Pharmacovigilance in Clinical Research: AE, SAE, and SUSAR Reporting

Pharmacovigilance in a clinical-trial-administration context is the ongoing, systematic detection, classification, assessment, and reporting of adverse effects associated with an investigational product — running as a continuous function in parallel to a trial’s efficacy objectives, not a one-time checkbox at study startup. It begins the moment a product is first given to a human subject and does not stop when the last subject completes their final visit: sponsors carry defined periodic-reporting obligations for as long as a product remains under active development or on the market.

The framework that governs this function across ICH regions (the US, EU, Japan, and the other ICH member/observer jurisdictions) is the ICH E2 guideline series, anchored by ICH E2A, “Clinical Safety Data Management: Definitions and Standards for Expedited Reporting” (finalized 1994) — the source of the adverse event, serious adverse event, and unexpected/SUSAR definitions this guide works through in detail, along with the FDA and EU regulations that implement them operationally. This guide is written for research administrators, sponsors, and site staff who need to know precisely what has to be reported, by whom, on what timeline, and how that reporting pipeline relates to — but is not the same thing as — a trial’s independent safety-oversight body.

What pharmacovigilance means in this context

“Pharmacovigilance” is most often associated with post-marketing drug safety, but within clinical research administration it covers the full arc of an investigational product’s safety data:

• During the trial — collecting, grading, and assessing adverse events as they occur at each site; determining seriousness, causality, and expectedness for each event; and routing anything that meets expedited-reporting criteria to the sponsor, regulators, and ethics bodies on a strict clock.
• Aggregated and periodic review — sponsors don’t just report individual cases; they also compile periodic safety updates (covered below) that let regulators and oversight bodies see the accumulating safety picture across the whole trial or program, not just isolated incidents.
• Beyond a single trial’s closeout — for products still in development, periodic safety reporting continues at the program level; for approved products, the function transitions into national spontaneous-reporting pharmacovigilance systems (e.g., FDA’s FAERS, the EU’s EudraVigilance).

This is operationally distinct from — though it depends on — clinical data management (the systems and SOPs that capture and clean trial data generally) and from Good Clinical Practice more broadly (the conduct and quality standard the whole trial is held to). Pharmacovigilance is the safety-specific data stream inside that larger GCP framework, with its own definitions, its own regulatory clock, and — as the last section of this guide covers — its own independent oversight mechanism in trials that use one.

AE vs. SAE vs. SUSAR: the ICH E2A definitions

These three terms are frequently used loosely in casual conversation but have precise, cascading regulatory definitions under ICH E2A. Getting the distinction right matters directly: it determines whether an event sits in routine case-report-form data or triggers an expedited regulatory clock.

Adverse event (AE)

An AE is any untoward medical occurrence in a subject administered a pharmaceutical product, whether or not considered related to that product. This is a deliberately broad, causality-neutral definition — a headache, an abnormal lab value, or a fall unrelated to the study drug all qualify as AEs, because the definition captures anything unfavorable and unintended that is temporally associated with product administration, not just events later confirmed to be caused by it.

Adverse drug reaction / suspected adverse reaction

An adverse (drug) reaction narrows the AE definition by adding causality: it is a noxious and unintended response to the product where a causal relationship is at least a reasonable possibility — a lower bar than “proven,” but higher than “merely coincided with.” (US regulation, per the FDA’s 2010 IND safety-reporting final rule, uses the parallel term “suspected adverse reaction” for the same reasonable-possibility standard.)

Serious adverse event (SAE)

“Serious” is a regulatory term of art, not a synonym for “severe” — a Grade 4 lab abnormality can be non-serious, and a hospitalization for an otherwise mild condition is serious. Under ICH E2A, an event is serious if, at any dose, it:

• results in death;
• is life-threatening (the subject was at immediate risk of death from the event as it occurred, not a theoretical future risk);
• requires inpatient hospitalization or prolongs an existing hospitalization;
• results in persistent or significant disability or incapacity;
• is a congenital anomaly or birth defect; or
• is otherwise medically important — a catch-all for events that don’t meet the other criteria literally but may jeopardize the subject or require medical or surgical intervention to prevent one of the outcomes above (the standard example is an emergency room visit for bronchospasm that doesn’t result in hospitalization).

Severity (mild/moderate/severe grading — often using the NCI’s Common Terminology Criteria for Adverse Events, CTCAE, especially in oncology trials) and seriousness (the regulatory criteria above) are graded on separate scales and should never be conflated when completing a safety report.

Unexpected

An adverse reaction is unexpected if its nature, severity, or frequency is not consistent with the current reference safety information — the Investigator’s Brochure for an unapproved product, or the approved labeling/summary of product characteristics for a marketed one being studied in a new trial. Expectedness is assessed against the current version of that reference document, which is why version control on the Investigator’s Brochure matters directly to safety-reporting accuracy: an event correctly logged as “unexpected” against an outdated IB version can be wrongly triggered for expedited reporting, or wrongly withheld from it.

Suspected Unexpected Serious Adverse Reaction (SUSAR)

A SUSAR is the intersection of all three qualifiers above: an adverse event that is serious (meets one of the ICH E2A seriousness criteria), suspected to be causally related to the investigational product (by either the investigator or the sponsor — either assessment is sufficient to trigger reporting), and unexpected (not consistent with the current reference safety information). SUSARs are the category ICH E2A’s expedited-reporting clock applies to — not every SAE, and not every AE.

Term	Core question it answers	Triggers expedited reporting?
AE	Did anything unfavorable happen, regardless of cause?	No — routine case-report-form data
SAE	Was the outcome serious (death, life-threatening, hospitalization, disability, congenital anomaly, or otherwise medically important)?	Not by itself — depends on causality and expectedness
SUSAR	Was it serious, suspected to be drug-related, and inconsistent with the current reference safety information?	Yes — expedited regulatory clock applies

Some protocols also pre-specify a subset of events — Adverse Events of Special Interest (AESIs) — for enhanced monitoring and expedited reporting regardless of where they otherwise fall in this AE/SAE/SUSAR hierarchy, because the sponsor already has a specific mechanistic or class-effect reason to watch for them from the outset.

Reporting timelines and responsibilities

Safety reporting moves through a defined chain, and each link has its own timeline. Confusing “report to the sponsor” with “report to the regulator” — or assuming one report satisfies both obligations — is a common, avoidable compliance gap.

Investigator → sponsor

Under US regulation (21 CFR 312.64(b)), the investigator must report any serious adverse event to the sponsor immediately, whether or not the investigator considers it drug-related, along with an assessment of whether there is a reasonable possibility the product caused it. Non-serious adverse events are recorded and reported to the sponsor on the schedule specified in the protocol, not on an immediate basis. ICH GCP (E6) imposes the same immediate-reporting principle for SAEs internationally, with the specific mechanics (forms, timeframes for follow-up information) set out in the trial protocol.

Sponsor → regulator

In the US, sponsor safety reporting to FDA under an active IND is governed by 21 CFR 312.32. A SUSAR that is fatal or life-threatening must be reported within 7 calendar days of the sponsor’s initial receipt of the information (with a complete follow-up report within an additional 8 days); other SUSARs must be reported within 15 calendar days. These are the same 7-/15-day expedited timelines ICH E2A establishes as the harmonized standard, and the EU applies materially the same structure: under Regulation (EU) No 536/2014, sponsors report SUSARs to the EudraVigilance database on the same 7-day (fatal/life-threatening) and 15-day (other) timelines, measured from the sponsor’s awareness of the case. The reporting clock starts from the sponsor’s first knowledge that a case meets the minimum reportability criteria (an identifiable patient, a reporter, a suspect product, and an event) — not from the first vague or incomplete mention of a possible event.

Sponsor → investigators

Sponsors are also responsible for keeping every participating investigator informed of new safety information that could affect the ongoing safety of subjects or the conduct of the trial — in practice, this means distributing IND safety reports/SUSAR notifications to all sites, not just filing them with the regulator. ICH E2A does not specify a fixed numeric timeline for this investigator-facing notification the way it does for regulatory reporting, but expects it to happen promptly enough that investigators can act on the information (for example, updating a consent form or reassessing a subject’s risk-benefit balance).

Sponsor / investigator → IRB or ethics committee

Separately from regulatory expedited reporting, 21 CFR 56.108(b) requires an IRB to have written procedures for the prompt reporting of unanticipated problems involving risks to subjects — a category that overlaps with, but is not identical to, “SUSAR”: an unanticipated problem is anything unexpected in nature, severity, or frequency given the protocol and study population, and it can include non-serious findings with safety implications that wouldn’t independently trigger a SUSAR report. In practice, sites typically route sponsor-forwarded IND safety reports and SUSAR notifications to their local IRB per the institution’s own reporting policy, which is frequently narrower and stricter than the federal floor — the applicable IRB’s written procedures, not ICH E2A alone, determine what a given site must submit and on what local timeline. See CASRAI’s guide on IRB review for the broader ethics-oversight role this reporting feeds into.

Beyond the trial: periodic and ongoing safety reporting

Individual-case expedited reporting (the SUSAR pathway above) is only part of the picture. The rest of the ICH E2 series governs how safety data is aggregated and reviewed over time:

• ICH E2F — Development Safety Update Report (DSUR). A standardized annual report on an investigational product’s accumulating safety profile across all trials in its development program, intended to satisfy the same underlying need as the US IND annual report and the EU annual safety report in one harmonized format.
• ICH E2C(R2) — Periodic Benefit-Risk Evaluation Report (PBRER). The post-approval counterpart: a periodic, critical analysis of a marketed product’s emerging risk and benefit information, structured so its sections can align closely with the DSUR’s.
• ICH E2B — electronic transmission standards for individual case safety reports (ICSRs), defining the data elements and message format that let sponsors and regulators exchange case-level safety data in a consistent structure regardless of the originating country or system.

Together, these mean a research administrator’s pharmacovigilance obligations don’t end at trial closeout for as long as the product remains in active development — and, for an approved product, safety monitoring simply continues through the applicable national spontaneous-reporting system rather than stopping outright.

The role of a DSMB — and how it differs from an SRC or SAB

A Data Safety Monitoring Board (DSMB, also called a Data Monitoring Committee or DMC) is an independent group of experts, external to the trial’s day-to-day conduct, that periodically reviews accumulating safety data — and, in many designs, interim efficacy data — for an ongoing trial and can recommend that it continue unchanged, continue with modification, or stop early for safety, futility, or a clearly demonstrated benefit. NIH’s long-standing data and safety monitoring policy (first issued in 1998) established the expectation that trials involving greater than minimal risk, particularly multi-site trials, have a formal, independent monitoring structure of this kind — the exact form (a full DSMB vs. a lighter monitoring plan) scales with the trial’s risk level and complexity.

It is worth being precise about how a DSMB relates to the AE/SAE/SUSAR reporting pipeline described above: the reporting obligations in ICH E2A are what get safety data to a DSMB (among other recipients) in a timely, structured way — but the DSMB itself is a separate governance layer that interprets the accumulating pattern across all subjects, often with access to unblinded data that individual sites and even the sponsor’s non-monitoring staff do not see. Meeting the regulatory reporting clock and having an effective DSMB are two different, complementary compliance obligations, not one substituting for the other.

A DSMB is also operationally distinct from two other governance bodies research administrators sometimes conflate it with:

• Scientific Review Committee (SRC) — performs upfront, pre-activation scientific-merit peer review of a protocol (common at NCI-designated cancer centers, where SRC approval precedes and is required alongside IRB approval before a trial can open). An SRC reviews trial design quality before enrollment starts; it does not conduct ongoing safety surveillance of an active trial’s accumulating data.
• Scientific Advisory Board (SAB) — advises an organization (a company, institute, or program) on its overall scientific strategy and direction. An SAB’s remit is institutional and strategic, not tied to monitoring the safety data of one specific ongoing trial.

In short: SRC review happens before a trial opens; DSMB/safety monitoring happens continuously while a trial is running and is what the AE/SAE/SUSAR reporting chain in this guide ultimately feeds; and an SAB sits outside any single trial’s oversight structure entirely, advising on strategy rather than reviewing case-level safety data.

A practical checklist for research administrators

• Confirm the protocol defines product- and indication-specific SAE criteria and a named reference safety document (Investigator’s Brochure version, or approved label) that expectedness will be assessed against — and that the IB’s version history is tracked, since expedited-reporting decisions depend on the current version.
• Build a written SOP that maps the full chain — investigator-to-sponsor, sponsor-to-regulator, sponsor-to-investigators, sponsor/site-to-IRB — with the specific timeline and owner at each link, rather than relying on staff to independently reconstruct ICH E2A’s timelines under pressure.
• Check the local IRB’s own unanticipated-problem and safety-reporting policy separately from the federal/ICH floor — many institutions require narrower categories or shorter local timelines than 21 CFR 56.108 sets as a minimum.
• For any greater-than-minimal-risk or multi-site trial, confirm whether a DSMB (or a lighter data-and-safety-monitoring plan, where a full board isn’t warranted) exists, has a current charter, and meets on a defined cadence — and that this is tracked separately from any SRC/SAB the institution or sponsor organization also maintains.
• For multi-region trials, confirm EudraVigilance registration and reporting responsibility are assigned (directly by the sponsor or via a delegated CRO) alongside the FDA IND safety-reporting pathway — the two systems run in parallel, not as substitutes for each other.

Frequently asked questions

What is the difference between an adverse event and a serious adverse event?

An adverse event (AE) is any untoward medical occurrence during a trial, regardless of cause or severity. A serious adverse event (SAE) is the subset that meets one of ICH E2A’s specific seriousness criteria — death, a life-threatening event, hospitalization or its prolongation, persistent or significant disability, a congenital anomaly, or another medically important event. Seriousness is a defined regulatory category, not a synonym for how severe an event felt to the subject.

Is every SAE a SUSAR?

No. An SAE only becomes a SUSAR — and only then triggers ICH E2A’s expedited regulatory-reporting clock — if it is also suspected to be causally related to the investigational product and unexpected relative to the current Investigator’s Brochure or approved labeling. Many SAEs in a trial are expected (already described in the reference safety information) or judged unrelated to the product, and are handled through routine and periodic reporting rather than the expedited SUSAR pathway.

How quickly must a SUSAR be reported to FDA?

Under 21 CFR 312.32, fatal or life-threatening SUSARs must be reported within 7 calendar days of the sponsor’s initial awareness, with a complete follow-up report within an additional 8 days; other SUSARs must be reported within 15 calendar days. The EU applies the equivalent 7-/15-day structure for EudraVigilance reporting under Regulation (EU) No 536/2014.

Who is responsible for reporting an adverse event during a clinical trial?

Responsibility is shared but sequential: the investigator must report SAEs to the sponsor immediately (21 CFR 312.64(b)); the sponsor is then responsible for expedited reporting of qualifying SUSARs to regulators (21 CFR 312.32 in the US; EudraVigilance in the EU), for keeping all participating investigators informed of new safety information, and — together with sites — for ensuring the local IRB’s own unanticipated-problem reporting requirements are met.

Is a DSMB the same thing as an IRB?

No. An IRB/ethics committee approves a trial’s ethical design (including informed consent) before it opens and continues to review it periodically, but it does not typically review accumulating unblinded safety or efficacy data as its core function. A DSMB is specifically constituted to monitor that accumulating trial data on an ongoing basis and can recommend early modification or termination of the trial on safety, efficacy, or futility grounds — a different function performed by a different, usually unblinded, body.

Does pharmacovigilance responsibility end when a trial finishes enrolling or closes out?

No. For a product still in active development, sponsors continue periodic safety reporting (the annual Development Safety Update Report under ICH E2F) at the program level even after an individual trial closes. Once a product is approved, the safety-monitoring function continues through national pharmacovigilance/spontaneous-reporting systems (FDA’s FAERS, the EU’s EudraVigilance) rather than stopping at approval.

Related CASRAI resources

For adjacent topics not covered in depth here, see CASRAI’s guides on informed consent in research, clinical data management, clinical trial registration and reporting compliance, what counts as an NIH-defined clinical trial, and clinical trial supply management; and the dictionary entries for ICH GCP, IRB, informed consent, Scientific Review Committee, and Scientific Advisory Board. For the wider clinical research administration picture, see the Clinical Research Administration cluster hub.