IRBs and research institutions may be concerned that reporting incidents of noncompliance to the HHS Office for Human Research Protections (OHRP) could be a red flag to prompt an investigation, but the reverse is actually true.

IRBs that do good-faith reporting are less likely to be targeted for a “not-for-cause evaluation,” says Kristina Borror, PhD, director of the Division of Compliance Oversight at OHRP.

“Institutions are selected for not-for-cause evaluation based on a range of considerations, and if an institution has a history of a relatively low level of reporting to OHRP under the requirements of HHS regulations, they will be more likely to be selected,” she tells IRB Advisor. “Reporting incidents is important not only because the regulations require it, but also to foster a partnership with OHRP to assist in responding to and preventing incidents.”

Borror and colleagues recently published a review and analysis1 of 6,511 incident reports from institutions conducting research between January 1, 2008, and December 31, 2014. The incident type most frequently reported was “serious noncompliance,” which often involved changes to the research protocol without IRB approval and breakdowns of the informed consent process. Overall, there were 2,943 instances of serious noncompliance and 583 instances of continuing noncompliance.

“Protocol changes without IRB review and approval included study interventions not administered as required by [the] protocol, compensating subjects more than allowed in the protocol, and failure to follow inclusion or exclusion criteria,” the OHRP authors reported. “Noncompliance related to informed consent included failure to obtain informed consent prior to inclusion in research, failure of the informed consent document to include all the risks of the research, and failure of the subject to sign the consent form prior to participation in research.”

These findings may help IRBs avoid common compliance pitfalls going forward.

“The paper points out many of the types of reportable incidents as well as some specific examples,” Borror says. “Institutions also can glean examples of types of corrective actions to consider when addressing an incident, particularly noncompliance — the most common type of incident reported to OHRP.”

Similarly, OHRP will use the findings to focus on the identified problems and improve reporting and feedback between the agency and IRBs and investigators.

“OHRP will use this information to develop educational materials to help institutions prevent and respond to incidents,” Borror says.

The Department of Health and Human Services (HHS) regulations require that institutions have written procedures to ensure that incidents of noncompliance are promptly reported to OHRP. In general, according to Borror and colleagues, these incidents include the following:

  • unanticipated problems involving risks to subjects or others,
  • serious noncompliance with the protocol approved by the IRB, and
  • suspension or termination of IRB approval.

“When reviewing an incident report, OHRP assesses most closely the adequacy of the actions taken by the institution to address the incident,” the authors report. “Specifically, OHRP assesses whether the corrective actions will help ensure that the incident will not happen again with the investigator or protocol in question, with any other investigator or protocol, or with the IRB. Therefore, OHRP recommends that, when appropriate, corrective actions be applied to the entire institution.”

Among the most common corrective action taken by reporting institutions was education of researchers, IRB members, and institution staff. OHRP received reports of 2,114 instances of corrective actions involving education from 2008 to 2014. In addition, corrective actions reported included restructuring the IRB, adding staff members or making staffing changes, adding an IRB, and adding a research compliance officer to the process. Policies and procedures were commonly corrected to ensure data encryption for research laptops and flash drives, and created checklists to confirm study compliance, they reported.

The OHRP authors also looked at how often the agency requests additional information after an IRB or institution reports incidents and corrective actions. Only 69 (3.8%) of 1,826 reports filed in 2013-2014 prompted OHRP requests for additional information.

“The conduct of human subjects research can be complicated and not necessarily under the control of the IRB,” the OHRP authors stated. “During the conduct of research, it is not uncommon to find that, for one reason or another, the research must be suspended or terminated or the approved protocol has not been followed — that there is noncompliance or unanticipated problems that may need to be reported to the IRB, institutional officials, sponsors, and federal agencies. These occurrences or deviations can have a range of possible impacts depending on multiple factors such as the overall risk of the study and the nature and extent of the incidents. Once the causes of the problem are discovered, they must be assessed, and action must be taken to correct them and prevent such occurrences in the future.”


  1. Ramnath K, Cheaves S, Buchanan L, et al. Incident Reports and Corrective Actions Received by OHRP. November-December 2016;38:6: