The investigator must update the IRB/IEC at defined checkpoints: continuing review at least annually (or more often if the IRB requires), immediately upon any change that alters risk or the study's conduct, and promptly for unanticipated problems, serious adverse events per local rules, protocol deviations, and enrollment or safety reports the committee specifies. Progress reporting is a scheduled obligation and an event-driven one, and the trigger is usually written into the approval letter, the protocol, and applicable regulation.
Investigators often treat IRB communication as a paperwork task that happens at submission and closure. In practice, the approval is a living agreement. The committee authorized a specific study, at a specific site, with specific risks, under a specific consent document. Every material change to that picture is a reason to go back to the committee. Understanding why the rules work this way makes the deadlines far easier to remember than memorizing a list.
This explainer covers the mechanisms behind progress reporting, the timing thresholds that apply, the situations where well-prepared sites still get it wrong, and the practical steps that keep a study in good standing.
The oversight mechanism
An IRB or IEC does not approve a study once and then step away. It makes an ongoing judgment that the balance of risk to participants against the value of the knowledge remains acceptable. That judgment depends on information only the site holds: how many participants have enrolled, what adverse events have occurred, whether the population in the room matches the population in the protocol, and whether the consent process is working.
Progress reporting is the channel that keeps that judgment current. When an investigator submits a continuing review report, the committee re-weighs the same factors it considered at initial review, now with real data. When an investigator reports an unanticipated problem promptly, the committee can decide whether enrollment should pause, whether consent language needs revision, or whether other sites running the same protocol need to know.
The underlying principle in US regulation is that the IRB must be able to determine whether the study should continue. That is why continuing review exists as a scheduled event and why certain events cannot wait for the schedule. The committee's authority to approve, modify, suspend, or terminate depends on receiving timely information. A site that reports late has not merely missed a deadline; it has temporarily removed the committee's ability to exercise its authority. A plain way to say it: the IRB cannot supervise what it cannot see.
Most committees also delegate day-to-day review to a convened board or an expedited reviewer. Progress reports typically go to the same body that conducted the initial review, which is why submission formats and portals differ so much between institutions.
Timing thresholds, reconciled
Several clocks run at once, and they are not identical. The most common confusion is treating the federal minimum as the institutional requirement. The federal floor for continuing review in the US is at least once per year for studies that require it, but an IRB may set a shorter interval, and many do for higher-risk protocols. The approval letter governs. If it says nine months, the deadline is nine months, and the federal minimum is irrelevant to that site's obligation.
Event-driven reporting has its own clocks. Unanticipated problems involving risk to participants or others must be reported to the IRB promptly, and the working interpretation at most institutions is within days, not weeks. Serious adverse events are reported on the timeline the IRB specifies, which is often 24 to 72 hours for deaths and serious events, with follow-up reports as information develops. Protocol deviations are usually reported at continuing review unless they meet the unanticipated-problem threshold, in which case the prompt clock applies.
The reconciliation rule is simple: the strictest applicable requirement controls. If the sponsor requires five-day reporting, the IRB requires prompt reporting, and the site's standard operating procedure requires 48 hours, the site follows 48 hours. Good sites build a single internal calendar that takes the earliest of all applicable deadlines rather than tracking each rule separately. That calendar should be reviewed whenever an approval letter is reissued, because intervals can change at renewal.
Timeline of reporting obligations
| Stage or event | Typical reporting obligation | Common timing threshold |
|---|---|---|
| Initial approval issued | Note the expiration date and any special conditions | At approval |
| Enrollment or progress milestone | Progress report if the IRB requires interim reports | Per approval letter, often every 6-12 months |
| Continuing review | Full renewal submission | At least annually; shorter if IRB requires |
| Protocol amendment | Amendment submission before implementation | Before changes take effect, except to eliminate immediate hazard |
| Unanticipated problem | Prompt report to the IRB | Within days; institution-specific, often 24-72 hours |
| Serious adverse event | Report per IRB and sponsor rules | Often 24-72 hours for deaths or serious events |
| Study closure | Final report | Within the interval the IRB specifies, commonly 30-90 days |
The table is a scaffold, not a substitute for the approval letter. Intervals vary by institution, by risk category, and by whether the study involves vulnerable populations or an investigational drug or device. Sites that run multiple protocols should keep a single tracking sheet with the actual dates from each approval document rather than relying on memory of the general rule.
Edge cases that change the clock
Several situations compress the reporting timeline or create obligations that sites do not anticipate. Each one is a place where the general rule is not enough.
A protocol change made to eliminate an immediate hazard to participants may be implemented before IRB approval, but the IRB must be notified promptly afterward. This is the one narrow exception to the rule that changes wait for approval.
A single serious adverse event that is both unexpected and related or possibly related to the study intervention can meet the definition of an unanticipated problem, which converts a routine safety report into a prompt IRB report. The same event may also trigger a sponsor report and a data safety monitoring board review.
Enrollment of a population not described in the approved protocol, such as a prisoner or a child in a study approved only for adults, is a deviation that usually rises to the level of an unanticipated problem because it changes the risk assessment.
A change in the availability of an alternative treatment can alter the risk-benefit balance without any change at the site. Some IRBs ask about this at continuing review; investigators should flag it when they learn of it.
A lapse in approval is its own emergency. If the approval expires before renewal is processed, the site generally must stop all study activity involving participants, including enrollment and intervention, until approval is reinstated. Many institutions require a prompt report of the lapse itself. This is the counterintuitive point that catches experienced coordinators: a continuing review submitted on time but not approved by the expiration date still produces a lapse, so the practical deadline is the submission date that guarantees approval before expiration, not the expiration date itself.
Misconceptions that cause trouble
The most common misconception is that continuing review is a formality. Committees use it to reassess risk, and a report that omits enrollment numbers, adverse events, or deviations forces the committee to approve blind. Some approvals have been modified or conditioned at renewal because the progress report revealed a drifting population or an unaddressed safety signal.
A second misconception is that only serious adverse events matter. Unanticipated problems can include events that are not serious in the regulatory sense, such as a breach of confidentiality or a consent form error that affected participants' decisions. The reportability question turns on unexpectedness, relatedness, and risk, not on severity alone.
A third is that the sponsor's safety reporting satisfies the IRB obligation. Sponsor reports to regulators and IRB reports serve different purposes and often run on different clocks. A site that forwards sponsor correspondence and assumes it counts as its own report can miss the IRB deadline entirely. The site's report should identify the event, its relationship to the study, and what the site did in response.
A fourth is that verbal communication suffices. Most committees require written submission through their system, and a phone call to the chair does not create a record. Emergency deviations still require written follow-up.
A final misconception concerns multicenter trials. Each site's IRB has its own reporting requirements, and reliance agreements do not necessarily align the clocks. A central IRB may set one interval while a local committee retains jurisdiction over certain events. Sites should confirm in writing which committee receives which report before the first participant enrolls.
Red-flag warnings
Enrollment continuing after a lapse in approval is a serious compliance problem; stop study activity and contact the IRB immediately. A death on study reported only at continuing review, when the IRB's rules require prompt notice, is a reportable failure regardless of cause. Protocol changes implemented before approval, outside the immediate-hazard exception, are unapproved changes even if they seem minor. A progress report that omits known deviations or adverse events undermines the committee's risk assessment and can trigger audit findings. Assuming a central IRB's calendar covers every site's local obligations is a recurring source of missed reports. Destroying or altering source documents before a reporting question is resolved can create a separate compliance issue.
Practical actions for the site
The work of staying current is mostly administrative discipline applied early. These steps are concrete and can be built into a standard operating procedure.
Build a single reporting calendar from the approval letter. Enter the expiration date, any interim progress report dates, and every event-driven threshold the letter names. Set internal reminders at 90, 60, and 30 days before continuing review, and treat the 30-day mark as the point at which the submission is at risk of a lapse.
Write the event-reporting pathway before the first enrollment. Name who decides whether an event is an unanticipated problem, who submits, and within what number of hours, using the strictest of the sponsor, IRB, and institutional requirements.
Keep a running log of deviations, adverse events, and enrollment counts. A log updated weekly turns the continuing review report into an assembly task rather than a reconstruction exercise.
Confirm jurisdiction in writing for every committee that touches the study, including central and local IRBs. State which reports go to which committee and on what schedule.
Submit amendments before implementation unless the change is needed to eliminate an immediate hazard, and document the rationale in the submission if the exception applies.
Reconcile the multiple deadlines at least once per year and whenever an approval letter is reissued. The strictest requirement controls.
Limitations and what the rules cannot settle
Reporting requirements are set by a combination of federal regulation, institutional policy, and the specific terms of each approval, and they vary across countries and committees. Nothing here substitutes for the approval letter, the protocol, the sponsor's requirements, or the institution's research policies. The definitions that matter most, including unanticipated problem and prompt, are interpreted differently across committees, and a site should get its own committee's interpretation in writing rather than infer it from another institution's practice. Where a specific interval is not stated in the approval document, the site should ask the IRB administrator to confirm it before relying on a default.
[This article is general educational information about research oversight processes, not a legal opinion or a substitute for regulatory or institutional guidance. Reporting obligations depend on the applicable regulations, the IRB/IEC approval letter, the protocol, and institutional policy. Consult your institution's research compliance office or a qualified professional for guidance on a specific study.]