b) the characteristics of the subject population being studied.
2. Related or possibly related to participation in the research — meaning there is a reasonable possibility the incident resulted from procedures involved in the research.
3. Suggests greater risk — the incident indicates that subjects or others are at a greater risk of harm (including physical, psychological, economic, social, or informational harm) than was previously known or recognized.

An event that fails even one prong is not, by OHRP’s definition, a UPIRSO — although it may still be reportable under a different category (e.g., as a routine adverse event, a protocol deviation, or ordinary noncompliance) depending on institutional policy.

Who Must Report, and When

The investigator (PI) is responsible for identifying and reporting a potential UPIRSO promptly to the IRB of record, per the IRB’s written procedures required under 21 CFR 56.108(b) for FDA-regulated research and expected practice under an institution’s Federalwide Assurance (FWA) for federally-supported non-exempt human subjects research generally. OHRP’s guidance requires reporting to be prompt but deliberately does not impose one fixed, universal number of days — the guidance recognizes that urgency should scale with severity (a serious incident may warrant reporting within days; a less serious one within a few weeks). In practice, institutions translate “prompt” into a specific, written deadline in their own IRB policies and FWA-governed procedures — commonly a defined number of business days (frequently in the 5–10 business day range across published university IRB policies) from the point the investigator becomes aware of the event. Always confirm the specific deadline in the reporting institution’s own IRB policy manual rather than assuming a single number applies everywhere.

Once the IRB (or the institution, via its Human Research Protections Program) determines an event is a genuine UPIRSO, a second reporting obligation can follow: for HHS-conducted or -supported research, the institution must, per its FWA commitments, report certain UPIRSOs onward to OHRP and to the funding federal department or agency, within a timeframe likewise set by the institution’s written procedures. For FDA-regulated research, 21 CFR 56.108(b) additionally requires the IRB’s procedures to ensure prompt reporting to institutional officials and to FDA. A UPIRSO that also reflects serious or continuing noncompliance, or that leads the IRB to suspend or terminate its approval of the research, triggers its own separate, more specific reporting requirement under 45 CFR 46.103 — reported at that point as a suspension/termination action, not merely as a UPIRSO.

UPIRSO vs. Adverse Event

Adverse Event (AE) is causality-neutral pharmacovigilance terminology (formalized in ICH E2A) for any untoward medical occurrence in a subject administered a drug or other intervention, whether or not it is considered related to that intervention. AE reporting to the sponsor and, for serious/unexpected reactions, to FDA (21 CFR 312.32) runs on its own schedule and its own definitional test. UPIRSO and AE overlap but are not the same set:

• Most AEs are not UPIRSOs. An adverse event that is expected (already disclosed in the investigator’s brochure or informed consent) and occurring at an anticipated rate fails the “unexpected” prong of the UPIRSO test, even though it is still tracked and reported as a routine AE under the protocol’s safety-monitoring plan.
• Not every UPIRSO is an AE. UPIRSOs are not limited to medical/physiological occurrences. A data security breach exposing identifiable subject records, a serious breach of confidentiality, coercive recruitment practices discovered after enrollment, or a device malfunction with no injury yet observed can all satisfy the three-part UPIRSO test — unexpected, related to the research, and indicating greater-than-previously-known risk — without involving any “medical occurrence” that AE terminology is built to capture.
• Where the two do overlap — an unexpected, study-related serious adverse reaction occurring more frequently or severely than anticipated — the event is typically reportable under both frameworks simultaneously: to the sponsor/FDA as a Suspected Unexpected Serious Adverse Reaction (SUSAR) under the AE/SAE pathway, and to the IRB as a UPIRSO under 21 CFR 56.108(b) and OHRP guidance.

UPIRSO vs. Protocol Deviation

A Protocol Deviation is any unplanned departure from the IRB/IEC-approved protocol’s procedures, visit schedule, or eligibility criteria. A deviation is a UPIRSO only if it independently satisfies the three-part test above — most deviations do not. A minor, administrative deviation (a study visit conducted a few days outside its protocol-specified window with no safety or data-integrity impact) is reportable to the IRB per the institution’s deviation-tracking policy but is not a UPIRSO, because it does not suggest greater-than-previously-known risk. By contrast, a deviation that inadvertently exposes a subject to a study procedure or dosage the protocol never contemplated, in a way that reveals a previously unrecognized risk, can rise to a UPIRSO in addition to being logged as a deviation — the two categories are evaluated independently, and an event can be either, both, or neither.

Illustrative Examples

• Example 1 — UPIRSO, not an AE. A study coordinator’s laptop containing unencrypted, identifiable subject data is stolen. The incident is unexpected, arose directly from participation in the research (the data existed because of the study), and suggests subjects face a greater risk of privacy/informational harm than previously recognized — all three prongs are met, making this a reportable UPIRSO, even though no medical adverse event occurred.
• Example 2 — UPIRSO and AE together. A subject in an oncology trial develops a severe, previously undocumented organ toxicity not listed in the investigator’s brochure, occurring at a rate higher than seen in prior study data. This is unexpected, related to the study drug, and indicates greater risk — it is both a UPIRSO reportable to the IRB and, under ICH E2A/21 CFR 312.32, a SUSAR reportable to the sponsor and FDA.

Counter-example — an AE that is not a UPIRSO: a subject experiences nausea, a side effect already disclosed in the informed consent form as a known, expected reaction occurring at the anticipated rate. It is tracked and reported as a routine adverse event under the protocol’s AE-reporting schedule, but it fails the “unexpected” prong of the UPIRSO test, so it is not separately reportable as a UPIRSO.

Frequently Asked Questions

Is UPIRSO an FDA term or an OHRP term?

Both bodies use it, but the definitional source is OHRP’s 2007 guidance, issued under the HHS Common Rule (45 CFR 46). FDA’s parallel IRB regulation, 21 CFR 56.108(b), separately requires IRBs to have written procedures for “prompt reporting to the IRB of … any unanticipated problems involving risks to human subjects or others,” using materially the same concept for FDA-regulated (drug, biologic, device) research.

Does every UPIRSO have to be reported to OHRP directly?

No. The investigator’s first reporting obligation is to the local IRB. Whether and when the institution, in turn, reports a given UPIRSO onward to OHRP and to the supporting federal agency depends on the institution’s Federalwide Assurance commitments and its own written Human Research Protections Program procedures, not a single OHRP-mandated step that bypasses the IRB.

Is there one federally mandated number of days to report a UPIRSO?

No. OHRP guidance requires “prompt” reporting scaled to severity, but leaves the exact number of days to each institution’s own written IRB policy. Research administrators should always check the specific reporting institution’s policy manual rather than assume a single figure applies universally.

Related Terms

• Adverse Event (AE)
• Protocol Deviation
• OHRP (Office for Human Research Protections)
• 21 CFR Part 56
• Continuing Review (IRB)
• Central IRB / Single IRB (sIRB)
• IND Safety Report