A protocol deviation is any departure from the study protocol: a visit outside its window, a missed assessment, a dosing error, an ineligible participant enrolled. Resolving one means classifying it, investigating, correcting and deciding what it does to the data. Every one of those steps refers back to a specific protocol version, so a deviation history that loses that reference loses most of its meaning.
What should be inventoried before a research system migration affects protocol deviation resolution history?
Record classes, time coverage, owners and the real access deadline, captured at metadata level. Use the questions below with the quality director or head of clinical operations; none of them requires seeing a record.
| Ask | Why it matters | A useful answer looks like |
|---|---|---|
| Which record classes exist? | Shows whether a full resolution chain can be rebuilt | Deviation logs, CAPAs, monitoring reports, protocol and amendment files, IRB correspondence, analysis population decisions |
| Which years and how many studies? | Depth matters more than any single study | "Deviation logs in the current system since 2017, about 60 studies" |
| Is the protocol version stored per deviation? | Often the weakest link in the chain | "Only in free text before 2021; a version field after" |
| What moves at cutover? | Defines what survives in usable form | "Open studies migrate; closed studies stay read-only for three years" |
| When does legacy access end? | The real deadline, from the contract | A dated license or hosting end, not a guess |
| Who owns each class? | Sponsor contracts may control trial data | "Sponsor-owned trial records; our own SOPs, training and internal audits" |
Do not recommend keeping data longer than the company's own retention schedule and contracts allow, and never collect exports, screenshots or system logins.
Why the links matter more than the log
Because whether a deviation was important depends on what the protocol said at the time. FDA's December 2024 draft guidance defines protocol deviations and important protocol deviations, and recommends which ones sponsors report in study reports and which investigators report to sponsors and IRBs. ICH E6(R3), issued by FDA as final guidance in September 2025, describes important deviations as a subset that may significantly affect data reliability or participant rights, safety or well-being, and says remediation should focus on them, with actions proportionate to their importance. If the amendment in force on the event date cannot be identified, neither can the classification.
Two more requirements explain why the history is usually substantial. ICH E3 says clinical study reports describe all important deviations related to inclusion or exclusion criteria, trial conduct, patient management or patient assessment, summarized by site and category. And 21 CFR 11.10 calls for secure, computer-generated, time-stamped audit trails in which changes do not obscure earlier entries, retained at least as long as the underlying electronic records. A validated migration therefore already has to decide how audit trails travel. That decision is the natural moment to ask how deviation links travel too.
An illustrative inventory sheet
Illustrative only; the company and figures are fictional. A 310-person contract research organization is consolidating its old trial management and quality systems into one platform. Its quality director fills in the sheet from the migration and validation plans.
| Record class | System | Years held | Owner | Moves at cutover? | Readable until |
|---|---|---|---|---|---|
| Deviation log entries and classifications | Old trial management system | 2017 to now | Quality director | Open studies only | Read-only period ends |
| Protocol version per deviation | Old trial management system | Free text before 2021, field after | Quality director | Field only | Read-only period ends |
| CAPAs and investigations | Old quality system | 2016 to now | Quality director | Yes, with audit trail | Not affected |
| Sponsor and IRB correspondence | Email, document management | Varies by study | Clinical operations head | No | Mailbox and document retention rules |
| Analysis population decisions | Statistics team files | 2018 to now | Head of biostatistics | No, and not linked to deviations | Team share kept |
Reading the sheet: classifications and corrective actions travel well. The weak points are the protocol version link, recorded only as free text before 2021, the sponsor correspondence, and the analysis population decisions, which survive in team files but with nothing tying them back to a deviation. Each depends on a date or a link the migration plan should already name.
Which date is the real deadline?
The end of the read-only period for the legacy systems, as written in the validation plan or hosting contract. Cutover itself is earlier and less important. Add the email and document retention rules for study correspondence, since deviation discussions with sponsors often live there; the email archive migration guide covers the same metadata-only discipline for mailbox history. For a research company that is closing rather than migrating, biotech wind-down and the board resolution clauses for data assets cover the different trigger.
Who decides, and does the company qualify?
The quality director knows coverage. The CEO or COO decides whether a licensing discussion fits, and counsel reads sponsor and site agreements to see which record classes the company controls. Participant information raises de-identification questions that SourceX's review handles; the HIPAA expert determination process explains one route where U.S. health data is involved.
The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records, and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.
What stays unknown until SourceX reviews it: dataset demand, the rights review result, what de-identification or sponsor consent requires, and whether any offer follows. Partners sign the Channel Partner Agreement before submitting introductions, and the first valid introduction within the 90-day window is credited when the company submits a verified application. Other sectors are on the industries hub.
Go deeper on protocol deviation resolution
- Protocol deviation resolution exception examples: one deviation worked through step by step, from late visit to analysis decision.
- Protocol deviation resolution records across systems: a system map of the identifiers that join logs, protocols, CAPAs and correspondence.
- Who can license protocol deviation resolution records: a decision tree for which executive to introduce and what needs sponsor sign-off.
- Protocol deviation resolution referral brief template: a fill-in, metadata-only brief for the introduction.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
If a research client is about to retire its trial management or quality system and years of deviation decisions sit behind the cutover, register as a partner, check the company against who qualifies, and read the program terms before you send the handoff.