When an Institutional Review Board (IRB) reviews a research study, it evaluates whether the study adequately protects the rights, safety, and well-being of the people who will participate. The board examines everything from the study design and risk level to the informed consent process and how participant data will be kept confidential. This review is required by federal regulation before any human subjects research can begin, and it continues through the life of the study.
What the IRB Actually Evaluates
Federal regulations lay out specific criteria the IRB must satisfy before approving any study. These aren’t vague guidelines. The board has to confirm each one is met:
- Risks are minimized. The study must use procedures consistent with sound research design and avoid exposing participants to unnecessary risk. When possible, researchers should piggyback on procedures participants are already undergoing for diagnosis or treatment.
- Risks are reasonable relative to benefits. The board weighs foreseeable harms against potential benefits to participants and the value of the knowledge the study may produce.
- Subject selection is equitable. The study can’t unfairly burden one group of people with research risks while another group reaps the benefits. This includes scrutinizing who gets recruited and why.
- Informed consent is properly obtained and documented. Participants must be told what they’re agreeing to in language they can actually understand, and that consent must be recorded appropriately.
- Safety monitoring is in place. For studies with ongoing risk, the research plan must include a way to monitor incoming data so problems can be caught early.
- Privacy and confidentiality are protected. There must be adequate provisions to shield participants’ identities and keep their data secure.
These criteria trace back to three ethical principles outlined in the Belmont Report, a foundational document in research ethics. Respect for persons drives the informed consent requirements. Beneficence is the basis for weighing risks against benefits. Justice demands that the burdens and benefits of research are distributed fairly across populations, not concentrated on people who are easy to recruit but unlikely to benefit.
Three Levels of Review
Not every study gets the same intensity of scrutiny. The IRB sorts research into three categories based on the level of risk involved.
Exempt review applies to research that poses virtually no risk to participants. Studies using publicly available data, anonymous surveys, or educational tests often qualify. “Exempt” doesn’t mean no one looks at it. Someone at the institution still confirms the exemption applies.
Expedited review is available when the research presents no more than minimal risk and involves only procedures from a specific federally approved list. One or two experienced IRB members can review and approve the study without convening the full board. Importantly, expedited review cannot be used if identifying participants or their responses could expose them to criminal or civil liability, damage their finances or reputation, or be stigmatizing, unless protections are in place to keep those risks minimal.
Full board review is required for research that exceeds minimal risk. The entire IRB panel meets, discusses the protocol, and votes. Studies involving experimental drugs, invasive procedures, or sensitive populations typically fall here.
Who Sits on the Board
An IRB must have at least five members with diverse backgrounds. Federal rules require the panel to include at least one member whose expertise is in a scientific area and at least one whose expertise is nonscientific. There must also be at least one member who has no affiliation with the institution, someone who can offer an outside perspective free from institutional pressures.
The board’s composition should reflect diversity in race, gender, and cultural background, and members should be sensitive to community attitudes. When the IRB regularly reviews research involving vulnerable groups like children, prisoners, or people with impaired decision-making capacity, the board should include someone with direct experience working with those populations.
How the Review Process Works
The process follows a fairly standard sequence, though details vary by institution. A researcher submits an application describing the study’s purpose, procedures, risks, benefits, and how participants will be recruited and consented. An IRB analyst then screens the submission for completeness, checking that all regulatory requirements are addressed. Incomplete or inaccurate applications get sent back with a list of items to fix.
Once the submission passes this pre-review, the analyst determines whether the study qualifies for expedited review or needs to go before the full board. For full board review, the protocol is placed on an upcoming meeting agenda. Board members review the entire application ahead of time, then discuss concerns during the meeting. The board can approve the study, request modifications, ask the researcher for more information, or disapprove it outright. After a decision is reached, the researcher receives a formal determination letter.
For expedited review, the process skips the full meeting. A designated reviewer evaluates the protocol and can approve it or request changes, but cannot disapprove a study. Disapproval requires the full board.
What the IRB Looks for in Informed Consent
The consent document is one of the most closely scrutinized parts of any submission. Federal regulations require it to include a specific set of disclosures, written in language the target population can understand. The consent form must tell participants:
- That the study involves research, what its purpose is, how long participation will last, and what procedures are involved
- Any reasonably foreseeable risks or discomforts
- Any expected benefits to the participant or to others
- Alternative treatments or procedures that might be available
- How confidentiality of records will be maintained
- For studies with more than minimal risk, whether compensation or medical treatment is available if injury occurs
- Who to contact with questions about the research or about participants’ rights
- That participation is voluntary and can be stopped at any time without penalty
The consent form cannot contain any exculpatory language, meaning it cannot ask participants to waive their legal rights or release the institution from liability. The IRB can also require additional information beyond these basics if the board believes it would meaningfully protect participants.
Extra Protections for Vulnerable Populations
Federal regulations include three additional subparts that impose stricter requirements when research involves pregnant women and fetuses, prisoners, or children. These aren’t optional considerations. When a study involves any of these groups, the IRB must apply the relevant additional protections on top of the standard review criteria. For example, research with children typically requires both parental permission and the child’s own agreement (called assent) when the child is old enough to understand what’s being asked.
Ongoing Oversight After Approval
IRB review doesn’t end when the study gets the green light. Most approved studies require continuing review at least once every 12 months, with no more than 364 days between reviews. Higher-risk studies, like first-in-human trials, may be reviewed more frequently. For FDA-regulated research, annual continuing review is mandatory regardless of the study’s current phase.
One notable change under the revised Common Rule (effective January 2019): studies that were initially approved through expedited review no longer require continuing review. This reduced administrative burden for lower-risk research without compromising participant safety.
Between scheduled reviews, researchers have an obligation to report unanticipated problems. An event qualifies as an unanticipated problem if it is unexpected given what was described in the protocol, possibly related to participation in the research, and suggests participants face greater risk than previously recognized. Serious adverse events meeting these criteria should be reported to the IRB within one week. Other unanticipated problems should be reported within two weeks.
Single IRB Requirements for Multi-Site Studies
If a study takes place at multiple institutions and receives NIH funding, a single IRB must serve as the reviewing body for all sites. This policy has been in effect for NIH grant applications submitted since January 25, 2018, and was broadened in January 2020 under the revised Common Rule’s cooperative research provision, which applies even to studies not directly subject to the NIH policy.
The goal is to eliminate redundant reviews across institutions while maintaining consistent protections. Exceptions are rare and generally require approval from the NIH Office of the Director. The cost of setting up a single IRB arrangement is not considered a valid reason for an exception.