Skip to main content

Data Governance

Non-Compliance in Research Data Collection – The Hidden Problem No One Talks About

28 September 2026

By Marinela Zagorscak from the Centre for Trials Research

If you are into baking, you know that even with your favourite recipe and the best ingredients there is a chance that your bake might not come out as you would expect it – maybe the baking powder expired, or you forgot to add one of the ingredients because someone distracted you. There could be multiple reasons.

When setting up a trial nobody is planning to create a non-compliance, however issues happen at every research organisation. It is therefore important to shift the view of ‘this won’t happen in my trial’ to ‘issues might happen, but I’m prepared to recognise them and address them’.

“Protocol and system deviations are not evidence of failure. They are and should be opportunities for stronger research quality.”

Centre for Trials Research (CTR) at Cardiff University has a team of quality assurance and regulatory affairs professionals that work daily on ensuring the research done at the centre is compliant with all the relevant legislation, regulations and guidelines. The procedures explained in CTR Standard Operating Procedures (SOPs) and Policies provide guidance and reassurance to staff that any issues can, and should be addressed, and therefore supports a culture of continuous improvement. Throughout my experience in pharmacovigilance, internal auditing and quality assurance I’ve always emphasised that the aim of the non-compliance and corrective and preventive action process is not about assigning blame (which sometimes feels like it is). It is about protecting participants, ensuring data integrity and maintaining regulatory compliance because a non-compliance can occur in any research setting. Looking at the identified issues from a wider perspective (centre-wide) it helps with sharing the understanding, knowledge, and learning from each other.

What is a non-compliance?

Imagine baking a cake and coming flat from the oven. It obviously didn’t rise. But that’s not the root cause. The question it needs answering is ‘why’? Could it be that the baking powder expired? Or it wasn’t added to the batter? Maybe the recipe was difficult to follow?

Similarly, in research by saying ‘staff oversight’ it can equate to ‘the cake is flat’ in baking, which describes what happened but not why it happened.

A non-compliance can be many things: process gap, procedural oversight, protocol deviation, inconsistency with study requirements, regulatory deviation, Good Clinical Practice (GCP) deviation, etc. Whatever that might be it is important to identify it and, depending on severity or level of risk, take appropriate actions.

The processes in CTR for managing non-compliances

First, if you want to know why your cake didn’t rise, you need to understand which ingredient helps the cake rise. Similarly, to recognise a deviation it is essential to understand the applicable requirements. Staff need to know the relevant regulations, SOPs, trial-specific protocols and complete appropriate training. Only then can they identify when there is an issue and a deviation has occurred.

Identification

The first step of management non-compliances is to identify it. Training is provided to all staff and study teams because anyone can identify an issue and it can be identified through different channels – monitoring visits, internal audits, regulatory inspections, self-reporting by study teams, etc.

Assessment and investigation

Once it’s been identified an assessment of the issues determines – what and when did it happen, who was affected, what are potential impacts, what is the root cause and categorisation of the event.

Documentation

The issue is documented by completing a relevant form that captures the points detailed in the assessment. The form should be accurate, objective, timely and complete.

Corrective and Preventive Actions (CAPAs)

Once the root cause is identified and the event is fully documented, preventive and corrective actions are proposed with timelines for completion given. The actions should correct the immediate issue, prevent recurrence and strengthen processes where required.

Approval and closure

The non-compliance form is reviewed and approved by the relevant staff and collaborators. Once confirmed all appropriate actions have been completed the case can be closed.

Some real-life examples

A member of staff read blog on Medicines and Healthcare products Regulatory Agency (MHRA) on electronic Case Report Forms (eCRFs) and identified some potential gaps in CTR eCRFs systems which would result in an MHRA inspection if not addressed. A review of the CTR processes was completed and several corrective and preventive actions were taken. One of these were to urgently update the Data Management SOP.

A data protection non-compliance was identified when patient identifiable information was found within submitted scan files due to incomplete anonymisation. The trial team took immediate action to stop further submissions, the affected files were reviewed, additional staff training provided, and new standard operating procedure created.

A trial site reported non-compliance where a participant was mistakenly provided with medication intended for another participant. None of the two participants received the Investigational Medicinal Product (IMP) belonging to the other participant. A courier was booked to deliver the correct IMP and pick up the incorrect one to be returned to the trial team and correctly disposed. The root cause was human error, and further measures were implemented to avoid similar issues in future.

Why is it important to have processes and awareness of non-compliances?

Effective non-compliance management is fundamental to research quality. It happens and will happen in different environments regardless of how robust the systems and processes are. But with effective management the number of occurrences, and severity of it can be minimised. Some of the key benefits of this process include protecting research participants, data integrity, maintaining regulatory compliance and promoting a culture of quality.

Sometimes a researcher may feel that reporting an issue could reflect poor performance, but it demonstrates a healthy quality culture. There are positive outcomes from it and can include: improved procedures and workflows, additional training opportunities, enhanced study oversight, identification of systemic issue, prevention of recurring problems, improved participant safety measures and stronger inspection readiness.

“Why it matters?  ☑ protects participants ☑ preserves data integrity ☑ maintains regulatory compliance ☑ improves study processes ☑ strengthens inspection readiness ☑ promotes a culture of quality and learning”

Non-compliances and regulatory inspections

Regulatory inspections often assess how organisations identify and manage non-compliances and different parts of the process may be reviewed by inspectors. It’s not expected from an organisation to be free from non-compliances but to have a robust system that demonstrates effective identification, management and resolution of issues.

“It is important to record non-compliances to maintain trial oversight, to review them periodically and to learn from the issues. Inspectors are not expecting organisations to be free from non-compliances.”

Common Challenges

Completing a non-compliance form can sometimes feel like a detective job or assembling flat-pack furniture. The root cause might seem obvious but digging in deeper and looking at the evidence, you discover a chain of events.
There can be different perspectives on challenges with non-compliances and some of the ones that we have encountered as a Centre (from Sponsor representative perspective) include:

  • Completion of non-compliance forms – this can be time-consuming, lack of understanding what should be included and how to complete, frustrations over potentially reporting and documenting too much
  • Root cause analysis – how to complete this effectively as often only surface-level causes are identified
  • Developing meaningful CAPAs – a corrective and preventive actions that are strong, clearly described and address the root cause

Final thoughts

Going back to baking analogy, most of us would point out the missing ingredient and say to the baker that something is not right with the cake. It is important that the issues in research data collection are also raised, appropriately captured and resolved to ensure compliance, safeguarding the integrity of research and most importantly protecting the rights and safety of research participants. The feedback about the cake is not to criticise the baker, but to help them get better and improve their recipe. Similarly, researchers should view non-compliances as valuable insights on how research works in practice, they can highlight opportunities for improvement and can provide better quality and reliable results.

 

Note: Header image imagined from the text by artist Chris Glynn