Can I accept an electronic signature?

Yes. Electronic signatures are generally enforceable under the federal ESIGN Act and state UETA or equivalent statutes provided intent, consent, attribution, and retention are satisfied. For consumer-facing or healthcare records, confirm any required disclosure and institutional policies before using e-signatures.

Who must sign the deviation log?

Typically the person who discovered the deviation and the principal investigator or designated reviewer should sign. Institutional policies and study protocol determine required signers; list roles clearly in the template to avoid ambiguity.

When must I notify the IRB or sponsor?

Notification timelines depend on IRB and sponsor policies. Serious or unanticipated problems often require rapid reporting — commonly within a few business days — and you should record notification dates and methods in the log.

How long must I retain the log?

Retention depends on sponsor, study contract, and applicable law. Maintain logs for the study period plus any additional years required by sponsor or regulatory guidance; healthcare records may have specific HIPAA-related retention rules.

What if multiple sites report the same deviation?

Use a consistent ID scheme to link related entries across sites. Summarize site-specific details, escalate aggregated findings to sponsor and QA, and track centralized corrective actions in a master deviation register.

How do I correct an entry after submission?

Do not alter original records; add a dated amendment or addendum documenting the correction, who made it, and why. Maintain a clear audit trail showing the original entry and subsequent amendments for inspection and review.

Electronic Signature
Templates
Miscellaneous
Protocol Deviation Log Template

Protocol Deviation Log Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

What the Protocol Deviation Log Template Is

The Protocol Deviation Log Template is a standardized form for recording any departure from an approved study protocol during clinical trials, observational research, or regulated studies. It centralizes key facts — date/time, protocol reference, detailed description, personnel involved, root cause, corrective actions, and impact assessment — into an auditable record. Properly completed logs support sponsor and IRB oversight, preserve evidence for monitoring and inspection, and help teams analyze trends and implement preventive measures to protect subject safety and data integrity.

Why a Consistent Deviation Log Matters

A consistent Protocol Deviation Log Template reduces ambiguity, speeds corrective actions, and creates a reliable audit trail for sponsors, IRBs, and regulators while helping teams measure and prevent recurring issues.

Who Typically Completes and Reviews These Logs

Typical users include clinical operations staff, principal investigators, quality teams, and regulatory officers who oversee study compliance.

Clinical research coordinators documenting deviations during participant visits and immediate corrective steps
Principal investigators reviewing impact on subject safety, protocol integrity, and reporting decisions
Quality assurance and regulatory affairs monitoring trends and preparing reports for IRB and sponsor review

Monitors, auditors, and sponsors commonly review logged deviations during routine monitoring visits and formal inspections to confirm corrective actions and trends.

Step-by-Step: Completing the Deviation Log

Record deviations promptly, then follow the sequence below to assess impact, notify stakeholders, and document corrective actions.

01

Identify Event: Record who, when, and where the deviation occurred.
02

Describe Deviation: Detail expected versus actual procedure steps.
03

Assess Impact: Evaluate subject safety and data integrity.
04

Implement CAPA: Document corrective and preventive actions and verification.

Recommended Online Form Configuration

Set form rules to enforce required fields, timestamps, and role-based approvals so records are uniform and exportable for audits.

Field	Configuration
Required Fields	Log ID, Date, Description, CAPA required
Auto Timestamp	Enable server timestamp on submit
Signer Roles	PI, Site Coordinator, QA approver
Audit Trail	Enable full action log and exports

Typical Routing and Review Flow

Define a clear routing path so reviewers understand responsibilities and approval order for each logged deviation.

Upload Document: Save completed log to the study file repository.
Assign Reviewer: Notify PI or QA for initial assessment.
Complete Review: Reviewer documents impact, recommendations, and sign-off.
Archive & Report: Store final record and submit reports to sponsor/IRB.

Essential Sections to Include in the Template

Include structured fields to capture identifiers, timeline, description, accountability, corrective plans, and assessment to meet audit and regulatory expectations.

Log ID

A unique identifier links the deviation to site records and tracking systems and prevents duplicate entries across databases.

Date/Time

Capture discovery and occurrence timestamps precisely; these timestamps determine reporting windows and sequence of corrective measures.

Protocol Section

Cite the exact protocol text or SOP section; this enables reviewers to map the deviation to specific procedural requirements quickly.

Description

Provide a factual narrative of expected versus actual procedures, affected subjects, equipment, and any immediate mitigations taken.

Corrective Action

Record immediate actions, longer-term fixes, responsible parties, due dates, and verification steps to close the issue.

Impact Assessment

Document safety and data integrity assessments, need for subject notification, and whether IRB or regulatory reporting is required.

Common Preparation Errors to Avoid

Delaying entry until after investigation: delays reduce accuracy of timestamps, impair root‑cause analysis, and may miss reporting windows.
Using vague descriptions or abbreviations: unclear narratives hinder reviewer understanding and create extra follow-up work during audits.
Missing verification evidence: failing to attach supporting documents, logs, or emails weakens the record of corrective action completion.
Inconsistent identifiers across sites: mismatched IDs make aggregation and trend analysis difficult for sponsors and quality teams.

Consequences of Incorrect or Incomplete Logs

Regulatory Findings: Warning letters or inspection observations

Data Integrity: Compromised datasets and unreliable results

IRB Sanctions: Suspension or increased oversight

Sponsor Action: Protocol hold or site termination

Financial Penalties: Contractual or regulatory fines

Participant Risk: Potential for patient harm or mismanagement

Security and Compliance Considerations

Encryption: TLS in transit, AES-256 at rest

Access Controls: Role-based signers and approvers

Audit Trail: Tamper-evident action logs

HIPAA Support: BAA available for PHI workflows

21 CFR Part 11: Electronic records and signatures support

Certifications: SOC 2, ISO 27001, PCI compliance

Key Reporting and Documentation Deadlines

Timely entry and notification reduce regulatory risk; follow protocol and IRB timelines and document when each notification was made and received.

Initial Entry Deadline:

Enter log within 24–72 hours of discovery.

IRB Reporting:

Report serious or unanticipated problems per IRB policy, often within 5 business days.

Sponsor Notification:

Notify sponsor per protocol timelines, commonly within 24–72 hours.

FDA Reporting:

Submit to FDA when safety impact meets reporting thresholds.

Record Retention:

Retain logs according to sponsor and regulatory guidance.

Milestones from Discovery to Closure

Outline sequential milestones so teams can see discovery, review, corrective action, and closure deadlines for each logged deviation.

01

Discovery

Event detected and recorded immediately.

02

Initial Review

PI or designee assesses impact and notifies stakeholders.

03

Corrective Action

Implement fixes and document verification steps.

04

Closure

Confirm resolution, archive record, and report closure.

eSignature Vendor Comparison for Deviation Logs

Compare vendor plans and features relevant to regulated deviation logs; signNow is shown first per platform comparison rules.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Available (Business Premium)	Available	Available	Available	Available
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Platform and Integration Considerations

Ensure your chosen system supports secure storage, tamper-evident audit trails, and appropriate signer authentication for regulated records.

Integrations: EDC, eTMF, and document repositories
Authentication: Email, SMS, or two-factor options
File Formats: PDF, PDF/A, DOCX exports supported

Prefer platforms that integrate with clinical trial systems (EDC, eTMF) and can export PDF/A with embedded audit logs; confirm HIPAA, 21 CFR Part 11, and institutional compliance support.

Frequently Asked Questions and Troubleshooting

Answers to common questions about e-signature acceptance, required signatories, reporting, retention, multi-site coordination, and correcting logged entries.

Need help? Contact support

Can I accept an electronic signature?
Yes. Electronic signatures are generally enforceable under the federal ESIGN Act and state UETA or equivalent statutes provided intent, consent, attribution, and retention are satisfied. For consumer-facing or healthcare records, confirm any required disclosure and institutional policies before using e-signatures.
Who must sign the deviation log?
Typically the person who discovered the deviation and the principal investigator or designated reviewer should sign. Institutional policies and study protocol determine required signers; list roles clearly in the template to avoid ambiguity.
When must I notify the IRB or sponsor?
Notification timelines depend on IRB and sponsor policies. Serious or unanticipated problems often require rapid reporting — commonly within a few business days — and you should record notification dates and methods in the log.
How long must I retain the log?
Retention depends on sponsor, study contract, and applicable law. Maintain logs for the study period plus any additional years required by sponsor or regulatory guidance; healthcare records may have specific HIPAA-related retention rules.
What if multiple sites report the same deviation?
Use a consistent ID scheme to link related entries across sites. Summarize site-specific details, escalate aggregated findings to sponsor and QA, and track centralized corrective actions in a master deviation register.
How do I correct an entry after submission?
Do not alter original records; add a dated amendment or addendum documenting the correction, who made it, and why. Maintain a clear audit trail showing the original entry and subsequent amendments for inspection and review.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now

Protocol Deviation Log Template