Quick orientation: why we're talking today

• How did you first hear about this need or trigger for IRB or compliance change? Options: Regulatory finding or letter, Investigator complaints about delays, New federal mandate, Internal audit, Other
• Tell me about the specific regulatory finding or operational pain that prompted you to explore a new IRB and compliance platform.
• In the past 12 months, how many protocol approvals were delayed beyond your target window? Options: Zero to 5, 6 to 20, 21 to 50, More than 50, Don't track reliably
• Which office or role initially raised the concern, and who currently owns remediation? Options: VP of Research, IRB Director, Compliance Officer, Research IT, Legal/Export Controls, Other
• If this issue is not resolved within 6 months, what is the most serious consequence you expect for your research programs?

Where approvals stall and why it matters

• What single approval bottleneck, if removed, would cut your average IRB cycle time in half?
• Describe the typical path a protocol follows from submission to approval, including handoffs and committees involved.
• How many full committee reviews versus expedited or exempt reviews do you process in an average month? Options: Mostly full committee, Mostly expedited/exempt, About equal mix, Volume varies widely month to month
• Which documents or steps most frequently trigger requests for revisions or hold-ups? Options: Consent forms, Risk assessments, Funding disclosures, Data use agreements, Sponsor contracts, Other
• Who on your team would block a scope change that requires altering committee workflow, and why?

When audit time arrives

• If a federal site visit happened tomorrow, what documentation gap would be most likely to draw a finding?
• Walk me through your current audit trail for a protocol from submission to closure, noting where records live on paper or in separate systems.
• On a scale from 1 to 10, how confident are you that your system would survive a rigorous compliance review? Options: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
• When a discrepancy is found, who is notified first and how is the investigation tracked? Options: IRB staff, Compliance office, Research leadership, Legal, Other
• What specific gap would cause you to pause any rollout until fixed?

Where investigators get frustrated

• What makes investigators complain most about your submission process, usability, or timelines?
• Share an example of a recent investigator complaint and what change, if any, it prompted.
• How many investigators revert to email or paper methods instead of using your portal in a typical quarter? Options: None, A few (under 5%), Moderate (5-20%), Many (over 20%), Unknown
• Which features would reduce investigator friction most, choose up to three. Options: Simplified forms, Contextual help and guidance, Saved templates, Integrated grant/project linking, Mobile-friendly investigator portal, Automated reminders
• If investigators refuse to adopt a new portal, what fallback plan would you enact and who signs off on it?

What other fixes you're weighing

• Which external vendors, incumbent systems, or internal build options are you actively considering or have recently evaluated? Options: Keep incumbent system, Upgrade current vendor, Evaluate other vendors, Internal build project, Hybrid approach
• For any incumbent system you might keep, what performance or support change would make you stay?
• Has anyone on your staff proposed solving this with an internal project instead of engaging an outside vendor? Options: Yes, active proposal, Yes, informal idea only, No one has proposed internal build, Unsure
• If you stayed with your current approach, what single metric would need to improve to make that choice acceptable?
• If a competitor matched the pilot terms we propose, what would still push you toward them instead of a platform plus services model?

What will actually need to change to get there

• Which committee workflows, policies, or SOPs must change to adopt a new platform, and who must sign off?
• Describe the customization points you expect the platform to support, for example conditional review paths, recurring continuing reviews, or multi-site reliance.
• In a typical month, count of integration or IT tickets related to research systems that your team closes, and who owns API work? Options: 0-5, 6-20, 21-50, More than 50, No clear owner
• Are there policy, union, or faculty governance constraints that would prevent automating steps currently done by human review? Options: Yes, significant constraints, Some constraints that can be negotiated, No major constraints, Unsure
• What single internal approval would kill the project if it is not obtained?

Operational readiness and known constraints

• Which upstream systems must the platform integrate with to be minimally useful, pick all that apply. Options: Grants management, Identity provider (SSO), HR/Payroll, Clinical EHR, SIS or student systems, Sponsor portals, Data repositories
• Tell me about the people who would partner on integrations, including whether you have an API owner and available dev hours.
• Do you have a clean export of legacy protocol records, consent forms, and adverse events that can be migrated? Options: Yes, ready to export, Partially ready, needs cleanup, No, large cleanup required, Unknown
• Who would be the day to day deployment owner on your side and how many FTEs can they dedicate during a pilot? Options: 0-0.5 FTE, 0.5-1 FTE, 1-2 FTE, More than 2 FTE, TBD
• What regulatory approvals or legal reviews are required before a pilot can begin, and how long do they typically take? Options: IRB chair signoff only, Legal review required, Institutional official approval required, Other compliance reviews, Combination of above
• If integrations require more than 12 weeks of engineering, would you still run the pilot as scoped? Options: Yes, we can run limited pilot, No, pilot depends on integrations, Maybe, if a reduced scope is acceptable, Unsure

Pilot outcomes that will convince leadership

• If the pilot cuts investigator approval time by 30 percent, what financial or operational benefit should we measure first? Options: Faster time to award, Reduced study start delays, Lower staff review hours, Fewer audit findings, Improved investigator satisfaction
• Which three metrics will convince leadership the pilot succeeded, pick up to three. Options: Investigator satisfaction score, Median cycle time, Audit trail completeness, Training completion rate, Integration uptime, Data migration completeness
• How will you measure audit trail completeness during the pilot, and who will sign off on that measurement?
• When the pilot ends, who has authority to approve moving to production and what is their decision window? Options: VP of Research within 2 weeks, IRB Director within 1 month, Compliance Committee within 1 month, Multiple signoffs required
• If the pilot misses one of your top two acceptance criteria, what minimum improvement would still keep you moving forward?

People, timing, and decision drivers

• Who must be at the decision table for a yes or no after pilot, including research leadership, compliance, IT, and finance? Options: VP of Research, IRB Director, Compliance Officer, IT/Integration Lead, Finance/Procurement, General Counsel
• In a typical quarter, how many competing priorities would this rollout face and which ones could delay it? Options: Low competition, Moderate competition, High competition, Seasons of freeze due to budget or audits
• What is your target timeline from pilot launch to enterprise rollout, measured in quarters? Options: Pilot only, no rollout, Pilot then rollout in 1 quarter, Pilot then rollout in 2 quarters, Pilot then rollout in 3-4 quarters, Unsure
• Which stakeholders would need formal training and how do you typically deliver lab or faculty training? Options: IRB staff in-person, Committee chairs workshop, Investigator webinars, On-demand eLearning, Train-the-trainer model
• If leadership demands a clear ROI number to proceed, what single number would close the deal for you?

Next practical steps to move forward

• If we could deliver pilot readiness in 8 weeks, what would stop you from starting next month?
• Provide the role and availability of your primary contact for weekly check-ins. Options: IRB Project Lead, 4 hours/week, Compliance Manager, 2 hours/week, IT Integration Lead, 4 hours/week, VP delegate, ad hoc
• Select your preferred pilot start window. Options: Immediately, Within 1 month, 1 to 3 months, 3 to 6 months, Unsure
• List the core systems, datasets, and teams we must see in a kickoff workshop.
• If we needed a letter of support from your VP of Research to proceed, could you secure that within two weeks? Options: Yes, Yes with conditions, No, Unsure

• Workshop Kickoff and Scope Confirmation
• Committee Current-State Workflow Mapping
• Rules, Forms, and Customization Decision Workshop
• Data Migration Risk and Sample Validation Workshop
• Integration, Security, and Environment Sign-off

• A prioritized remediation plan for high-risk or incompatible records.
• Collect and deliver all legacy form templates, screenshots, and field definitions for mapping.
• Produce the configuration decision document with must-have items and estimated complexity.
• List any committee SOP changes needed and the evidence required for committee approval.
• Deliver a field-level mapping template or data dictionary for use during transformation.
• Inventory legacy data sources and exports
• A migration scope listing the fields and record sets to migrate for the pilot.
• A documented sample validation plan and acceptance criteria for migrated data.
• Confirm scope and success criteria
• Provide representative data extracts for each legacy source in agreed export formats.
• Run an initial data profile and deliver a short report highlighting nulls, duplicates, and format mismatches.
• Confirm integration endpoints and authentication
• A signed technical readiness checklist including endpoints, auth methods, and test environment details.
• A finalized integration test plan with dates for execution and acceptance criteria.
• An agreed escalation path and clear go/no-go criteria for pilot technical readiness.
• Provide endpoint specifications, API documentation, and sample credentials for sandbox testing.
• Schedule integration test windows and confirm environment access dates.
• Document rollback, data protection, and backup procedures to be used during migration and testing.
• Agreed stakeholder roster and workshop schedule for the next 8 weeks.
• Confirmed pilot committee boundaries and the measurable success criteria for the pilot.
• Documented list of required data extracts, access rights, and prework with deadlines.
• Publish the finalized workshop schedule and attendee list.
• Provide access requests and environment credential requirements for IT to provision.
• Deliver the baseline success metrics definition and identify the data sources for each metric.
• Confirm scope and process boundaries
• A completed current-state workflow map for the committee with owners for each step.
• A prioritized list of workflow gaps and exceptions, with estimated impact on cycle time or compliance risk.
• A list of outstanding evidence or data needed to finalize disputed workflow items.
• Provide representative protocol records and timestamps used during the mapping session.
• Document disputed workflow steps with the evidence required to resolve each dispute.
• Deliver an initial draft current-state workflow diagram for asynchronous review within 48 hours.
• Recap agreed workflow gaps
• A configuration decision document enumerating must-have fields, forms, and routing rules for the pilot.
• An agreed prioritization of customizations with complexity bands to inform deployment planning.
• A list of any approvals required to change committee SOPs in order to accept platform-enforced rules.
• Identify and confirm stakeholders and roles
• Define mandatory fields and incompatibilities
• Validate test and sandbox environment readiness
• Review required form fields and data capture points
• Walk the workflow step-by-step
• Agree routing, reviewer roles, and escalation logic
• Agree integration acceptance tests and timeline
• Capture exceptions and manual workarounds
• Agree workshop schedule and per-session attendees
• Agree migration acceptance criteria and sample validation plan
• Document technical escalation and go/no-go criteria
• Identify high-risk records and remediation approach
• Prioritize customizations into must-have and future backlog
• Define data and access prerequisites
• Identify decision points and timing checkpoints
• Confirm mapping and open items
• Establish risk and escalation protocol

• Solution Walkthrough Session

• Confirm the current state and its cost
• You confirm the demonstrated workflow eliminates the manual handoffs and rework you described in Discovery.
• Provide one representative protocol and the list of committee-specific exceptions to use in the pilot configuration and walkthrough.
• Align on prioritized outcomes and acceptance metrics
• You agree on measurable pilot acceptance criteria, including target cycle-time reduction, investigator usability checks, and audit-trail completeness.
• Deliver a configured run of the prioritized workflow using the provided protocol, and record the submission through approval including the generated audit trail for review.
• Live walkthrough of a prioritized investigator scenario
• Provide a proposed set of pilot acceptance metrics and the target cycle-time reduction for committee review and sign-off.
• You identify any committee-specific exceptions that would prevent the shown workflow from delivering the future state without additional customization.
• Deliver a short migration-risk summary for the provided legacy records and outline any data gaps that require parallel records during the pilot.
• Show the audit record and integrations for the scenario
• Validate alignment explicitly
• Agree next steps and pilot acceptance gates

• Solution Walkthrough Session
• Solution Walkthrough Deck
• Solution Brief

• meeting
• slides
• document

• Provision platform tenant and admin accounts
• Configure IRB submission workflows
• Configure continuing review and renewal automation
• Implement adverse event reporting and tracking
• Deploy investigator portal and submission forms
• Migrate legacy protocol records and attachments
• Integrate grants and proposal systems
• Implement conflict of interest management module
• Implement IACUC protocols and animal research workflows
• Implement biosafety workflows and inventory tracking
• Set role-based permissions and committee assignments
• Configure audit trails and regulatory reporting
• Train investigators and IRB staff on platform
• Import user accounts and training records
• Configure email notifications and deadline reminders

Provision platform tenant and admin accounts

• Do you require a separate tenant for test, pilot, and production environments for IRB workflows? Options: Yes, No, Unsure - need guidance
• Which institutional identity provider(s) do you use for single sign-on (SSO) and should we connect (example: SAML, OIDC)? Options: SAML, OpenID Connect (OIDC), LDAP, No SSO - use platform accounts, Other
• Who will be the primary administrative owner for tenant provisioning and platform governance (name or role)?
• What is the expected maximum number of admin accounts and committee administrators to be created initially? Options: 1-5, 6-20, 21-100, More than 100
• Which institutional policies (for example, Federalwide Assurance (FWA) contact or OHRP-specific point of contact) should be recorded in tenant metadata?

Configure IRB submission workflows

• Which institutional review board (IRB) submission types must be supported in the workflow (e.g., new protocols, exempt determinations, expedited reviews)? Options: New full board, Exempt determinations, Expedited review, Modifications, Other
• Do any committees require custom review steps such as pre‑screen triage, science review, or legal review before IRB review? Options: Yes - list committees, No
• Which protocol metadata fields are mandatory in your forms (examples: sponsor ID, grant number, human subject population, study phase)?
• How should reviewer assignments be triggered (examples: automatic by committee roster, manual chair assignment, round‑robin)? Options: Automatic by roster, Manual chair assignment, Round‑robin, Other
• Are there committee-specific document templates (consent forms, study summary) that must be available in the submission form library? Options: Yes - upload list, No

Configure continuing review and renewal automation

• Which continuing review triggers should the platform enforce (examples: anniversary date, IRB expiration, funding end date)? Options: Anniversary date, IRB expiration, Funding end date, Other
• What are the required fields or documents for continuing review submissions at your institution (examples: enrollment numbers, adverse events since last review)?
• When should automated reminders be sent to investigators and study teams before a continuing review deadline (examples: 30 days, 14 days)? Options: 60 days, 30 days, 14 days, 7 days, Custom schedule
• Which workflow outcome should occur if a continuing review expires without approval (examples: automatic suspension notification, block new enrollments)? Options: Suspend study, Notify compliance officer only, Allow grace period with notifications, Other
• Are there coordinator roles that must complete interim checks before continuing review moves to committee (examples: safety officer, grants administrator)? Options: Yes - list roles, No

Implement adverse event reporting and tracking

• Which adverse event (AE) reporting workflows must be captured (examples: local AE reporting, unanticipated problems, serious adverse event (SAE) reporting to sponsor)? Options: Local AE, Unanticipated problems, SAE to sponsor, Other
• What regulatory timelines for AE escalation must the platform enforce (examples: 24‑hour SAE notification, 7‑day reporting window)?
• Which fields and attachments are required for an AE form at your institution (examples: narrative description, date of event, consent form version)?
• Who needs automatic notifications when an SAE is submitted (examples: IRB chair, safety officer, sponsor contact)?
• Do you require linkage between AE records and the protocol record and participant ID in the investigator portal? Options: Yes, No

Deploy investigator portal and submission forms

• Which investigator-facing forms must be available at pilot launch (examples: new protocol, modification, continuing review, adverse event)? Options: New protocol, Modification, Continuing review, Adverse event, Other
• What usability acceptance criteria will confirm investigator portal readiness for pilot (examples: average time to complete new application under X minutes, SUS score target)?
• Which single sign-on or ORCID requirements do investigators rely on to access the portal? Options: Institution SSO (SAML/OIDC), ORCID, Platform credentials only, Other
• How should attachments be validated on submission (examples: consent form format PDF/A, maximum file size, virus scan)?
• Which investigator roles (PI, co‑investigator, research coordinator) need distinct submission permissions and form views? Options: PI, Co‑investigator, Research coordinator, Other

Migrate legacy protocol records and attachments

• Which legacy sources contain protocol records to migrate (examples: departmental file shares, legacy IRB database export, paper archives)? Options: Legacy IRB database export, Shared drives, Paper/PDF archives, Other
• What migration completeness threshold will you accept for legacy protocols (example: 95% of active protocols including consent form and history)? Options: 95% or greater, 90-95%, 80-90%, Other
• Which document types must be preserved with original timestamps and signatures (examples: signed consent forms, IRB letters, approval memos)?
• How many historical years of protocol activity should be migrated into the platform (examples: 1 year, 3 years, all active history)? Options: 1 year, 3 years, All available active history
• What validation method should be used to confirm migration accuracy (examples: checksum of attachments, record count matching, spot audit of X records)?

Integrate grants and proposal systems

• Which grants or proposal systems must be integrated (examples: institution proposal system, sponsored projects system, eRA Commons feeds)?
• Which grant identifiers must be visible on protocol records (examples: funder award number, internal chartfield, sponsor award ID)?
• When a protocol references a grant, which data flow do you require (examples: lookup only, two‑way sync of end dates and budgets)? Options: Lookup only, One‑way sync into protocol, Two‑way sync, Other
• Which approval handoffs should be automated between the proposal system and IRB workflow (examples: auto-create protocol when proposal is approved)?
• Are there sponsor reporting obligations that require grant integration for compliance reporting (examples: NIH progress report linkage)? Options: Yes - list obligations, No

Implement conflict of interest management module

• Which financial conflict of interest (FCOI) disclosure types must be captured (examples: investigator financial interests, outside activity disclosures)? Options: Financial interests, Outside activities, Gifts and travel, Other
• Which review thresholds trigger COI committee review (examples: equity > $5,000, paid consulting > $5,000)?
• Who should receive automated notifications when a COI disclosure intersects with a protocol submission (examples: IRB chair, COI officer)?
• What record retention period do you require for COI disclosures and management plans to satisfy audit requests? Options: 3 years, 6 years, Institutional policy period, Custom
• Which integration points are required between COI module and protocol records (examples: auto-attach management plan to protocol, block approvals until resolved)?

Implement IACUC protocols and animal research workflows

• Which institutional animal care and use committee (IACUC) protocol types must be supported (examples: new animal protocol, amendment, annual re‑approval)? Options: New protocol, Amendment, Annual re‑approval, Other
• Which species and facility-specific approvals or biosafety reviews need to be linked to IACUC protocols (examples: large animals, ABSL2 facility booking)?
• What animal use records and attachments must be migrated or linked (examples: animal census logs, training certifications, IACUC correspondence)?
• Which committee-specific review steps (examples: post‑approval monitoring, occupational health clearance) must be enforced in the workflow?
• Are there external reporting obligations (examples: USDA annual reports) that require extractable IACUC data fields? Options: Yes - list reports, No

Implement biosafety workflows and inventory tracking

• Which biosafety review types are required (examples: recombinant DNA, select agent review, biological materials transfer agreements)? Options: rDNA, Select agents, Material transfer agreement, Other
• Which inventory items must be tracked in the platform (examples: BSL2 biological agents, cold storage units, biosafety cabinet serial numbers)?
• What linkage is required between biosafety records and protocol permissions (examples: lab access granted only if training current)?
• Which exposure or incident reporting fields are required to satisfy institutional biosafety officer (BSO) workflows?
• Do you require scheduled inventory reconciliation or certification reminders for biological assets (examples: quarterly, annually)? Options: Quarterly, Annually, Monthly, Custom

Set role-based permissions and committee assignments

• What canonical roles must be defined at launch (examples: IRB chair, primary reviewer, administrative coordinator, Investigator)?
• Which committee assignment rules should be enforced (examples: departmental membership, conflict‑free reviewer assignment)?
• Who will approve role and membership lists and provide final authorization for committee rosters?
• What escalation paths are required for permission changes or urgent access (examples: emergency access to protocol for audit)?
• Do you require attribute‑based access controls by unit, department, or study type (examples: access only to pediatrics studies)? Options: Yes, No, Partial - need discussion

Configure audit trails and regulatory reporting

• Which audit trail events must be captured and retained for audits (examples: submission timestamps, reviewer edits, letter generation, attachment uploads)?
• What retention period is required for audit logs to meet OHRP and institutional audit requests (examples: 6 years, 7 years)? Options: 6 years, 7 years, Institutional policy period, Custom
• What acceptance evidence will validate audit trail completeness for compliance (examples: exportable change log with user IDs and UTC timestamps, immutability proof)?
• Which regulatory report extracts do you need from the platform (examples: active protocols by department, continuing review overdue list, AE summary)?
• Do you require time‑zone normalization or signed timestamping for audit events to support federal site visit review? Options: Yes - signed timestamps, Yes - UTC normalization only, No

• current_state
• decision_readiness
• success_criteria
• stakeholders
• gaps
• desired_state
• gaps
• success_criteria
• stakeholders
• desired_state
• current_state
• decision_readiness
• stakeholders
• decision_readiness
• current_state
• desired_state
• success_criteria
• gaps
• desired_state
• success_criteria
• current_state
• decision_readiness
• gaps
• decision_readiness
• desired_state
• decision_readiness
• decision_readiness

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Order Form / Subscription Agreement
• Service Level Agreement (SLA)
• Pilot Acceptance Addendum
• Data Processing Agreement (DPA)
• HIPAA Business Associate Addendum (BAA)
• Operational Responsibilities & Runbook Appendix
• Change Order Agreement
• Support and Training Schedule

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate Review (around day 90)
• Ongoing Operational Review, Monthly (months 4+)
• Quarterly Governance Review

• Resolve the top priority operational tickets and update the ticket log with evidence of resolution.
• Publish the acceptance decision record including evidence files and signatory statement.
• Execute incumbent decommission tasks: archive or migrate remaining data and disable write access as documented.
• Track and close remediation items against agreed timelines and evidence checkpoints.
• Operational metrics trend review
• Confirm the operational metrics are stable or improving toward Pilot Evaluation targets and identify any new risks.
• Reduce the hypercare ticket backlog and document owners and resolution dates for remaining tickets.
• Maintain a prioritized enhancement backlog and confirm next delivery window for minor changes.
• Re-confirm success criteria and owners
• Publish the monthly metric snapshot and note any data adjustments or calculation changes.
• Triage enhancement requests from the shared channel into the backlog with priority and target delivery quarter.
• Quarterly outcomes vs acceptance targets
• Executive confirmation that outcome metrics are being sustained relative to Pilot Evaluation targets or that an adjusted plan is in place.
• Confirm ongoing governance and training cadence with named owners and escalation steps.
• Agree the enhancement roadmap priorities and next quarter delivery commitments.
• Publish the quarterly outcomes report including metric trends and any approved adjustments to targets.
• Schedule the next quarter's governance and training sessions and publish the calendar.
• Update the enhancement roadmap with priorities, estimated delivery quarters, and acceptance criteria for each item.
• Confirm deployment and migration validations are complete and any outstanding environment issues are documented.
• Document early adoption signals and immediate user blockers for remediation.
• Agree remediation tasks and schedule the First Measurement meeting within 4 to 8 weeks.
• Publish a go-live validation report showing environment checks and sample migrated records.
• Log and prioritize open blockers with target resolution dates.
• Schedule the First Measurement meeting and circulate pre-read on data sources and measurement timing.
• Present first measurement data
• Establish whether median protocol committee cycle time and investigator portal weekly active users are moving toward the Pilot Evaluation targets.
• Document root causes for each off-target metric and agree corrective actions with due dates.
• Confirm the data sources and timeline required for the Acceptance Gate review.
• Produce a metric dashboard extract showing baseline, current period, and variance to Pilot Evaluation targets.
• Implement agreed corrective actions, such as workflow configuration updates or targeted investigator training, with completion dates.
• Deliver a readiness packet for the Acceptance Gate meeting including raw data, calculation method, and evidence files.
• Restate acceptance criteria and numeric targets
• Record a documented acceptance decision per Pilot Evaluation criteria with a named buyer signatory or owner where required.
• Confirm incumbent system is decommissioned or formally retained read-only and that data disposition is complete.
• Agree remediation plan and timelines for any unmet criteria so the project can move into steady state.
• Hypercare ticket burn-down
• Governance cadence and escalation path review
• Present outcome data against each criterion
• Diagnose gaps and root causes
• Deployment and migration validation
• Training completion and proficiency check
• Document pass or fail and capture formal acceptance decision
• Enhancement backlog and prioritization
• Agree corrective actions and dates
• Early adoption signals and access checks
• Risk register and audit readiness
• Blockers and open issues log
• Confirm timeline to Acceptance Gate
• Enhancement requests triage via shared channel
• Incumbent system wind-down confirmation
• Agree immediate remediation actions
• Agree remediation items and resolution timelines