45 CFR 46 -- the Common Rule -- establishes the requirements for IRB oversight of human subjects research. While it does not prescribe specific safety reporting forms, it requires IRBs to conduct continuing review and to be notified of events that affect participant safety. The IRB's interpretation of 45 CFR 46 generates the site's IRB safety reporting obligations, which the RC must execute.

I want to be precise about something that new regulatory coordinators sometimes misunderstand: these frameworks are not redundant. They address different aspects of the safety reporting system, and they impose obligations on different parties. A single safety event at a site can trigger requirements under all three frameworks simultaneously -- and the RC must satisfy each one according to its own terms, its own timeline, and its own documentation standard.

RC task generated: Maintain a protocol-by-protocol reference of safety reporting thresholds and timelines. Monitor compliance with protocol-specific timelines for each active study.

Section 2.7.2(b): SAE reporting with causality assessment

The provision states: all SAEs "should be reported immediately (after the investigator reasonably becomes aware of the event) to the sponsor," and "the investigator should also include an assessment of causality."

This is the provision that drives the most time-sensitive RC work. "Immediately" is not a defined number of hours in E6(R3) -- it is operationally interpreted through the protocol's safety reporting plan, which typically specifies 24 hours for initial notification. But "immediately" also means the RC cannot batch SAE transmissions. Each completed SAE report must be transmitted to the sponsor as soon as the investigator's causality assessment is documented.

The provision also requires follow-up reports: "subsequent information should be submitted as a follow-up report, as necessary." This creates an ongoing tracking obligation -- the RC must monitor open SAE reports and ensure that follow-up information (discharge summaries, autopsy reports, additional test results) is submitted when it becomes available.

RC tasks generated: Transmit completed SAE reports to the sponsor within protocol-specified timelines. Track open SAE reports requiring follow-up. Ensure follow-up reports are submitted when additional information becomes available.

Section 2.7.2(c): death reporting

For reported deaths, the provision states: "the investigator should supply the sponsor, the IRB/IEC and, where applicable, the regulatory authority with any additional requested information (e.g., autopsy reports and terminal medical reports) when they become available."

This provision creates a multi-destination reporting obligation from a single event. A participant death triggers simultaneous reporting to the sponsor, the IRB, and potentially the regulatory authority -- each with its own timeline and content requirements. The RC must coordinate all three tracks.

RC task generated: Coordinate multi-destination reporting for participant deaths, ensuring the sponsor, IRB, and (if applicable) regulatory authority each receive the required information on the required timeline.

Section 2.7.2(d): delegation with retained responsibility

We addressed this provision extensively in L2. In the regulatory requirements context, what matters is the operational implication: the RC performs delegated safety reporting activities, but the investigator retains accountability. This means the RC must maintain a clear delegation record for each study, and the RC's work must be performed under documented oversight.

RC task generated: Ensure the delegation log accurately reflects the safety reporting activities delegated to the RC for each study. Maintain documentation that supports the investigator's oversight of delegated activities.

The provision states that the sponsor "should aggregate, as appropriate, and review in a timely manner relevant safety information," and that information affecting participant willingness, trial conduct, or IRB/regulatory approval "should be communicated to the participants, investigator, IRB/IEC and regulatory authorities, as applicable, in a timely manner."

This provision is the engine behind every safety letter, every Investigator's Brochure update, and every DSMB communication the RC receives. The sponsor reviews aggregate safety data, identifies signals, and communicates them outward. The investigator site is one of the destinations.

RC task generated: Process all inbound sponsor safety communications -- receive, log, route to the investigator, and determine whether IRB submission is required.

Section 3.13.2(a)-(b): sponsor reporting to regulatory authorities

These provisions require the sponsor to submit safety updates and expedited SUSAR reports to the regulatory authority. The RC does not execute these tasks -- they are the sponsor's obligation. But understanding them matters because the regulatory authority's response to sponsor reports can generate follow-up actions at the site level. When the FDA receives a SUSAR report and requests additional site-level information, the RC may need to coordinate the site's response.

Section 3.13.2(c): expectedness assessment against the IB

This provision specifies that safety reporting to regulatory authorities "should be undertaken by assessing the expectedness of the reaction in relation to the applicable product information (e.g., the reference safety information (RSI) contained within the Investigator's Brochure)."

For the RC, this provision underscores a task from L2: the RC must maintain current copies of every Investigator's Brochure for every active study, because the Reference Safety Information in the IB is the basis against which expectedness is determined. When the IB is updated, the Reference Safety Information may change -- and that change affects what counts as "unexpected" going forward.

RC task generated: Maintain current IB versions for all active studies. When an updated IB is received, route it to the investigator and determine whether the updated Reference Safety Information changes any open safety assessments.

Section 3.13.2(d): SUSAR reporting to investigators and IRBs

This is, in my view, the single provision that generates the most RC workload. It states: "The reporting of SUSARs to investigator(s)/institutions(s) and to the IRB(s)/IEC(s) should be undertaken in a manner that reflects the urgency of action required."

When the sponsor identifies a SUSAR, the sponsor notifies the site. That notification arrives as an IND Safety Report (in the U.S. context) or equivalent document. The RC must then do three things: (1) ensure the investigator receives and reviews the notification, (2) document the investigator's review, and (3) determine whether the IRB requires submission of this notification -- and if so, submit it within the IRB's specified timeline.

For a site running 15 studies, SUSAR notifications can number in the dozens per month. Each one follows this three-step sequence. This is volume work with zero tolerance for missed items.

RC tasks generated: Receive and log all SUSAR notifications. Ensure investigator review and documented acknowledgment. Submit to the IRB per the IRB's reporting requirements and timelines.

Section 3.13.2(e)-(f): urgent issues and alternative arrangements

Section 3.13.2(e) addresses urgent safety issues requiring "immediate attention or action" -- these must be reported "without undue delay." Section 3.13.2(f) permits alternative arrangements for safety reporting, prospectively agreed upon and described in the protocol.

For the RC, 3.13.2(e) establishes that some safety communications demand a faster response than the standard processing timeline. The RC must be able to identify urgent communications and escalate them accordingly. And 3.13.2(f) means the RC must check whether any active study has negotiated alternative safety reporting arrangements that differ from the standard E6(R3) framework.

RC task generated: Identify and escalate urgent safety communications per 3.13.2(e). Check protocols for alternative safety reporting arrangements per 3.13.2(f).

(c) All SUSARs in accordance with applicable regulatory requirements. This is the provision that creates the IRB submission obligation when the RC receives a SUSAR notification from the sponsor. Not every IRB requires submission of every SUSAR -- but the determination must be made for each one.

(d) New information that may adversely affect the safety of the participants or the conduct of the trial. This is the broadest category. It encompasses safety information that does not fit neatly into the SUSAR category but still has implications for participant safety or trial conduct. Updated Investigator's Brochures, DSMB recommendations, and sponsor safety letters may trigger reporting under this provision.

These timelines are the sponsor's obligation, not the site's. But they determine when IND Safety Reports arrive at the site. A SUSAR that occurred at a site in Houston may generate an IND Safety Report that arrives at a site in Portland 10 days later. The RC at the Portland site then has its own timeline obligations: investigator review, documentation, and IRB submission (if required by the IRB).

The 15-day and 7-day reports

The two reporting timelines create two categories of inbound safety communication:

15-day IND Safety Reports cover SUSARs -- suspected unexpected serious adverse reactions. These are the standard expedited reports the RC processes most frequently. They describe an event at another site, the sponsor's assessment, and any changes to the risk-benefit profile.

7-day IND Safety Reports are reserved for events suggesting a significant risk to trial participants -- typically fatal or life-threatening SUSARs. These are urgent communications. When the RC receives a 7-day report, the investigator notification and IRB submission (if required) should be expedited accordingly.

RC tasks generated: Receive and log IND Safety Reports. Distinguish 15-day from 7-day reports. Prioritize 7-day reports for immediate investigator review. Submit to the IRB per the IRB's reporting requirements. Maintain documentation of the complete processing chain.

What 312.32 does NOT require of the site

A point of clarification that matters operationally: 21 CFR 312.32 imposes obligations on the sponsor, not the investigator. The investigator's reporting obligations to the sponsor are governed by the protocol and by ICH E6(R3) Section 2.7.2. The RC should understand 312.32 because it explains where IND Safety Reports come from and why they arrive on the timelines they do -- but the RC's direct regulatory obligation for outbound reporting flows from E6(R3) and from 45 CFR 46, not from 312.32.

For the RC, this provision generates two obligations. First, the RC must prepare and submit the safety component of each study's continuing review package -- typically an annual safety summary that aggregates all reportable events for the review period. Second, the RC must track continuing review dates across the portfolio and ensure safety summaries are submitted before the IRB's deadline. A lapse in continuing review approval means the study cannot enroll new participants and, in some cases, must suspend all research activities until approval is restored. That is not a paperwork inconvenience. It is a regulatory emergency.

Unanticipated problems involving risks to subjects

45 CFR 46.103(b)(5) requires institutions to report to the IRB "any unanticipated problems involving risks to subjects or others." The OHRP guidance on this provision defines an unanticipated problem as an event that is (1) unexpected in terms of nature, severity, or frequency, (2) related or possibly related to participation in the research, and (3) suggests that the research places subjects or others at a greater risk of harm than was previously known or recognized.

This is the provision that determines a substantial portion of the RC's IRB safety reporting workload. Not every adverse event is an unanticipated problem. Not every serious adverse event is an unanticipated problem. The determination depends on the three-part test -- and that determination, while informed by the RC's analysis, ultimately rests with the investigator's medical judgment and the IRB's interpretation.

RC tasks generated: Prepare continuing review safety summaries for each active study. Track continuing review dates across the portfolio. Prepare and submit reports of unanticipated problems per the IRB's reporting criteria and timelines.

21 CFR 312.32 (downstream effect): The sponsor receives this report and, along with data from other sites, determines whether the event qualifies as a SUSAR. If so, the sponsor generates an IND Safety Report. That report will be sent back to the originating site and to all other sites participating in the trial. When the RC at other sites receives this IND Safety Report weeks later, the RC's processing obligation begins.

E6(R3) Section 1.4.8(c)-(d) and 45 CFR 46.103(b)(5): At the originating site, the investigator determines whether this event meets the criteria for an unanticipated problem (unexpected, related, and suggesting greater risk than previously known). If so, the RC must prepare and submit a report to the IRB within the IRB's specified timeline. If the event resulted in death, Section 2.7.2(c) adds a further obligation to provide autopsy reports and terminal medical reports when available -- to the sponsor, the IRB, and the regulatory authority.

One event. Three frameworks. Multiple reporting tracks running in parallel, each with its own deadline. This is what the regulatory coordinator manages. And this is why the matrix is not an academic exercise -- it is a survival tool.

Multi-IRB sites face multiplicative complexity. A site that uses one central IRB and one institutional IRB across its portfolio must maintain two separate reporting matrices for IRB submissions. The central IRB may have a 10-business-day window for SUSAR submissions. The institutional IRB may require 5 business days and a different form. The RC must know which IRB governs which study and apply the correct reporting requirements to each.

The "promptly" standard creates operational ambiguity that the RC must resolve. E6(R3) uses "promptly" and "immediately" without defining them in hours or days. 45 CFR 46 uses "promptly" without a numeric timeline. The protocol and the IRB's policies resolve this ambiguity operationally -- but only if the RC has read them and built the specific timelines into the tracking system. An RC who relies on "I'll get to it as soon as I can" instead of "this is due by Thursday at 5:00 PM per the IRB's 5-business-day reporting policy" is setting the site up for a compliance failure.

45 CFR 46 -- the Common Rule -- establishes the requirements for IRB oversight of human subjects research. While it does not prescribe specific safety reporting forms, it requires IRBs to conduct continuing review and to be notified of events that affect participant safety. The IRB's interpretation of 45 CFR 46 generates the site's IRB safety reporting obligations, which the RC must execute.

I want to be precise about something that new regulatory coordinators sometimes misunderstand: these frameworks are not redundant. They address different aspects of the safety reporting system, and they impose obligations on different parties. A single safety event at a site can trigger requirements under all three frameworks simultaneously -- and the RC must satisfy each one according to its own terms, its own timeline, and its own documentation standard.

RC task generated: Maintain a protocol-by-protocol reference of safety reporting thresholds and timelines. Monitor compliance with protocol-specific timelines for each active study.

Section 2.7.2(b): SAE reporting with causality assessment

The provision states: all SAEs "should be reported immediately (after the investigator reasonably becomes aware of the event) to the sponsor," and "the investigator should also include an assessment of causality."

This is the provision that drives the most time-sensitive RC work. "Immediately" is not a defined number of hours in E6(R3) -- it is operationally interpreted through the protocol's safety reporting plan, which typically specifies 24 hours for initial notification. But "immediately" also means the RC cannot batch SAE transmissions. Each completed SAE report must be transmitted to the sponsor as soon as the investigator's causality assessment is documented.

The provision also requires follow-up reports: "subsequent information should be submitted as a follow-up report, as necessary." This creates an ongoing tracking obligation -- the RC must monitor open SAE reports and ensure that follow-up information (discharge summaries, autopsy reports, additional test results) is submitted when it becomes available.

RC tasks generated: Transmit completed SAE reports to the sponsor within protocol-specified timelines. Track open SAE reports requiring follow-up. Ensure follow-up reports are submitted when additional information becomes available.

Section 2.7.2(c): death reporting

For reported deaths, the provision states: "the investigator should supply the sponsor, the IRB/IEC and, where applicable, the regulatory authority with any additional requested information (e.g., autopsy reports and terminal medical reports) when they become available."

This provision creates a multi-destination reporting obligation from a single event. A participant death triggers simultaneous reporting to the sponsor, the IRB, and potentially the regulatory authority -- each with its own timeline and content requirements. The RC must coordinate all three tracks.

RC task generated: Coordinate multi-destination reporting for participant deaths, ensuring the sponsor, IRB, and (if applicable) regulatory authority each receive the required information on the required timeline.

Section 2.7.2(d): delegation with retained responsibility

We addressed this provision extensively in L2. In the regulatory requirements context, what matters is the operational implication: the RC performs delegated safety reporting activities, but the investigator retains accountability. This means the RC must maintain a clear delegation record for each study, and the RC's work must be performed under documented oversight.

RC task generated: Ensure the delegation log accurately reflects the safety reporting activities delegated to the RC for each study. Maintain documentation that supports the investigator's oversight of delegated activities.

The provision states that the sponsor "should aggregate, as appropriate, and review in a timely manner relevant safety information," and that information affecting participant willingness, trial conduct, or IRB/regulatory approval "should be communicated to the participants, investigator, IRB/IEC and regulatory authorities, as applicable, in a timely manner."

This provision is the engine behind every safety letter, every Investigator's Brochure update, and every DSMB communication the RC receives. The sponsor reviews aggregate safety data, identifies signals, and communicates them outward. The investigator site is one of the destinations.

RC task generated: Process all inbound sponsor safety communications -- receive, log, route to the investigator, and determine whether IRB submission is required.

Section 3.13.2(a)-(b): sponsor reporting to regulatory authorities

These provisions require the sponsor to submit safety updates and expedited SUSAR reports to the regulatory authority. The RC does not execute these tasks -- they are the sponsor's obligation. But understanding them matters because the regulatory authority's response to sponsor reports can generate follow-up actions at the site level. When the FDA receives a SUSAR report and requests additional site-level information, the RC may need to coordinate the site's response.

Section 3.13.2(c): expectedness assessment against the IB

This provision specifies that safety reporting to regulatory authorities "should be undertaken by assessing the expectedness of the reaction in relation to the applicable product information (e.g., the reference safety information (RSI) contained within the Investigator's Brochure)."

For the RC, this provision underscores a task from L2: the RC must maintain current copies of every Investigator's Brochure for every active study, because the Reference Safety Information in the IB is the basis against which expectedness is determined. When the IB is updated, the Reference Safety Information may change -- and that change affects what counts as "unexpected" going forward.

RC task generated: Maintain current IB versions for all active studies. When an updated IB is received, route it to the investigator and determine whether the updated Reference Safety Information changes any open safety assessments.

Section 3.13.2(d): SUSAR reporting to investigators and IRBs

This is, in my view, the single provision that generates the most RC workload. It states: "The reporting of SUSARs to investigator(s)/institutions(s) and to the IRB(s)/IEC(s) should be undertaken in a manner that reflects the urgency of action required."

When the sponsor identifies a SUSAR, the sponsor notifies the site. That notification arrives as an IND Safety Report (in the U.S. context) or equivalent document. The RC must then do three things: (1) ensure the investigator receives and reviews the notification, (2) document the investigator's review, and (3) determine whether the IRB requires submission of this notification -- and if so, submit it within the IRB's specified timeline.

For a site running 15 studies, SUSAR notifications can number in the dozens per month. Each one follows this three-step sequence. This is volume work with zero tolerance for missed items.

RC tasks generated: Receive and log all SUSAR notifications. Ensure investigator review and documented acknowledgment. Submit to the IRB per the IRB's reporting requirements and timelines.

Section 3.13.2(e)-(f): urgent issues and alternative arrangements

Section 3.13.2(e) addresses urgent safety issues requiring "immediate attention or action" -- these must be reported "without undue delay." Section 3.13.2(f) permits alternative arrangements for safety reporting, prospectively agreed upon and described in the protocol.

For the RC, 3.13.2(e) establishes that some safety communications demand a faster response than the standard processing timeline. The RC must be able to identify urgent communications and escalate them accordingly. And 3.13.2(f) means the RC must check whether any active study has negotiated alternative safety reporting arrangements that differ from the standard E6(R3) framework.

RC task generated: Identify and escalate urgent safety communications per 3.13.2(e). Check protocols for alternative safety reporting arrangements per 3.13.2(f).

(c) All SUSARs in accordance with applicable regulatory requirements. This is the provision that creates the IRB submission obligation when the RC receives a SUSAR notification from the sponsor. Not every IRB requires submission of every SUSAR -- but the determination must be made for each one.

(d) New information that may adversely affect the safety of the participants or the conduct of the trial. This is the broadest category. It encompasses safety information that does not fit neatly into the SUSAR category but still has implications for participant safety or trial conduct. Updated Investigator's Brochures, DSMB recommendations, and sponsor safety letters may trigger reporting under this provision.

These timelines are the sponsor's obligation, not the site's. But they determine when IND Safety Reports arrive at the site. A SUSAR that occurred at a site in Houston may generate an IND Safety Report that arrives at a site in Portland 10 days later. The RC at the Portland site then has its own timeline obligations: investigator review, documentation, and IRB submission (if required by the IRB).

The 15-day and 7-day reports

The two reporting timelines create two categories of inbound safety communication:

15-day IND Safety Reports cover SUSARs -- suspected unexpected serious adverse reactions. These are the standard expedited reports the RC processes most frequently. They describe an event at another site, the sponsor's assessment, and any changes to the risk-benefit profile.

7-day IND Safety Reports are reserved for events suggesting a significant risk to trial participants -- typically fatal or life-threatening SUSARs. These are urgent communications. When the RC receives a 7-day report, the investigator notification and IRB submission (if required) should be expedited accordingly.

RC tasks generated: Receive and log IND Safety Reports. Distinguish 15-day from 7-day reports. Prioritize 7-day reports for immediate investigator review. Submit to the IRB per the IRB's reporting requirements. Maintain documentation of the complete processing chain.

What 312.32 does NOT require of the site

A point of clarification that matters operationally: 21 CFR 312.32 imposes obligations on the sponsor, not the investigator. The investigator's reporting obligations to the sponsor are governed by the protocol and by ICH E6(R3) Section 2.7.2. The RC should understand 312.32 because it explains where IND Safety Reports come from and why they arrive on the timelines they do -- but the RC's direct regulatory obligation for outbound reporting flows from E6(R3) and from 45 CFR 46, not from 312.32.

For the RC, this provision generates two obligations. First, the RC must prepare and submit the safety component of each study's continuing review package -- typically an annual safety summary that aggregates all reportable events for the review period. Second, the RC must track continuing review dates across the portfolio and ensure safety summaries are submitted before the IRB's deadline. A lapse in continuing review approval means the study cannot enroll new participants and, in some cases, must suspend all research activities until approval is restored. That is not a paperwork inconvenience. It is a regulatory emergency.

Unanticipated problems involving risks to subjects

45 CFR 46.103(b)(5) requires institutions to report to the IRB "any unanticipated problems involving risks to subjects or others." The OHRP guidance on this provision defines an unanticipated problem as an event that is (1) unexpected in terms of nature, severity, or frequency, (2) related or possibly related to participation in the research, and (3) suggests that the research places subjects or others at a greater risk of harm than was previously known or recognized.

This is the provision that determines a substantial portion of the RC's IRB safety reporting workload. Not every adverse event is an unanticipated problem. Not every serious adverse event is an unanticipated problem. The determination depends on the three-part test -- and that determination, while informed by the RC's analysis, ultimately rests with the investigator's medical judgment and the IRB's interpretation.

RC tasks generated: Prepare continuing review safety summaries for each active study. Track continuing review dates across the portfolio. Prepare and submit reports of unanticipated problems per the IRB's reporting criteria and timelines.

21 CFR 312.32 (downstream effect): The sponsor receives this report and, along with data from other sites, determines whether the event qualifies as a SUSAR. If so, the sponsor generates an IND Safety Report. That report will be sent back to the originating site and to all other sites participating in the trial. When the RC at other sites receives this IND Safety Report weeks later, the RC's processing obligation begins.

E6(R3) Section 1.4.8(c)-(d) and 45 CFR 46.103(b)(5): At the originating site, the investigator determines whether this event meets the criteria for an unanticipated problem (unexpected, related, and suggesting greater risk than previously known). If so, the RC must prepare and submit a report to the IRB within the IRB's specified timeline. If the event resulted in death, Section 2.7.2(c) adds a further obligation to provide autopsy reports and terminal medical reports when available -- to the sponsor, the IRB, and the regulatory authority.

One event. Three frameworks. Multiple reporting tracks running in parallel, each with its own deadline. This is what the regulatory coordinator manages. And this is why the matrix is not an academic exercise -- it is a survival tool.

Multi-IRB sites face multiplicative complexity. A site that uses one central IRB and one institutional IRB across its portfolio must maintain two separate reporting matrices for IRB submissions. The central IRB may have a 10-business-day window for SUSAR submissions. The institutional IRB may require 5 business days and a different form. The RC must know which IRB governs which study and apply the correct reporting requirements to each.

The "promptly" standard creates operational ambiguity that the RC must resolve. E6(R3) uses "promptly" and "immediately" without defining them in hours or days. 45 CFR 46 uses "promptly" without a numeric timeline. The protocol and the IRB's policies resolve this ambiguity operationally -- but only if the RC has read them and built the specific timelines into the tracking system. An RC who relies on "I'll get to it as soon as I can" instead of "this is due by Thursday at 5:00 PM per the IRB's 5-business-day reporting policy" is setting the site up for a compliance failure.