Clinical Trial Protocol Deviations: A New FDA Draft Guidance to Ring in the New Year

Alert
January 6, 2025
11 minutes

As the curtain closed on 2024, FDA issued a new draft guidance to assist clinical trial sponsors, investigators, and institutional review boards (“IRBs”) with defining, identifying, and reporting protocol deviations in clinical investigations (“Draft Guidance”). The Draft Guidance defines “protocol deviations” and “important protocol deviations” and provides recommendations regarding:

  • how sponsors should describe protocol deviations in clinical study reports submitted to FDA for drugs and devices;
  • the types of deviations that investigators should report to sponsors and IRBs; and
  • how IRBs should evaluate protocol deviations as they fulfill their obligations to monitor clinical investigations.

The Draft Guidance consolidates both relevant regulatory requirements and recommendations from previously issued guidance documents related to protocol deviations in one place for the first time, highlighting a number of International Council for Harmonisation (“ICH”) guidance documents that may be less familiar to some with responsibilities related to clinical research. The Draft Guidance also clarifies certain ambiguities and inconsistencies regarding the evaluation and reporting of protocol deviations from prior guidance, though some inconsistencies remain. While failure to comply with the non-binding recommendations in the Draft Guidance could potentially heighten concerns about data quality and impact FDA’s medical product review decisions, the agency lacks the authority to take enforcement action for such noncompliance. Further, whether the agency will prioritize these recommendations in a new administration remains to be seen.

Rationale for Draft Guidance

In the Federal Register notice announcing the availability of the Draft Guidance, FDA explains that current FDA regulations lack a definition of the term “protocol deviation” and do not “provide a system for classifying the various types of deviations that may occur during the conduct of a clinical investigation.”1 FDA further explains that “a system that applies consistent classification, reporting, and documentation standards is important to assure the most interpretable and useful information emerges from the reporting of protocol deviations.”

While FDA regulations do not require the reporting of all protocol deviations as defined in the Draft Guidance, investigators are required to maintain records of all protocol deviations in device investigations.2 In addition, the circumstances around protocol deviations and their impact must also be evaluated to determine whether they may in fact trigger mandatory regulatory reporting requirements, such as requirements to report unanticipated problems involving risks to human subjects or others or serious adverse events and whether they meet the definition of “important protocol deviations” that should be summarized in clinical study reports. The Draft Guidance details information that may be helpful in making these determinations.

Defining and Classifying Protocol Deviations

The Draft Guidance defines “protocol deviation” as “any change, divergence, or departure from the study design or procedures defined in the protocol.” In contrast, an “important protocol deviation” is defined as a subset of protocol deviations that might significantly affect the completeness, accuracy, and/or reliability of the study data or that might significantly affect a subject’s rights, safety, or well-being.” FDA acknowledges that terms such as “major, critical and significant” have previously been used to classify protocol deviations that would meet the definition of an “important protocol deviation” but recommends future use of the descriptor “important” in place of the other terms.

The definitions in the Draft Guidance are adopted from a January 2013 ICH guidance titled E3 Structure and Content of Clinical Study Reports: Questions and Answers (R1) (“E3(R1) Q&A Guidance”) issued to clarify recommendations regarding the structure and content of a harmonized clinical study report, and how protocol deviations should be reported therein. An earlier 1996 guidance, E3 Structure and Content of Clinical Study Reports, had recommended that such clinical study reports include a description of “all important deviations related to study inclusion or exclusion criteria, conduct of the trial, patient management[] or patient assessment” without addressing the kinds of deviations that would be considered “important.” Thus, the E3(R1) Q&A Guidance filled this gap.

The Draft Guidance highlights that FDA does not consider all potential violations of good clinical practice guidelines or requirements (“GCPs”) to be protocol deviations even where the study protocol references GCP compliance. This is because clinical trial protocols are often not detailed enough to require the specific actions that would ensure GCP compliance. For example, the Draft Guidance notes that a missing signature on a clinical study site delegation log might constitute a GCP violation but would not be a protocol deviation unless the protocol explicitly required completed signatures on clinical study site delegation logs. FDA recommends that GCP compliance issues that are not protocol deviations be managed outside the protocol deviation process.

The Draft Guidance also suggests that deviations be classified as “important” when they “could affect “critical-to-quality factors” for the clinical trial. This focus on “critical-to-quality” factors reflects a relatively new “quality by design” approach to clinical research, reflected in the ICH Guidance E8(R1) General Considerations for Clinical Studies (“ICH E8(R1)” Guidance), finalized in April 2022. “Critical-to-quality” factors are defined in the ICH E8(R1) Guidance as “attributes of a study whose integrity is fundamental to the protection of study participants, the reliability and interpretability of the study results, and the decisions made based on the study results.” The ICH E8(R1) Guidance further explains that “these quality factors are considered to be critical because, if their integrity were to be undermined by errors of design or conduct, the reliability or ethics of decision-making based on the results of the study would also be undermined.”

Examples of Protocol Deviations Considered “Important”

The Draft Guidance recommends that protocols “pre-specify which type of protocol deviations will be considered important.” It also includes a non-exhaustive list of protocol deviations that FDA generally considers to be important due to (1) their impact on the protection of trial participants and safety assessment and (2) their potential to reduce the reliability of conclusions regarding effectiveness. 
The Draft Guidance identifies the following protocol deviations as “important” due to their impact on human subject protection and the assessment of safety:

  • Failing to conduct study procedures designed to assess safety or adequately monitor participants, such as failing to collect important lab assessments for safety monitoring; or failing to administer the investigational product in accordance with protocol requirements;
  • Administering treatments prohibited by the protocol due to their potential to increase risks to study participants (e.g., drug-drug interactions) or to impact interpretation of a device’s safety and efficacy;
  • Failing to obtain informed consent or comply with other human subject protection requirements in 21 CFR Part 50;
  • Failing to protect a subject’s identifiable, private, protected health information;
  • Failing to withdraw investigational product administration from trial participants who meet withdrawal criteria;
  • Administering a trial participant the wrong treatment or an incorrect dose, or implanting an incorrect device in a trial participant;
  • Failing to adhere to the randomization scheme specified in the protocol.

The deviations listed below are identified as “important” because they could reduce the reliability of conclusions about effectiveness: 

  • Enrolling a subject in the trial in violation of key eligibility criteria designed to ensure the inclusion of a specific patient population;
  • Failing to collect data to evaluate important study endpoints;
  • Unblinding a trial participant’s treatment allocation prematurely, for reasons other than those specified in the study protocol. 

Sponsor and Investigator Responsibilities Regarding Protocol Deviations

The Draft Guidance reviews the regulatory requirements of investigators and sponsors with respect to clinical trials generally and regarding protocol deviations specifically. FDA’s key recommendations include:

  • Sponsors should train investigators on identifying “important” protocol deviations.
  • For drug investigations, investigators should report to the sponsor “all protocol deviations of which they are aware, using reporting procedures that highlight important protocol deviations.”3
  • Sponsors should inform investigators of the time frame and manner in which they expect to receive information about protocol deviations. For example, sponsors might require that investigators report important protocol deviations to the sponsor within a specific number of days, but allow the reporting of all other protocol deviations at a site monitoring visit. 
  • Sponsors may wish to update the recommended list of protocol deviations pre-specified as “important,” under a specific protocol, as data is accumulated and reviewed. 
  • When making required reports related to adverse reactions or adverse events, sponsors should note when protocol deviations contributed to the occurrence of the reported event. 
  • Sponsors should document and evaluate protocol deviations not classified as “important” to determine if reclassification is warranted.
  • Sponsors or investigators should conduct root-cause analyses of any recurrent protocol deviations that are similar in nature and prevent recurrence of similar deviations. 
  • Sponsors should consider closing a trial site if, despite remediation efforts, a site is unable to maintain GCP standards, comply with the protocol, or implement measures to identify and/or address recurring “important” protocol deviations

Role of the IRB in Evaluating Protocol Deviations

The Draft Guidance recommends that investigators report to the IRB protocol deviations that are identified as “important,” when they are identified, in accordance with written IRB procedures. In addition, IRBs are encouraged to review “important” protocol deviations that are submitted “as soon as possible to determine any impact on participant safety or study conduct.” The Draft Guidance acknowledges that protocol deviations not classified as “important” and that do not present an apparent immediate hazard to participants need not be “immediately” reported to the IRB. The implication of this recommendation, however, is that protocol deviations not considered “important” or posing a significant hazard nevertheless should be reported to IRBs at some point. 

This recommendation may cause IRBs to revisit their policies, as IRBs are currently only required under 21 C.F.R. § 56.108 to have procedures in place to ensure (i) “the prompt reporting” of “unanticipated problems involving risks to human subjects or others”4 and (ii) “any instance of serious or continuing noncompliance” with the regulations in 21 C.F.R. Part 56 or “the requirements or determinations of the IRB.” This recommendation also may conflict with the position taken by some IRBs that minor protocol deviations not affecting subject safety need not be reported to the IRB. Further, investigator reports of all deviations to IRBs could result in a flood of information about unimportant protocol deviations with no impact on data quality or clinical trial subject safety. Reviewing these unimportant protocol deviations could prove to be a significant burden on IRBs for an uncertain purpose, and IRBs will have to consider whether to amend existing procedures to ensure the reporting of all protocol deviations within a select time frame, such as at continuing review.5 The research community may wish to seek more clarity on the rationale for FDA’s apparent view that all protocol deviations should be reported to IRBs, or formally lodge any concerns during the comment process. 

Remaining Inconsistencies Regarding Approaches to Protocol Deviations

More than a decade ago, shortly before FDA’s adoption of the E3(R1) Q&A Guidance, the U.S. Department of Health and Human Services Secretary’s Advisory Committee on Human Research Protections (“SACHRP”) noted inconsistencies in how the clinical research community defined “protocol deviations” and how to address them. In particular, SACHRP highlighted the need for consistency in categorizing protocol deviations and the requirements applicable to each.6

At that time, SACHRP also pointed to inconsistencies between HHS and FDA regulations in addressing protocol deviations, among the various FDA regulations and guidance documents that discussed such deviations and between FDA’s approach to protocol deviations and that of its sister agency, the Department of Health and Human Services’s Office for Human Research Protections (“OHRP”). While the Draft Guidance clarifies the definition of a protocol deviation and what makes a protocol deviation “important,” it does not fully reconcile the lack of alignment related to protocol deviations that still exists between different FDA regulations, FDA regulations and guidance, and the distinct approaches to protocol deviations taken by OHRP versus FDA. 

For example, SACHRP pointed to differences in how FDA and OHRP address intentional protocol deviations, including stating that OHRP’s position, though unwritten, was that all intentional protocol deviations require pre-approval from the IRB while FDA regulations set out exceptions to the need for pre-approval from the IRB in certain contexts.7 SACHRP noted that the drug regulations do not reference “deviations” from a protocol at all, instead referring to the reporting and or notification of “changes in research activity” or “changes to a protocol.”8

The Draft Guidance clarifies the definition of a “protocol deviation” and what makes a protocol deviation “important.” It also recognizes that a protocol deviation can be intentional or unintentional, and may be discovered after it has occurred, thus addressing some of the concerns identified by SACHRP. However, regulatory inconsistencies remain that may make assessments about the reporting and the need for pre-approval of certain protocol deviations confusing, and that may require different IRB policies for federally funded research. This could be a particular challenge for research that is subject concurrently to the jurisdiction of FDA and OHRP, such as federally supported studies of FDA-regulated products. Addressing the differences in approach to protocol deviations taken by OHRP and FDA, as identified by SACHRP, in a joint guidance issued by both agencies would be an additional benefit to the research community. 

Conclusion

The Draft Guidance’s compilation of recommendations related to protocol deviations made in several previously issued ICH guidance documents that have been adopted by FDA makes it a useful resource. Notably, the recommendations regarding the reporting of “important” protocol deviations are guidance only and may never be promulgated in regulation. Further, FDA’s implicit recommendation that all protocol deviations be reported to IRBs regardless of whether they are classified as “important” may prove to be both burdensome and unnecessary. Whether the Draft Guidance will remain on the books or be finalized by FDA with the coming administration change remains to be seen.

Comments on the Draft Guidance are due by February 28, 2025. Ropes & Gray will continue to monitor developments in this area. If you have any questions regarding this Alert or would like assistance with the submission of comments on this new Draft Guidance, please reach out to any of the attorneys listed below or your usual Ropes & Gray advisor.

  1. See 89 Fed. Reg. 106510 (December 30, 2024).
  2. Pursuant to 21 C.F.R. § 812.140(a)(4), the records that investigators in device investigations are required to keep include “[t]he protocol, with documents showing the dates of and reasons for each deviation from the protocol.”
  3. The Draft Guidance recognizes the Part 812 requirements that investigators in device investigations maintain records of all protocol deviations and notify the sponsor and IRB of any deviation intended to “protect the life or physical well-being of a subject in an emergency” as soon as possible or within five working days. The Draft Guidance does not recommend that investigators in device trials report all protocol deviations to sponsors.
  4. In FDA guidance, the agency notes that “unanticipated problems may be adverse events or other types of problems, i.e., adverse events are subset of unanticipated problems.” See Guidance for Clinical Investigators, Sponsors, and IRBs Adverse Event Reporting to IRBs-Improving Human Subject Protections (“AE Reporting Guidance”) (Jan. 2009).
  5. The recommendation also may conflict with prior guidance from FDA regarding which adverse events should be considered reportable “unanticipated problems.” That guidance seeks to limit the submission of information that is not useful and could hinder the ability of IRBs to ensure the protection of human subjects. See id. at p. 3.
  6. See SACHRP Recommendations, Attachment C: Recommendation on Protocol Deviations (March 30, 2012).
  7. See 21 C.F.R. § 312.66; 21 C.F.R. § 812.35.
  8. See 21 C.F.R.§§ 312.53 and 312.66.