If One Win Could Calm the Room

• If a single measurable win in the next 90 days would make you breathe easier, what would that win be?
• Which of these outcome types would feel most urgent right now? (select all that apply) Options: Reduce average approval time, Complete audit-trail for active protocols, Enterprise training completion, Close outstanding OHRP findings, Improve investigator satisfaction, Integrate with grants system
• What is your current baseline for the top metric above (give number, timeframe, and how it’s measured)?
• Who is currently the named owner for that metric inside your institution? Options: VP Research, IRB Director, Research Compliance Officer, IT/Systems Lead, Grants Office, Other
• If we achieved that win, what downstream impact would you expect on funding, investigator workload, or reputation? Be specific.

What Keeps You Up at 2 AM About Compliance?

• Imagine an unannounced federal site visit tomorrow — what single failure would cause the biggest institutional damage?
• How often have you had OHRP/agency inquiries, audits, or determinations in the last 3 years? Options: None, 1, 2–3, 4+ (systemic)
• Of recent regulatory findings, which gap recurs most frequently (select the best fit)? Options: Incomplete consent records, Missing audit logs, Inadequate training documentation, Failure to follow approved protocols, Conflicts of interest not managed, Other
• How would you describe your institutional tolerance for regulatory risk? Options: Very low — avoid any finding, Low — minor findings acceptable, Moderate — can absorb short-term risk, High — willing to prioritize speed
• When a compliance gap appears, who must be notified within 24 hours and what usually happens next?

Where Paper and Email Still Hide the Problems

• Which parts of your IRB workflow live outside your structured system today and why do they remain there?
• Approximately how many active protocols are recorded only in spreadsheets/email/legacy systems? Options: None, 1–50, 51–200, 201–500, 500+
• Do you maintain parallel records (electronic + paper) during reviews? If yes, how long does parallel maintenance typically persist? Options: No, Yes — days, Yes — weeks, Yes — months, Yes — indefinitely
• Which failure modes from legacy tracking have led to regulatory exposure or investigator complaints? Please give one or two concrete examples.
• How often do investigators bypass the portal or email the IRB directly, and what reasons do they give? Options: Never, Rarely, Occasionally, Often, Very often

What Would Each Stakeholder Say 'Good' Looks Like?

• If you asked the VP of Research, IRB Chair, and a PI what ‘good’ looks like, where would their answers differ most and whose view must prevail?
• For each stakeholder below, select the outcome that matters most to them (choose multiple stakeholders if needed). Options: VP Research — institution risk minimized, IRB Director — consistent committee throughput, IRB Chair — manageable meeting load, Compliance Officer — defensible audit trail, Investigators — faster approvals, Research Admin — grants alignment
• What specific approval-time targets would satisfy leadership, chairs, and investigators respectively? (give numeric targets or ranges)
• Which compliance controls are truly non‑negotiable for your institution (select all that apply)? Options: Complete timestamped audit logs, Role-based approvals with separation of duties, Verifiable training records before approval, Documented protocol versioning, Automated adverse event linkage, Data export for regulators
• Are there stakeholder groups whose acceptance you anticipate will be hardest to win? Who are they and why?

Metrics You Can Trust — Not Just Numbers You Hope For

• If an auditor asked to trace the lifecycle of a protocol from submission to approval, would your current metrics and logs satisfy them? Options: Yes — fully traceable, Partially — gaps exist, No — would not satisfy, Unsure
• How are your key compliance metrics currently collected? Options: Automated system logs, Manual case reviews, Spreadsheets exported from systems, Ad hoc reports from committees, Other
• Which specific metrics do you rely on monthly to make compliance or operational decisions? (e.g., avg approval days, % training complete)
• Who validates the accuracy of those metrics today, and how often are they reconciled? Options: IRB staff, Compliance office, Internal audit, IT/data team, Not validated
• What minimum thresholds or tolerances must those metrics meet to be considered acceptable (provide numeric thresholds where possible)?

Training and Behavior: Will People Actually Do the Right Thing?

• Even with the right tech, what human behavior would most likely sabotage the outcomes you care about?
• What is your current enterprise training completion rate for required compliance modules? Options: <50%, 50–74%, 75–89%, 90–100%
• Which training modalities have worked best for your faculty (select all that apply)? Options: In-person workshops, Self-paced eLearning, Microlearning modules, Live webinars, Department-led sessions
• What enforcement or incentive mechanisms do you use when completion is low (select all that apply)? Options: No enforcement, Access restrictions, Grant hold notifications, Performance review flags, Incentives/awards
• What target training completion rate would you require before approving an enterprise rollout? Options: 70%, 80%, 90%, 95%+

When Things Go Wrong: Escalation, Accountability, and Fixes

• If a protocol missed a required control and created regulatory exposure, what response timeline would you demand? Options: Immediate (hours), Next business day, Within 3 business days, Within 2 weeks
• Describe your ideal escalation path for compliance incidents — who gets alerted and who ultimately signs corrective action plans?
• Which remediation actions are non-negotiable after a serious finding (select all that apply)? Options: Suspend affected protocols, Retrain involved staff, Notify external funders, External consultant review, Policy rewrite
• How comfortable are you with automated alerts that escalate directly to senior leadership? Options: Very comfortable, Somewhat comfortable, Prefer manual review first, Not comfortable
• What evidence do you require to be confident a root cause has been addressed and will not recur?

Pilot Signals: What Proof Will Unlock Enterprise Rollout?

• At pilot close, what single piece of evidence would make you comfortable recommending an enterprise rollout?
• Which pilot success signals matter to you? (select all that should be met) Options: Approval time reduced to target, Audit-trail completeness verified, Training completion threshold met, Investigator usability score >= target, Data migration validated, Integration with grants confirmed
• For each selected pilot signal, what is the numeric acceptance threshold you would require?
• Who must sign the pilot acceptance — list roles/titles and whether they have veto power.
• How soon after pilot close do you want a decision meeting to occur? Options: Within 1 week, Within 2–3 weeks, Within a month, Longer / TBD

What Tradeoffs Are You Willing to Make?

• Which tradeoff would you accept: slightly stricter workflow that halves approval time, or lighter workflow that preserves pace but leaves some compliance manual? Options: Stricter workflow (higher compliance, more friction), Lighter workflow (faster today, more risk), Depends on stakeholder, Undecided
• Which of the following one-time costs would you tolerate to reach your outcome goals? (select all that apply) Options: Extended configuration timeline, Higher implementation fees, Custom development, Temporary parallel systems, Dedicated change management budget
• Are there any tradeoffs that are absolute deal-breakers for your institution? Please list with reason.
• What is the maximum acceptable timeline to demonstrate pilot success before you reassess strategy? Options: 1 quarter, 2 quarters, 3 quarters, 6+ months
• What budget band have you allocated (or would consider) for a pilot that proves these outcomes? Options: <$50k, $50–150k, $150–300k, $300k+

Choose One Hypothesis to Prove First

• If you had to pick one hypothesis for a focused pilot that would unlock the rest, what would it be (be bold and specific)?
• Which pilot scope below best matches your appetite for proof-of-value? Options: Single IRB committee, single protocol type, Single IRB committee, mixed protocol types, Multiple committees, focused protocol type, Enterprise proof across committees (larger risk)
• What minimum data access and exports do we need to prove the hypothesis (select all that apply)? Options: Full protocol metadata, Submission/decision timestamps, Training records, Adverse event data, Grants linkage data
• Who will be the pilot owner on your side and what percent of their time can they commit?
• What cadence for pilot review meetings would you prefer to feel confident (select one)? Options: Weekly, Bi-weekly, Monthly, Milestone-based

• Experience Prep & Current State Confirmation
• Scenario Walkthrough Workshop (Diagnosis → Proof)
• Live Simulation — Investigator & Committee Flows (Proof)
• Acceptance Test Review & Pilot Success Criteria Finalization
• Executive Validation & Pilot Go/No-Go

• Customer and seller sign the finalized acceptance criteria and pilot gates document.
• Team to create simulation scripts for the Live Simulation meeting capturing the precise inputs and expected outputs.
• Readout of Expected Metrics & Test Plan
• Collect measured evidence demonstrating improvement (or gaps) against approval time, usability, and audit completeness targets.
• Identify and prioritize configuration or process fixes required to meet acceptance criteria.
• Ensure every observed issue is tied back to customer consequence and a remediation owner.
• Seller to deliver a metrics report (timestamps, reviewer latency, audit log samples) within 48 hours of the simulation.
• Customer to validate the accuracy of captured metrics and flag any anomalies.
• Team to log prioritized remediation tickets with owners and target completion dates.
• Executive Recap: Preconditions & Targets
• Reach explicit agreement on which acceptance criteria are met and which require remediation prior to pilot.
• Create an actionable remediation and retest plan with owners and deadlines for any failed items.
• Establish clear go/no-go gates and sign-off authority for pilot launch.
• Introductions & Meeting Objectives
• Seller to implement critical remediations and schedule retest sessions within agreed timelines.
• Customer to confirm availability of reviewers for the retest and final decision meeting.
• One-sentence Recap: Current State, Consequence, Future State
• Secure executive sign-off to proceed to pilot or capture explicit reasons and conditions if pausing.
• Confirm pilot governance, roles, and escalation paths to manage compliance risk during pilot.
• Ensure a clear, dated set of next steps to launch the pilot efficiently if approved.
• Execute pilot authorization signature and publish the pilot kickoff date and governance cadence.
• Communications owner to notify pilot participants and publish the pilot scope document.
• Seller to prepare the pilot-run playbook (roles, runbook, escalation) and hand it off to the customer governance lead.
• Produce and record a single-sentence current state validated by stakeholders.
• Document quantified consequences tied to regulatory and operational risk.
• Agree a one-sentence future-state outcome and the measurable success signals to prove it.
• Lock the set of institution scenarios, acceptance criteria, and required sandbox data for simulations.
• Customer to provide sample protocols, backlog metrics, and any OHRP findings referenced in the consequence discussion.
• Seller to provision sandbox with agreed forms, 3 representative protocols, and committee roles before the simulation meeting.
• Owner to finalize acceptance criteria document (pass/fail thresholds) and circulate to attendees.
• IT contact to confirm access and test credentials for all named participants.
• Recap Preconditions
• Demonstrate, step-by-step, how the platform changes the investigator and committee workflows to achieve the future state.
• Bind each platform action to a quantifiable success signal and a current-state failure it eliminates.
• Collect explicit customer validation or corrections for each scenario so no assumptions remain.
• Seller to convert walkthrough notes into a scenario playbook showing steps, controls, and mapped success signals.
• Customer SMEs to mark any deviations from expected institutional policy that require configuration changes.
• Investigator Portal Simulation
• Results vs Acceptance Criteria
• One-sentence Current State Confirmation
• Evidence Package Summary
• Scenario 1 Walkthrough — Investigator Submission
• Residual Risks & Mitigations
• Consequence Quantification
• Failure Root-Cause & Remediation Plan
• Committee Review & Decision Simulation
• Scenario 2 Walkthrough — Committee Review & Approval
• Audit-trail & Compliance Reporting Validation
• Finalize Pilot Success Gates & Go/No-go Rules
• One-sentence Future State & Success Signals
• Risk-Point Controls Mapping
• Pilot Plan, Timeline & Governance
• Immediate Feedback & Triaging
• Scenario and Acceptance Criteria Inventory
• Validation Check & Forced Confirmation
• Decision & Signature
• Assign Owners & Next Steps
• Immediate Next Steps
• Environment & Data Readiness Review

• Deploy Investigator Submission Portal
• Configure IRB Review Workflows
• Migrate Legacy Protocol Records
• Integrate Grants and Protocol Systems
• Implement Adverse Event and SAE Tracking
• Activate Continuing Review Automation
• Enable Conflict-of-Interest Disclosure Workflows
• Set Up IACUC Animal Protocol Workflows
• Install Biosafety Incident Reporting Module
• Provision Role-Based User Accounts
• Deploy Audit Trail and Regulatory Reporting
• Train Investigators and Research Staff on Platform

Deploy Investigator Submission Portal

• What are your current channels for protocol submission? Options: Email/PDF attachments, Paper/physical packets, Existing internal portal, Hybrid (mix of email, paper, portal)
• Approximately how many unique investigators will use the submission portal in the pilot scope? Options: Less than 50, 50-200, 200-500, 500+
• Do different investigator groups (e.g., clinical, basic science, multi-site) require distinct submission forms or flows? Options: Yes, No
• List required attachment types or templates investigators must submit (e.g., consent forms, CVs, study protocols, budgets).
• Do you require multilingual forms or localized guidance within the portal? Options: English only, English + Spanish, English + other languages, Other / custom localization
• Should the portal enforce pre-submission checks (completeness, required signatures, training completion)? Options: Yes — block submission if missing, Warn but allow submission, No
• Are there investigator privacy or data-segmentation rules (e.g., external collaborators whose identities are redacted)? Options: Yes, No

Configure IRB Review Workflows

• How many IRB committees/boards will be included in the pilot configuration? Options: 1, 2-3, 4-6, 7+
• Do committees follow different review types (Full board, Expedited, Exempt) with unique routing or pre-review steps? Options: Yes — distinct routing per review type, Some differences but mostly unified, No — one standard workflow
• What voting rules and quorum requirements must the workflow enforce? Options: Simple majority, Specified number of members, Quorum + chair voting, Other (describe)
• Do you require conditional branching (e.g., route to biosafety or COI review when triggers present)? If yes, specify common triggers. Options: Yes, No
• Are there committee-specific templates, review checklists, or scoring rubrics that must be embedded? Options: Yes — each committee has its own, Some committees have custom checklists, No — one standard checklist
• What target submission-to-decision SLA should workflows support for pilot committees (in calendar days)?
• Will reviewers need anonymous review modes or redacted investigator information? Options: Yes — full blind review, Partial redaction, No

Migrate Legacy Protocol Records

• How many legacy protocol records need to be migrated for the pilot (approximate count)? Options: Less than 1,000, 1,000-5,000, 5,000-20,000, 20,000+
• What formats are legacy records stored in? Options: Spreadsheets/CSV, PDFs in folders, Legacy IRB system export, Paper/physical, Other
• Which core fields must map from legacy records to the new system (e.g., protocol ID, PI, approval date, consent documents)?
• Do legacy records require redaction or de-identification before migration for privacy reasons? Options: Yes — all PII removed, Partial redaction required, No
• Is there an expected downtime window or parallel-run period where both systems must be maintained? Options: Yes — parallel run required, No — cutover preferred, Flexible
• Are there duplicate or inconsistent protocol identifiers that require deduplication rules? Options: Yes, No, Unknown — need assessment
• Do you need historical audit logs preserved and surfaced in the new system? Options: Yes — full audit history, Summary history only, No

Integrate Grants and Protocol Systems

• Which grants or award management system(s) must integrate with the platform? Options: InfoEd/InfoReady, Coeus, Workday Grants, Banner/ELLUCID, Custom/Other
• Is a real-time sync required or will batch nightly exports be sufficient? Options: Real-time/API sync, Near real-time (hourly), Nightly batch, Ad-hoc manual imports
• Which key identifiers must be mapped between systems (e.g., PI ID, project ID, award number)?
• Do grants integrations need to restrict access to protocols based on sponsor or funding source? Options: Yes — restrict by sponsor, No — open access rules, Some restrictions
• Are there security or contractual constraints on API access (IP allowlist, VPN, SCIM, client certs)? Options: Yes — strict constraints, Standard API token acceptable, Unknown — need IT review
• Will the integration be used for automated compliance checks (e.g., link protocol to active award status)? Options: Yes — must enable automated checks, No — manual verification acceptable
• Are legacy grant-to-protocol mappings documented and stable, or will mapping rules need discovery work? Options: Documented/stable, Partially documented, Not documented — discovery required

Implement Adverse Event and SAE Tracking

• What types of safety events must be captured (adverse events, serious adverse events, unanticipated problems, device malfunctions)? Options: AE/SAE, Unanticipated problems, Device incidents, Other
• What regulatory reporting windows must workflows support (e.g., 24-hour, 7-day, 15-day reporting)? Options: 24-hour, 72-hour, 7-day, 15-day, Other
• Who must receive automatic notifications or escalations (IRB chair, PI, institutional safety officer, OHRP liaison)?
• Should event intake include structured severity scoring and causality assessment fields? Options: Yes — structured fields required, Optional structured fields, No — free-text only
• Do you require integration with external safety systems (e.g., CTMS, sponsor safety portals)? Options: Yes — integrate with CTMS/sponsor, No
• Is there an institutional policy defining who performs initial triage vs. who completes regulatory reporting? Options: Yes — policy defined, No — policy under development
• Do you need dashboards or reports for incident trends and regulatory readiness? Options: Yes — trend dashboards, Basic incident logs only, No

Activate Continuing Review Automation

• Which study types require continuing review in your institution (e.g., full board, minimal risk studies)? Options: Full board, Expedited, Exempt, Externally funded multi-site studies
• What are your required reminder cadences before an upcoming continuing review (e.g., 90, 60, 30 days)? Options: 90 days, 60 days, 30 days, Custom cadence
• Should continuing review automation include automatic renewal generation or only notify owners to submit? Options: Auto-generate renewal, Notify owners only, Both options available
• Do continuing reviews require linkage to enrollment/subject counts, consent expiration, and deviation logs? Options: Yes — link to enrollment & deviations, Partial linkage, No
• Are there programmatic exceptions (e.g., longitudinal minimal-risk cohorts) that need custom automation rules? Options: Yes — exceptions exist, No — uniform rules
• How should lapsed approvals be handled in automation (e.g., suspend access, send escalations, auto-assign manager review)? Options: Suspend access + escalate, Escalate only, Custom handling — describe below
• Describe any regulatory reporting that must trigger automatically when a continuing review lapses.

Enable Conflict-of-Interest Disclosure Workflows

• Do you have an existing COI policy with defined disclosure thresholds and review pathways? Options: Yes — policy in place, Policy in development, No formal policy
• Which roles must complete COI disclosures (PI, study staff, external collaborators) for protocol approval? Options: PI only, PI + key personnel, All listed study personnel, External collaborators
• Should COI disclosures block protocol approval if unresolved, or allow approval with mitigation conditions? Options: Block approval until resolved, Allow with mitigation, Escalate to COI committee
• Do you require integration with HR or financial systems to validate investigator appointments and external income? Options: Yes — integrate with HR/finance, No — manual verification
• Are there standard mitigation templates or management plans that should be auto-attached to approvals? Options: Yes — pre-defined templates, No — free-text plans, Some templates exist
• Do COI disclosures need periodic renewal cadence separate from protocol continuing review? Options: Yes — e.g., annual, No — tied to protocol only, Custom cadence
• Describe any required public disclosures or export formats for COI reporting (e.g., CSV for compliance office).

Set Up IACUC Animal Protocol Workflows

• Which animal species and facility types will be included in the pilot (e.g., rodents, large animals, ABSL-2/3)? Options: Rodents only, Rodents + large animals, Includes ABSL-2/3 labs, Other
• Do IACUC protocols require linked facility reservations, husbandry approvals, or occupational health signoffs? Options: Yes — facility & OH links, Some signoffs required, No
• Are standard IACUC forms/checklists available that must be embedded in the workflow? Options: Yes — forms ready, Forms need adaptation, No standard forms
• Should protocol routing include species-specific review panels or designated reviewers? Options: Yes — species-based panels, No — general reviewers
• Is training verification for animal care staff required during submission, and how is training tracked? Options: Yes — training must be verified, Optional verification, No training verification
• Do you need automated notifications for IACUC protocol expirations or animal use reporting? Options: Yes — automated notifications, Manual tracking preferred
• Describe any mandatory institutional or funding-agency inspections/attestations that must be supported.

Install Biosafety Incident Reporting Module

• Which biosafety incident types must the module capture (exposure events, containment breaches, spills, near-misses)? Options: Exposure events, Containment breaches, Spills, Near-misses, Other
• What BSL levels and lab locations should be in scope for the pilot? Options: BSL-1, BSL-2, BSL-3, Multiple BSL levels across sites
• Who should receive immediate incident notifications (biosafety officer, PI, EHS, institutional leadership)?
• Do incidents require evidence attachments (photos, instrument logs, video) and do those need restricted access? Options: Yes — attachments and restricted access, Attachments allowed with standard access, No

• Statement of Work (SOW)
• Master Services Agreement (MSA)
• Data Processing & Security Agreement (DPA/Security Addendum)
• Pilot Acceptance Criteria & Signoff
• Data Migration Plan & Responsibilities
• Training & Adoption Plan
• Governance & RACI Agreement
• Service Level Agreement (SLA) & Support
• Change Control & Customization Order
• Billing & Payment Schedule
• Regulatory Audit & Inspection Support Agreement
• Escalation & Compliance Incident Playbook
• Termination, Transition & Data Return

• Success Review & Outcome Validation
• Lessons Learned Workshop (Retrospective)
• Ongoing Issues & Enhancements Cadence Setup
• Executive Metrics & Risk Briefing
• Governance Handoff & Training Verification

• Prepare and distribute a one-page executive brief with the evidence package and recommended rollout ask.
• Frame the Retrospective & Prework Review
• Capture a comprehensive, evidence-backed set of lessons and failure modes from the pilot.
• Produce a prioritized improvement backlog with owners and acceptance criteria for each item.
• Agree on required updates to institutional playbooks, training, and governance artifacts.
• Draft and circulate the Lessons Learned document including root-cause analysis and the prioritized improvement backlog.
• Update the IRB playbook and training materials to reflect changes proven during the pilot.
• Schedule improvement sprints or workshops for the top 3 high-priority items.
• Proposed Cadence & Communication Channels
• Establish a clear, agreed-upon channel and cadence for ongoing issues and enhancements.
• Define triage severity, SLAs, and escalation paths for compliance-impacting incidents.
• Agree on a transparent enhancement request and backlog prioritization process tied to outcome signals.
• Create the shared communication channel and invite stakeholders with documented channel norms.
• Publish the triage workflow, severity definitions, and SLAs to the project repository.
• Provision a public enhancement backlog board and schedule the first backlog grooming session.
• Executive Summary (3 lines)
• Provide executives with a clear, quantified view of outcomes and residual risk to enable a funding/rollout decision.
• Secure executive endorsement for the recommended next step (scale, additional remediation, or maintenance budget).
• Identify any executive follow-up requests and owners for those deliverables.
• Introductions & Meeting Objectives
• If requested, produce a detailed cost-benefit and rollout plan for executive review within the agreed timeline.
• Document any executive commitments and translate them into project milestones.
• Training Completion & Remediation Status
• Confirm training and remediation actions meet institutional requirements and that documentation is audit-ready.
• Transfer governance responsibilities to steady-state owners with a clear cadence and escalation path.
• Schedule and agree on the quarterly health-check cadence and the criteria to reopen improvement work.
• Finalize and publish the governance RACI, runbooks, and closeout checklist in the central repository.
• Resolve any outstanding training remediation items and certify completion for compliance records.
• Schedule the first quarterly health-check and invite required governance participants.
• Confirm whether each agreed success signal has been met and document evidence supporting acceptance or rejection.
• Quantify the operational and compliance consequences of the outcomes for executive stakeholders.
• Assign owners and timelines for any remediation items and set a date for re-validation if needed.
• Produce and circulate an Evidence Package (dashboards, logs, export snapshots) supporting each success signal.
• Create remediation action list for any unmet signals with owners, acceptance criteria, and re-test dates.
• Capture formal stakeholder sign-off or objections in the project record.
• Issue Triage Workflow & Severity Definitions
• Timeline & Major Events Mapping
• Committee Governance & Cadence
• Key Metrics & Trends
• Current State (one-sentence) — Pre-Project Baseline
• What Worked Well (capture successes)
• Enhancement Request Process & Acceptance Criteria
• Documentation & Audit-Readiness Handover
• Compliance Risk Posture & Residual Exposure
• Agreed Success Signals & Targets
• Outcomes Dashboard: Evidence vs Targets
• Data Ownership, Retention & Migration Closure
• Operational & Financial Impact
• What Didn’t Work / Failure Modes
• Backlog Management & Release Cadence
• Consequence Analysis (quantified)
• Escalation Paths & Governance Roles
• Decision Points & Proposed Next Steps
• Steady-State Support Model & Quarterly Health Checks
• Root Cause Analysis
• Gaps, Residual Risks & Root Causes
• Onboarding & Handoff to Steady-State Support
• Q&A and Executive Commitments
• Improvement Backlog & Prioritization
• Closeout Checklist & Transition Signatures