**MEMORANDUM**

**To:** NovaCrest Research incident response team  
**From:** Outside counsel  
**Re:** Version 4.2 consent-form omission; immediate stop, reporting, investigation, and re-consent sequence  

**Assumptions used for timing:** Discovery occurred **Wednesday at 10:00 a.m.** Deadlines are measured from discovery. If a business-day deadline falls on a holiday, adjust according to the applicable rules. To avoid last-minute risk, treat the outside dates as **earlier than the legal maximum**.

---

## 1. Bottom-line immediate posture

Version 4.2 is defective because it omitted a protocol-required material risk: the **3% risk of temporary nerve weakness**.

The affected population is not yet fully known. The current factual state is:

- **38 subjects** are confirmed to have signed **v4.2** — defective.
- **20 subjects** are confirmed to have signed **v4.1 or v4.3** — not affected by this omission.
- **62 subjects** are **unresolved** because consent version is not yet verified.

Do **not** infer that the 62 unknown subjects are unaffected, or that all 62 are affected, from enrollment dates, site pattern, or the known 38/20 counts. Each of the 62 must be individually resolved through version-controlled records and direct site confirmation.

Until each subject is resolved:

- Treat confirmed v4.2 subjects as affected.
- Treat confirmed v4.1/v4.3 subjects as not affected by this omission.
- Treat the 62 unresolved subjects as **potentially affected** for any nonurgent research intervention that depends on valid consent.

---

# 2. Immediate stop: enrollment and intervention holds

Effective **immediately upon discovery**, i.e., **Wednesday 10:00 a.m.**, NovaCrest must implement the following.

## A. Stop new enrollment

Stop **new enrollment** at all five sites until:

1. The active consent form being used at each site is verified to be **not v4.2**; and  
2. An ethics-board-approved corrected form or re-consent/addendum is in use where required.

A site may not enroll new subjects under a consent form whose version cannot be affirmatively confirmed as compliant.

## B. Stop nonurgent research interventions under the defective or unverified consent

Immediately suspend **all nonurgent research interventions** for:

1. **All 38 confirmed v4.2 subjects**, until:
   - the central ethics board approves corrected materials; and
   - the subject is re-consented, if the subject has not completed study interventions, or has received the required new risk information and made data-use/continued-participation choices, if the subject has completed interventions.

2. **All subjects whose consent version cannot yet be affirmatively confirmed as v4.1 or v4.3**, including the **62 unresolved subjects**, until each subject’s consent version is directly verified.

This includes, at minimum, the **12 subjects scheduled for implantation in the next 72 hours**:

- **4 confirmed v4.2 subjects** — hold implantation.
- **8 unknown-version subjects** — hold implantation until their signed consent version is verified. If verified as v4.1 or v4.3, no re-consent is required solely for this error. If verified as v4.2 or unresolved, implantation must not proceed before re-consent on the approved corrected form.

## C. What is not stopped

Medically necessary care and safety follow-up must continue.

The pause does **not** permit NovaCrest to:

- withhold clinically necessary care;
- abandon implanted subjects;
- delay safety follow-up needed to assess nerve weakness or other safety issues;
- use the consent issue as a reason to refuse necessary medical management.

For the **six subjects needing routine safety visits this week**, continue the safety/medically necessary components. If any component of the visit is a nonurgent research procedure and the subject is a confirmed v4.2 subject or an unresolved subject, defer that nonurgent research component until the subject is properly re-consented or verified. Do not delay the safety assessment itself.

## D. Reject the site investigators’ proposed workaround

The proposal to **continue scheduled implants now and send an explanatory email afterward** is not acceptable.

It violates the required sequence because:

- consent must be valid before a research intervention;
- v4.2 consent for the nerve-weakness risk is defective;
- an after-the-fact email is not valid prior informed consent;
- the sponsor must stop nonurgent interventions under the defective form until corrected materials are approved;
- unknown-version subjects cannot proceed as if their consent were valid.

If any site proceeds with an implant after this notice, that becomes a separate reportable noncompliance.

---

# 3. Preservation, privilege, and the proposed PDF replacement

## A. Immediate preservation order

Issue a legal hold and preservation instruction immediately to all sites, data-management staff, quality/regulatory staff, IT, and the chief scientific officer.

Preserve, in original form and with metadata where possible:

1. **All consent-form versions**: v4.1, v4.2, v4.3, and any other versions or drafts.
2. **All signed consent forms and PDFs**, including unuploaded local files.
3. **All consent-form version identifiers**, file names, file paths, timestamps, and document-conversion logs.
4. **Site consent logs**, subject source documents, and investigator signatures.
5. **Central database records**, enrollment dates, subject status, visit logs, implant logs, and audit trails.
6. **Safety reports**, including the nerve-weakness event report and any related correspondence.
7. **Communications** about version 4.2, the conversion error, the omission, the site proposal to continue implants, and the CSO’s request to replace PDFs.
8. **Data records** and any data dictionaries, access logs, or change logs.
9. **Training, monitoring, and quality-assurance records** relevant to consent-form use.

## B. Do not replace v4.2 PDFs with v4.3

The CSO’s instruction to replace v4.2 PDFs with v4.3 “so the file is clean” is prohibited.

That action would:

- destroy evidence;
- alter the audit trail;
- create a false record that subjects signed v4.3;
- backdate or recreate consent as though valid disclosure occurred earlier;
- violate the required preservation and audit-trail integrity rules.

If the database must be corrected, do it through **version-controlled correction only**:

- retain the original v4.2 file;
- retain metadata and file history;
- add a corrected or annotated record if appropriate;
- document who made the correction, when, and why;
- never overwrite, delete, or silently substitute a different consent version.

If any staff member has already replaced a v4.2 PDF with v4.3:

1. stop further replacement immediately;
2. preserve forensic evidence of the replacement, including logs, email, and file timestamps;
3. disclose the attempted or completed alteration to the ethics board and regulator as part of the corrective record.

## C. Privilege

Privileged legal analysis may be separated from operational fact gathering, but privilege does **not** excuse:

- required reporting;
- factual candor to the ethics board or regulator;
- preservation of documents;
- accurate disclosure of what is known and what remains unresolved.

Use a practical two-track approach:

- **Factual incident file**: facts, records, subject status, reports, remediation steps. This is the record provided to oversight bodies.
- **Legal analysis file**: counsel’s legal assessments, privilege-sensitive analysis, and strategy. Maintain a privilege log where appropriate.

Do not withhold facts merely because they are contained in a document prepared at counsel’s direction.

---

# 4. Ethics-board and regulator reporting clocks

## A. Clock start

The reporting clocks begin at **discovery: Wednesday 10:00 a.m.**

NovaCrest has not yet reported. It must not wait until the end of the reporting period.

## B. Central ethics board

The sponsor must report material consent noncompliance to the **central ethics board within five business days after discovery**.

Assuming discovery day is not counted as a business day:

- Thursday = Day 1  
- Friday = Day 2  
- Monday = Day 3  
- Tuesday = Day 4  
- Wednesday = Day 5  

The outside deadline is therefore the **fifth business day after discovery**, i.e., the following Wednesday, absent holidays.

**Recommended internal deadline:** notify the central ethics board **today, Wednesday**, and submit a preliminary written report **by Thursday morning** in connection with the emergency review. File a more complete report by **Tuesday**, and in no event later than the fifth business day.

## C. Device regulator

The sponsor must report material consent noncompliance to the **device regulator within seven calendar days after discovery**.

The outside deadline is the **seventh calendar day after Wednesday 10:00 a.m.**, i.e., the following Wednesday at 10:00 a.m., absent holidays.

**Recommended internal deadline:** make an initial regulatory notification by **Thursday or Friday**, and file the formal report well before Day 7, preferably by **Tuesday**, to allow time for any follow-up questions.

## D. Site/local reporting

Each site must check its approved plan for any faster local reporting requirement.

No faster local period is supplied in the facts, but each site must:

1. confirm whether its local IRB/ethics board or sponsor-approved plan requires faster reporting;
2. make any faster local report immediately if required;
3. document that check even if no faster local report is required.

## E. Content of reports

Reports should state, at minimum:

- discovery date and time;
- protocol and device;
- the omitted material risk: 3% temporary nerve weakness;
- that v4.2 omitted the required nerve-weakness paragraph;
- that v4.1 and v4.3 contain the paragraph;
- current known scope:
  - 38 confirmed v4.2;
  - 20 confirmed v4.1/v4.3;
  - 62 unresolved;
- immediate holds on new enrollment and nonurgent interventions;
- continuation of medically necessary care and safety follow-up;
- the nerve-weakness event in a confirmed v4.2 subject;
- preservation actions;
- proposed corrected materials and re-consent plan;
- status of ethics-board and regulator reporting;
- that the affected population may expand until the 62 unresolved subjects are individually verified.

Do not report that only 38 subjects are affected. Report that **at least 38 are confirmed affected** and **62 remain unverified**.

---

# 5. Emergency ethics-board approval of corrected materials

NovaCrest should convene the central ethics board for emergency review **tomorrow, Thursday**.

The emergency submission should request approval of:

1. the immediate enrollment and intervention holds;
2. the corrected consent/re-consent form or addendum;
3. the notification form for subjects who completed interventions;
4. the re-consent process and required documentation;
5. interim data handling, including retention and any freeze on nonessential use;
6. communication regarding the nerve-weakness event;
7. criteria for resuming enrollment and nonurgent interventions.

## A. Corrected form

The corrected form should:

- be current and dated as of the re-consent or notification date;
- clearly identify the study and procedure;
- state that a prior consent form, version 4.2, omitted a known material risk;
- describe the **3% risk of temporary nerve weakness**;
- explain what symptoms to watch for and what to do if they occur;
- provide contact information for questions;
- allow the subject to ask questions before signing or choosing continued participation/data use;
- not backdate the consent;
- not represent that the original consent was valid;
- be approved by the central ethics board before use.

If version 4.3 is already an approved form that contains the required risk disclosure, the emergency review should confirm whether version 4.3 alone is sufficient or whether a new re-consent/addendum version is required. Given the omission and the need to avoid recreating consent as though the disclosure originally occurred, a **new dated re-consent or addendum that identifies the omission** is the safer approach.

## B. If the ethics board does not approve by Thursday

If corrected materials are not approved, the holds remain in place. NovaCrest may not begin re-consent or resume nonurgent research interventions under the defective or unverified consent process until approval is obtained.

---

# 6. Re-consent of subjects awaiting intervention

Apply this subject-by-subject after ethics-board approval.

## A. Subjects who have not completed study interventions

For each enrolled subject who has **not completed study interventions**:

1. Verify the signed consent version.
2. If the subject signed **v4.2**:
   - schedule individual re-consent;
   - use the approved corrected form;
   - do not proceed with the next nonurgent research intervention until the subject signs the approved corrected form.
3. If the subject’s version is **unknown**:
   - hold the next nonurgent intervention until the version is verified;
   - if verified as v4.2, re-consent before proceeding;
   - if verified as v4.1 or v4.3, no re-consent is required solely for this omission, subject to any other applicable requirements.
4. If the subject declines re-consent:
   - do not perform the nonurgent research intervention;
   - continue medically necessary care;
   - document the subject’s decision.

## B. The 12 scheduled implants

For the next 72 hours:

### Four confirmed v4.2 subjects

- Hold implantation.
- After ethics-board approval, re-consent each subject individually using the approved corrected form.
- Implant only after valid re-consent.

### Eight unknown-version subjects

- Hold implantation.
- Obtain direct site confirmation of the signed consent version.
- If verified as v4.1 or v4.3, no re-consent is required solely for this omission, and implantation may proceed if no other hold applies.
- If verified as v4.2, re-consent before implantation.
- If the version remains unresolved, continue the hold beyond 72 hours until resolution.

Do not use enrollment date alone to decide whether the consent form was good or bad.

---

# 7. Notice and consent choices for subjects who completed intervention

For subjects who have **completed interventions**, the requirement is not to recreate the original consent as valid. Instead, NovaCrest must provide new risk information where it may affect:

- safety follow-up; or
- the subject’s willingness to permit continued data use.

This applies at minimum to all **confirmed v4.2 subjects who completed interventions**, including the subject who experienced temporary nerve weakness.

For the 62 unresolved subjects, first verify consent version. If verification is not complete before a safety visit or other contact point, treat the subject as potentially affected pending verification and use the approved notification process.

## A. Method

The communication should be individualized and documented. A standalone explanatory email is not sufficient by itself, particularly where the subject may need to make an informed choice about continued safety follow-up or data use.

Preferred approach:

1. Face-to-face or telephone contact by the investigator or designated study staff;
2. followed by written documentation;
3. opportunity to ask questions;
4. documented subject response.

An email may be used as a supplement, but not as the only remedial contact, unless the ethics board approves a specific email-based process.

## B. Required information

Tell the subject:

- that version 4.2 omitted a known material risk;
- the nature of the risk: 3% temporary nerve weakness;
- what symptoms to monitor for;
- that the omission has been reported;
- that the subject may ask questions;
- what options are available regarding continued participation, safety follow-up, and data use.

## C. Subject choices

For completed subjects, document the subject’s choice regarding:

1. continued safety follow-up, to the extent it is research-related and subject to consent;
2. continued use of previously collected data, to the extent subject choice affects it;
3. future nonurgent research interventions, if any remain.

If a subject declines continued research participation or future data use:

- respect the refusal to the extent feasible;
- continue medically necessary care;
- do not force research participation;
- refer the question of previously collected data to the ethics board, because previously collected data is not automatically discarded.

## D. The nerve-weakness subject

The confirmed v4.2 subject who experienced temporary nerve weakness must be prioritized.

Provide individualized notification that:

- the event was a known protocol risk;
- the risk was omitted from the version 4.2 consent form;
- the subject was not told before implantation that this was a known risk;
- the event has been reported through the safety channel;
- supplemental reporting or investigation is occurring;
- the subject is offered appropriate clinical follow-up.

Document the conversation and the subject’s response.

---

# 8. Treatment of previously collected data

Do not discard data automatically.

All previously collected data must be:

1. preserved;
2. labeled by consent version where possible;
3. retained in the study record;
4. not deleted or overwritten;
5. not used for nonessential analysis, publication, or secondary use until the ethics board decides continued use.

The ethics board will decide continued use after considering:

- the risk involved;
- subject wishes;
- scientific integrity;
- the nature of the noncompliance.

Until that determination:

- continue collecting data necessary for medically necessary care and safety follow-up;
- freeze nonessential research use of affected-subject data;
- if a subject refuses future data use, stop future research data collection to the extent feasible;
- do not represent to the subject that previously collected data will be erased before the ethics board has decided.

For confirmed v4.1/v4.3 subjects, this consent omission does not, by itself, require data remediation.

For the 62 unresolved subjects, classify their data as pending version verification. Do not assume their data is clean or compromised.

---

# 9. Specific records needed to determine the affected population

NovaCrest must determine scope through version-controlled records and direct site confirmation. The following records are required:

## A. Consent-form records

1. Approved protocol sections requiring the nerve-weakness risk disclosure.
2. Ethics-board approvals for consent-form versions.
3. Master consent forms for v4.1, v4.2, v4.3, and any drafts or related versions.
4. Version-control metadata:
   - version numbers;
   - effective dates;
   - approval dates;
   - file names;
   - file paths;
   - creation/modification timestamps;
   - document-conversion logs.
5. Any template, conversion tool output, or conversion-error evidence.

## B. Signed subject records

For each of the 120 subjects, obtain or verify:

1. Signed consent form or PDF.
2. Visible version identifier, if present.
3. Metadata identifying the document version.
4. Date signed.
5. Site and investigator signature.
6. Location of original/source document.
7. Whether the signed PDF has been uploaded to the central database.

Several signed PDFs have not yet been uploaded. Those files must be retrieved immediately from the sites and preserved with metadata.

## C. Site confirmation records

Each of the five sites must provide:

1. Site consent log.
2. Subject-level reconciliation list:
   - subject ID;
   - enrollment date;
   - consent version;
   - verification method;
   - verifying investigator;
   - date verified;
   - supporting source document.
3. Written site attestation that the version list is accurate to the site’s knowledge.
4. If a site cannot verify a subject’s version, the subject remains unresolved.

## D. Study operational records

1. Central database enrollment dates and subject status.
2. Visit logs.
3. Implant logs.
4. Safety-visit logs.
5. Subject completion status.
6. Scheduled future interventions.
7. Withdrawal or suspension status.

## E. Safety records

1. The nerve-weakness event report.
2. All safety reports that may involve nerve weakness or similar events.
3. Subject clinical notes relevant to the event, to the extent available and permitted.
4. Supplemental event reporting communications.

## F. Investigative and remedial records

1. Discovery communication at Wednesday 10:00 a.m.
2. Hold notices to sites.
3. Preservation instructions.
4. Site responses.
5. Ethics-board submissions.
6. Regulator submissions.
7. Re-consent forms and documentation.
8. Completed-subject notifications.
9. Data-use decisions.
10. Root-cause and corrective-action records.

---

# 10. The known nerve-weakness event

The confirmed v4.2 subject who experienced temporary nerve weakness is a critical fact.

## A. Safety reporting

The event was already reported through the ordinary safety channel. That report should be supplemented to reflect:

- that the risk was known and protocol-required;
- that the subject’s signed consent form omitted the risk;
- that the subject was not told before implantation that the risk was known;
- that the event is part of a material consent noncompliance;
- any new clinical facts.

Do not treat the ordinary event report as sufficient for the consent-noncompliance report.

## B. Subject notification

The subject must be contacted promptly and individually. The contact should explain:

- the known 3% risk;
- that the omission occurred in v4.2;
- that the event is consistent with a known risk;
- that the omission has been escalated;
- what follow-up is available.

This subject’s consent choices regarding continued safety follow-up and data use must be documented.

## C. Underreporting check

Review all safety reports and site logs for other events that may represent nerve weakness or similar adverse events. Include the findings in the ethics-board and regulator reports.

## D. Clinical follow-up

Even though the weakness resolved after four days:

- confirm current status;
- offer follow-up if clinically appropriate;
- document the offer and the subject’s response;
- ensure the subject knows what symptoms should prompt immediate contact.

---

# 11. Concrete sequence for the next 72 hours and seven days

The following sequence assumes no holidays and that the central ethics board meets tomorrow, Thursday.

---

## Day 0 — Wednesday, discovery day

### 10:00 a.m. — Discovery and activation

- Confirm discovery time: **Wednesday 10:00 a.m.**
- Declare a material consent noncompliance.
- Activate incident team:
  - outside counsel;
  - regulatory affairs;
  - quality assurance;
  - clinical operations;
  - data management;
  - central ethics-board liaison;
  - site leads;
  - communications.

### 10:15 a.m. — Immediate holds

Issue written hold notice to all five sites:

1. Stop new enrollment until the active consent form is verified and an approved corrected form is in use where required.
2. Suspend all nonurgent research interventions for:
   - all confirmed v4.2 subjects;
   - all subjects whose consent version cannot yet be verified.
3. Specifically hold the 12 scheduled implants:
   - 4 confirmed v4.2;
   - 8 unknown.
4. Continue medically necessary care and safety follow-up.
5. Do not use v4.2 for any subject.
6. Do not replace, delete, alter, or backdate any consent records.

### 10:30 a.m. — Preservation

- Issue legal hold/preservation order.
- Preserve v4.2 and all signed consent PDFs, logs, and metadata.
- Instruct CSO and all staff: no replacement of v4.2 PDFs with v4.3.
- If any replacement has already occurred, preserve evidence of it and report it.

### 11:00 a.m. — Scope triage

Create a subject-level tracker for all 120 subjects:

- subject ID;
- site;
- enrollment date;
- consent version:
  - confirmed v4.2;
  - confirmed v4.1/v4.3;
  - unresolved;
- completion status;
- scheduled interventions;
- safety-visit status;
- event status;
- re-consent status;
- notification status;
- data-use choice.

Initial classification:

- 38 confirmed v4.2;
- 20 confirmed v4.1/v4.3;
- 62 unresolved.

### 11:30 a.m. — Begin records retrieval

Request from all five sites:

- consent logs;
- signed consent PDFs;
- unuploaded local PDFs;
- enrollment and visit logs;
- implant logs;
- safety reports;
- document-version metadata.

### 1:00 p.m. — Event-subject handling

Identify the confirmed v4.2 subject who experienced nerve weakness.

Arrange prompt clinical and consent-related contact. If the ethics board can approve a communication template quickly, use it. If not, make an individualized safety/consent-related contact with documentation, followed by written confirmation.

### 3:00 p.m. — Prepare oversight reports

Prepare:

- central ethics-board emergency report;
- preliminary regulator report;
- corrected consent/re-consent draft;
- completed-subject notification draft;
- data-handling interim request.

### 5:00 p.m. — Notify central ethics board

Notify the central ethics board of the material consent noncompliance and request emergency review for Thursday.

Provide a preliminary report even if full scope is unknown. State clearly:

- 38 confirmed affected;
- 20 confirmed not affected by this omission;
- 62 unresolved pending verification;
- scope may expand.

### 6:00 p.m. — Site local-report check

Each site PI or site lead must confirm whether any faster local reporting is required.

If any faster local report is required, make it immediately and document the requirement.

### End of Day 0

By close of Wednesday:

- no new enrollment;
- no nonurgent research interventions for confirmed v4.2 or unresolved subjects;
- 12 scheduled implants held;
- preservation in place;
- central ethics board notified;
- records retrieval started;
- event-subject contact underway or scheduled.

---

## Day 1 — Thursday, 24 hours after discovery

### Morning — Emergency ethics-board review

Submit the emergency package to the central ethics board:

- factual background;
- defective version and omitted risk;
- known scope and unresolved scope;
- immediate holds;
- continuation of care;
- proposed corrected re-consent/addendum;
- completed-subject notification;
- re-consent process;
- data-handling request;
- nerve-weakness event details;
- preservation status.

Request approval of:

1. the hold protocol;
2. corrected consent/re-consent form;
3. completed-subject notification;
4. interim data handling;
5. event-subject communication.

### Morning through afternoon — Continue scope verification

For the 62 unresolved subjects:

- retrieve unuploaded PDFs;
- verify version identifiers;
- reconcile central database with site consent logs;
- obtain direct site confirmation.

Priority:

- the 8 unknown subjects scheduled for implantation;
- any subjects with safety visits this week;
- any confirmed or suspected event subjects.

### If ethics board approves corrected materials

Begin re-consent for:

- the 4 confirmed v4.2 subjects scheduled for implantation;
- any other confirmed v4.2 subjects with upcoming nonurgent interventions.

Do not proceed with nonurgent interventions until the approved corrected form is signed.

For the 8 unknown scheduled implant subjects:

- if verified v4.1/v4.3, no re-consent is required solely for this error;
- if verified v4.2, re-consent before implantation;
- if unresolved, continue hold.

### Afternoon — Event-subject completion

Complete the individualized notification for the nerve-weakness subject, unless already completed on Wednesday.

Document:

- what was explained;
- questions asked;
- subject response;
- follow-up plan.

### End of Day 1

By close of Thursday:

- emergency ethics-board review completed or scheduled for next available emergency slot;
- corrective materials approved or pending;
- 8 unknown implant subjects’ status documented;
- re-consent process underway if approved;
- event subject contacted;
- preliminary ethics-board report filed.

---

## Day 2 — Friday, 48 hours after discovery

### Morning — Re-consent confirmed v4.2 subjects awaiting intervention

Complete re-consent for all confirmed v4.2 subjects who have nonurgent interventions scheduled, starting with the 4 confirmed v4.2 implant subjects.

For each:

- confirm identity;
- confirm version;
- confirm completion status;
- conduct individual consent discussion;
- use approved corrected form;
- document current date and signature;
- schedule intervention only after valid re-consent.

### Morning — Regulator reporting

Submit or finalize the device-regulator report, or ensure it is on track for filing well before the 7-calendar-day deadline.

The report should include:

- discovery;
- defective version;
- known and unresolved scope;
- holds;
- event;
- preservation;
- corrective plan.

### Afternoon — Completed-subject notifications

Begin notifications to confirmed v4.2 subjects who completed interventions.

Priority:

- nerve-weakness subject;
- subjects with safety visits this week;
- subjects with residual symptoms or safety concerns.

For each:

- provide corrected risk information;
- allow questions;
- document subject’s choices regarding continued safety follow-up and data use.

### End of Day 2

By close of Friday:

- all confirmed v4.2 subjects awaiting nonurgent interventions should be re-consented or have a documented schedule to do so;
- regulator report submitted or imminently due;
- completed-subject notifications underway;
- unresolved subjects remain held where a nonurgent research intervention is pending.

---

## Day 3 — Saturday, 72-hour checkpoint

By **Saturday 10:00 a.m.**, produce an internal 72-hour status report.

It must state:

1. **Enrollment hold status**
   - new enrollment stopped;
   - sites verified;
   - corrected form approved or pending.

2. **Intervention hold status**
   - no confirmed v4.2 subject underwent a nonurgent research intervention without re-consent;
   - no unresolved-version subject underwent a nonurgent research intervention without verification/re-consent;
   - status of the 12 scheduled implants:
     - 4 confirmed v4.2: re-consented or pending;
     - 8 unknown: verified good, re-consented, or still held.

3. **Care and safety status**
   - medically necessary care continued;
   - safety visits completed or continued;
   - no subject abandoned.

4. **Scope status**
   - 38 confirmed v4.2;
   - 20 confirmed v4.1/v4.3;
   - number of the 62 unresolved subjects now verified;
   - number still unresolved;
   - no assumption made about the remaining unknown subjects.

5. **Reporting status**
   - central ethics-board report filed;
   - emergency review outcome;
   - regulator report filed or scheduled;
   - site local-report check completed.

6. **Event-subject status**
   - contacted;
   - information provided;
   - follow-up arranged;
   - safety report supplemented.

7. **Preservation status**
   - legal hold in place;
   - no PDFs replaced;
   - audit trail preserved.

Any unresolved subjects whose version remains unknown must remain held for any nonurgent research intervention.

---

## Days 4–6 — Sunday through Tuesday

### Sunday and Monday — Complete version verification

For the remaining unresolved subjects:

- retrieve missing signed PDFs;
- obtain site attestations;
- reconcile database with site source records;
- classify each subject as:
  - v4.2;
  - v4.1/v4.3;
  - still unresolved if records remain incomplete.

Do not close the scope investigation until each subject is either verified or affirmatively identified as unresolvable based on available records.

### Monday and Tuesday — Finish re-consent and notifications

Complete:

1. re-consent for all affected subjects who have not completed study interventions and have upcoming nonurgent interventions;
2. notifications for all affected completed subjects;
3. documentation of subject choices;
4. follow-up for the nerve-weakness subject;
5. supplemental ethics-board and regulator reports if new facts emerge.

### Tuesday — Data-use determination

Request or finalize the central ethics board’s determination on continued use of previously collected data.

The request should provide:

- final known scope;
- subjects who declined future data use;
- nature of the noncompliance;
- safety risk;
- scientific value;
- data types involved;
- proposed data-handling restrictions.

### Tuesday — Corrective actions

Begin or complete corrective actions:

- retrain site staff on consent-version control;
- correct document-conversion process;
- add version verification to enrollment workflow;
- require site upload of signed consent forms before or at data entry;
- add monitoring checklist for consent-version integrity;
- confirm no site is using v4.2;
- document root cause and corrective-action plan.

---

## Day 7 — Wednesday, seven days after discovery

By **Wednesday**, and no later than the outside deadline:

1. **Central ethics board report**
   - final or supplemental report filed within five business days;
   - includes final known scope, unresolved subjects, event details, re-consent results, notifications, data-use status, and corrective actions.

2. **Device regulator report**
   - final or supplemental report filed within seven calendar days;
   - includes same core facts and the current status of subject remediation.

3. **Ethics-board data-use decision**
   - obtain and document the board’s determination on previously collected data.

4. **Resume operations only as permitted**
   - resume new enrollment only after:
     - ethics-board approval of corrected form;
     - site verification that no defective form is in use.
   - resume nonurgent interventions only after:
     - verified compliant consent for that subject; or
     - approved re-consent for affected subjects.

5. **Close initial response phase**
   - move to monitoring and follow-up;
   - maintain preservation;
   - continue safety follow-up;
   - track any further events or underreported nerve-weakness cases.

---

# 12. Final required sequence in one sentence

Immediately stop new enrollment and all nonurgent research interventions for confirmed v4.2 subjects and any subject whose consent version is unverified; preserve all records without replacement; report to the central ethics board within five business days and to the device regulator within seven calendar days, with preliminary notice now; obtain emergency ethics-board approval of corrected materials; re-consent affected subjects who have not completed interventions before any next nonurgent intervention; provide corrected risk information and documented choices to affected subjects who completed interventions; resolve the 62 unknown subjects individually through version-controlled records and direct site confirmation; supplement the nerve-weakness event report and notify that subject; treat previously collected data as retained and pending ethics-board decision; and do not proceed until each affected or unresolved subject is individually resolved.