# Protocol deviation exception, worked example | SourceX

Canonical: https://refer.sourcex.si/guides/protocol-deviation-resolution-exception-examples
Last updated: 2026-10-20

The records that explain a protocol deviation are the ones that let a reader follow each judgment in order: the protocol version and amendment in force, the site activation date, the departure itself, the first classification, the review that challenged it, the corrected classification and root cause, the corrective action and the analysis decision that followed. In the Illustrative case below, the useful evidence is not "deviation closed" but a visit date read two ways and a documented correction.

This worked case is part of the [protocol deviation resolution guide](/guides/workflow-protocol-deviation-resolution), which covers what to inventory before a research system migration. Here one deviation is walked through from start to finish, so a partner can recognize the same pattern at a client. This page is general information, not regulatory advice.

## The case in brief (Illustrative)

A fictional 340-person contract research organization runs a multi-site study for a sponsor. Protocol amendment 4 tightens the window for the week-12 visit from plus or minus 3 days to plus or minus 2 days. One site holds a participant's week-12 visit 4 days late. The site coordinator logs it as minor, measuring against the old window. Seventeen days later a monitor notices that the site was already bound by amendment 4. The deviation is reclassified as important, the cause is traced to a site calendar, a corrective action follows, and the participant's week-12 data leaves the per-protocol analysis set.

Nobody did anything dramatic. That is the point: many informative exceptions are ordinary departures where a first judgment was made against the wrong rule and someone caught it.

## Step by step: what happened, who decided, which record captured it

| Day | What happened | Who decided | Record that captured it |
|---|---|---|---|
| Day 0 | Amendment 4 approved with an effective date | Sponsor, IRB and regulatory lead | Amendment file and approval letter |
| Day 9 | Site activates amendment 4 | Site coordinator and clinical research associate | Site activation log |
| Day 21 | Week-12 visit held 4 days late | Site staff | Visit date in the data capture system |
| Day 23 | Logged as minor: one day outside the old 3-day window | Site coordinator | Deviation log entry with its classification |
| Day 40 | Monitor flags that the site was on amendment 4 | Clinical research associate | Monitoring visit report |
| Day 44 | Reclassified as important; root cause: calendar not updated after activation | Study manager and quality lead | Updated deviation record and its audit trail |
| Day 50 | Re-training; calendar check added to the activation checklist | Quality assurance | Corrective and preventive action record |
| Analysis | Participant's week-12 data excluded from the per-protocol set | Biostatistics, under the analysis plan | Analysis population decision |

Each row is a decision with an owner and a dated record. Remove the day 9 activation log and nobody can prove which window applied. Remove the day 40 report and the reclassification looks arbitrary. Remove the analysis decision and the case never shows what the deviation changed.

## Why this sequence is useful evidence

Because each step carries a judgment that regulators already expect to be recorded. FDA's December 2024 draft guidance separates protocol deviations from important protocol deviations and recommends which ones sponsors report in study reports and which investigators report to sponsors and IRBs. ICH E6(R3), issued by FDA as final guidance in September 2025, describes important deviations as those that may significantly affect data reliability or participant rights, safety or well-being, and asks that remediation focus on them, proportionately. ICH E3 then has sponsors describe important deviations in the clinical study report, summarized by site and category.

So a well-kept deviation history already pairs what happened with how serious it was and what was done about it. In this case it also holds a correction: a first classification, the evidence that overturned it and the consequence. Pairs of judgment and outcome like this are what make exception records informative for training and evaluating AI systems that review or route operational work; [how AI labs buy data](/questions/how-do-ai-labs-buy-data) explains how such records are assessed.

## Where this chain usually breaks

The same case, held by a company with weaker records, would look like this:

- **The amendment is in a document file, the deviation in a log.** Without a version field on the deviation, the day 9 activation has to be inferred from dates. The [system map](/guides/protocol-deviation-resolution-records-across-systems) shows which keys join the two.
- **The reclassification overwrote the first entry.** If the log kept only the latest classification, the day 23 judgment disappears and the case reads as "important, closed".
- **The CAPA has its own number but no link back.** The remedy exists, but nobody can say which deviation prompted it.
- **The analysis decision sits in a statistics team folder.** It survives, but with no reference to the deviation number.

Any one of these leaves the records accurate but unexplained. A partner does not need to judge which applies; asking the questions below is enough.

## How to recognize a similar case at a client

Ask the quality director, and write down only the answers:

1. When an amendment changes a visit window or eligibility rule, is the effective date per site recorded anywhere a deviation reviewer can see?
2. Do deviation logs keep earlier classifications, or only the current one?
3. How often does monitoring or quality review change a classification? A rough share is enough.
4. Does each CAPA record the deviation number that triggered it?
5. Are analysis population decisions tied to deviation numbers, or kept separately?
6. How many years and studies does the current system cover?

If several answers are yes, the company likely holds chains like the one above. If most are no, the records may still matter, but the review will be harder; the [logistics exceptions guide](/guides/how-to-identify-logistics-exceptions-and-their-documented-resolutions) shows the same test in another sector, and [accounts payable exception handling](/data-types/accounts-payable-exception-handling-process) is a back-office parallel.

## What the partner asks, and what stays with SourceX

Discovery stays at metadata level: record classes, years, studies, systems and owners. Never ask for a deviation log, a monitoring report, participant study IDs or a login. Trial records generated under sponsor contracts may belong to the sponsor; the CRO's own procedures, training and internal audits may be its own. The [who-can-license tree](/questions/who-can-license-protocol-deviation-resolution-records) sorts out who can open the discussion, and the [CRO retention guide](/guides/jay-alix-protocol-cro-retention) covers a related trigger.

For SourceX, an introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. What stays unknown until SourceX reviews it: which record classes the company controls, what de-identification is needed, SourceX's current data needs and any offer. SourceX licenses approved business data directly from companies for AI training and evaluation, and manages the agreement, rights review, data preparation, delivery and payout. Partners sign the Channel Partner Agreement before submitting, and the first valid introduction within the 90-day window is credited when the company submits a verified application.

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

If a research client's deviation history keeps first judgments, corrections and their consequences linked, [register as a partner](/register), check the company on [who qualifies](/who-qualifies) and read the [program terms](/terms) before you introduce the decision-maker.

## Sources

- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/protocol-deviations-clinical-investigations-drugs-biological-products-and-devices
- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp
- https://database.ich.org/sites/default/files/E3_Guideline.pdf
- https://refer.sourcex.si/terms