Pick the type of deviation and answer four impact questions: rights, safety, key data and analysis population. The tool suggests important (major) or non-important (minor), flags repeated or intentional patterns, and gives you a log entry to paste.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Suggested class
Important (major)
Reason
Key data, analysis population
Classifying protocol deviations in brief
Free tool
Choosing a type sets the typical answers, which you can then change. The demo is a primary endpoint assessment done outside its window. Nothing is saved or sent.
Category: Primary endpoint assessment missed or done outside its window Description: Week 12 primary assessment performed on day 99; the protocol window closes on day 91. Suggested classification: Important (major) deviation Rationale: It may significantly affect the completeness, accuracy or reliability of key data (primary endpoint or critical-to-quality data). It changes who belongs in the analysis population (for example it would exclude the participant from the per-protocol set). Proposed by a decision aid; the study team and sponsor confirm the classification against the protocol deviation plan.
Guidance to adapt to your protocol, not a regulatory classification. ICH E3 distinguishes important protocol deviations (those that may significantly affect key data or participants' rights, safety or well-being) from other deviations; major and minor are sponsor conventions. Your protocol deviation plan, the sponsor and the medical monitor decide the final class. The tool starts from typical answers for each type and you should change them to fit the case. Nothing is stored or sent.
Terminology
The vocabulary is a source of avoidable arguments. ICH E3 (the clinical study report guideline and its questions and answers) uses protocol deviation for any departure and important protocol deviation for the subset that matters. Older documents and many sponsors still say protocol violation for the serious ones, and major and minor for the two tiers. These are not interchangeable in law: only the ICH wording and the legal concept of a serious breach have a regulatory basis.
The EU Clinical Trials Regulation (Article 52) uses serious breach for a breach likely to affect to a significant degree the safety and rights of a participant or the reliability and robustness of the data generated. That is a stricter test than an important deviation, and it triggers a notification duty to the regulator through the sponsor. Most important deviations are not serious breaches, but a pattern of them can be. National rules elsewhere have comparable concepts. Your regulatory team decides, which is why the tool raises a prompt rather than a conclusion.
TransCelerate’s work on protocol deviations adds three useful principles for deciding whether something is a deviation at all: the event must have occurred, it must relate to the protocol or the documents it references, and it is assessed without regard to fault or blame. Deciding the class comes after that.
Worked examples
The tool’s default answers for each type. Your plan may differ, which is the point of writing the criteria down.
| Deviation | Rights | Safety | Key data | Population | Usual class |
|---|---|---|---|---|---|
| Procedure done before consent was signed | Yes | Maybe | No | No | Important |
| Key exclusion criterion not met, participant randomised | No | Yes | No | Yes | Important |
| Wrong dose dispensed | No | Yes | No | No | Important |
| Primary endpoint assessment outside its window | No | No | Yes | Yes | Important |
| Randomisation or blinding error | No | No | Yes | Yes | Important |
| Secondary questionnaire missed | No | No | No | No | Non-important |
| Non-endpoint visit 3 days outside a 7-day window | No | No | No | No | Non-important |
| Log updated two days late | No | No | No | No | Non-important, watch if repeated |
The same type can land in either class. A visit outside its window is non-important at week 4 and important at the primary endpoint visit, which is why the question is about impact and not about the type.
Making it consistent
Classification drifts when it is decided case by case. A one-page protocol deviation plan fixes it: the definition of a deviation, the list of key data and critical procedures taken from your risk assessment, the criteria for important, who classifies (usually the site proposes and the sponsor or monitor confirms), and the time limit for logging. A short list of pre-agreed examples, like the table above, removes most disputes. The ICH E6(R3) guide explains why the expectation is trial-specific criteria tied to risk, and the data validation plan template is a good place to link the critical data to the checks that protect them.
Review the classification as the study goes on. If a minor deviation turns out to affect an endpoint, or an important one is common and harmless, change the plan and apply it to earlier cases, with the date. Downgrading after the fact to protect an analysis population is a well-known failure, so keep the original classification and the reason for any change on the record. Deviations found at monitoring visits belong in the same log with the same class, as the monitoring visit report template suggests.
Add edit checks to your forms in the free sandbox and see the auto-queries they raise when a value breaks a protocol rule.
In Capture
Capture has no dedicated protocol deviation form and does not classify deviations for you. What it gives you is the evidence behind them: an edit check raises an auto-query when a value breaks a protocol rule, tied to the exact field and subject, and the resolution keeps the original value, the new value and the reason.
Edit checks / auto-queries
2Type
Range High
Operator
Greater than
Value
180
Priority: High
Type
Range Low
Operator
Less than
Value
80
Priority: Normal
Query raised automatically
Value 192 violates limit (180). Please verify.
Deviation process
Definition, key data list, criteria for important, owner and time limit in one document.
Classification rests on rights, safety, key data and analysis population.
A short cause code lets you see patterns by site and type.
Retraining, a reminder, a protocol clarification or a template change, with a date.
The original class, the new class, who changed it and why.
A monthly look at repeated types, with escalation to the sponsor when needed.
There is no universal regulatory definition. Sponsors usually treat a deviation as major (important) when it may significantly affect participants’ rights, safety or well-being, or the completeness, accuracy or reliability of key data, and as minor otherwise. The criteria should be written in the protocol deviation plan.
ICH E3 and its questions and answers distinguish protocol deviations from important protocol deviations, a subset that may significantly affect key study data or a participant’s rights, safety or well-being. Trials define their own list of important deviations from the design, critical procedures and planned analyses.
The words are used inconsistently. Violation is an older term that many sponsors still use for serious or important deviations. Use the term your protocol defines and keep it consistent across documents.
Under EU CTR Article 52, a breach that is likely to affect to a significant degree the safety and rights of a participant or the reliability and robustness of the data. That is a higher bar than an important deviation. Whether a case meets it is for the sponsor and regulatory team to decide.
If the protocol required the visit and it did not happen, yes, as a departure from the protocol. Its class depends on impact: a missed primary endpoint visit is usually important, a missed routine safety visit may be, and a missed optional visit usually is not.
It suggests a class from your answers, with the reasoning. The study team, the monitor and the sponsor confirm it against the protocol deviation plan. Capture itself does not auto-classify deviations either.
No. What you type stays in your browser and is not saved or transmitted.
Keep exploring
Protocol deviation tracking software
Edit checks and queries behind a deviation record.
ICH E6(R3) guide
Risk-based quality management expectations.
Risk-based monitoring and SDV
Focus checking on critical data.
Monitoring visit report template
Record findings and their class.
Data validation plan template
Link critical data to checks.
Build your forms, add edit checks and watch auto-queries appear in the free sandbox. No credit card, pay only when you go live.