Managing Protocol Deviations in a Retatrutide Research Program: What to Do When Something Goes Wrong

Protocol deviations are inevitable in any research program. A patient misses a monitoring visit. A dose is administered outside the specified window. A consent form is signed after the first dose rather than before. These events happen — in academic research centers, in pharmaceutical trials, and in private practice research programs. How you manage them determines whether they remain minor administrative events or become serious compliance problems.

A protocol deviation is any departure from the approved IRB protocol. Deviations range from minor administrative errors (a monitoring visit conducted one week late) to significant events that may affect patient safety or data integrity (a patient enrolled who did not meet the inclusion criteria).

The distinction between a minor deviation and a major deviation matters because the reporting and corrective action requirements are different. Your IRB protocol should define what constitutes a major deviation — or your IRB will provide guidance on this distinction.

Minor deviations are departures from the protocol that do not affect patient safety, do not affect the integrity of the research data, and do not represent a pattern of non-compliance. Examples include:

• A monitoring visit conducted 1–2 weeks outside the specified window
• A minor documentation error that was corrected promptly
• A laboratory test ordered slightly outside the specified timeframe

Minor deviations should be documented in the research record and reported to the IRB at the time of continuing review (annual review), not as immediate reports.

Major deviations are departures from the protocol that affect patient safety, affect data integrity, or represent a pattern of non-compliance. Examples include:

• Enrollment of a patient who did not meet the inclusion criteria
• Administration of the compound without obtaining informed consent
• Failure to report a serious adverse event within the required timeframe
• A pattern of repeated minor deviations suggesting systemic non-compliance

Major deviations must be reported to the IRB promptly — typically within 5–10 business days of discovery, depending on your IRB's requirements.

When a deviation occurs, the response should follow a consistent process:

1. Identify and document. As soon as a deviation is identified, document it in the research record — what happened, when it was discovered, and who identified it.

2. Assess the impact. Determine whether the deviation affected patient safety or data integrity. If there is any question about patient safety, address the clinical issue first.

3. Classify the deviation. Determine whether it is a minor or major deviation based on your protocol definitions and IRB guidance.

4. Report to the IRB. Report major deviations promptly. Document minor deviations for inclusion in the continuing review report.

5. Implement corrective action. Identify the root cause of the deviation and implement corrective action to prevent recurrence. Document the corrective action.

6. Follow up. Confirm that the corrective action was effective. If the same deviation recurs, escalate the corrective action.

Proactive deviation management — identifying, documenting, and correcting deviations promptly — is the difference between a compliant research program and a non-compliant one. IRBs understand that deviations happen. What they do not accept is deviations that are concealed, ignored, or not corrected.

A research program with a well-maintained deviation log and documented corrective actions is a program that takes compliance seriously. An IRB auditor who sees a clean deviation log with appropriate responses will have confidence in the program's overall compliance posture. An auditor who finds undocumented deviations or deviations without corrective action will not.

The same logic applies in an M&A due diligence context. A buyer's healthcare counsel reviewing your research program will look at your deviation log. A log that shows deviations were identified, documented, and corrected is evidence of a well-managed program. A log that is empty — or that does not exist — is a red flag.