Protocol Compliance and the Deviations You Will See Most
Part of Clinical Research Associate (CRA) Training: Site Performance, Recruitment and Compliance.
About 6 minutes. Free, in your language, no account needed.
Why this matters
A protocol only works if every site follows it the same way. Compliance failures compromise participant safety, data integrity and sometimes the viability of the whole study.
This lesson gives you the deviations you will actually meet, why each happens, and what to do about them. Learn the causes; the causes are what you fix.
What protocol compliance means
Conducting all study activities according to the approved protocol and its amendments, ICH GCP and applicable regulation, and the sponsor's and site's procedures.
A protocol deviation is any departure from the approved protocol, regardless of intent or severity. Deviations may be operational, caused by site workflow, caused by the participant, or systemic.
The distinction that matters most: isolated events versus patterns. One out-of-window visit is an event. Four in three months is a process failure, and the second requires a different response.
The deviations you will see most
Eligibility deviations
What happens: a participant who does not meet inclusion criteria, or who meets an exclusion criterion, is enrolled.
Why: misread thresholds; missing or outdated baseline assessments; screening assessments outside the permitted window; an outdated eligibility checklist; unverified prior therapies or medical history.
What you do: re-verify eligibility for every new participant at the first monitoring visit after enrollment. Review screening logs and checklists. Retrain on the criteria that are actually being misread. Recommend two-person eligibility verification before randomization, which prevents more of these than any other single measure. Escalate repeats.
Visit window deviations
What happens: a visit occurs outside the protocol-defined window.
Why: scheduling pressure, staff shortages, participant availability, narrow windows, missing supplies.
What you do: review the site's scheduling process. Recommend a window check at the point of booking, calendar alerts, a weekly review of upcoming windows, and booking early within the window rather than late. Explain the effect of timing on endpoints, because sites that understand it comply better.
Missed or incorrect procedures
What happens: a required assessment is not done, or is done at the wrong visit.
Why: unfamiliarity with the schedule of assessments; workload; equipment or training unavailable; participant refusal; misunderstanding which assessments are visit-specific.
What you do: ensure the site uses visit worksheets derived from the schedule of assessments. Recommend a pre-visit check of the day's requirements. Verify equipment availability. Clarify what counts as an acceptable justification and how it must be documented.
Investigational product administration errors
What happens: wrong dose, timing or route; missed doses undocumented; wrong kit dispensed; product given before a required safety result.
Why: misread titration rules; errors in the randomization and supply system; workload; similar labeling; unrecognized temperature excursions.
What you do: recommend two-person verification before dispensing. Review labels, dosing instructions and logs with the site. Reinforce correct use of the supply system. Check segregation of expired and quarantined product. Ensure follow-up on every dosing deviation, because these carry safety implications.
Informed consent deviations
What happens: the wrong version used; consent signed after procedures began; missing signatures or dates; re-consent not completed.
Why: outdated versions still in circulation; staff unaware of a new version; urgent scheduling.
What you do: review the consent version history at every visit. Verify all superseded versions have been physically removed. Recommend a consent checklist before procedures, and cross-checking the version against the ethics approval letter. Repeated issues need a version-control corrective action.
Adverse event and serious adverse event reporting deviations
What happens: events in source but not in the data system; serious events reported late; missing follow-up information; inaccurate severity or causality.
Why: inconsistent investigator review; misunderstood definitions or timelines; staff turnover without safety training; reliance on participants to self-report.
What you do: reinforce definitions. Encourage routine investigator review of events and safety results. Cross-check source against the data system systematically. Confirm the site knows the reporting route, including out of hours and when the usual person is absent.
Concomitant medication deviations
What happens: prohibited medicines taken; washout not observed; medications missing from logs.
Why: care received elsewhere; staff unaware of the prohibited list; misclassification of over-the-counter products and supplements; the medical record never cross-checked.
What you do: review medication lists against the medical record at every visit. Suggest a simplified prohibited-medicine reference for coordinators. Encourage participant education about reporting new medicines. Ensure the investigator decides whether product continuation is affected.
Documentation deviations
What happens: missing source notes; late or back-dated entries; illegible handwriting; incomplete forms; missing signatures.
Why: no documentation procedure; workload; misunderstanding of the data integrity attributes; inconsistent templates.
What you do: reinforce the attributes E6(R3) actually requires — attributable, legible, contemporaneous, original, accurate, complete, secure and reliable — rather than attributing the acronym ALCOA to the guideline. Encourage standardized templates and contemporaneous documentation. Spot-check documentation practice.
Where non-compliance shows up first
Red flags visible in the data or on a visit:
- Copy-and-paste patterns in documentation, or values identical across visits.
- Chronically missing data.
- Frequently late visits.
- Low adverse event rates compared with other sites.
- Discrepancies in dosing or visit timing between systems.
- Deviations repeatedly explained as "busy clinic days".
- New staff unfamiliar with protocol requirements.
In practice
At a VT-301 site, Leah finds three eligibility deviations in four months, all on the same criterion: a laboratory value threshold.
Her first instinct is a training finding. She checks the criterion instead.
The protocol reads "estimated glomerular filtration rate greater than 45", while the site's eligibility checklist — produced by the site from an earlier draft — reads "45 or above". Three participants with a value of exactly 45 were enrolled who should not have been.
The site was following its checklist faithfully. The checklist was wrong.
Leah escalates it, the site's checklist is corrected against the current protocol, and the sponsor checks whether other sites built their own checklists the same way. Two had.
She does not write "staff require retraining on eligibility criteria". She writes what happened.
Three deviations from one cause is not three problems. It is one.
Key takeaways
- A protocol deviation is any departure from the approved protocol, and the key distinction is between isolated events and patterns, which require different responses.
- Two-person eligibility verification before randomization prevents more eligibility deviations than any other single measure.
- Consent version control is checked at every visit, including physically confirming that superseded versions have been removed from circulation.
- Investigational product and concomitant medication deviations carry safety implications and are rarely minor.
- Reinforce the data integrity attributes E6(R3) actually states rather than attributing the ALCOA acronym to the guideline.