A protocol deviation becomes an important (major) deviation the moment it affects a subject’s safety, rights, or well-being, or the completeness, accuracy, or reliability of the study data — see Protocol Deviation for the classification framework itself. This page covers what happens next: the concrete sequence of actions a study team takes once that determination has been made, from the moment of discovery through IRB reporting and corrective action close-out.
There is no single universal clock or form that applies to every study — the specific reporting interval and paperwork are set by each IRB’s own written policy and the trial’s sponsor agreement, so the sequence below is the structure that applies everywhere, with the specific timelines you should confirm against your own IRB’s and sponsor’s requirements.
Step 1: Address any immediate safety issue first
If the deviation involves ongoing or imminent risk to a subject, the safety action comes before the paperwork. Under ICH E6(R2) Good Clinical Practice and the parallel FDA requirement at 21 CFR 312.66, an investigator may implement a change to the approved protocol without prior sponsor/IRB approval only to eliminate an apparent immediate hazard to a trial subject — and must then promptly report that change and the reasoning behind it. This is the one situation where action precedes documentation and notification rather than following it; every other deviation is documented and reported without being implemented as a workaround for a hazard.
Step 2: Document the deviation in full
As soon as the immediate situation is stable, record the deviation in the site’s deviation log (or equivalent quality system record): what happened, the date it occurred versus the date it was discovered (these are often different, and both matter for a timeliness assessment), which subject(s) and protocol section were involved, and the study team member’s initial account of the cause. A deviation log entry that only states what happened, without an explained severity rationale and root cause, is a recurring finding in FDA and other regulatory inspections — the documentation step is not a formality, it is what an inspector or auditor will actually read.
Step 3: Classify severity against the site/sponsor framework
Confirm the deviation genuinely meets the “important” (major) threshold rather than the minor/administrative one — see the worked examples on the Protocol Deviation term. FDA’s draft guidance Protocol Deviations for Clinical Investigations of Drugs, Biological Products, and Devices (released December 2024, comment period closed February 2025) defines an important protocol deviation as one that “might significantly affect the completeness, accuracy, and/or reliability of the study data or that might significantly affect a subject’s rights, safety, or well-being,” and recommends that sponsors, investigators, and IRBs use a consistent classification system rather than each applying an ad hoc standard. Getting the classification right at this step determines everything downstream: an important deviation triggers prompt reporting obligations that a minor one does not.
Step 4: Notify the study team lead and sponsor
Notify the principal investigator (if they were not already involved in the discovery) and the sponsor per the clinical trial agreement and monitoring plan — sponsor SOPs typically require prompt reporting of deviations on a defined form regardless of severity tier, with severity affecting urgency rather than whether reporting happens at all. FDA’s draft guidance frames the investigator’s reporting obligation differently depending on whether the deviation was intentional/planned or unintentional: an intentional deviation normally requires sponsor and IRB approval before implementation, with an exception for urgent situations (implement first, then “promptly report to the sponsor and the IRB”); an unintentional deviation is reported to the sponsor and IRB “within the specified reporting timelines” set by the study’s own procedures. For device studies specifically, the same draft guidance describes a concrete number: in an emergency deviation implemented before approval, the investigator should promptly report to the sponsor and IRB within 5 business days.
Step 5: Report to the IRB, using that IRB’s own form and timeline
Report the deviation to the IRB of record using its specific reportable-event submission process — see IRB Reportable Events for how this fits into the broader reporting-event taxonomy alongside unanticipated problems and adverse events. Neither the Common Rule (45 CFR 46) nor FDA’s parallel regulation at 21 CFR 56.108(b) specifies a fixed day-count for this report — the statutory language requires “prompt” reporting, and each institution’s Human Research Protection Program (HRPP) or IRB policy fills in the actual clock. In practice, a commonly seen pattern (confirm against your specific IRB’s written policy rather than assuming this applies) is: events posing an immediate risk to subject safety reported within 24–48 hours (often by phone or email, followed by the formal written report), and other important/reportable deviations reported within a handful of business days. Do not assume a number from a different institution’s policy carries over to yours.
Step 6: Let the IRB complete its review — and know what can follow
Once the IRB has the report, it evaluates whether the deviation, on its own or as part of a pattern, requires further action: continuing the study as-is with the deviation noted, requiring a corrective action plan before continued enrollment, requiring a protocol amendment, or — if the finding rises to serious or continuing noncompliance — escalating into a formal IRB violation review. That threshold activates the IRB’s own suspension/termination authority under 45 CFR 46.113 / 21 CFR 56.113, and, for any institution holding a Federalwide Assurance, an independent obligation to self-report the finding to OHRP. A single important deviation does not automatically become a violation — that determination turns on whether the IRB finds the noncompliance serious, a repeated pattern, or evidence that earlier corrective measures did not work. A cluster of important deviations at one site (rather than isolated, unrelated incidents) is also a recognized trigger for targeted or for-cause monitoring, independent of whether any single deviation individually escalates to a violation finding.
Step 7: Run root cause analysis and implement corrective action (CAPA)
ICH E6 does not use the term “CAPA” itself, but it expects sponsors and investigators to identify and correct noncompliance, and CAPA — correction, corrective action, preventive action, and an effectiveness check — is the operational process research teams use to meet that expectation. The concept is borrowed from the broader quality-management lineage (ISO 9001:2015 §10.2, ISO 13485:2016 §§8.5.2–8.5.3, ICH Q10’s Pharmaceutical Quality System), not created specifically for clinical trials. For an important deviation, this means identifying why it happened (not just what happened), fixing the immediate cause, considering whether a broader process change is needed to prevent recurrence, and documenting that the fix actually worked — not just that something was changed. This CAPA record is exactly what a monitor or inspector will look for alongside the original deviation log entry.
Step 8: If the trial has an EU/UK arm, check the “serious breach” trigger separately
The EU Clinical Trials Regulation (EU) No 536/2014 and the equivalent UK framework use a related but distinct concept: a serious breach, defined as a breach likely to significantly affect a subject’s safety or rights, or the reliability/robustness of the trial’s data. A sponsor who becomes aware of a serious breach has an independent notification obligation to the relevant regulator without undue delay — commonly cited as no later than 7 days from becoming aware of it. “Serious breach” and “important protocol deviation” overlap conceptually but come from different regulatory frameworks; an important deviation under ICH E6(R2)/FDA practice is not automatically a reportable serious breach under EU CTR Article 52 or vice versa, so a multi-region trial needs both assessments run separately rather than assuming one substitutes for the other.
Step 9: Keep the paper trail inspection-ready
Everything above — the deviation log entry, severity classification rationale, sponsor/IRB correspondence, IRB determination, and CAPA record — is what FDA and other regulators review during routine and for-cause inspections. A deviation log that records events without a documented root cause and a closed-loop CAPA is a recurring inspection finding precisely because it suggests the team logged the event but never actually addressed why it happened.
Frequently asked questions
Who decides whether a deviation is “major” or “minor”?
The investigator and study team make the initial classification against the site’s SOP and the sponsor’s protocol-specific guidance, but the IRB makes its own independent assessment on review and can disagree with the site’s initial call — which is one more reason the documented rationale in Step 2 matters, not just the conclusion.
Does every important deviation have to be reported to the IRB immediately?
No single universal timeline applies. Reporting is required promptly under federal regulation, but the specific number of days is set by the reviewing IRB’s own written policy (and, separately, by the sponsor’s monitoring plan and, for EU/UK trials, the serious-breach notification clock). Always check the actual policy of the IRB of record rather than assuming a figure that applied at a different institution or on a different trial.
Does an important deviation automatically become a “protocol violation”?
Not automatically. “Protocol violation” is industry-convention terminology, not an ICH-harmonized tier — see Protocol Deviation vs. Violation. A deviation escalates to formal noncompliance status only when the IRB determines it (or a pattern of it) is serious or continuing under 45 CFR 46.113 / 21 CFR 56.113.
What if the deviation was made to protect a subject from immediate harm?
That is the one recognized exception where implementing the change can come before IRB/sponsor approval — but prompt reporting afterward is still required, not optional; the exception covers the sequencing, not the reporting obligation itself.
