An IRB, or Institutional Review Board, is a committee that reviews research involving people to make sure participants are treated ethically and protected from unnecessary harm. Any study that involves human subjects at a U.S. institution receiving federal funding must be reviewed and approved by an IRB before it can begin. If you’ve encountered this term on a consent form, a clinical trial listing, or a university research requirement, this is the body responsible for vetting that research.
What an IRB Actually Does
An IRB acts as an independent gatekeeper between researchers and the people they want to study. Before any experiment, survey, or clinical trial involving humans can proceed, the board examines the research plan and decides whether the potential benefits justify the risks. It checks that participants will be fully informed about what they’re signing up for, that their privacy will be protected, and that no group of people is being unfairly burdened by the research.
The board doesn’t just approve or reject a proposal once and walk away. It conducts ongoing oversight for the life of the study. If something unexpected happens during research, like a side effect no one predicted or a safety concern that wasn’t in the original plan, the investigator must report it back to the IRB. Serious unexpected problems must be reported within one week, and less urgent ones within two weeks. The IRB can require changes to the study, suspend it, or shut it down entirely.
The Ethical Principles Behind IRB Review
IRBs operate on three core principles laid out in the Belmont Report, a foundational document published in 1979 after several high-profile research abuses, including the Tuskegee syphilis study.
- Respect for persons: People must be treated as independent decision-makers who can choose whether to participate. Those with reduced ability to make their own choices, such as children or people with cognitive impairments, are entitled to extra protection.
- Beneficence: Researchers have an obligation to minimize harm and maximize potential benefits. This goes beyond simply avoiding damage; it requires actively designing studies to be as safe as possible.
- Justice: The burdens and benefits of research should be distributed fairly. No group should be singled out to bear the risks of a study while another group reaps the rewards.
These three principles form the lens through which every IRB evaluates every study. A proposal that exposes participants to avoidable risk, targets a vulnerable population without justification, or withholds meaningful information from volunteers will not pass review.
Who Sits on an IRB
Federal regulations require a minimum of five members with diverse backgrounds. The board must include at least one scientist, at least one person from outside the sciences (such as an ethicist, lawyer, or community member), and at least one person who has no affiliation with the institution at all. That unaffiliated member exists specifically to represent the perspective of someone outside the research community. A former patient, a community volunteer, or a retired professional with no ties to the university or hospital can fill this role.
The board must also make a genuine effort to include both men and women. Any member who has a personal stake in a particular study, whether financial or professional, is barred from voting on that project, though they can answer questions if the board asks. This structure is designed to prevent any single viewpoint from dominating decisions about whether a study is ethical.
Who Regulates IRBs
Two main federal agencies set the rules. The Department of Health and Human Services oversees IRBs through regulations known as the Common Rule (45 CFR 46), which covers all research conducted or funded by federal agencies. The FDA has its own parallel set of regulations (21 CFR 56) that governs clinical investigations of drugs, medical devices, and biologics, regardless of funding source. Most research institutions follow both sets of rules simultaneously.
One notable difference: HHS regulations include special protections for vulnerable groups like children and prisoners, while FDA regulations don’t have equivalent provisions. The enforcement approach also differs. The FDA monitors compliance through its own inspection program, while HHS relies on a system of institutional assurances where organizations formally commit to following the rules.
Since January 2020, federally funded research conducted at multiple sites must use a single IRB rather than having each site run its own separate review. This change, part of the revised Common Rule, was meant to reduce redundancy and speed up the launch of large studies. Exceptions are rare and require approval from the NIH Office of the Director.
Three Levels of Review
Not every study goes through the same depth of scrutiny. The level of review depends on how much risk the research poses to participants.
Exempt review applies to research that falls into specific low-risk categories, such as anonymous surveys, educational tests, or analysis of publicly available data. “Exempt” doesn’t mean no one looks at it. The IRB still makes the determination that the study qualifies for exemption.
Expedited review is for studies that pose no more than minimal risk, meaning the likelihood of harm is no greater than what a person would encounter in everyday life or during a routine medical checkup. One or two designated IRB members can review these proposals rather than the full board. Studies involving noninvasive data collection, small blood draws, behavioral surveys, or voice and video recordings typically qualify.
Full board review is required for anything that doesn’t fit into the exempt or expedited categories. The entire committee meets, discusses the proposal, and votes. Research involving experimental treatments, invasive procedures, or vulnerable populations usually goes through full review.
What the IRB Checks Before Approving a Study
The approval checklist is specific. The board must confirm that risks have been minimized through sound research design, that the remaining risks are reasonable compared to the expected benefits, and that participants are selected fairly. Studies that recruit from vulnerable groups, such as children, prisoners, or people who are economically disadvantaged, receive extra scrutiny to guard against coercion.
The IRB verifies that every participant will go through a proper informed consent process. A valid consent form must include: a clear statement that the study is research, an explanation of its purpose and how long participation lasts, a description of foreseeable risks and potential benefits, information about alternatives, details on how privacy will be maintained, contact information for questions or complaints, and an explicit statement that participation is voluntary and can be stopped at any time without penalty. For studies involving more than minimal risk, the form must also explain whether compensation or medical treatment is available if something goes wrong.
The board also evaluates whether the research plan includes appropriate data monitoring to catch safety problems early and adequate protections for participant privacy.
How Long IRB Approval Takes
Timelines vary widely, but researchers should generally expect the process to take two to three months from submission to approval. A study at one Veterans Affairs medical center found that the median total review time was 82 days for exempt protocols, 85 days for expedited reviews, and 131 days for full board reviews. The IRB’s own review portion (separate from administrative processing) had median times of 43, 57, and 103 days for those same categories.
Most proposals go through two to three rounds of revision before they’re approved, with each round of feedback from the board taking roughly six to twelve days. A national working group has suggested that IRBs should be able to review 90% of protocols within 60 days, though many institutions don’t consistently meet that target. Researchers can shorten the process by submitting thorough, well-organized applications and responding quickly to revision requests.