Blog › ICP guides

Clinical research coordinator on retainer: protocol deviation management, IRB submission advisory, and monitoring visit guidance on monthly retainer

July 24, 2026 · ~20 min read

A Phase II oncology trial at a community hospital site has enrolled 23 subjects over 14 months. The sponsor has not received a deviation report in four months. The principal investigator considers this a sign that the site is running cleanly. The clinical operations consultant joining the site on a monthly retainer engagement reviews the source documents from the past four months and identifies a different picture: six visit window deviations (subjects seen outside the protocol-specified visit window) that the site coordinator had not reported because she did not know that missed visit windows constituted protocol deviations under the current version of the protocol. A protocol amendment 8 months earlier had changed the visit window from ±7 days to ±3 days for the primary efficacy assessment timepoints. The site coordinator had not attended the amendment training webinar — it had been scheduled during a period when she was covering two other active studies — and the amended protocol was uploaded to the site’s electronic trial master file without a notification that the visit window had changed.

None of the six deviations are individually disqualifying. Documented correctly, with appropriate corrective action (site coordinator re-training on the amended protocol, implementation of a visit window alert in the CTMS), they become a protocol deviation log with an adequate response. Undocumented, they become an FDA inspection finding under 21 CFR 312.62 (maintenance of records) and 21 CFR 312.68 (inspection of investigator's records and reports) — specifically, a finding that the site failed to maintain adequate records of deviations from the protocol and failed to report deviations to the sponsor as required by the protocol and the ICH E6(R2) Good Clinical Practice guideline. An inspection finding for failure to report deviations is categorized more severely than six individually-documented minor deviations. The clinical operations consultant prepares a retrospective deviation report for each of the six events, documents the corrective and preventive action plan, and submits the reports to the sponsor. The sponsor informs the data safety monitoring board. No further action is required. The sponsor sees six deviation reports on a day that could have been an FDA Form 483 observation.

This is the specific dynamic that makes clinical research coordination retainer hours systematically undervalued: the visible output of the retainer engagement is six deviation reports in the sponsor’s regulatory binder. The analytical work that produced those reports — reviewing 14 months of source documents, identifying the connection between the protocol amendment and the undocumented visit windows, understanding the regulatory classification of the finding, and preparing documentation that satisfies both ICH E6(R2) and FDA inspection standards — is invisible. The sponsor’s weekly status call produced a “no issues to report” update for four months. The four months of invisible advisory work that replaced a Form 483 observation with a compliant deviation log do not appear on an invoice without a work log.

Protocol deviation management advisory

Protocol deviation management is the clinical operations retainer function with the highest regulatory consequence. A protocol deviation is any departure from the approved protocol, and the sponsor and site are required by ICH E6(R2) and by 21 CFR 312.62 to maintain records of deviations and report them to the sponsor in accordance with the protocol and the site agreement. The practical challenge is that the classification of events as deviations (and the further classification of deviations as minor, moderate, or major) requires both knowledge of the protocol requirements and judgment about the regulatory significance of the departure.

Deviation vs. violation classification advisory

The regulatory distinction between a protocol deviation and a protocol violation is significant for inspection and data integrity purposes. A deviation is a departure from the protocol that did not eliminate subject safety risk, compromise data integrity, or violate ethical principles. A violation is a departure that did one or more of those things. ICH E6(R2) uses “deviation” as the general term, but some sponsors and regulatory bodies distinguish between major deviations (which require immediate reporting and CAPA) and minor deviations (which are logged and addressed in aggregate). FDA inspectors apply their own assessment of severity based on what the deviation affected: safety, consent, efficacy endpoint assessment, or data integrity.

In one deviation classification advisory engagement, a clinical operations consultant reviewed a set of 12 events identified at a site over a three-month period. The site had classified all 12 as minor deviations and included them in the site’s next quarterly deviation log submission to the sponsor. The consultant’s review identified two events that required reclassification. The first was a case where a required safety assessment (a 12-lead ECG at the primary efficacy assessment visit) had been performed two days late. The site had classified this as a minor visit window deviation. The consultant identified that the ECG was a primary endpoint assessment and was required at a protocol-specified time point, not a visit window with a ±3-day allowance: the late ECG represented a protocol deviation affecting the primary endpoint data, which required sponsor notification and documentation of the clinical significance of the two-day difference. The second was a case where a subject had received study drug during a protocol-prohibited concomitant medication period. The site coordinator had documented the event as a minor deviation; the consultant classified it as a major deviation because the concomitant medication exclusion existed to prevent a known drug interaction that could affect both subject safety and drug metabolism, directly affecting the pharmacokinetic data endpoint. Both reclassifications required revised documentation, sponsor notification, and data quality review for the affected subjects’ records. The classification review of 12 events took 4 hours.

Corrective and preventive action plan development

A deviation report without an adequate Corrective and Preventive Action (CAPA) plan is a compliance documentation failure. The CAPA section of a deviation report must describe what action was taken to address the specific deviation (corrective action) and what systemic change was implemented to prevent recurrence (preventive action). An inadequate CAPA — one that documents “site coordinator was reminded of the protocol requirement” as the preventive action for a recurring class of deviation — is itself an inspection finding: it indicates that the site lacks a process-level response to systematic protocol compliance failures.

In one CAPA development engagement, a clinical operations consultant reviewing a site’s deviation log found that 7 of 14 deviation reports for the prior 6 months had identical preventive action language: “Site coordinator will review protocol requirements.” Five of the 14 deviations were in the same category (informed consent timing deviations — subjects completing consent forms after completing eligibility screening procedures, in the wrong order). Five deviations in the same category with the same generic CAPA over 6 months indicates that the preventive action did not prevent recurrence. The consultant developed a process-level CAPA for the consent timing deviations: a structured consent workflow requiring the consent form signature timestamp to be recorded before any study procedure timestamps in the electronic health record, with a CTMS eligibility screening lock that could not be opened without confirming consent form completion in the document management system. The process CAPA required coordination with the site’s CTMS administrator and EHR coordinator. Developing and documenting the CAPA took 5 hours; the implementation was handled by the site’s IT team over two weeks. No consent timing deviations were reported in the subsequent 6-month period.

IRB submission advisory

IRB (Institutional Review Board) submission advisory covers the spectrum of regulatory submissions that require IRB review and approval during the life of a clinical study: initial protocol approval, protocol amendments, continuing reviews, reportable adverse events, and study closure. The regulatory deadlines for these submissions are defined by IRB operating procedures and by federal regulations under 21 CFR Part 56 and 45 CFR Part 46. Missing a submission deadline has consequences ranging from a conditional continuing approval (the study may continue pending receipt of required information) to an IRB approval lapse (all study activities must cease until approval is reinstated), depending on the submission type and the IRB’s response to the missed deadline.

Continuing review timing and approval lapse prevention

Continuing review is the IRB’s annual or more frequent review of an approved study to confirm that the research continues to meet the standards for approval, that the risks remain acceptable, and that the informed consent process is adequate. The timing requirements for continuing review are set by the IRB in the initial approval letter: the approval is valid for a specified period, and the continuing review submission must be received by the IRB and approved before the approval expiration date. If the approval expires without a continuing review approval in place, the IRB approval lapses. An approval lapse requires the site to suspend all study activities — enrollment, study procedures, and sometimes even follow-up visits for subjects already enrolled — until the IRB reinstates approval.

In one IRB monitoring engagement, a clinical operations consultant conducting a monthly review of a site’s regulatory binder identified that the annual continuing review submission deadline was 31 days away. The study coordinator who typically prepared continuing review submissions had been reassigned to a newly opened Phase III trial six weeks earlier; the continuing review preparation had not been formally reassigned. The consultant prepared the continuing review submission package: enrollment summary (17 subjects enrolled, 14 completed, 3 ongoing), safety update (2 non-serious adverse events, 0 serious adverse events, no changes to the risk profile that would require protocol modification), investigator brochure version current status, and IRB-required protocol summary checklist. The submission was filed 28 days before the approval expiration. IRB approval was renewed with no lapse. The cost of the 5-hour continuing review preparation engagement was 5 hours of retainer advisory time. The cost of an approval lapse for a Phase II trial with 3 active subjects would have included the cost of suspending study procedures for all 3 subjects, the administrative burden of IRB reinstatement, and a potential sponsor audit triggered by the lapse.

Protocol amendment submission strategy

Protocol amendments require IRB review because changes to the protocol may affect subject safety, the risk-benefit analysis, or the adequacy of informed consent. The regulatory classification of the amendment (as requiring full board review or as qualifying for expedited review) determines the timeline for approval and the impact on study activities. Amendments that affect subject safety or that expand the subject population typically require full board review (the full IRB committee reviews the amendment at a scheduled meeting, which may be 4 to 8 weeks away). Amendments that represent minor modifications not affecting risk (administrative changes, clarifications, corrections of typographical errors) typically qualify for expedited review (a designated IRB reviewer can approve the amendment, potentially within days).

The classification decision matters for study operations: a sponsor who submits a protocol amendment to the IRB without characterizing the change correctly may receive an IRB request for full board review when expedited review was available, delaying implementation by 4 to 8 weeks; conversely, a sponsor who submits a substantive safety-related amendment as an administrative change may receive the amendment approval as invalid and face a request to resubmit for full board review, with the intervening period constituting an unapproved protocol modification. In one amendment strategy advisory, a clinical operations consultant reviewed a proposed protocol amendment that added a new biomarker collection procedure (an additional blood draw of 10 mL at two existing study visits). The sponsor had characterized the amendment as a minor modification not affecting risk. The consultant recommended characterizing the amendment as a minor modification to existing procedures (since the blood draws were at existing, approved visit timepoints and the additional volume of 10 mL per draw was below the threshold for significant additional risk) but flagging the change for expedited review rather than requesting an administrative exemption, given that the amendment modified an informed consent procedure (subjects would need to consent to the additional blood draws). The IRB approved the amendment under expedited review in 6 days, avoiding a full board cycle.

Site initiation and monitoring visit advisory

Monitoring visit advisory covers the preparation, conduct support, and response management for sponsor and CRO monitoring visits to investigational sites. Monitoring visits are a regulatory requirement under 21 CFR 312.53(d) (sponsor obligations to select and monitor investigators) and ICH E6(R2) Section 5.18 (monitoring procedures). The quality of monitoring visit preparation directly affects the productivity of the visit and the site’s regulatory exposure during and after the visit.

Site initiation visit checklist quality review

The site initiation visit (SIV) is the monitoring visit that occurs before the first subject is enrolled at a site. Its purpose is to confirm that the site has the required regulatory documentation in place, that site staff have been trained on the protocol and GCP, that the investigational product storage and dispensing procedures meet protocol requirements, and that the site’s recruitment and consent procedures are adequate. The SIV checklist that the monitor uses to verify site readiness determines what gets checked and what gaps are identified before enrollment begins vs. after.

In one SIV preparation advisory, a clinical operations consultant reviewing the monitor’s planned SIV checklist identified three categories of items that the checklist did not include: verification that the site’s electronic health record (EHR) system timestamp settings were calibrated to the correct time zone (a source of systematic timestamp errors in source data); confirmation that the site’s temperature monitoring log for the investigational product storage unit included maximum/minimum temperature recording (the checklist required daily temperature, but not maximum/minimum range, which is needed to detect temperature excursions that occur between daily checks); and verification that the site’s delegation of authority log included all staff who would have contact with study subjects or study data, not only those who would perform protocol-specified procedures. The monitor added all three items to the SIV checklist. At the SIV, the monitor identified that the EHR time zone was set to UTC rather than Eastern Time (the site’s local time zone), which would have generated systematic one-hour offsets in all source data timestamps. The time zone was corrected before the first subject was enrolled.

Risk-based monitoring and SDV scope design

Source data verification (SDV) is the process of comparing data recorded in the case report form (CRF) or electronic data capture (EDC) system against the original source document (the subject’s medical record, the laboratory report, the ECG tracing) to confirm accuracy and completeness. Traditional monitoring practice required 100% SDV — every data point in the CRF was verified against source documentation. FDA’s 2013 guidance on risk-based monitoring endorsed a targeted SDV approach under which the scope of SDV is determined by a risk assessment of which data points are most critical to subject safety and data integrity, rather than verifying every field regardless of risk.

In one SDV scope advisory engagement, a clinical operations consultant reviewed a Phase II multi-site trial where the sponsor was conducting 100% SDV at all 12 sites. The monitoring budget for 100% SDV, at an average of 4 monitoring visits per site per year with each visit covering approximately 3 weeks of source data, was consuming 68% of the total clinical operations budget. The consultant conducted a risk assessment of the data fields in the CRF and identified 4 categories for targeted SDV: primary efficacy endpoint data (all timepoints, 100% SDV), serious adverse event data (100% SDV), informed consent documentation (100% SDV), and protocol eligibility criteria (100% SDV at screening visit). All other data fields — approximately 73% of the total CRF data points — were classified as low-risk and subject to statistical sampling SDV at a rate of 10%. The transition from 100% SDV to risk-based monitoring at the targeted scope reduced monitoring visit duration at each site from an average of 3.5 days to 1.8 days, reducing the annual monitoring budget by 39% while maintaining 100% SDV coverage of the data fields that FDA inspectors prioritize in clinical data audits. The risk assessment and SDV scope design documentation took 18 hours over three weeks and was reviewed by the sponsor’s medical monitor and regulatory affairs team before implementation.

Regulatory submission preparation advisory

Regulatory submission preparation advisory in a clinical research operations retainer covers the contributions that the clinical operations team makes to IND (Investigational New Drug) application sections, safety reporting under 21 CFR 312.32, and clinical study report sections. These contributions are not clinical research coordinator work in the traditional sense — they require clinical operations expertise to ensure that the regulatory submission accurately reflects the study conduct and that the clinical data submitted is accompanied by appropriate documentation of the conditions under which it was collected.

IND safety reporting advisory

Sponsors of IND studies are required under 21 CFR 312.32 to report serious adverse events (SAEs) to FDA on an expedited basis if the event meets the criteria for an IND safety report: the event is both serious and unexpected (not listed in the investigator brochure at the frequency and severity described) and there is a reasonable possibility that the investigational product caused the event. The clinical operations function’s role in IND safety reporting is ensuring that all SAEs at investigational sites are identified and reported to the sponsor within the protocol-specified timeframe (typically 24 hours for serious events), that the site documentation supports the sponsor’s regulatory assessment, and that the sponsor’s safety database receives accurate information about the event.

In one IND safety reporting advisory, a clinical operations consultant conducting a monthly site record review identified a serious adverse event at one of the trial sites that had been entered in the site’s adverse event log as “expected — no IND report required.” The site coordinator had classified the event as expected because the investigator brochure listed the event type (hospitalization for pneumonia) in the adverse event listing. The consultant reviewed the investigator brochure listing and identified that the brochure listed pneumonia as a known adverse event at a frequency of less than 1% in the prior trial population. The subject who experienced the event was in a different demographic (immunocompromised due to a concurrent autoimmune condition that was permitted by the study eligibility criteria) and had experienced a more severe presentation than the brochure described. Under 21 CFR 312.32 and ICH E2A, the severity and clinical context of the event required a sponsor assessment of whether the event qualified as unexpected. The consultant flagged the event to the sponsor’s medical monitor, who conducted the expectedness assessment and determined that the event qualified for expedited IND reporting. The safety report was submitted to FDA within the 15-day calendar day requirement. The consultant’s identification of the misclassified SAE during a routine monthly site record review took 2 hours. The consequences of the missed IND safety report would have included FDA inspection findings and potential clinical hold under 21 CFR 312.42.

Tracking clinical research coordination retainer hours with HourTab

Clinical research coordinators and clinical operations consultants on monthly retainer face an acute version of the invisible-work billing problem. The visible milestones of a clinical trial — enrollment targets, database lock, study completion — are separated by months or years of continuous compliance monitoring, deviation management, IRB submission preparation, and monitoring visit oversight. The work that prevents an FDA Form 483 observation, an IRB approval lapse, or a disqualifying protocol violation is precisely the work that produces no visible output when it succeeds. A month where the retainer engagement identified and remediated a continuing review deadline risk, reclassified two protocol events from minor deviations to major deviations, and updated the risk-based monitoring plan for the next monitoring period produces no enrollment record, no safety report, and no submission to show for the billing cycle.

When the monthly invoice arrives, sponsors and principal investigators who evaluate the clinical operations retainer against visible study milestones apply a calculation that systematically undervalues ongoing compliance advisory: “what did we receive this month?” If the answer is “two deviation reports, an IRB continuing review submission, and a monitoring visit preparation report,” the invoice may feel disconnected from the study’s visible progress — even though the two deviation reports prevented a pattern of unreported deviations from becoming an inspection finding, the IRB submission prevented an approval lapse that would have suspended study activities, and the monitoring visit preparation identified a delegation of authority gap before the monitor arrived and found it. The prevention hours are the majority of the retainer value; the deliverable documents are the compliance record that would matter only if an FDA inspector asked to review it.

HourTab is built for exactly this billing challenge. Import your time-tracker CSV, and HourTab generates a public retainer-hours URL that your sponsor or PI can bookmark. The URL shows a live view of hours logged against the monthly retainer allocation, with the work log entries visible in chronological order. The sponsor does not need a login or a portal to see where the retainer hours stand. When the invoice arrives, the sponsor has already seen the protocol deviation review sessions, the IRB monitoring log entry, the SDV planning work, and the monitoring visit preparation hours. The hours are not a surprise; they are a record of the ongoing clinical operations advisory engagement the sponsor has been following in real time.

The Free plan handles one active retainer: a public share URL, CSV import, and a work log with a progress bar showing hours consumed against the monthly allocation. The Solo plan at $9 per month supports up to 10 active retainers with a custom URL slug, no HourTab branding, CSV export, and email-a-summary for month-end reporting. The Studio plan at $19 per month supports unlimited retainers, a branded subdomain, two team seats, per-client headers, and rollover rules for engagements where unused hours carry forward.

Try HourTab free →