IRB reporting requirements for investigators come in five distinct flavors, each with its own trigger and deadline. At minimum, federal regulations require continuing review at least once every 12 months.1eCFR. 45 CFR 46.109 – IRB Review of Research On top of that annual review, you have to report protocol changes before making them, unanticipated problems promptly after learning of them, serious or continuing noncompliance, and study closure. Miss any of these and you risk a study shutdown, unusable data, loss of grant funding, or FDA disqualification.
The Annual Continuing Review Deadline
Under both the HHS Common Rule and FDA regulations, the IRB must review every active study at least once per year.1eCFR. 45 CFR 46.109 – IRB Review of Research Higher-risk studies, including Phase I first-in-human trials, may be reviewed more often at the IRB’s discretion, but the interval between approvals cannot exceed 12 months.2eCFR. 21 CFR 56.109 – IRB Review of Research
Your approval letter carries an expiration date. Submit your continuing review materials well before that date. Most institutions recommend at least six weeks in advance because there is no federal grace period. If the IRB has not re-approved by midnight on the expiration date, all research activities must stop. No new enrollment. No continued interventions with existing participants, unless stopping would put them at greater risk.3U.S. Department of Health and Human Services. Continuing Review Guidance (2010) The investigator may make that initial safety determination, but the IRB has to confirm it as soon as possible. Once re-approval is in hand, you can resume.
When Annual Continuing Review Is Not Required
The 2018 revised Common Rule removed the annual continuing review requirement for certain categories unless the IRB specifically decides otherwise.1eCFR. 45 CFR 46.109 – IRB Review of Research Continuing review is not required for research eligible for expedited review under 45 CFR 46.110, for studies reviewed under the limited IRB review procedures for certain exempt categories, or for research that has progressed past all interventions and interactions and now involves only data analysis or accessing follow-up clinical data from routine care.4eCFR. 45 CFR 46.110 – Expedited Review Procedures
Here is where FDA-regulated investigators need to be careful. The FDA has not adopted these exemptions. If your study involves an investigational drug, biologic, or device, annual continuing review still applies regardless of risk level.2eCFR. 21 CFR 56.109 – IRB Review of Research OHRP has also noted that some expedited-review categories involving ongoing subject interactions may still benefit from continuing review, and IRBs keep discretion to require it.5U.S. Department of Health and Human Services. 2018 Requirements FAQs
Even when annual review is waived, you still have to submit protocol modifications, report deviations, and file reportable events. The exemption only removes the scheduled check-in.
Protocol Changes Require Approval Before You Make Them
This is the reporting rule investigators get wrong most often. Changes to an approved protocol — a new recruitment method, a revised dosing schedule, an updated consent form, an added study site — need IRB approval before you implement them. Both the Common Rule and FDA regulations are explicit on this point.6eCFR. 21 CFR 56.108 – IRB Functions and Operations7eCFR. 21 CFR 312.66 – Assurance of IRB Review
The one exception is when a change is necessary to eliminate an apparent immediate hazard to a participant. In that situation, you act first to protect the participant, then report the change to the IRB as quickly as possible, typically within a few business days depending on your institution’s procedures. The controlling word is “immediate.” If there is time to ask the IRB first, you must ask first.
Minor changes — small wording edits, a new contact number — can often go through expedited review by the IRB chair or a designated reviewer rather than the full board.4eCFR. 45 CFR 46.110 – Expedited Review Procedures Expedited still means before implementation.
Unanticipated Problems and Adverse Events
Federal regulations require prompt reporting of any unanticipated problem involving risks to participants or others.8eCFR. 45 CFR 46.108 – IRB Functions and Operations OHRP treats an incident as an unanticipated problem only when all three of the following are true:
- It was unexpected in nature, severity, or frequency given the protocol documents and the study population.
- There is a reasonable possibility it was caused by the study procedures.
- It suggests participants or others face a higher level of harm than previously recognized.9U.S. Department of Health and Human Services. Reviewing Unanticipated Problems
All three criteria have to be met. A serious adverse event that was anticipated in the consent form and protocol, occurring at the expected rate, is generally not an unanticipated problem, even though it is serious. A non-serious event can qualify if it was completely unexpected and shifts the risk picture.
The federal rules say “prompt” without setting an hour count. In practice, IRBs set their own deadlines. Fatal or life-threatening events that are unexpected and related to the research typically must be reported within 24 hours of the investigator learning of them, with detailed written follow-up within a few days.10Human Research Protection Office | University of Pittsburgh. Reporting Responsibilities of the Investigator Other reportable events often have a window of 5 to 10 business days.11Human Research Protection Program. Reporting Requirements Check your IRB’s written policies before you need them, not after something goes wrong.
Protocol Deviations and Noncompliance
A protocol deviation is any departure from the IRB-approved plan, whether intentional or accidental. Dosing at the wrong time, skipping a required assessment, enrolling a participant who does not meet eligibility criteria. Federal regulations require prompt reporting of any instance of serious or continuing noncompliance.6eCFR. 21 CFR 56.108 – IRB Functions and Operations
Serious noncompliance generally means the violation increased risk to participants, reduced potential benefit, compromised data integrity, or harmed participant rights or welfare. Continuing noncompliance — a pattern of repeated deviations, even individually minor ones — also triggers expedited reporting.8eCFR. 45 CFR 46.108 – IRB Functions and Operations
Minor, isolated deviations that do not affect safety or data integrity — a missed visit rescheduled the next day, a consent form signed with the wrong date — typically go into the next continuing review or periodic deviation logs, depending on your IRB’s procedures. When in doubt, report sooner. An IRB will not fault you for over-reporting. It will fault you for sitting on something that turns out to be significant.
Study Completion or Early Termination
When your study ends, whether on schedule or by early termination for safety concerns, poor enrollment, loss of funding, or a sponsor decision, notify the IRB. The IRB needs to close its oversight file and, in the case of early termination, evaluate whether follow-up obligations remain for enrolled participants.
Federal regulations do not set a universal deadline for the final report. Most IRBs require notification within 30 to 60 days of the last research activity. Study completion means all participant interactions, interventions, data collection, and follow-up have ended. If you are still analyzing identifiable data, the study is not complete for IRB purposes and remains under the IRB’s oversight even without active participants.
What Happens If You Miss a Report
Consequences escalate quickly. At the study level, a lapse in continuing review approval means all research activities stop immediately with no grace period.3U.S. Department of Health and Human Services. Continuing Review Guidance (2010) Data collected during a lapse may be unusable. Participants enrolled during a lapse were enrolled without valid IRB approval, which creates regulatory and ethical problems that are difficult to fix later.
At the institutional level, missed reporting can trigger an OHRP or FDA investigation. The FDA can disqualify a clinical investigator who has repeatedly or deliberately failed to comply with regulatory requirements or submitted false information in required reports.12U.S. Food and Drug Administration. Clinical Investigators – Disqualification Proceedings A disqualified investigator cannot receive investigational drugs, biologics, or devices and cannot conduct any clinical investigation that supports an FDA application. That effectively ends a regulated research career.
Federally funded investigators face additional exposure. The NIH can suspend or terminate a grant when the recipient fails to comply with the terms and conditions of the award, and it can immediately terminate funding when necessary to protect the public from the effects of a serious deficiency.13National Institutes of Health. Remedies for Noncompliance or Enforcement Actions – Suspension, Termination, and Withholding of Support NIH generally suspends first and gives the investigator a chance to correct the problem, but it reserves the right to skip that step for serious violations.
What to Put in Each Report
Every submission starts with study identification: protocol number, study title, principal investigator, current approval dates. The rest depends on the report type.
A continuing review submission needs a summary of research progress since the last review, current enrollment against the approved target, a summary of adverse events or protocol deviations during the review period, and any new information — published literature, findings from other sites, sponsor safety data — that might change the risk-benefit balance. Financial conflict of interest disclosures, if your institution requires them, typically must be updated at least annually and within 30 days of any change to your financial interests.
An adverse event or unanticipated problem report describes the event, the date it occurred and the date you learned of it, the participant’s current status, your assessment of whether the event was related to the research, and any protocol or consent form changes you believe are needed as a result.
A deviation or noncompliance report describes what happened, why, how it affected or could have affected participant safety or data integrity, and what corrective steps you have taken to prevent recurrence. IRBs care less about the deviation itself than about whether you understand the cause and have a credible plan to prevent it happening again.