IRB Noncompliance Reporting: What & When

US federal human-subjects regulations do not ask an Institutional Review Board (IRB) to report every deviation from a protocol. They draw a specific, narrower line: an IRB must have written procedures for the prompt reporting of three categories of event — unanticipated problems involving risks to subjects or others, serious or continuing noncompliance, and any suspension or termination of IRB approval — to the IRB itself, appropriate institutional officials, the relevant federal department or agency, and, for most federally conducted or supported research, the Office for Human Research Protections (OHRP). This guide breaks down what falls inside that line, what doesn’t, who is actually responsible for reporting at each step, and on what timeline.

The regulatory source: 45 CFR 46.108 and 21 CFR 56.108(b)

The reporting obligation sits in the IRB-functions-and-operations sections of both the HHS Common Rule and the parallel FDA human-subjects regulation:

45 CFR 46.108 (the Common Rule, applicable to HHS-conducted or HHS-supported research and any research an institution has voluntarily extended equivalent protections to) requires an IRB to have written procedures for ensuring prompt reporting to the IRB, appropriate institutional officials, and the department or agency head of: (i) any unanticipated problems involving risks to subjects or others, or any serious or continuing noncompliance with the Common Rule or the requirements or determinations of the IRB; and (ii) any suspension or termination of IRB approval. Where HHS is the relevant department, that reporting flows to OHRP as HHS’s designated recipient.
21 CFR 56.108(b) is FDA’s structurally identical requirement for FDA-regulated research (drugs, biologics, devices), with reports flowing to the IRB, institutional officials, and FDA rather than OHRP.

Both provisions describe the same three reportable categories and the same recipient structure — institution first, federal oversight body in parallel — which is why most academic medical centers and university IRBs run a single unified reportable-events process rather than separate Common Rule and FDA tracks. Whether OHRP, FDA, or both need a report depends on whether the specific study is HHS-supported, FDA-regulated, or both.

Category 1: Unanticipated problems involving risks to subjects or others (UPIRSOs)

OHRP’s 2007 guidance, Reviewing and Reporting Unanticipated Problems Involving Risks to Subjects or Others and Adverse Events, is the operative interpretive document institutions use to apply 45 CFR 46.108 in practice. It frames a reportable unanticipated problem (commonly abbreviated UPIRSO) as an event that generally meets all three of the following:

Unexpected — in nature, severity, or frequency, given the research procedures described in the protocol/consent documents and the characteristics of the subject population.
Related or possibly related to participation in the research (a reasonable possibility of a causal relationship, not necessarily a confirmed one).
Suggests the research places subjects or others at a greater risk of harm (physical, psychological, economic, social, or otherwise) than was previously known or recognized.

The key practical point institutions repeatedly get wrong: a UPIRSO is not the same thing as an adverse event, and not every serious adverse event is a UPIRSO. A serious adverse event that is expected and disclosed in the consent form (a known, listed side effect occurring at an expected rate) is not unanticipated and therefore not reportable as a UPIRSO, even though it may still need to be captured in routine safety reporting to the sponsor or a monitoring board. Conversely, non-adverse-event findings can be UPIRSOs — a protocol deviation that exposed subjects to an unapproved procedure, a breach of confidentiality that put participants at social or legal risk, or new literature revealing a previously unrecognized risk of a study drug, can all meet the three-part test even without a single participant being physically harmed. For the AE/SAE/SUSAR safety-reporting track specifically (distinct from, but sometimes overlapping with, UPIRSO reporting), see our guide to pharmacovigilance in clinical research.

Category 2: Serious or continuing noncompliance

The regulation itself does not define “serious” or “continuing” noncompliance numerically — that determination is left to the IRB and institution, applied case by case. In practice, institutional human-research-protection programs generally distinguish:

Minor/non-serious noncompliance — an isolated administrative lapse (a missed signature date, a late continuing-review submission caught and corrected quickly) that does not affect subject rights, safety, or welfare, or the integrity of the research data. This is typically tracked internally and does not trigger external reporting on its own.
Serious noncompliance — a single instance that does, or could, materially affect the rights, safety, or welfare of subjects, or the validity of the research — for example, enrolling subjects before IRB approval was obtained, conducting research under a lapsed approval, or a significant unapproved deviation from the approved consent process.
Continuing noncompliance — a pattern of repeated noncompliance, even where no single instance is individually “serious,” that indicates a systemic failure to comply with the Common Rule, FDA regulations, or the IRB’s own determinations (for example, a research team repeatedly missing continuing-review deadlines across multiple studies despite prior corrective guidance).

Either finding — serious or continuing — triggers the same reporting obligation under 45 CFR 46.108(a)(3) / 21 CFR 56.108(b). Institutions generally route the initial determination through the IRB’s own noncompliance-review procedure (sometimes a subcommittee, sometimes the convened board) before external reporting, since the IRB is the body the regulation designates to make the “serious or continuing” determination in the first place.

Category 3: Suspension or termination of IRB approval

An IRB has independent authority under 45 CFR 46.113 to suspend or terminate approval of research that is not being conducted in accordance with the IRB’s requirements, or that has been associated with unexpected serious harm to subjects. Whenever an IRB exercises that authority, the action itself — along with the IRB’s stated reasons — must be reported promptly to the investigator, appropriate institutional officials, and the relevant federal department/agency (OHRP and/or FDA, as applicable). This is a distinct reportable category from the underlying finding that triggered the suspension: the noncompliance or safety issue that caused the IRB to act may itself be independently reportable under Category 1 or 2, and institutions typically report both together rather than treating the suspension as a standalone administrative footnote.

Who is actually responsible for reporting, and to whom

The regulation places the procedural obligation on the IRB, but in practice, reporting responsibility is distributed across several roles:

Investigator / study team — typically the first to identify and report a potential UPIRSO or noncompliance event to the IRB, per the institution’s own reportable-events policy and timeline (commonly a matter of days, not weeks, for anything with immediate safety implications).
IRB / IRB coordinator or IRB Chair — reviews the report, makes (or brings to the convened board) the determination of whether it meets the unanticipated-problem or serious/continuing-noncompliance threshold.
Institutional officials — commonly the institution’s Designated Institutional Official (DIO) or Human Protections Administrator named on the institution’s Federalwide Assurance (FWA) — receive the IRB’s report and are typically the ones who formally transmit it externally.
OHRP and/or FDA — the external federal recipients. Which one (or both) applies depends on whether the research is HHS-conducted/supported, FDA-regulated, or both; many academic medical center studies are both, since an FDA-regulated drug or device trial can simultaneously carry federal (e.g., NIH) funding.

A Data Safety Monitoring Board (DSMB), where one exists for a trial, is a separate structure with its own safety-monitoring reporting lines to the sponsor — it does not substitute for or replace the IRB’s independent 45 CFR 46.108 / 21 CFR 56.108(b) reporting obligation, even though the underlying safety data reviewed may overlap.

Reporting timeframes

Neither 45 CFR 46.108 nor 21 CFR 56.108(b) specifies a fixed number of calendar days for external reporting — the regulatory text uses “prompt reporting” rather than a numeric deadline. OHRP’s guidance interprets “prompt” as scaling to severity: reports on serious incidents (immediate safety implications, or a suspension/termination action) are generally expected within days, while less time-sensitive findings may be reported within a few weeks. This is a materially looser standard than the fixed regulatory clocks that apply to sponsor safety reporting under 21 CFR 312.32 (7/15 calendar days for SUSARs) or investigator-to-sponsor SAE reporting under 21 CFR 312.64(b) — IRB reportable-events timing and IND safety reporting are related but legally separate obligations, and meeting one does not automatically satisfy the other. Because “prompt” is not numerically defined at the federal level, individual institutions set their own specific internal deadlines (commonly ranging from 5 to 10 business days for the initial report, with a defined process for follow-up once an investigation or corrective action plan is complete) in their written IRB procedures — check the specific institution’s HRPP policy for the operative number, since the federal regulation itself won’t tell you.

Frequently asked questions

Is every serious adverse event a reportable unanticipated problem?

No. An SAE that is expected (disclosed in the consent form as a known risk, occurring at an expected rate) fails the “unexpected” prong of the three-part UPIRSO test and is not reportable on that basis, even though it may still require routine safety reporting through other channels. Only SAEs that are also unexpected and suggest a previously unrecognized level of risk are UPIRSOs.

Does a single missed continuing-review deadline count as reportable noncompliance?

Usually not on its own — most institutions treat an isolated, promptly corrected administrative lapse as minor noncompliance handled internally. It becomes reportable if it’s serious (e.g., research continued after approval actually lapsed, exposing subjects to unapproved research) or if it becomes part of a continuing pattern.

Do I report to OHRP, FDA, or both?

It depends on the study’s funding and regulatory status. HHS-conducted or HHS-supported human subjects research reports to OHRP; FDA-regulated research (drugs, biologics, devices) reports to FDA under 21 CFR 56.108(b). A study that is both HHS-funded and FDA-regulated may require reporting to both, since the two reporting obligations are legally distinct even when the underlying institutional report is prepared once and routed to both.

Who decides whether an event meets the reporting threshold — the investigator or the IRB?

The IRB (or its delegated committee/chair) makes the formal determination of whether a reported event meets the unanticipated-problem or serious/continuing-noncompliance threshold. The investigator’s role is to report potential events promptly per the institution’s policy; the classification decision itself is the IRB’s under the regulation.

Related CASRAI resources

Sources: 45 CFR 46.108 and 46.113 (eCFR/Cornell LII); 21 CFR 56.108(b) (eCFR/Cornell LII); OHRP, Reviewing and Reporting Unanticipated Problems Involving Risks to Subjects or Others and Adverse Events (2007 guidance).