How to Apply the 5 Whys Technique in Clinical Deviation Investigations

Why Use the 5 Whys in Clinical Trial RCA?

The 5 Whys technique is a simple but powerful Root Cause Analysis (RCA) tool that helps uncover the true origin of a problem—not just its symptoms. In clinical research, where protocol deviations can disrupt subject safety and data integrity, identifying the root cause is essential for implementing effective Corrective and Preventive Actions (CAPA).

Regulators like the FDA, EMA, and MHRA expect that every significant deviation be investigated using a structured approach. The 5 Whys method satisfies this expectation by providing a traceable rationale behind deviation classification, CAPA actions, and effectiveness monitoring.

This article shows how to apply the 5 Whys method specifically within the GCP-compliant deviation handling process and how it aligns with ICH E6(R2) requirements.

Overview of the 5 Whys Method

The 5 Whys technique involves asking “Why?” multiple times (usually five) to peel away layers of symptoms and expose the root cause of a problem. It is best used when:

• ✅ The issue appears to have one dominant root cause
• ✅ The problem is straightforward, like a missed procedure or documentation lapse
• ✅ Timely RCA is needed to comply with deviation closure timelines

Benefits of using 5 Whys in GCP trials:

• ✅ Easy to apply by site staff, CRAs, or sponsor personnel
• ✅ Suitable for most protocol deviations, especially operational ones
• ✅ Audit-friendly—provides a logical narrative trail
• ✅ Requires no specialized software or tools

Step-by-Step Example: Applying 5 Whys to a Realistic Deviation

Deviation: Subject 207 received IP 1 day early—outside of the protocol-defined visit window.

5 Whys Analysis:

1. Why did the subject receive IP early? → Coordinator scheduled visit incorrectly.
2. Why was the visit scheduled early? → Calendar invite didn’t match protocol-specified visit window.
3. Why was the calendar incorrect? → The coordinator created a manual visit calendar based on a misread version of the protocol.
4. Why was the wrong protocol version used? → Site downloaded version 1.2 instead of version 1.3.
5. Why did this happen? → No SOP for version control of protocol documents at the site.

Root Cause: Lack of a site-level SOP for protocol version control and calendar creation.

CAPA: Implement version-controlled protocol binder SOP, train staff on protocol updates, and use sponsor-supplied visit calculator tools going forward.

Documentation Format for 5 Whys in Deviation Logs

Many sponsors and CROs now require the 5 Whys output to be embedded directly in deviation records or RCA forms. A simple format may include:

Root Cause: Missing SOP for protocol document control.

CAPA: Create and implement SOP. Retrain site staff.

When to Use (and Not Use) the 5 Whys Method

Recommended for:

• ✅ Missed visits or assessments
• ✅ Incorrect dosing or procedure timing
• ✅ Delayed data entry or safety reporting
• ✅ Documentation lapses

Not recommended for:

• ❌ Multi-site systemic issues
• ❌ Cross-functional operational failures
• ❌ Deviations requiring layered root cause categories

In such cases, Fishbone diagrams or FMEA may be more appropriate.

Auditor Expectations for 5 Whys in RCA

Regulators and auditors are increasingly checking whether sponsors and sites used structured RCA methods. For 5 Whys in particular, they will expect:

• ✅ A logical flow between each “Why” and its answer
• ✅ No blame language (e.g., “staff carelessness”)
• ✅ A root cause that is actionable
• ✅ CAPA that addresses the final Why

Example audit finding: “The RCA was inadequate. The deviation form listed ‘staff forgot’ as the reason, with no structured analysis or preventive action.”

Integrating 5 Whys into SOPs and Training

To embed the 5 Whys in your organization’s quality culture:

• ✅ Add a 5 Whys template to deviation forms and CAPA logs
• ✅ Include the technique in GCP and deviation handling SOPs
• ✅ Train investigators and CRAs to use 5 Whys consistently
• ✅ Review 5 Whys narratives during QA audits for completeness

Tip: Assign a deviation review committee to validate root causes and prevent shallow or circular logic in RCA reports.

Conclusion: 5 Whys as a GCP-Compliant RCA Tool

The 5 Whys technique is a simple yet powerful approach to uncovering the true cause of protocol deviations in clinical trials. When applied correctly, it supports CAPA planning, meets auditor expectations, and contributes to continuous improvement in trial operations.

By integrating the 5 Whys into SOPs, templates, and training, clinical teams can elevate their deviation management processes from reactive fixes to proactive prevention—ensuring GCP compliance and protecting the integrity of clinical data.

Preventing Protocol Deviations in Site Audits

Introduction: Why Protocol Deviations Are a Major Concern

Protocol deviations occur when trial conduct does not strictly follow the approved clinical trial protocol. Regulators, including the FDA, EMA, and MHRA, view deviations as a serious threat to both data integrity and patient safety. Even minor deviations, if recurring, can raise questions about the reliability of study outcomes and the adequacy of investigator oversight. As such, protocol deviations consistently appear in regulatory inspection reports and are among the most frequent findings at investigator sites.

While some deviations may be unavoidable due to medical emergencies or unique patient needs, a large proportion result from systemic failures: insufficient training, poor documentation, or inadequate site oversight. This makes prevention strategies critical to maintaining compliance and inspection readiness.

Regulatory Expectations on Protocol Adherence

Regulators clearly define expectations for protocol compliance in clinical trials:

• ✅ ICH GCP E6(R2) Section 4.5 requires investigators to conduct the study according to the approved protocol and not deviate unless necessary to eliminate immediate hazards to subjects.
• ✅ FDA 21 CFR 312.60 obligates investigators to ensure that the investigation is conducted according to the signed investigator statement and protocol.
• ✅ EMA Clinical Trials Regulation (EU CTR) emphasizes that protocol deviations must be minimized, documented, and reported to ethics committees or competent authorities when significant.
• ✅ MHRA inspections often highlight systemic failures in deviation documentation and reporting as major findings.

Regulators expect investigator sites to have robust systems for identifying, documenting, and addressing protocol deviations promptly.

Common Audit Findings Related to Protocol Deviations

Inspections frequently reveal patterns of protocol deviation deficiencies. Examples include:

These findings, whether major or minor, often lead to significant corrective actions, retraining, and intensified monitoring by sponsors.

Case Study: EMA Audit on Protocol Deviations

In a 2019 EMA inspection of a multi-country oncology trial, several protocol deviations were identified, including missed tumor imaging assessments and incorrect dosing schedules. The site argued that staff shortages led to delays, but regulators concluded that the site lacked adequate contingency planning. As a result, the trial data from that site was deemed unreliable, and additional monitoring visits were mandated. The sponsor also implemented a site-wide retraining program and introduced escalation procedures for high-risk deviations.

This case illustrates how systemic oversight failures, rather than isolated mistakes, can lead to significant regulatory consequences.

Root Causes of Protocol Deviations

Analysis of deviation-related findings often identifies recurring root causes:

• ➤ Inadequate staff training on protocol requirements and visit schedules.
• ➤ Poor communication between investigator, sub-investigators, and site staff.
• ➤ Inefficient site scheduling systems leading to missed visits or procedures.
• ➤ Lack of monitoring oversight by the sponsor or CRO.
• ➤ Inadequate SOPs for identifying, classifying, and reporting deviations.

These systemic issues highlight why prevention requires both site-level and sponsor-level interventions.

CAPA Strategies for Protocol Deviation Findings

To address audit findings related to protocol deviations, structured CAPA actions are essential:

1. Corrective Actions: Immediately correct deviation records, notify sponsors, and update subject files.
2. Root Cause Analysis: Identify whether deviations arose from staff error, unclear SOPs, or inadequate oversight.
3. Preventive Actions: Enhance staff training, improve site scheduling tools, and clarify delegation of tasks.
4. Verification: Conduct targeted monitoring visits to verify that corrective measures have been implemented effectively.

For example, some sponsors have implemented electronic deviation tracking systems, ensuring real-time logging, categorization, and escalation of deviations, thereby reducing recurrence.

Best Practices for Preventing Protocol Deviations

To proactively prevent deviations and reduce the likelihood of audit observations, investigator sites should adopt these practices:

• ✅ Provide comprehensive protocol training during site initiation and refresher sessions during the trial.
• ✅ Implement site-level SOPs specifically addressing deviation identification and reporting.
• ✅ Use electronic tools for scheduling and tracking subject visits and required assessments.
• ✅ Foster clear communication between investigators, sub-investigators, and site coordinators.
• ✅ Conduct mock audits to evaluate site readiness and deviation handling processes.

These practices not only enhance compliance but also improve the reliability of trial outcomes, thereby strengthening sponsor and regulator confidence.

Conclusion: Strengthening Site Oversight Through Prevention

Protocol deviations remain one of the most frequent audit findings at investigator sites, reflecting weaknesses in training, communication, and oversight. By aligning with global regulatory expectations, implementing CAPA strategies, and adopting proactive best practices, sites can minimize deviations and improve compliance. Ultimately, prevention is the most effective strategy—ensuring both regulatory readiness and protection of patient safety while maintaining trial data integrity.