Study guide
6.1 Protocol Compliance, Waivers vs. Violations & Deviation Management
ACRP Certified Professional ACRP-CP
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: GCP Principles, Roles & Delegation
1.1 The Eleven ICH E6(R3) Principles of GCP & Guideline Structure 1.2 Sponsor & Investigator Responsibilities and Delegation of Authority 1.3 Staff Training, Qualifications & Delegation of Authority Log (DOAL) 1.4 CRO Oversight, Vendor Management & Transfer of Regulatory Obligations (TORO)
2 Chapter 2: Essential Records, Source Documentation & Data Confidentiality
2.1 Essential Records Before, During and After the Trial (ICH E6(R3) Appendix C) 2.2 Trial Master File (TMF) and Investigator Site File (ISF) Structure & Inspection Readiness 2.3 Source Documentation, ALCOAC Principles & Medical Record Standards 2.4 Confidentiality, Privacy & Protection of Participant Personal Information
3 Chapter 3: Monitoring, Quality Management & Audits
3.1 Risk-Based Quality Management (RBQM) & Quality Management Systems (QMS) 3.2 Monitoring Visit Types: Site Selection, SIV, IMV, and Close-Out 3.3 Risk-Based Monitoring (RBM), Centralized Monitoring & Source Data Verification (SDV vs SDR) 3.4 Quality Audits, Regulatory Inspections, Non-Compliance & Root Cause Analysis / CAPA
4 Chapter 4: Site Feasibility, Start-Up, Facilities & Laboratory Operations
4.1 Site Feasibility Assessment, Capability Analysis & Investigator Selection 4.2 Contractual Agreements: Clinical Trial Agreements, Budgets, Indemnification & Financial Arrangements 4.3 Site Initiation Preparation, System Access & Regulatory Greenlight 4.4 Protocol Review, Operational Feasibility & Institutional Approvals 4.5 Site Facilities, Equipment Maintenance, Calibration & Trial Supplies 4.6 Biological Samples & Hazardous Goods: Collection, Storage, Disposal & Shipment
5 Chapter 5: Subject Recruitment, Retention & Study Visits
5.1 Subject Recruitment Strategies, Advertising Guidelines & Ethical Constraints 5.2 Screening, Eligibility Verification & Inclusion/Exclusion Adherence 5.3 Subject Retention, Compliance, Visit Scheduling & Protocol Window Management 5.4 Managing Lost to Follow-Up, Subject Withdrawal & Early Termination Procedures
6 Chapter 6: Protocol Compliance, Deviations & Site Close-Out
6.1 Protocol Compliance, Waivers vs. Violations & Deviation Management 6.2 Investigational Site Close-Out Activities & Final Reconciliations 6.3 Record Retention, Archiving Requirements & Post-Trial Responsibilities
7 Chapter 7: Research Ethics, Vulnerable Populations & Research Integrity
7.1 Historical Milestones: Nuremberg Code, Belmont Report & Declaration of Helsinki 7.2 Ethical Principles: Beneficence, Non-Maleficence, Autonomy, Justice & Equipoise 7.3 Vulnerable Populations (Pediatrics, Pregnant Women, Prisoners, Cognitively Impaired, Economically Disadvantaged) 7.4 Conflict of Interest, Research Misconduct & Fraud in Clinical Research
8 Chapter 8: Informed Consent & Institutional Review Boards (IRB/IEC)
8.1 Informed Consent Elements, Process & Ongoing Consent / Re-Consent Requirements 8.2 Assent in Minors & Legally Acceptable Representative (LAR) Requirements 8.3 IRB/IEC Composition, Functions, Review Types (Full, Expedited, Exempt) & Continuing Review
9 Chapter 9: Safety Reporting & Adverse Event Management (ICH E2A)
9.1 Adverse Events (AE) vs. Adverse Drug Reactions (ADR) & Serious Adverse Events (SAE) Definitions 9.2 Causality Assessment, Expectedness, Reference Safety Information (RSI) & SUSARs 9.3 Expedited Reporting Timelines (7-day fatal/life-threatening, 15-day other serious) & Periodic Safety Updates (DSUR)
10 Chapter 10: Investigational Product (IP) Management & Accountability
10.1 Investigational Product Lifecycle, Labeling, Packaging & Blinding Procedures 10.2 IP Shipping, Receipt, Temperature Monitoring, Excursion Handling & Chain of Custody 10.3 IP Storage, Dispensing, Accountability Logs & Destruction/Return Procedures 10.4 Emergency Unblinding (Code Breaking) Protocols & Subject Safety Procedures
11 Chapter 11: Regulatory Frameworks, Submissions & Product Reference Information
11.1 Stakeholders, Regulatory Institutions & Global Frameworks in Clinical Research 11.2 Protocol Submission, Approval & Amendment Processes 11.3 Investigator's Brochure, Instructions for Use & Reference Product Information 11.4 Regulatory Reporting Requirements Before and After Marketing Authorisation
12 Chapter 12: Clinical Data Management, EDC & Electronic Records
12.1 Electronic Data Capture (EDC), eCRF Design & Clinical Data Management Systems (CDMS) 12.2 Computerised Systems, Data Governance & Audit Trails (ICH E6(R3) Annex 1 §4) 12.3 Data Validation, Edit Checks, Discrepancy / Query Management & Resolution 12.4 Medical Coding (MedDRA, WHO Drug), SAE Reconciliation, Data Transfer & Database Lock
13 Chapter 13: Trial Design, Biostatistics, Data Monitoring & Transparency
13.1 Phases of Clinical Research (Phase 0, I, II, III, IV) & Translational Medicine 13.2 Study Designs: Parallel, Crossover, Factorial, Adaptive & Non-Inferiority / Equivalence 13.3 Randomization Schemes, Stratification, Blinding Methods & Minimizing Bias 13.4 Endpoints (Primary, Secondary, Surrogate, Composite), Sample Size & Biostatistical Concepts (p-values, CI, ITT vs PP) 13.5 Interim Analyses, DSMB/IDMC Oversight & Efficacy and Safety Evaluation Milestones 13.6 Trial Registration, Results Transparency & Communicating Results to Participants
6.1 Protocol Compliance, Waivers vs. Violations & Deviation Management
Key Takeaways Explain This Topic AI
Under ICH E6(R3) Annex 1 section 2.5, the Principal Investigator must conduct the trial in strict compliance with the protocol agreed to by the sponsor and approved by the IRB/IEC.
Prospective sponsor 'protocol waivers' or protocol exemptions are strictly prohibited by FDA and international regulatory authorities; enrolling non-eligible subjects constitutes a major protocol violation regardless of sponsor agreement.
Under ICH E6(R3) Annex 1 2.5.4–2.5.5 and 21 CFR 312.66, an emergency protocol deviation may be implemented immediately without prior IRB/sponsor approval ONLY to eliminate an immediate hazard to trial subjects.
Major protocol violations directly compromise participant safety, rights, or the integrity of core study data, whereas minor deviations do not substantively impact safety or trial endpoints.
Systemic or repetitive protocol deviations mandate Root Cause Analysis (RCA) and a structured Corrective and Preventive Action (CAPA) plan rather than repeated, isolated Note-to-File documentation.
Last updated: August 2026
Protocol Compliance, Waivers vs. Violations & Deviation Management
Exam scope note: This section cites national regulations (for example US Code of Federal Regulations provisions) because they shape day-to-day practice. ACRP states the ACRP-CP exam is referenced only to ICH Guidelines and that no country-specific framework is tested. Treat those citations as professional context; the provision examined here is ICH E6(R3) Annex 1 sections 2.5 (Compliance with Protocol) and 1.4.7 , plus 3.12 (Noncompliance) .
Quick Reference: Under ICH E6(R3) Annex 1 section 2.5.2 , the Principal Investigator (PI) must conduct the trial in strict compliance with the protocol approved by the Institutional Review Board (IRB) / Independent Ethics Committee (IEC) and agreed to by the sponsor and regulatory authority. Any departure from the protocol constitutes non-compliance. While prospective sponsor "protocol waivers" are strictly prohibited, emergency protocol deviations implemented to eliminate an immediate hazard to human subjects (ICH E6(R3) Annex 1 2.5.4–2.5.5) must be executed immediately, followed by prompt documented reporting to the IRB/IEC and sponsor.
Protocol compliance is the bedrock of clinical research integrity. On the ACRP-CP (ACRP Certified Professional) exam, questions evaluating protocol compliance test your ability to differentiate between minor procedural variations and major safety violations, execute emergency life-safety deviations, eliminate improper sponsor waiver requests, and institute systemic corrective and preventive action (CAPA) plans.
1. Regulatory Foundations of Protocol Compliance
When a Principal Investigator signs Form FDA 1572 (for IND studies) or the Investigator Agreement (for IDE device trials), they enter into a legally binding commitment to personally conduct or supervise the study in accordance with the relevant protocol.
Core Regulatory Mandates:
ICH E6(R3) Annex 1 section 2.5.2: The investigator/institution should conduct the trial in compliance with the protocol that received prior approval/favorable opinion from the IRB/IEC and agreed to by the sponsor and regulatory authority.
ICH E6(R3) Annex 1 section 1.4.7: The investigator should not implement any deviation from, or changes of, the protocol without agreement by the sponsor and prior review and documented approval/favorable opinion from the IRB/IEC of an amendment, except where necessary to eliminate an immediate hazard to trial subjects, or when the change(s) involves only logistical or administrative aspects of the trial (e.g., change of monitor, telephone number).
21 CFR 312.60 & 312.66: The investigator must ensure that an investigation is conducted according to the investigational plan and assure that no changes are made in the research without IRB approval, except where necessary to eliminate apparent immediate hazards to human subjects.
2. Defining Non-Compliance: Minor Deviations vs. Major Violations
Regulatory agencies and industry standards categorize departures from the protocol based on their potential impact on subject safety, rights, and welfare and the scientific validity/integrity of the clinical data .
Classification Definition Impact on Subject / Data Typical Examples Required Actions
Minor Protocol Deviation A departure from protocol procedures that does not significantly affect the subject's safety, rights, or clinical welfare, and does not compromise the completeness or reliability of the study's primary/secondary endpoints. Low / Negligible • Routine follow-up visit conducted 1 day outside the ±2-day visit window.; • Routine non-safety blood sample drawn in a green-top tube instead of gold-top if sample remains analyzable.; • Quality-of-Life questionnaire administered after clinical exam rather than before. Document on site Protocol Deviation Log; report to sponsor monitor (CRA); include in annual IRB continuing review or periodic summary per IRB policy.
Major Protocol Violation A significant divergence from protocol requirements that compromises the rights, safety, or well-being of trial participants, OR significantly damages the scientific integrity and interpretability of study endpoints. High / Substantial • Enrolling a participant who fails inclusion/exclusion criteria (e.g., eGFR 24 mL/min when protocol requires ≥30 mL/min).; • Administering incorrect investigational product (IP) dose or expired drug.; • Failure to perform protocol-mandated safety holding rules or stopping criteria (e.g., repeating QTc ECG after marked prolongation).; • Failure to obtain re-consent on an updated IRB-approved ICF prior to next study intervention. Immediate clinical assessment; notify Sponsor Medical Monitor within 24 hours; submit prompt report to IRB/IEC per institutional safety reporting timelines; initiate Root Cause Analysis and CAPA.
Serious / Continuing Non-Compliance A systemic pattern of non-compliance, repeated willful disregard of GCP/regulations, or intentional falsification that compromises participant safety or institutional trial credibility. Critical / Extreme • Repeatedly administering study drug without required safety lab reviews across multiple subjects.; • Backdating signatures or fabricating source records.; • Failure to report multiple Serious Adverse Events (SAEs). Sponsor site suspension or termination; IRB suspension/revocation of approval; formal FDA BIMO inspection trigger; report to regulatory authorities (FDA/OHRP).
3. The Strict Elimination of Sponsor "Protocol Waivers"
Historically, sponsors occasionally issued "protocol waivers" or "eligibility exemptions" permitting sites to enroll borderline patients (e.g., enrolling a subject whose blood pressure or platelet count slightly missed protocol cutoffs) or skip specific study procedures.
The Modern Regulatory Consensus: No Waivers Allowed
Both the FDA (CDER/CBER) and international bodies operating under ICH GCP have unequivocally declared that prospective protocol waivers are unacceptable :
Protocols are Legal and Ethical Boundaries: The IRB/IEC approved a specific, bounded study population based on a risk-benefit assessment. A sponsor medical monitor has no legal or ethical authority to unilaterally alter IRB-approved entry criteria for an individual patient.
Scientific Bias & Confounding: Granting ad-hoc waivers introduces selection bias, creates heterogeneous cohorts, and threatens the statistical validity and generalizability of trial results.
Inspection Finding Severity: If an FDA Bioresearch Monitoring (BIMO) inspector or EMA auditor discovers a subject enrolled with an inclusion/exclusion failure, citing an "email approval from the sponsor Medical Monitor" does not protect the site. The FDA will cite the Principal Investigator on Form FDA 483 for failure to follow the investigational plan under 21 CFR 312.60.
Exam Key Point: If a subject does not meet 100% of the protocol inclusion criteria and zero exclusion criteria, the subject cannot be enrolled . The only compliant mechanism to adjust criteria is for the sponsor to submit a formal Protocol Amendment to the IRB/IEC and regulatory agencies for documented review and approval prior to enrolling such participants.
4. Emergency Protocol Deviations to Eliminate Immediate Hazards
The single explicit regulatory exception to obtaining prior IRB approval and sponsor agreement before altering protocol-specified procedures is the Emergency Safety Exception .
Regulatory Authority: ICH E6(R3) Annex 1 sections 2.5.4–2.5.5 & 21 CFR 312.66
"The investigator may implement a deviation from, or a change of, the protocol to eliminate an immediate hazard(s) to trial subjects without prior IRB/IEC approval/favorable opinion."
Operational Sequence During an Acute Emergency:
Immediate Medical Intervention (Participant Safety First): The investigator must take all immediate clinical steps necessary to protect the life, health, and well-being of the subject (e.g., immediately halting an investigational infusion, administering emergency rescue medications, performing unblinding to guide resuscitation, or performing emergency surgical intervention).
Immediate Source Documentation: Document the exact clinical rationale, the specific deviation implemented, the subject's acute medical status, and the immediate clinical outcomes in the subject's medical record.
Prompt Sponsor Notification: Notify the sponsor medical monitor promptly (typically within 24 hours of stabilization).
Prompt IRB/IEC Submission: Submit a detailed written report of the emergency deviation, clinical rationale, and outcome to the IRB/IEC as soon as possible, in accordance with the IRB's established timeline for prompt reporting (typically within 5 to 10 business days).
Protocol Deviation Log Entry: Log the emergency deviation with full attribution and tracking. ┌───────────────────────────────────────────────────────────────────────────┐
- │ EMERGENCY DEVIATION WORKFLOW (ICH E6(R3) Annex 1 2.5.4–2.5.5) │
- ├───────────────────────────────────────────────────────────────────────────┤
- │ STEP 1: ACUTE MEDICAL ACTION │
- │ • Act immediately to eliminate hazard (Stop IP, unblind, treat subject) │
- │ • DO NOT delay medical care to request sponsor or IRB pre-approval │
- ├───────────────────────────────────────────────────────────────────────────┤
- │ STEP 2: CLINICAL & SOURCE DOCUMENTATION │
- │ • Record precise clinical status, vital signs, rationale & intervention │
- ├───────────────────────────────────────────────────────────────────────────┤
- │ STEP 3: CONCURRENT STAKEHOLDER NOTIFICATIONS │
- │ • Notify Sponsor / Medical Monitor within 24 hours │
- │ • Submit detailed prompt report to IRB/IEC (per IRB reporting policies) │
- ├───────────────────────────────────────────────────────────────────────────┤
- │ STEP 4: LOGGING & SAFETY SURVEILLANCE │
- │ • Record on Site Protocol Deviation Log; follow subject to resolution │
- └───────────────────────────────────────────────────────────────────────────┘
- 5. Deviation Logs, Trending & Root Cause Analysis (CAPA)
Every clinical trial site must maintain a contemporaneous, comprehensive Protocol Deviation Log (PDL) . Maintaining deviation logs allows sites and sponsor monitors (CRAs) to detect systemic vulnerabilities before they jeopardize the entire trial.
Core Fields in a Protocol Deviation Log:
- Subject Identifier (e.g., Subject 102-004)
- Date of Occurrence & Date of Identification
- Protocol Version in effect at time of occurrence
- Detailed Description of the deviation
Deviation Category / Code (e.g., Eligibility, Consent, IP Administration, Safety Assessment, Visit Window, Laboratory Protocol)
- Classification (Minor Deviation vs. Major Violation)
- Impact Assessment (Effect on subject safety, rights, and data reliability)
- Immediate Corrective Action (What was done to fix the immediate issue)
- Preventive Action (Systemic measure implemented to prevent recurrence)
- PI Review & Signature
- Moving Beyond "Note to File" (NTF) Wallpapering
A dangerous site habit is generating a standalone "Note to File" for every error without addressing the underlying procedural breakdown. Regulatory inspectors heavily criticize sites that accumulate dozens of repetitive NTFs for identical errors.
Root Cause Analysis (RCA) & CAPA Methodology
When deviations recur or when a major protocol violation occurs, the site and sponsor must apply formal Root Cause Analysis (RCA) —such as the 5 Whys or Ishikawa (Fishbone) Diagram —to identify whether the breakdown was caused by:
- Inadequate staff training or ambiguous Delegation of Authority
- Flawed source document templates or misleading worksheets
- Protocol complexity or unworkable visit scheduling windows
- Equipment calibration or pharmacy labeling ambiguities
Once the true root cause is isolated, a formal Corrective and Preventive Action (CAPA) plan is executed, establishing measurable preventive steps, responsible individuals, and a re-evaluation date to verify effectiveness.
6. Realistic Clinical Scenario & Exam Decision Path
Scenario: At a clinical research site conducting a Phase III oncology trial for non-small cell lung cancer, the protocol inclusion criteria specify that participants must have an Absolute Neutrophil Count (ANC) ≥ 1,500/µL at the Baseline visit prior to Cycle 1 Day 1 dosing.
Candidate Subject 308's baseline laboratory report returns with an ANC of 1,440/µL. The Clinical Research Coordinator (CRC) contacts the Sponsor Medical Monitor, explaining that the patient is clinically stable and eager to participate. The Medical Monitor replies via email: "Approved to enroll Subject 308 as an exception; the ANC difference of 60/µL is clinically insignificant."
ACRP-CP Critical Analysis & Decision:
Regulatory Violation: Enrolling Subject 308 based on the Medical Monitor's email is a major protocol violation and violates ICH E6(R3) Annex 1 2.5.2 and 21 CFR 312.60. The sponsor cannot waive IRB-approved protocol entry criteria.
Proper Site Action: The PI and CRC must not randomize or dose the subject.
Compliant Options:
Re-test the participant's ANC if the protocol screening window allows repeat laboratory assessments.
If the ANC remains below 1,500/µL and cannot be re-screened, the subject must be recorded as a Screen Failure .
If the sponsor believes an ANC of 1,400/µL is scientifically safe, the sponsor must submit a formal Protocol Amendment to the FDA and IRB to lower the threshold across all study sites.