Corrective and Preventive Action Plans

The IRB-approved research plan includes all information submitted and approved by the IRB, including 1) the scientific protocol, 2) all information in the IRB applications, amendments and reported events, and 3) any other study-specific IRB determination or requirement.

The federal regulations and Good Clinical Practice guidelines do not allow deviations from the IRB-approved research plan except where necessary to eliminate apparent immediate hazards to human subjects. Even with the most cautious and careful research and subject teams, however, meticulous protocol compliance can be difficult to maintain in the increasingly complex clinical trial environment. The studies themselves are highly technical with multiple requirements and the human subjects are research volunteers with individual medical and life situations that may influence compliance. 

The investigator and research team members must make a concerted effort to comply with the protocol and educate subjects on the requirements through the continuing informed consent process. When deviations from the IRB-approved research plan occur, the investigator must act quickly to ensure subject safety and report to sponsor or IRB when necessary.

How to Prevent Deviations

  • All study team members must be trained on the protocol before starting the research
  • Ask the sponsor about confusing wording in the protocol
  • Keep the protocol, or significant sections, handy with the subject charts for quick reference
  • Communicate expectations to subjects
  • Talk to monitors about common deviations across sites

What to Do When a Deviation Occurs

If you become aware of a deviation that has already occurred, you must first take immediate corrections to protect the rights, welfare, and safety of the subject(s).  This may be in the form of a phone call or an office visit with a qualified research team member. The investigator may need to order tests and other procedures to ensure the subject is safe.  Document the deviation, reason it occurred, and immediate corrections taken. Consider the reporting requirements of the sponsor and IRB; report appropriately. Do not wait to report—if there isn’t time to complete an electronic application then report by phone and finish the application when time allows.  The Emory IRB requires noncompliance and deviations to be reported, as applicable, within 10 business days of becoming aware.  You may also need to notify subject(s) of the problem and the IRB will advise you on how to do this (e.g., letter to subjects, phone, or reconsent).  Immediate corrections should be focused on rights, welfare, and safety of subjects and reporting.

Evaluate Risk

After immediate corrections have been made, evaluate the risk of the deviation with regards to severity and frequency. To evaluate severity, a good start is using the Emory IRB reporting requirements, which considers events that adversely affect the rights, welfare, or safety of subjects (among other things) to be major. In general, if you reported the deviation to the IRB, the risk of the event could be severe.

To evaluate frequency, consider recurrence of the problem in the future and history of the problem in the past. For future assessment, consider the risk of the event recurring in the same subject or other subjects in the study. For past assessment, review the protocol deviation log for other occurrences of the event.  If there is a risk of the problem recurring in the future or if you notice it becoming a pattern on the protocol deviation log, there is a risk of frequency.

If there is a risk of severity and/or frequency, you must continue to investigate the problem through root cause analysis. If there is no risk of severity or frequency, the corrections should resolve the problem. Lastly, document the deviation, corrections, and risk assessment and continue to monitor the protocol deviation log for patterns. 


It is important to make a distinction between corrections and corrective actions.  Corrections are the immediate steps taken to resolve a problem and involve ensuring rights, welfare, and safety of subjects and reporting. Corrections may resolve minor deviations but they will not effectively resolve more significant noncompliance (reminder: risk = severity + frequency).  Corrective actions are developed and implemented for more significant or systematic noncompliance, once the root cause is known.

Root Cause Analysis

When significant deviations or noncompliance occur in research, it is important to identify the causes of the problem so that they can be resolved to prevent further noncompliance.  There can be multiple reasons or causes that contribute to one single problem.  Conversely, there may be multiple methods to resolve each cause.  The root cause is the initiating, most basic cause of a problem that may or may not lead to a chain of causes or other problems.  Eliminating the root cause should prevent recurrence of the problem.

A root cause analysis (RCA) is the process of identifying and documenting the root cause and the downstream effect on the causal chain. RCA should focus on identifying underlying problems that contribute to error rather than focusing on mistakes made by individuals.


  1. Identify the problem
  2. Interview those impacted by the problem
  3. Interview those people responsible for the problem, if applicable
  4. Questions to identify root causes
  5. What happened?  What is the problem?
  6. Why and how did the problem occur? What were the steps?
  7. Who was affected by the problem? Was it one subject or all subjects in the study?
  8. What is the magnitude of the problem? Is it in one study or does the problem exist in all studies under this PI or even in an entire clinical department?
  9. Keep asking "why" and "how" until you reach the root cause

Once the root cause has been identified, the next step is to develop a corrective and preventive action plan to eliminate the root cause. 

Corrective and Preventive Action (CAPA) Plans

The FDA indicates that corrective and preventive actions (CAPAs) are absolutely necessary to resolve problems and noncompliance in clinical investigations.  Corrective actions are those taken to resolve a problem and preventive actions are those actions that keep the problem from recurring.  Although investigators have implemented CAPAs for decades, it is now an expectation that CAPAs are thoroughly documented, implemented, and evaluated over time for effectiveness.

Corrective Actions

The first and most critical corrective action is to ensure that the immediate corrections previously taken removed any risk of harm or further harm to the subject and future subjects and that the deviation was appropriately reported to the sponsor and IRB. Because you have already assessed the rights, welfare, and safety of the subject and the root cause is now known, you may consider additional reporting to the sponsor and IRB at this time.  Ensure that the report to the sponsor and IRB is accurate and thorough and that the CAPA is included. 

Preventive Actions

Preventive actions are necessary to ensure that the problem does not repeat itself in one or more subjects.  Preventive actions should be based on process. Create and document a process or standard operating procedure (SOP). Train on the process, implement the process, evaluate the process, and amend the process as necessary. Consider revising the protocol or informed consent as necessary.


There are five factors to create a S.M.A.R.T corrective action plan.



Compliant, addresses the full observation or root cause, accountable to named individual or role



Action can be measured to demonstrate whether it's adequate to address root cause



Addresses all implicated processes and levels



Plan can be carried out with given resources and knowledge


Time Bound

Assigned to someone who can accomplish action in a given time period


CAPAs Must Be Implemented

Ensure that the CAPA is well documented and that all study team members have been trained and understand their roles and responsibilities for successful CAPA implementation.  The CAPA and associated SOP may be relevant only for the study or it may need to be implemented systematically across the clinical department; this should be well understood. The CAPA and SOP can be rolled out in stages; the important thing is that you are documenting it.

CAPAs Must Be Evaluated Over Time

Effectiveness check is the final step of the CAPA process.  Ensure that the CAPA has addressed the root cause and that the problem has not recurred.  If the CAPA has not addressed the root cause, amend the CAPA as necessary, train on the process, implement the process, and re-evaluate.

CAPAs must be well documented

  1. Documenting the CAPA
  2. Action type (corrective or preventive)
  3. Action description
  4. Owner
  5. Due date
  6. Plan for effectiveness check
  7. Effectiveness check outcome