AE vs SAE vs SUSAR vs UPIRSO

Pharmacovigilance in a clinical-trial-administration context is the ongoing, systematic detection, classification, assessment, and reporting of adverse effects associated with an investigational product — running as a continuous function in parallel to a trial’s efficacy objectives, not a one-time checkbox at study startup. It begins the moment a product is first given to a human subject and does not stop when the last subject completes their final visit: sponsors carry defined periodic-reporting obligations for as long as a product remains under active development or on the market.

The framework that governs this function across ICH regions (the US, EU, Japan, and the other ICH member/observer jurisdictions) is the ICH E2 guideline series, anchored by ICH E2A, “Clinical Safety Data Management: Definitions and Standards for Expedited Reporting” (finalized 1994) — the source of the adverse event, serious adverse event, and unexpected/SUSAR definitions this guide works through in detail, along with the FDA and EU regulations that implement them operationally. This guide is written for research administrators, sponsors, and site staff who need to know precisely what has to be reported, by whom, on what timeline, and how that reporting pipeline relates to — but is not the same thing as — a trial’s independent safety-oversight body.

What pharmacovigilance means in this context

“Pharmacovigilance” is most often associated with post-marketing drug safety, but within clinical research administration it covers the full arc of an investigational product’s safety data:

During the trial — collecting, grading, and assessing adverse events as they occur at each site; determining seriousness, causality, and expectedness for each event; and routing anything that meets expedited-reporting criteria to the sponsor, regulators, and ethics bodies on a strict clock.
Aggregated and periodic review — sponsors don’t just report individual cases; they also compile periodic safety updates (covered below) that let regulators and oversight bodies see the accumulating safety picture across the whole trial or program, not just isolated incidents.
Beyond a single trial’s closeout — for products still in development, periodic safety reporting continues at the program level; for approved products, the function transitions into national spontaneous-reporting pharmacovigilance systems (e.g., FDA’s FAERS, the EU’s EudraVigilance).

This is operationally distinct from — though it depends on — clinical data management (the systems and SOPs that capture and clean trial data generally) and from Good Clinical Practice more broadly (the conduct and quality standard the whole trial is held to). Pharmacovigilance is the safety-specific data stream inside that larger GCP framework, with its own definitions, its own regulatory clock, and — as the last section of this guide covers — its own independent oversight mechanism in trials that use one.

AE vs. SAE vs. SUSAR: the ICH E2A definitions

These three terms are frequently used loosely in casual conversation but have precise, cascading regulatory definitions under ICH E2A. Getting the distinction right matters directly: it determines whether an event sits in routine case-report-form data or triggers an expedited regulatory clock.

Adverse event (AE)

An AE is any untoward medical occurrence in a subject administered a pharmaceutical product, whether or not considered related to that product. This is a deliberately broad, causality-neutral definition — a headache, an abnormal lab value, or a fall unrelated to the study drug all qualify as AEs, because the definition captures anything unfavorable and unintended that is temporally associated with product administration, not just events later confirmed to be caused by it.

Adverse drug reaction / suspected adverse reaction

An adverse (drug) reaction narrows the AE definition by adding causality: it is a noxious and unintended response to the product where a causal relationship is at least a reasonable possibility — a lower bar than “proven,” but higher than “merely coincided with.” (US regulation, per the FDA’s 2010 IND safety-reporting final rule, uses the parallel term “suspected adverse reaction” for the same reasonable-possibility standard.) Deciding whether that reasonable-possibility threshold is met on a given case is a judgement, and structured instruments exist to make it consistent and auditable — see how the Naranjo algorithm scores causality item by item, and where it is documented to break down.

Serious adverse event (SAE)

“Serious” is a regulatory term of art, not a synonym for “severe” — a Grade 4 lab abnormality can be non-serious, and a hospitalization for an otherwise mild condition is serious. Under ICH E2A, an event is serious if, at any dose, it:

results in death;
is life-threatening (the subject was at immediate risk of death from the event as it occurred, not a theoretical future risk);
requires inpatient hospitalization or prolongs an existing hospitalization;
results in persistent or significant disability or incapacity;
is a congenital anomaly or birth defect; or
is otherwise medically important — a catch-all for events that don’t meet the other criteria literally but may jeopardize the subject or require medical or surgical intervention to prevent one of the outcomes above (the standard example is an emergency room visit for bronchospasm that doesn’t result in hospitalization).

Severity (mild/moderate/severe grading — often using the NCI’s Common Terminology Criteria for Adverse Events, CTCAE, especially in oncology trials) and seriousness (the regulatory criteria above) are graded on separate scales and should never be conflated when completing a safety report.

Unexpected

An adverse reaction is unexpected if its nature, severity, or frequency is not consistent with the current reference safety information — the Investigator’s Brochure for an unapproved product, or the approved labeling/summary of product characteristics for a marketed one being studied in a new trial. Expectedness is assessed against the current version of that reference document, which is why version control on the Investigator’s Brochure matters directly to safety-reporting accuracy: an event correctly logged as “unexpected” against an outdated IB version can be wrongly triggered for expedited reporting, or wrongly withheld from it.

Suspected Unexpected Serious Adverse Reaction (SUSAR)

A SUSAR is the intersection of all three qualifiers above: an adverse event that is serious (meets one of the ICH E2A seriousness criteria), suspected to be causally related to the investigational product (by either the investigator or the sponsor — either assessment is sufficient to trigger reporting), and unexpected (not consistent with the current reference safety information). SUSARs are the category ICH E2A’s expedited-reporting clock applies to — not every SAE, and not every AE.

Term	Core question it answers	Triggers expedited reporting?
AE	Did anything unfavorable happen, regardless of cause?	No — routine case-report-form data
SAE	Was the outcome serious (death, life-threatening, hospitalization, disability, congenital anomaly, or otherwise medically important)?	Not by itself — depends on causality and expectedness
SUSAR	Was it serious, suspected to be drug-related, and inconsistent with the current reference safety information?	Yes — expedited regulatory clock applies

Some protocols also pre-specify a subset of events — Adverse Events of Special Interest (AESIs) — for enhanced monitoring and expedited reporting regardless of where they otherwise fall in this AE/SAE/SUSAR hierarchy, because the sponsor already has a specific mechanistic or class-effect reason to watch for them from the outset.

Reporting timelines and responsibilities

Safety reporting moves through a defined chain, and each link has its own timeline. Confusing “report to the sponsor” with “report to the regulator” — or assuming one report satisfies both obligations — is a common, avoidable compliance gap.

Investigator → sponsor

Under US regulation (21 CFR 312.64(b)), the investigator must report any serious adverse event to the sponsor immediately, whether or not the investigator considers it drug-related, along with an assessment of whether there is a reasonable possibility the product caused it. Non-serious adverse events are recorded and reported to the sponsor on the schedule specified in the protocol, not on an immediate basis. ICH GCP (E6) imposes the same immediate-reporting principle for SAEs internationally, with the specific mechanics (forms, timeframes for follow-up information) set out in the trial protocol.

Sponsor → regulator

In the US, sponsor safety reporting to FDA under an active IND is governed by 21 CFR 312.32. A SUSAR that is fatal or life-threatening must be reported within 7 calendar days of the sponsor’s initial receipt of the information (with a complete follow-up report within an additional 8 days); other SUSARs must be reported within 15 calendar days. These are the same 7-/15-day expedited timelines ICH E2A establishes as the harmonized standard, and the EU applies materially the same structure: under Regulation (EU) No 536/2014, sponsors report SUSARs to the EudraVigilance database on the same 7-day (fatal/life-threatening) and 15-day (other) timelines, measured from the sponsor’s awareness of the case. The reporting clock starts from the sponsor’s first knowledge that a case meets the minimum reportability criteria (an identifiable patient, a reporter, a suspect product, and an event) — not from the first vague or incomplete mention of a possible event.

Sponsor → investigators

Sponsors are also responsible for keeping every participating investigator informed of new safety information that could affect the ongoing safety of subjects or the conduct of the trial — in practice, this means distributing IND safety reports/SUSAR notifications to all sites, not just filing them with the regulator. ICH E2A does not specify a fixed numeric timeline for this investigator-facing notification the way it does for regulatory reporting, but expects it to happen promptly enough that investigators can act on the information (for example, updating a consent form or reassessing a subject’s risk-benefit balance).

Sponsor / investigator → IRB or ethics committee

Separately from regulatory expedited reporting, 21 CFR 56.108(b) requires an IRB to have written procedures for the prompt reporting of unanticipated problems involving risks to subjects — a category that overlaps with, but is not identical to, “SUSAR”: an unanticipated problem is anything unexpected in nature, severity, or frequency given the protocol and study population, and it can include non-serious findings with safety implications that wouldn’t independently trigger a SUSAR report. In practice, sites typically route sponsor-forwarded IND safety reports and SUSAR notifications to their local IRB per the institution’s own reporting policy, which is frequently narrower and stricter than the federal floor — the applicable IRB’s written procedures, not ICH E2A alone, determine what a given site must submit and on what local timeline. See CASRAI’s guide on IRB review for the broader ethics-oversight role this reporting feeds into, and CASRAI’s guide to adverse event reporting to the IRB for the full three-part unanticipated-problem test that determines what actually has to reach the IRB.

Master decision table: AE, SAE, SUSAR, and UPIRSO — what counts as what, who to report it to, and by when

The terms in this guide are not nested inside one another the way most people assume. An adverse event does not have to be serious to matter, a serious adverse event does not have to be a SUSAR, and — critically — an unanticipated problem involving risks to subjects or others (UPIRSO) is a different category entirely, defined by OHRP’s 2007 guidance interpreting 45 CFR 46.108 and 21 CFR 56.108(b), not by ICH E2A. An event can be an AE without ever becoming a UPIRSO (true of most AEs), and an event can be a UPIRSO without being a clinical adverse event at all — a breach of confidentiality is the standard example. The table below is the fast-reference version; CASRAI’s dedicated guides to AE reporting to the IRB and IRB noncompliance and unanticipated-problem reporting work through the UPIRSO rows in full.

Category	Defining test	Reported by	Reported to	Governing timeline
AE (non-serious)	Any untoward medical occurrence, regardless of cause (ICH E2A)	Site / investigator	Sponsor (case-report-form data)	Per protocol schedule — not immediate
SAE	Meets one of ICH E2A’s seriousness criteria (death, life-threatening, hospitalization, disability, congenital anomaly, or otherwise medically important), regardless of expectedness or causality	Investigator	Sponsor	Immediately (21 CFR 312.64(b)) — no fixed day-count; “immediate” means without the delay of routine data entry
SUSAR	Serious + suspected causally related + unexpected against the current IB/label	Sponsor	FDA (21 CFR 312.32) and/or EudraVigilance (EU Reg. 536/2014)	7 calendar days (fatal/life-threatening, plus an 8-day follow-up) or 15 calendar days (other)
UPIRSO involving an AE	Unexpected + related or possibly related + suggests greater risk than previously known (OHRP’s three-part test), applied to an adverse event	Investigator (initial determination) then IRB (binding determination)	Local IRB, then institutional officials and OHRP/FDA as applicable	“Prompt,” scaled to severity per OHRP guidance; exact day-count set by each institution’s written IRB procedures (21 CFR 56.108(b) / 45 CFR 46.108)
UPIRSO not involving an AE	Same three-part test applied to a non-clinical event — e.g. a confidentiality breach, an unapproved consent-process deviation, or new literature revealing a previously unrecognized risk	Investigator or study team	Local IRB, then institutional officials and OHRP/FDA as applicable	Same “prompt” standard — no separate federal clock for the non-AE subtype
Serious / continuing noncompliance	A single event materially affecting subject rights, safety, or data validity, or a repeated pattern — a reportable category distinct from UPIRSO under the same regulations	IRB, on referral from investigator or monitoring	Institutional officials, OHRP and/or FDA	Same “prompt” standard; institution-defined day-count

Reading the table by row, rather than assuming a hierarchy, is the point. An expected SAE — a listed, anticipated side effect occurring at the anticipated rate — routes to the sponsor/FDA row and stops there: it fails the “unexpected” prong of the UPIRSO test, so it never reaches the IRB as an unanticipated problem, even though it is unquestionably “serious.” A mild, non-serious finding that turns out to reveal a new and previously unrecognized risk can skip the SAE/SUSAR rows entirely and land in the UPIRSO row, because UPIRSO status depends on what the finding reveals about the study’s risk profile, not on ICH E2A’s seriousness criteria. And a confidentiality breach with no clinical content can be a UPIRSO the IRB must review even though no adverse-event field on any case report form was ever triggered.

Who at the site owns which row — and what changes for a sponsor-investigator

In an industry-sponsored, multi-site trial, the obligations in the table above are split: the site and its investigator own the AE/SAE-to-sponsor row and their own IRB rows, while the sponsor owns the SUSAR-to-regulator row and the sponsor-to-investigators notification row. A sponsor-investigator — an individual who both initiates and personally conducts a trial, typically under their own IND — inherits every row in the table at once: they must still perform the sponsor-side causality/expectedness assessment and internal timeline discipline for SAEs even without a separate corporate sponsor to report to, determine and file SUSAR reports to FDA under 21 CFR 312.32 on the same 7-/15-day clock a pharmaceutical sponsor faces, and separately satisfy the local IRB’s UPIRSO reporting obligations as the investigator. This is a common place institutions under-resource investigator-initiated trials: a sponsor-investigator’s safety-reporting workload does not shrink because there is no separate sponsor company involved, and monitoring plans for these studies should build in coverage for every row explicitly.

Beyond the trial: periodic and ongoing safety reporting

Individual-case expedited reporting (the SUSAR pathway above) is only part of the picture. The rest of the ICH E2 series governs how safety data is aggregated and reviewed over time:

ICH E2F — Development Safety Update Report (DSUR). A standardized annual report on an investigational product’s accumulating safety profile across all trials in its development program, intended to satisfy the same underlying need as the US IND annual report and the EU annual safety report in one harmonized format.
ICH E2C(R2) — Periodic Benefit-Risk Evaluation Report (PBRER). The post-approval counterpart: a periodic, critical analysis of a marketed product’s emerging risk and benefit information, structured so its sections can align closely with the DSUR’s.
ICH E2B — electronic transmission standards for individual case safety reports (ICSRs), defining the data elements and message format that let sponsors and regulators exchange case-level safety data in a consistent structure regardless of the originating country or system.

Together, these mean a research administrator’s pharmacovigilance obligations don’t end at trial closeout for as long as the product remains in active development — and, for an approved product, safety monitoring simply continues through the applicable national spontaneous-reporting system rather than stopping outright.

The role of a DSMB — and how it differs from an SRC or SAB

A Data Safety Monitoring Board (DSMB, also called a Data Monitoring Committee or DMC) is an independent group of experts, external to the trial’s day-to-day conduct, that periodically reviews accumulating safety data — and, in many designs, interim efficacy data — for an ongoing trial and can recommend that it continue unchanged, continue with modification, or stop early for safety, futility, or a clearly demonstrated benefit. NIH’s long-standing data and safety monitoring policy (first issued in 1998) established the expectation that trials involving greater than minimal risk, particularly multi-site trials, have a formal, independent monitoring structure of this kind — the exact form (a full DSMB vs. a lighter monitoring plan) scales with the trial’s risk level and complexity.

It is worth being precise about how a DSMB relates to the AE/SAE/SUSAR reporting pipeline described above: the reporting obligations in ICH E2A are what get safety data to a DSMB (among other recipients) in a timely, structured way — but the DSMB itself is a separate governance layer that interprets the accumulating pattern across all subjects, often with access to unblinded data that individual sites and even the sponsor’s non-monitoring staff do not see. Meeting the regulatory reporting clock and having an effective DSMB are two different, complementary compliance obligations, not one substituting for the other.

A DSMB is also operationally distinct from two other governance bodies research administrators sometimes conflate it with:

Scientific Review Committee (SRC) — performs upfront, pre-activation scientific-merit peer review of a protocol (common at NCI-designated cancer centers, where SRC approval precedes and is required alongside IRB approval before a trial can open). An SRC reviews trial design quality before enrollment starts; it does not conduct ongoing safety surveillance of an active trial’s accumulating data.
Scientific Advisory Board (SAB) — advises an organization (a company, institute, or program) on its overall scientific strategy and direction. An SAB’s remit is institutional and strategic, not tied to monitoring the safety data of one specific ongoing trial.

In short: SRC review happens before a trial opens; DSMB/safety monitoring happens continuously while a trial is running and is what the AE/SAE/SUSAR reporting chain in this guide ultimately feeds; and an SAB sits outside any single trial’s oversight structure entirely, advising on strategy rather than reviewing case-level safety data.

A practical checklist for research administrators

Confirm the protocol defines product- and indication-specific SAE criteria and a named reference safety document (Investigator’s Brochure version, or approved label) that expectedness will be assessed against — and that the IB’s version history is tracked, since expedited-reporting decisions depend on the current version.
Build a written SOP that maps the full chain — investigator-to-sponsor, sponsor-to-regulator, sponsor-to-investigators, sponsor/site-to-IRB — with the specific timeline and owner at each link, rather than relying on staff to independently reconstruct ICH E2A’s timelines under pressure.
Check the local IRB’s own unanticipated-problem and safety-reporting policy separately from the federal/ICH floor — many institutions require narrower categories or shorter local timelines than 21 CFR 56.108 sets as a minimum.
For any greater-than-minimal-risk or multi-site trial, confirm whether a DSMB (or a lighter data-and-safety-monitoring plan, where a full board isn’t warranted) exists, has a current charter, and meets on a defined cadence — and that this is tracked separately from any SRC/SAB the institution or sponsor organization also maintains.
For multi-region trials, confirm EudraVigilance registration and reporting responsibility are assigned (directly by the sponsor or via a delegated CRO) alongside the FDA IND safety-reporting pathway — the two systems run in parallel, not as substitutes for each other.

Frequently asked questions

What is the difference between an adverse event and a serious adverse event?

An adverse event (AE) is any untoward medical occurrence during a trial, regardless of cause or severity. A serious adverse event (SAE) is the subset that meets one of ICH E2A’s specific seriousness criteria — death, a life-threatening event, hospitalization or its prolongation, persistent or significant disability, a congenital anomaly, or another medically important event. Seriousness is a defined regulatory category, not a synonym for how severe an event felt to the subject.

Is every SAE a SUSAR?

No. An SAE only becomes a SUSAR — and only then triggers ICH E2A’s expedited regulatory-reporting clock — if it is also suspected to be causally related to the investigational product and unexpected relative to the current Investigator’s Brochure or approved labeling. Many SAEs in a trial are expected (already described in the reference safety information) or judged unrelated to the product, and are handled through routine and periodic reporting rather than the expedited SUSAR pathway.

How quickly must a SUSAR be reported to FDA?

Under 21 CFR 312.32, fatal or life-threatening SUSARs must be reported within 7 calendar days of the sponsor’s initial awareness, with a complete follow-up report within an additional 8 days; other SUSARs must be reported within 15 calendar days. The EU applies the equivalent 7-/15-day structure for EudraVigilance reporting under Regulation (EU) No 536/2014.

Who is responsible for reporting an adverse event during a clinical trial?

Responsibility is shared but sequential: the investigator must report SAEs to the sponsor immediately (21 CFR 312.64(b)); the sponsor is then responsible for expedited reporting of qualifying SUSARs to regulators (21 CFR 312.32 in the US; EudraVigilance in the EU), for keeping all participating investigators informed of new safety information, and — together with sites — for ensuring the local IRB’s own unanticipated-problem reporting requirements are met.

Is a DSMB the same thing as an IRB?

No. An IRB/ethics committee approves a trial’s ethical design (including informed consent) before it opens and continues to review it periodically, but it does not typically review accumulating unblinded safety or efficacy data as its core function. A DSMB is specifically constituted to monitor that accumulating trial data on an ongoing basis and can recommend early modification or termination of the trial on safety, efficacy, or futility grounds — a different function performed by a different, usually unblinded, body.

Does pharmacovigilance responsibility end when a trial finishes enrolling or closes out?

No. For a product still in active development, sponsors continue periodic safety reporting (the annual Development Safety Update Report under ICH E2F) at the program level even after an individual trial closes. Once a product is approved, the safety-monitoring function continues through national pharmacovigilance/spontaneous-reporting systems (FDA’s FAERS, the EU’s EudraVigilance) rather than stopping at approval.

Is a UPIRSO the same thing as a SUSAR?

No, and conflating them is one of the most common mistakes in trial safety administration. A SUSAR is an ICH E2A / 21 CFR 312.32 concept: a serious, suspected, unexpected adverse reaction that triggers sponsor-to-FDA expedited reporting. A UPIRSO is a separate OHRP / 21 CFR 56.108(b) concept: any event — adverse or not — that is unexpected, related to the research, and suggestive of a previously unrecognized level of risk, reported through the IRB rather than directly to FDA by the sponsor. The two categories overlap (a SUSAR is very often also a UPIRSO) but neither implies the other: an expected SAE can be a routine SUSAR-track non-event for IRB purposes, and a non-serious or wholly non-clinical incident can be a UPIRSO without ever being a SUSAR.

Can something be a reportable unanticipated problem without being an adverse event at all?

Yes. OHRP’s three-part test — unexpected, related to the research, and suggestive of greater risk — does not require a medical occurrence. A breach of participant confidentiality, an unapproved deviation in the consent process, a data security incident exposing identifiable research data, or new external literature revealing a previously unrecognized risk can all meet the test and require IRB reporting as a UPIRSO, with no adverse event in the ICH E2A clinical sense ever having occurred.

Do sponsor-investigators have to satisfy every reporting obligation at once?

Yes. A sponsor-investigator holds both roles simultaneously, so the full set of obligations in the decision table above applies without a separate corporate sponsor to divide the work: SAE assessment and documentation on the sponsor side, SUSAR determination and FDA reporting under 21 CFR 312.32 on the same 7-/15-day clock, and UPIRSO reporting to the local IRB on the institution’s own timeline. Institutions supporting investigator-initiated trials should build this into the study’s monitoring plan explicitly, since the workload doesn’t shrink just because there’s no separate pharmaceutical sponsor company involved.