Protocol Deviations Workflow

⚠️

Protocol Deviations - Managing Departures From the Approved Plan

A protocol deviation is any departure from the approved protocol or GCP requirements, whether accidental or intentional. ICH E6(R2) requires that deviations be documented, and that their impact on subject safety, rights, and data reliability be assessed. EU CTR 536/2014 introduces the distinct concept of a serious breach, a deviation likely to affect subject safety, rights, or the reliability of trial results, which carries its own expedited notification requirement. This map details the pathway from identification through classification, reporting, and corrective action.

ICH E6(R2) Section 4.5 · EU CTR 536/2014 Art. 52 · 21 CFR 312.66

ICH E6(R2)

EU CTR 536/2014

21 CFR 312.66

Non-Important Deviation

Limited impact on subject safety, rights, or data reliability. Logged and reported through routine channels.

Reporting: Routine / periodic

Important Deviation

Significant potential effect on subject safety, rights, or the reliability of trial data. Requires expedited handling.

Reporting: Sponsor and IRB, expedited

Serious Breach

EU CTR concept: a breach likely to substantially affect subject safety, rights, or result reliability.

Reporting: Competent authority, 7 days

Prospective Waiver

A planned, pre-approved departure from a protocol requirement for a specific subject, distinct from an unplanned deviation.

Reporting: Prior sponsor/IRB approval

Phase 1

Deviation Identification and Documentation

1Identify departure from the approved protocol

Deviation identified through site self-report, monitoring visit, or data review, covering any departure from protocol procedures, visit windows, or eligibility criteria.

ICH E6(R2) Section 4.5

↓

2Document the deviation in the site log

Deviation recorded in the site's deviation log with date of occurrence, date of discovery, description, and subject identifier where applicable.

ICH E6(R2) Section 4.5

↓

3Notify the investigator

Investigator informed of the deviation and reviews the circumstances, since the investigator bears responsibility for protocol adherence at the site.

ICH E6(R2) Section 4.5

↓

4Determine whether planned or unplanned

Distinction made between an unplanned deviation and a prospectively requested and approved waiver, which follows a separate approval pathway.

ICH E6(R2) Section 4.5

Phase 2

Classification and Impact Assessment

5Classify as important or non-important

Deviation classified based on its actual or potential effect on subject safety, subject rights, or the reliability of trial data.

ICH E6(R2) Section 4.5

↓

6Assess impact on safety, rights, and reliability

Structured impact assessment performed, documenting the specific effect, if any, on the subject and on the integrity of the collected data.

ICH E6(R2) Section 4.5

↓

Does the deviation meet the definition of a serious breach?

YES → Notify competent authority NO → Standard deviation pathway

Phase 3

Reporting and Notification

7Document the root cause

Root cause of the deviation investigated and documented, distinguishing site process failure, investigator judgment, or subject-driven factors.

ICH E6(R2) Section 4.5

↓

8Report important deviations to the sponsor

Important deviations reported to the sponsor within the timeline specified by the protocol or monitoring plan.

ICH E6(R2) Section 4.5

↓

9Notify the IRB / Ethics Committee

Important deviations reported to the IRB or Ethics Committee per its requirements and the applicable regulatory timeline.

ICH E6(R2) Section 4.5

↓

10Submit serious breach notification if applicable

Serious breaches under EU CTR notified to the competent authority within 7 days of the sponsor becoming aware of the breach.

EU CTR 536/2014 Art. 52

Phase 4

CAPA and Prevention

11Implement corrective action

Immediate action taken to address the specific deviation, such as re-consenting a subject or correcting a data entry.

ICH E6(R2) Section 4.5

↓

12Implement preventive action

Broader action taken to reduce recurrence risk, such as retraining site staff or clarifying an ambiguous protocol procedure.

ICH E6(R2) Section 4.5

↓

13Trend deviations across the trial

Deviation data trended across sites and time to identify systemic site performance or protocol design issues requiring broader action.

ICH E6(R2) Section 5.18

Deviation Classification Categories

Non-Important Deviation

Limited or no effect on subject safety, rights, or data reliability. Documented and reported through routine, periodic channels.

ICH E6(R2) Section 4.5

Important Deviation

Significant actual or potential effect on subject safety, subject rights, or the reliability of trial results. Requires expedited sponsor and IRB reporting.

ICH E6(R2) Section 4.5

Serious Breach

EU CTR-specific category requiring notification to the competent authority within 7 days of sponsor awareness.

EU CTR 536/2014 Art. 52

Common Root Cause Categories (Overview)

Visit window non-compliance Subject visit conducted outside the protocol-specified window, often driven by subject availability or site scheduling constraints.

Eligibility criteria misapplication Subject enrolled despite not fully meeting inclusion or exclusion criteria, typically traced to an incomplete eligibility review.

Procedural or dosing error Study procedure performed incorrectly or investigational product dosed outside the protocol-specified regimen.

Informed consent process gaps Consent obtained using an outdated version of the form, or without all protocol-required elements documented.

Reporting Timelines (Overview)

Important deviation to sponsor Reported within the timeline specified by the protocol or monitoring plan, typically within a small number of business days.

Important deviation to IRB / EC Reported per the overseeing body's own reporting requirements, which may differ from the sponsor timeline.

Serious breach to competent authority Notified within 7 days of the sponsor becoming aware, per EU CTR 536/2014, distinct from routine deviation reporting.

Non-important deviations Summarized in periodic reports rather than reported individually and immediately.

Protocol Deviation Quality Elements

Deviation Log Maintenance Site-level log capturing every deviation with dates of occurrence and discovery, description, and classification.

Investigator Review and Sign-Off Every deviation reviewed and acknowledged by the investigator, consistent with their responsibility for site conduct.

Classification Consistency Important versus non-important classification applied consistently across sites using the same defined criteria.

Root Cause Documentation Underlying cause investigated and documented for every important deviation, not just the deviation's description.

Sponsor Notification Timeliness Important deviations and serious breaches reported within the applicable regulatory or protocol-defined timeline.

IRB / EC Reporting Deviations reported to the overseeing ethics body per its own specific requirements and timeline.

CAPA Implementation Corrective action addressing the immediate deviation and preventive action addressing its underlying cause, both documented.

Deviation Trending Deviation data reviewed across sites and time to detect systemic issues in site performance or protocol design.

Never do this

Classify a deviation without a documented impact assessment. Treat a serious breach as a routine deviation and miss the 7-day competent authority notification. Close a deviation without addressing its root cause. Allow the same deviation type to recur at a site without escalation.

Deviation vs violation

A protocol deviation is typically unintentional and does not necessarily indicate a systemic problem. A protocol violation reflects a willful or repeated departure from the protocol, often carrying more serious consequences for the site's continued participation.

Prospective waiver vs deviation

A prospective waiver is a planned, pre-approved departure from a specific protocol requirement, requested and approved before it occurs. An unplanned deviation is identified only after it has already happened and follows the standard deviation reporting pathway.

Key regulations

ICH E6(R2) Section 4.5 - investigator compliance with the protocol and deviation handling. EU CTR 536/2014 Art. 52 - serious breach definition and notification. 21 CFR 312.66 - investigator's obligation to conduct the trial per the protocol.