Is the difference between a protocol deviation and a protocol violation a matter of interpretation, or does GCP provide an answer?

Real world or ideal world?
In an ideal world, protocol violations would not occur, but since we must deal with the world we live in, this difference is considered most often in terms of the degree of effect on data integrity or credibility. It may be argued that despite departing from the protocol, a protocol deviation is an “allowable” instance of protocol non-compliance, with minor consequences, in terms of its effect on the subject’s rights, safety or welfare, or the integrity of study data. For example, there may be occasions when study visits or tests will fall outside the acceptable visit “window”, due to public holidays for example, or for other unforeseen reasons, such as study subjects having transport issues causing them to miss or postpone their visit date.
In practical terms, such minor deviations from the protocol tend to be agreed in advance with the study sponsor, having been assessed as making little difference to study subjects’ safety, or to data analysis of primary or secondary objectives.
By contrast, a protocol violation is an incident with potentially serious consequences that could critically affect data analysis (casting doubt on its reliability/integrity) – aside from having put patients’ safety at risk. Generally, such incidents (most often picked up during monitoring) tend to involve unintentional non-compliance with study protocol inclusion/exclusion criteria.
Then again, no one can foresee the effects of protocol deviations on data analysis, which is why every effort should be made to limit their effects. That is, a large number of ‘minor’ deviations arising on one study site, or from across all sites, could impact analysis, affecting both ethical and statistical validity, thus compromising patient safety and data integrity. From a quality assurance perspective, a large number of minor deviations across sites point to systematic non-compliance.
The question then becomes why?
For example, is it due to a global training issue, since from a quality control perspective, monitoring should pick up on ‘incidents’ in order to suggest corrective actions. Or, is systematic non-compliance due to an aspect of trial design, in which case a timely protocol amendment would be appropriate corrective action?
To decide on appropriate action, perhaps we need to go back to basics – to review what protocol violations/deviations mean in GCP terms.

Think patient safety first
According to GCP, the distinction between a protocol deviation/violation is about responsibilities – for the investigator, these are defined in Section 4.5: Compliance with Protocol; and for the sponsor, they’re defined in Section 5.20: Noncompliance from ICH GCP.
ICH GCP section 4.5.4 states:-
The investigator may implement a deviation from, or a change of, the protocol to eliminate an immediate hazard(s) to trial subjects without prior IRB/IEC approval/favourable opinion. As soon as possible, the implemented deviation or change, the reasons for it, and, if appropriate, the proposed protocol amendment(s) should be submitted:
a) to the IRB/IEC for review and approval/favourable opinion,
b) to the sponsor for agreement and, if required,
c) to the regulatory authority(ies).
ICH GCP section 5.20 states:-
5.20.1 Non-compliance with the protocol, SOPs, GCP, and/or applicable regulatory requirement(s) by an investigator/institution, or by member(s) of the sponsor’s staff should lead to prompt action by the sponsor to secure compliance.
5.20.2 If the monitoring and/or auditing identifies serious and/or persistent noncompliance on the part of an investigator/institution, the sponsor should terminate the investigator’s/institution’s participation in the trial. When an investigator’s/institution’s participation is terminated because of non-compliance, the sponsor should notify promptly the regulatory authority(ies).
In effect, GCP recognises that deviations will occur, and that investigators/sponsors will work together in these instances to protect patients and to ensure data integrity. However, ultimately, when investigators’ fail in their responsibilities, serious and/or persistent protocol non-compliance (i.e. violation) warrants site suspension/closure by the study sponsor, if they are to fulfil their obligations to protect patients.
Therefore, if the distinction between a protocol deviation and a protocol violation is considered in terms of investigators’/sponsors’ responsibilities and corrective actions, then it becomes clear: with a deviation, both parties do what they can to protect trial subjects (as per ICH GCP section 4.5), since despite everyone’s best efforts, they will arise.
But, if investigators fail in their responsibilities, as indicated by persistent failure to either adhere to the protocol, or to implement the sponsor’s requirements, how should a sponsor handle this, in terms of corrective actions?
In terms of GCP requirements, specified in section 5.20.2, the sponsor must view protocol non-compliance as a ‘violation’ of agreed responsibilities. As such, the necessary corrective actions, then need to be detailed in Standard Operating Procedures (SOPs), or Work Instructions (WIs). For example, when serious and/or persistent non-compliance is identified, GCP would require that: the investigator’s participation must be terminated and regulatory authorities notified, accordingly.
Surely, incorporating such steps into an SOP or WI demonstrates the translation of these GCP standards into action?
(This post is based on my comments given in a discussion on this topic on LinkedIn, Clinical Research Professionals group, Jan/Feb 2011.)
Recommended Links
E6 ICH GCP