CASRAI’s Dictionary already defines the vocabulary: research misconduct, and its three components, fabrication, falsification, and plagiarism (together, FFP). What those entries don’t cover is what actually happens once someone raises a concern: who looks into it, how long that takes, what a finding actually leads to, and what protects the person who reported it. This guide covers that procedural layer, using the US federal process — the Office of Research Integrity (ORI) under 42 CFR Part 93 — as a real, worked example, because it’s the most fully codified misconduct-investigation process in research administration and the one most other institutional policies are modeled on or benchmarked against. For live examples of the same procedural arc outside the federal system, see the Kerri Greenidge case at Tufts, where informal criticism of a book escalated into a commissioned external review, and the University of Melbourne’s formal probe into John Hattie, opened after the university had first concluded no full investigation was needed.
One timing note that matters for anyone reading this in 2026: ORI issued a final rule substantially revising 42 CFR Part 93 in September 2024, and institutions were required to have implemented the revised procedures by January 1, 2026 — the first major update to this regulation since 2005. If you’re comparing this guide to an older summary of “the ORI process” that cites a 60-day inquiry window, that figure is out of date; the rest of this guide reflects the current rule.
Who actually investigates — it’s the institution, not the funder
A common misconception is that a federal agency shows up to investigate a misconduct allegation. Under the PHS model, it’s the opposite: the institution that received the funding is responsible for conducting the inquiry and investigation itself. Every institution that applies for or receives PHS support (funding that flows through NIH, CDC, FDA, and other Public Health Service agencies) must have a written misconduct policy on file and must designate a Research Integrity Officer (RIO) — the institutional official who administers the process: receiving allegations, determining whether they fall within the definition and jurisdiction of research misconduct, sequestering relevant research records, and appointing the inquiry and investigation committees.
ORI’s own role is oversight, not first-line investigation. It reviews the institution’s findings, can request additional information or a re-opened inquiry if the institutional process was inadequate, makes the final federal misconduct finding where PHS funds were involved, and proposes administrative actions to HHS. This split — institution investigates, federal office oversees and adjudicates consequences — is the structural feature to understand before anything else in this process makes sense.
The process, step by step
42 CFR Part 93 sets out a sequential process. The current rule defines each stage with a specific purpose and, since the 2024 revision, firmer timelines:
1. Assessment
Before anything formal opens, the RIO assesses whether an allegation, on its face, falls within the definition of research misconduct (fabrication, falsification, or plagiarism — not authorship disputes, data-ownership disagreements, or general research-quality complaints, which are handled through other institutional channels) and whether it involves PHS-supported research. If it doesn’t clear that threshold, it doesn’t proceed under this framework at all.
2. Inquiry
The inquiry is a preliminary fact-finding step, not a full evidentiary review: its only question is whether the allegation has enough substance to warrant a full investigation. Institutions must complete an inquiry within 90 days under the current rule (up from the previous 60-day window). Research records relevant to the allegation must be sequestered before the person accused (the “respondent”) is notified, to prevent alteration or loss. The inquiry concludes with a written report and a decision: proceed to investigation, or close the matter.
3. Investigation
If warranted, the institution appoints an investigation committee — individuals without unresolved conflicts of interest and with relevant subject-matter expertise — to conduct a full review of the evidence. This is where the regulation’s specific mental-state standard actually gets applied: a finding requires that the conduct represents a significant departure from accepted practices in the relevant research community, and that it was committed intentionally, knowingly, or recklessly — the current rule defines each of those three terms explicitly, precisely to rule out honest error and legitimate differences of scientific judgment. Investigations must be completed within 180 days under the current rule. The respondent has the right to review and comment on the draft investigation report before it’s finalized.
4. Institutional finding and ORI review
The institution issues its finding and, where misconduct is found (or where PHS funding or applications are involved), reports it to ORI along with the full institutional record. ORI reviews that record — it can accept the institutional finding, request further inquiry, or reach a different conclusion — and, where misconduct is confirmed, proposes administrative actions to HHS.
5. Administrative action and appeal
A respondent who disagrees with an HHS-proposed administrative action can request a hearing before an HHS Administrative Law Judge (ALJ) before the action becomes final. This is a real procedural right, not a formality on paper — it’s the mechanism through which a contested finding gets independent review outside the institution and ORI.
What a misconduct finding actually leads to
Consequences split into two categories that are easy to conflate: what the institution does (employment action, which is governed by institutional policy and, for faculty, often tenure/academic-freedom procedures — outside 42 CFR Part 93’s scope), and what ORI/HHS can impose federally. The federal administrative actions available include:
- Debarment from eligibility to receive federal funds for grants and contracts, for a specified period
- Exclusion from serving on PHS advisory committees, peer-review panels, or as a consultant
- Supervision requirements or certification requirements on a researcher’s future PHS-funded work
- Correction or retraction of the affected portion of the research record
Duration and severity scale with the seriousness of the misconduct, its impact, and whether it reflects a pattern rather than an isolated incident — a fixed multi-year term is typical, but ORI’s published case summaries (in the Federal Register) show a wide range from a single year to permanent debarment in the most serious cases. A finding of research misconduct is separate from, and doesn’t automatically trigger, a journal retraction — that decision sits with the journal editor; see CASRAI’s guide on how a retraction actually happens for that separate process, though the two frequently run in parallel once an institutional finding becomes public.
Whistleblower and complainant protections
The person who raises the original concern — the complainant, or in CASRAI’s Dictionary vocabulary, the whistleblower — is protected under the same regulation, provided the report is made in good faith through the institution’s official channels. Institutional policies compliant with 42 CFR Part 93 must include safeguards against retaliation for complainants (and, symmetrically, protections for respondents against prejudgment while a case is open and unresolved). In practice this means: the institution cannot take adverse employment action against someone for reporting a good-faith concern, and the complainant’s identity is kept as confidential as the process allows — though confidentiality can’t always be absolute once an investigation is underway and the respondent has a right to know and respond to the specific evidence against them. A report made in bad faith, to damage a colleague or competitor rather than out of genuine concern, doesn’t carry these protections and can itself be treated as a form of misconduct.
Beyond PHS-funded research: NSF and non-US processes
42 CFR Part 93 only governs PHS-supported research. Research funded by the National Science Foundation follows a structurally similar but distinct process under 45 CFR Part 689: the same FFP definition and the same inquiry-then-investigation structure, but NSF’s own Office of Inspector General (OIG) is more directly involved in oversight than ORI is for PHS cases, and the final disposition runs through the NSF Deputy Director rather than HHS. Outside the US, national or regional bodies play a comparable coordinating role without direct investigative authority of their own — the UK’s UKRIO and the European Network of Research Integrity Offices (ENRIO) both operate on a similar principle: the employing institution investigates, using the national/regional body’s guidance as the reference standard, rather than the body itself running the case.
What this guide doesn’t cover
This is a guide to the individual-allegation investigation process — one institution, one respondent, one case moving through inquiry and investigation. It’s a distinct topic from the detection of systematic, industrial-scale fraud (shared figure templates, machine-paraphrased “tortured phrases,” and submission patterns that recur across unrelated papers and venues) associated with paper mills — that’s a red-flag-detection problem publishers and integrity sleuths deal with largely before an individual-allegation process like the one above even opens, and it deserves its own treatment rather than a subsection here. It’s also distinct from self-plagiarism and other questionable research practices that fall short of the misconduct threshold described above (a significant departure from accepted practice, done intentionally, knowingly, or recklessly) but still erode trust in the research record — those are typically handled through separate authorship/publication-ethics channels, not a formal 42 CFR Part 93 inquiry.
Frequently asked questions
What are the three components of research misconduct?
Fabrication (making up data or results), falsification (manipulating research materials, equipment, processes, or data so the research isn’t accurately represented), and plagiarism (appropriating another person’s ideas, processes, results, or words without proper credit) — FFP. See CASRAI’s Research misconduct Dictionary entry for the full operational definition and worked examples.
Who actually investigates a research misconduct allegation?
For PHS-funded research, the researcher’s own institution does — specifically, its Research Integrity Officer and the inquiry/investigation committees the RIO appoints. The federal Office of Research Integrity oversees and reviews the institution’s work rather than conducting the first-line investigation itself.
How long does a research misconduct investigation take?
Under the current rule (in effect for institutions since January 1, 2026), an inquiry must be completed within 90 days and, if it proceeds, a full investigation within 180 days. Complex or multi-institution cases can extend beyond these windows with documented justification.
Does an honest mistake count as research misconduct?
No. The regulatory definition explicitly excludes honest error and legitimate differences of scientific opinion. A finding requires that the conduct was a significant departure from accepted practice committed intentionally, knowingly, or recklessly — not merely that a result later turned out to be wrong.
Are whistleblowers protected if their allegation turns out to be unfounded?
Yes, provided the report was made in good faith through the institution’s official channels. Good-faith protection does not depend on the allegation ultimately being substantiated — it depends on the complainant having a reasonable basis for the concern and not acting to knowingly make a false report.
What happens if a researcher is found to have committed misconduct?
Consequences fall into two tracks: institutional (employment/disciplinary action, governed by the institution’s own policy) and federal (administrative actions ORI can propose to HHS, such as debarment from federal funding eligibility, exclusion from PHS review panels, supervision requirements, or corrections to the research record). A misconduct finding doesn’t automatically produce a journal retraction — that’s a separate editorial decision, though the two often occur together.
The federal half of this process is agency-dependent, and capacity can degrade without any change in law. In 2026 NSF’s Office of Inspector General lost the practical ability to investigate misconduct in NSF-funded work while retaining its statutory authority to do so.
How this differs from human-subjects protection
Research misconduct (fabrication, falsification, plagiarism) is a distinct oversight regime from human-subjects protection. Misconduct findings concern the integrity of the research record and are investigated under each institution’s misconduct policy and, where federal funding is involved, ORI’s regulations; human-subjects protection concerns how participants are treated during the research itself and is governed by the Belmont Report’s three principles as implemented through IRB review under the Common Rule. See the Belmont Report principles and how they apply in practice for that framework.
Related CASRAI Dictionary terms
Research misconduct · Fabrication · Falsification · Plagiarism · ORI (US Office of Research Integrity) · Whistleblower (research) · UKRIO · ENRIO · Paper mill · Self-plagiarism · Image manipulation · Duplicate publication · Authorship dispute · The Belmont Report principles and how they apply in practice
