IND Safety Reporting Under 21 CFR 312.32: Sponsor Obligations, Aggregate Analysis, and Common Errors

IND safety reporting under 21 CFR 312.32: sponsor obligations, aggregate analysis, and common errors

IND safety reporting asks the sponsor to make a judgment. It is not a rule to forward every serious adverse event (SAE). Under 21 CFR 312.32, the sponsor must review all safety information it receives, decide whether that information meets defined criteria, and notify FDA and all participating investigators within 15 or 7 calendar days ¹⁰⁶¹¹². FDA's guidance has long identified the most common failure as over-reporting uninformative single cases. Inspection records show the opposite failure too: serious events that reach FDA late or never reach it ⁹²¹⁸⁴.

This article covers the regulatory text, FDA's current guidance (including the December 2025 final guidance that replaced the 2012 document), and what FDA's Bioresearch Monitoring (BIMO) program looks for during inspections.

Key takeaways

• Expedited reports for single cases need three elements: the event must be serious, unexpected, and supported by evidence suggesting the drug caused it ⁸².
• The sponsor makes the causality call. It considers the investigator's assessment but does not simply adopt it ⁸³⁹³.
• Many SAEs can only be interpreted in aggregate. Anticipated events in the study population and study endpoints call for comparing exposed and unexposed groups, not filing individual expedited reports ^8990115.
• A clinically important increase in an expected serious suspected adverse reaction is a separate reporting trigger ¹¹⁰⁹¹.
• FDA's December 15, 2025 final guidance on sponsor responsibilities replaced the 2012 guidance ²³⁶²⁷⁸. It calls for a prospective safety surveillance plan, a firewalled entity to review unblinded aggregate data, and a predefined list of anticipated SAEs ^238240242.
• Electronic submission: individual-case IND safety reports go to FAERS as ICSRs. The electronic requirement took effect April 1, 2026 ⁵⁴⁵⁵.

Regulatory definitions that drive reportability (21 CFR 312.32(a))

FDA's 2025 guidance also addresses events that occur at a meaningfully higher rate than the IB describes ²¹⁹. Under the regulation, a clinically important increase in the rate of a listed serious suspected adverse reaction is reported through the increased-rate trigger in 21 CFR 312.32(c)(1)(iv); it does not, by itself, make a listed reaction unexpected ¹¹⁰. The guidance separates expected reactions (listed in the IB because they have been seen with the drug and causality is suspected or confirmed) from events anticipated in the study population. Treating an anticipated but unlisted event as "expected" is an error. A class effect listed in the IB stays unexpected for reporting purposes until it is listed as occurring with the particular drug ²²⁰. ICH E6(R3) likewise names the IB's reference safety information as the reference for deciding expectedness and whether expedited reporting is needed ²²¹.

Duty to review safety information (21 CFR 312.32(b))

The sponsor must promptly review all information relevant to the drug's safety, from domestic or foreign sources. The listed sources are clinical and epidemiological investigations, animal and in vitro studies, scientific literature, unpublished papers, reports from foreign regulatory authorities, and foreign commercial marketing experience for drugs not marketed in the US ¹⁹⁶. The 2025 guidance confirms this covers information from any source, whether or not it arose under the sponsor's IND. It also states that not every item reviewed calls for an IND safety report ^274275276.

Expedited reporting: the four triggers (21 CFR 312.32(c)(1))

The sponsor must notify FDA and all participating investigators of potential serious risks as soon as possible, and no later than 15 calendar days after it determines the information qualifies. Each report must identify previously submitted IND safety reports about a similar suspected adverse reaction and analyze the new information in that context ¹⁰⁶.

Timelines and clock start

For a 15-day report, day 0 is the day the sponsor determines the information qualifies, including the day it determines that multiple cases together qualify. For an unexpected fatal or life-threatening suspected adverse reaction, the 7-day clock runs from initial receipt of the information. Day 0 is not the onset date of the event ^106112484950.

Study endpoints (21 CFR 312.32(c)(5))

Study endpoints such as mortality or major morbidity are ordinarily reported as the protocol specifies, not as IND safety reports. A serious and unexpected endpoint event that has evidence suggesting drug causation must still be reported under (c)(1)(i) ¹¹⁵.

Alternative formats (21 CFR 312.32(c)(3))

FDA may require a different reporting format or frequency. A sponsor may also propose one, and adopt it if the director of the responsible review division agrees in advance ¹¹³.

Single-case reporting versus aggregate analysis

The 2025 guidance sets out three tiers ^87888990:

1. One case can be enough when the event is uncommon, strongly associated with drug exposure, and has no alternative explanation. Examples are anaphylaxis and Stevens-Johnson syndrome ⁸⁷.
2. One persuasive case or a few cases may be needed for an event that is uncommon in the population but not typically drug-associated. A strong causal feature, such as recurrence on rechallenge, makes a single case persuasive ⁸⁸.
3. Aggregate comparison is required for serious events that would be expected in the study population regardless of drug exposure. Individual reports of these events are generally uninformative. Report when an imbalance between groups supports a reasonable possibility that the drug caused the higher incidence ⁸⁹⁹⁰.

Aggregate analysis is also how a sponsor detects the separate (c)(1)(iv) trigger: a clinically important increase in an expected serious suspected adverse reaction over the rate in the protocol or IB. Deciding whether that threshold is met depends on the population, how serious the reaction is, and how large the increase is ⁹¹²⁵⁰.

Building the aggregate-review infrastructure

The 2025 final guidance recommends the following:

• Prospective safety surveillance plan. Write it in advance to cover SAEs that can only be interpreted in aggregate. It should specify who reviews data, who analyzes it, who decides on reporting, and who may see unblinded data. It should set the frequency and methods of aggregate review and the unblinding controls. Update it as the program evolves ^236238239.
• A firewalled reviewing entity. The sponsor keeps responsibility for the reporting decision. It may designate a qualified individual or group to review accumulating unblinded data and recommend whether to report. A data monitoring committee (DMC) can do this if its charter assigns the role. People who conduct or analyze the trial should not see unblinded aggregate data ²⁴⁰²⁴¹. FDA's 2024 draft DMC guidance separates this safety-reporting role from a traditional DMC's role in recommending whether the trial continues ⁷³.
• A list of anticipated SAEs. Identify SAEs expected to occur in the study population that will not be reported individually, whatever the investigator's causality assessment. Monitor them with medically related terms grouped in advance. An anticipated event left off the list does not automatically become reportable as a single case ^242243244.
• Comparison by arm, with a trigger option. Compare incidence in exposed and unexposed groups periodically, by treatment arm, using clinical judgment rather than only a statistical cutoff ^245246247. Without periodic unblinded review, FDA describes a trigger approach. The sponsor compares pooled, blinded observed rates against predicted rates and unblinds by arm only when a prespecified criterion is meaningfully exceeded ²⁴⁸²⁴⁹. Unblind only the data needed to assess the safety concern, not efficacy data ⁹⁶.

Format and electronic submission

Under the regulation, a report may be a narrative, FDA Form 3500A, or an electronic format FDA can process. Foreign cases may be submitted on CIOMS I. Pooled or overall findings must be submitted as narratives, prominently identified as "IND Safety Report" ¹¹¹.

FDA guidance now directs (c)(1)(i) reports that contain individual participant data to FAERS as ICSRs, using the applicable ICH E2B standard. The electronic requirement took effect April 1, 2026 ⁵⁴⁵⁵. Reports under (c)(1)(ii) through (iv) go as narrative reports in eCTD, not to FAERS, and should not use Form 3500A or CIOMS ⁵⁶⁵⁷. Follow-up ICSRs keep the initial case identifier, keep the previously reported structured data, and add the new information ⁵¹⁵². Every IND safety report must identify prior similar reports and analyze the significance of the reaction in that context ⁶⁰.

Related sponsor and investigator obligations in Part 312

• 21 CFR 312.50: the sponsor must ensure that FDA and all participating investigators are promptly informed of significant new adverse effects or risks ³¹⁴.
• 21 CFR 312.55(b): the sponsor must keep each investigator informed of new observations, particularly adverse effects and safe use, and relay important safety information under 312.32 ³¹³.
• 21 CFR 312.56: the sponsor must monitor its investigations, review safety and effectiveness evidence as it comes in, and discontinue investigations that present an unreasonable and significant risk ¹⁰²¹⁰³.
• 21 CFR 312.33(b): the IND annual report must include a narrative or tabular summary of the most frequent and most serious adverse experiences by body system, a summary of all IND safety reports submitted during the year, a list of subjects who died with the cause of each death, and a list of subjects who dropped out in association with an adverse experience ⁴⁰⁶.
• 21 CFR 312.64(b): investigators must immediately report all SAEs to the sponsor, whether or not considered drug-related, with a causality assessment ¹⁰¹. FDA's December 2025 investigator guidance expects the protocol's initial-reporting window to generally not exceed one calendar day ³⁹⁸³⁹⁹. It also states that investigators must report to the IRB those IND safety reports that are unanticipated problems involving risks to subjects or others, not every IND safety report. If the sponsor submits on the investigator's behalf under a documented arrangement, a duplicate submission is not expected ⁴⁰³⁴⁰⁴.
• IND-exempt BA/BE studies (21 CFR 320.31(d)): the person conducting the study must report any SAE for the test or reference drug to FDA and investigators within 15 calendar days, regardless of suspected causality. Fatal or life-threatening events also go to CDER's Office of Generic Drugs within 7 calendar days ²⁷⁰²⁷¹.

Common sponsor errors identified in FDA guidance

1. Over-reporting uninformative single cases. FDA reports that sponsors often submitted serious events with little reason to suspect the drug. These included manifestations of the underlying disease, events common in the study population, and study endpoints. Without treated-versus-untreated context, such reports were generally uninformative and pulled FDA, investigators, and IRBs away from meaningful safety issues ^92319225.
2. Deferring to the investigator's causality assessment. Reporting only because an investigator assessed an event as related is an identified error. The reverse also applies: a qualifying event must be reported even if the investigator assessed it as unrelated ⁹³³²⁰. FDA notes that under the IND rule the sponsor makes the causality judgment ²²⁴.
3. Mischaracterizing expectedness. Errors include treating events anticipated in the population as "expected," and treating class effects in the IB as expected for the investigational drug ²²⁰.
4. Submitting blinded or placebo cases. For individually reportable cases, the blind should ordinarily be broken. A qualifying event that turns out to have occurred on placebo should not be submitted as an IND safety report ⁹⁵³²¹.
5. Inadequate aggregate surveillance. Without a prospective plan, an anticipated-SAE list, and periodic comparison by arm, a sponsor cannot reliably detect the aggregate and increased-rate triggers ^236242323324.
6. Omitting prior similar reports and their analysis. This requirement applies to all IND safety reports ⁶⁰³²⁵.
7. Routing reports to the wrong place. Aggregate and other-findings reports belong in eCTD as narratives, not in FAERS. This affects where a report goes, not whether it must be filed ⁵⁶.

What FDA inspections look for and find

FDA's BIMO Compliance Program 7348.810 (Sponsors and Contract Research Organizations) directs investigators to assess general compliance with safety reporting and to expand the inspection if they find systemic issues ¹⁵⁴¹⁵⁵. Investigators are directed to:

• Determine how the sponsor reviews investigator SAE reports. Confirm it has a process for deciding whether each SAE meets reporting criteria, including 312.32, and that it followed that process ¹⁵⁶¹⁵⁷.
• Review SAE and adverse-event-of-special-interest tracking lists. Determine whether required information reached FDA and participating investigators within the 15-day and 7-day timeframes, and whether follow-up was submitted as soon as available ¹⁵⁸³⁰⁹.
• Review procedures for receiving, evaluating, and monitoring safety information, for updating the IB, and for notifying investigators ¹⁵⁹.

Published inspection records show these failure patterns:

These records show that the sponsor's 312.32 clock depends on upstream processes. If investigator SAE reports reach the sponsor late, or monitoring does not detect late or missing reports, the sponsor's own IND safety reporting cannot be timely. FDA treats this as a sponsor oversight failure under 312.50 and 312.56 ^314102361.

In the warning letters reviewed, enforcement records citing 21 CFR 312.32 by section were scarce. Letters about late 15-day reports most often concerned postmarketing reporting under 21 CFR 314.80, not IND reporting ¹²⁵. The Samsung Bioepis inspection included a separate postmarketing (PADE) observation in which 15 of 16 late 15-day alert reports were more than 40 days late ³⁴⁵. For IND programs, BIMO findings usually appear as sponsor oversight, monitoring, and timely-notification failures, not as section-level 312.32 citations.

Practical implications for sponsors

Based on the regulation, guidance, and inspection focus above, sponsor safety systems should have:

• A written causality and expectedness process that documents the sponsor's own judgment, separate from the investigator's ⁸³⁹³.
• A day-0 tracking method for both single cases and aggregate determinations, with 7-day and 15-day deadlines and follow-up deadlines ⁴⁸⁵¹.
• A prospective safety surveillance plan, an anticipated-SAE list, and a firewalled unblinded review entity or a documented unblinding trigger ^238240242248.
• Investigator SAE reporting windows in protocols, plus monitoring that verifies they are met ³⁹⁹³⁶¹.
• Reconciliation of SAE tracking lists against submitted IND safety reports and investigator notifications, since BIMO investigators examine this directly ¹⁵⁸.
• Channel controls for FAERS (individual-case ICSRs) versus eCTD (narrative aggregate reports) ⁵⁴⁵⁶.