An adverse event (AE) is any untoward medical occurrence in a research participant, whether or not it is judged to be caused by the study intervention. Investigators track AEs continuously, but not every AE has to go to the Institutional Review Board (IRB) on its own, and not every AE report to a sponsor or the FDA is the same thing as an AE report to the IRB. Confusing these two reporting tracks is one of the most common compliance missteps in human-subjects research. This guide covers what specifically must go to the IRB, when, and why — as distinct from the sponsor/FDA safety-reporting pipeline.
The two separate reporting tracks, and why they get confused
Clinical and behavioral research studies typically run two parallel adverse-event reporting systems that share vocabulary but serve different regulators and different purposes:
- Sponsor/regulatory pharmacovigilance track — investigators report serious adverse events (SAEs) to the study sponsor, who evaluates them for expectedness and causality and, when an event qualifies as a Suspected Unexpected Serious Adverse Reaction (SUSAR), reports it onward to the FDA under 21 CFR 312.32 (7 calendar days for fatal/life-threatening SUSARs, 15 calendar days for others, measured from the sponsor’s awareness) or to EudraVigilance under the equivalent EU framework. Under 21 CFR 312.64(b), the investigator must report any SAE to the sponsor immediately, with a causality assessment, regardless of whether the event turns out to be reportable further up the chain.
- Local IRB track — separately, 21 CFR 56.108(b) requires every IRB to have written procedures for the prompt reporting to the IRB, appropriate institutional officials, and (where applicable) the FDA of any unanticipated problem involving risks to subjects or others (UPIRSO). This is a narrower and differently-defined category than “every SAE,” and it is evaluated by the IRB (or the study team applying the IRB’s own written criteria), not by the sponsor.
An event can trigger one track without triggering the other. A serious adverse event that is expected — already disclosed in the consent form and occurring at the anticipated rate — is very often reportable to the sponsor and possibly the FDA as part of routine SAE/SUSAR tracking, but is not automatically a UPIRSO the IRB needs to review as an unanticipated problem, because nothing about it is unanticipated. Conversely, a non-serious finding that reveals a new, previously unrecognized risk can be a reportable UPIRSO for the IRB even though it would never rise to SUSAR reporting thresholds. This guide is about the second track: what has to go to the IRB, and how to tell whether a given AE belongs there.
The three-part test: is this AE a reportable unanticipated problem?
The Department of Health and Human Services’ Office for Human Research Protections (OHRP) guidance on this topic (issued 2007, still the standing federal interpretive guidance under the Common Rule/FWA framework) sets out a three-part test. An incident, experience, or outcome generally must be reported to the IRB as an unanticipated problem only if it is all three of the following:
- Unexpected — unexpected in nature, severity, or frequency given (a) the research procedures described in the protocol-related documents (protocol, consent form, investigator’s brochure) and (b) the characteristics of the subject population being studied.
- Related or possibly related to participation in the research — there is a reasonable possibility that the event was caused by the study procedures or intervention, not merely coincidental to it.
- Suggestive of greater risk — the event suggests that the research places subjects, or others, at a greater risk of physical, psychological, economic, social, legal, or other harm than was previously known or recognized.
All three conditions have to be met. An adverse event that is severe but fully expected (condition 1 fails), or that is unexpected but clearly unrelated to the study (condition 2 fails), or that is both unexpected and related but doesn’t change the known risk profile (condition 3 fails), is not a UPIRSO and does not require IRB reporting under this pathway — even though it may still need to be logged, tracked, and reported through the sponsor/pharmacovigilance track described above. Determining which of the three conditions apply is a judgment call the investigator makes in the first instance, using the protocol, consent form, and any prior safety information as the reference point for “expected.” When the answer is genuinely unclear, the safer and standard practice is to report to the IRB and let the IRB (or a delegated reviewer) make the determination, rather than deciding unilaterally not to report.
Not every UPIRSO is an adverse event
It’s worth noting the three-part test is broader than adverse events alone — a breach of confidentiality, a data security incident, a consent-process failure, or a change in a device’s risk profile discovered outside a clinical encounter can all be UPIRSOs with no associated “adverse event” in the clinical-medical sense. This guide focuses on the AE/SAE side of that broader category. For the full UPIRSO framework, including non-AE unanticipated problems and the related noncompliance-reporting pathway, see CASRAI’s guide to IRB noncompliance and unanticipated problem reporting.
Who reports what, and to whom
Investigator to IRB
The investigator (or a delegated study team member acting under the investigator’s oversight) is responsible for making the initial determination of whether an AE meets the three-part UPIRSO test and, if so, submitting a report to the IRB using the institution’s designated reportable-event or UPIRSO reporting form. Most IRBs distinguish between:
- Internal events — AEs occurring at the reporting site itself, under that site’s own protocol and consent, where the local IRB has direct oversight.
- External events — AEs occurring at other sites in a multi-site study, typically forwarded to each participating IRB by the sponsor or coordinating center. External reports are usually reviewed on a different, often less urgent, timeline than internal events, and many IRBs only require a full external-event report when a pattern emerges or the sponsor specifically flags it as safety-relevant, rather than for every individual external AE.
IRB to institutional officials and OHRP/FDA
Once the IRB (or its chair or a designated reviewer) confirms an event is a genuine UPIRSO, 21 CFR 56.108(b) requires the institution to promptly notify appropriate institutional officials and, for FDA-regulated research, the FDA itself. For research conducted under an OHRP Federalwide Assurance (FWA), the OHRP guidance separately describes prompt reporting obligations running from the institution to OHRP for the most serious category of incidents — broadly, those involving serious harm or unexpected harm to subjects, or that require substantive changes to the protocol or consent process, or that involve serious or continuing noncompliance. Neither 45 CFR 46 nor 21 CFR 56.108(b) specifies a fixed federal number of calendar days for this reporting; the regulatory language is “prompt,” and OHRP’s guidance interprets promptness as scaling with severity — an event with immediate, ongoing safety implications warrants same-day or next-business-day notification, while a lower-urgency finding may reasonably follow the institution’s routine reporting cycle.
Why your institution’s own timeline is what actually governs
Because the federal regulations use “prompt” rather than a specific deadline, individual institutions set their own binding reporting windows in their IRB’s written procedures — exactly what 21 CFR 56.108(b) requires them to have. These local policies are commonly, though not universally, structured around event severity, for example: a short window (often measured in a small number of business days, sometimes less for events with immediate safety implications) for AEs that are serious, unexpected, and related, and a longer window (often 10 business days or tied to the next continuing-review cycle) for AEs that need to be reported but carry lower urgency. Exact numbers vary by institution — always follow your own IRB’s written policy and reporting form instructions rather than a generic figure, since the specific day-count is a local-policy decision, not a fixed federal rule.
What a complete AE report to the IRB typically includes
- Subject identifier (coded, not directly identifying, per the protocol’s data-handling plan) and the applicable protocol/IRB approval number.
- Description of the event: what happened, when it started, current status (ongoing, resolved, resolved with sequelae, fatal).
- Severity/grading, if the study uses a formal grading scale (for oncology and many NIH-funded trials, this is often the Common Terminology Criteria for Adverse Events (CTCAE)).
- Investigator’s assessment of relatedness to the study intervention and of expectedness against the protocol/consent form/investigator’s brochure.
- Action taken (dose modification, intervention discontinued, medical treatment provided, subject withdrawn) and any protocol or consent-form changes proposed as a result.
- Explicit statement of whether the event meets all three parts of the unexpected/related/greater-risk test, with the reasoning, not just a conclusion.
IRBs generally expect this documentation regardless of whether the event is ultimately classified as a UPIRSO — the analysis has to be shown, not just asserted, so the IRB (or an auditor) can independently verify the determination later.
How this connects to continuing review and protocol amendments
AE and UPIRSO reports don’t exist in isolation from the rest of the IRB’s oversight cycle. A pattern of AEs, or a single serious UPIRSO, can trigger IRB actions beyond acknowledging the report: a request to revise the consent form to disclose a newly recognized risk, a protocol amendment to add a safety monitoring procedure, or, in the more serious cases, temporary suspension of enrollment pending review. Cumulative AE experience is also a standard input to the study’s next continuing review, where the IRB reassesses the overall risk/benefit balance in light of everything reported since the last approval. If an AE reveals that the study is deviating from its approved protocol in some way — for example, a monitoring procedure wasn’t followed and that’s what led to the missed event — that additional dimension should be evaluated separately as a possible protocol deviation; see CASRAI’s guide on what to do about a major protocol deviation and how to report it to the IRB.
FAQ
Is every serious adverse event reportable to the IRB as an unanticipated problem?
No. A serious adverse event that is expected — disclosed in the consent form and occurring at or below the anticipated rate — does not meet the “unexpected” prong of the three-part test, so it is not reportable to the IRB as a UPIRSO, even though it will typically still be tracked and reported through the sponsor/FDA safety-reporting track (SAE/SUSAR reporting under 21 CFR 312.64(b) and 312.32).
What’s the difference between reporting an AE to the sponsor and reporting it to the IRB?
Sponsor/FDA reporting (the AE/SAE/SUSAR pharmacovigilance pipeline) is about aggregate drug or device safety monitoring across every site in a trial, governed by 21 CFR Part 312 and, for serious unexpected reactions, tight federal timelines. IRB reporting is a separate, local-institution process governed by 21 CFR 56.108(b) and the IRB’s own written procedures, focused on whether a specific event changes the known risk profile of the study at the local level and whether the IRB needs to take action — amend the protocol, revise consent, or suspend enrollment. An event can be reportable on one track, both, or neither.
Does an unexpected adverse event automatically have to be reported to the IRB?
Not by itself. It has to also be judged related (or possibly related) to study participation and to suggest a greater risk than previously known. An unexpected event that’s clearly caused by something unrelated to the study, or that doesn’t change the risk calculus, doesn’t meet all three parts of the test.
How quickly does an AE have to be reported to the IRB?
Federal regulation (21 CFR 56.108(b)) requires “prompt” reporting but doesn’t set a specific number of days; each institution’s IRB defines its own reporting windows in its written procedures, typically scaled to severity. Always follow your own IRB’s reportable-event policy and submission form rather than assuming a generic timeframe.
Who decides whether an AE meets the reportable unanticipated-problem criteria?
The investigator makes the initial determination when submitting the report, but the IRB (directly, through its chair, or through a delegated reviewer) makes the binding determination of whether the event is in fact a reportable UPIRSO. When it’s genuinely unclear, standard practice is to submit the report and let the IRB decide, rather than deciding not to report.
This guide reflects the federal Common Rule (45 CFR 46) and FDA (21 CFR Part 56, Part 312) regulatory framework and HHS/OHRP’s 2007 guidance on reviewing and reporting unanticipated problems, current as of publication. It describes the general federal structure, not any single institution’s specific reporting form or day-count deadlines — always confirm current requirements against your own IRB’s written policies.
