Frequently Asked Questions

An Institutional Review Board (IRB) is a committee that reviews research involving human participants before the study begins. Its purpose is to confirm that risks are minimized, that consent is informed and voluntary, and that vulnerable participants receive additional protections. The IRB requirement is federal, codified in 45 CFR 46, and applies to any institution receiving federal research funds.

You need IRB review if your project meets both of the federal definitions at 45 CFR 46.102: it is a systematic investigation designed to produce generalizable knowledge, and it involves living individuals either through interaction or through identifiable private information. Quality improvement, program evaluation, and journalism are often outside these definitions, but only your IRB can make that determination — do not self-exempt.

In the United States, the term IRB is used; outside the US, the equivalent body is usually called a research ethics committee (REC) or ethics review committee. The functions are similar: pre-approval review of research involving human participants. For multi-country studies, both a US IRB and a local ethics committee typically need to approve.

Start during study design, not after. The review level, the sample, the instruments, and the consent process all interact, and design choices that seem small can push a study from exempt to expedited or from expedited to full board. Reading a basic ethics primer and a review categories overview before you draft saves weeks on the back end.

Exempt review applies to research that meets one of the categories in 45 CFR 46.104(d). It is still human subjects research and still requires an IRB determination letter — you do not self-exempt. Typical exempt studies involve anonymous surveys of adults on non-sensitive topics or secondary analysis of de-identified data.

Expedited review applies to minimal-risk research that fits one of nine federally defined categories under 45 CFR 46.110. A single IRB member, rather than the full board, can approve it, which typically shortens turnaround to 2 to 6 weeks. Most interview and focus group research with adults on non-sensitive topics qualifies.

Full board review is required whenever the study involves more than minimal risk, vulnerable populations such as prisoners, investigational interventions, or deception that could cause psychological distress. The convened IRB must review at a scheduled meeting with majority approval. Turnaround is 4 to 10 weeks depending on the meeting calendar.

No. The review level is determined by the IRB based on federal criteria, not by applicant preference. However, you can influence the level by designing the study appropriately — using de-identified data, avoiding sensitive topics when not essential, and recruiting adults when minors are not required.

A complete protocol includes background and significance, research questions, study design and methods, participants and recruitment, informed consent process, risks and benefits, data management, compensation, and conflicts of interest. Institutional forms rearrange these into specific prompts, but the content is consistent.

Most first-time protocols run 8 to 15 pages. Length matters less than completeness — a protocol that covers every required section concisely is better than a long protocol with gaps. Attachments (consent forms, recruitment materials, instruments) are separate from the protocol narrative itself.

For quantitative studies, cite the analytic approach, the effect size assumed, the power level, and the software used. For qualitative studies, justify sample size by saturation logic or information-richness norms for your method (typically 6 to 30 interviews for interpretive studies). Reviewers reject vague or hand-waved sample size justifications.

Submit the protocol with your current design, then file an amendment when the design changes. Do not wait for a fully finalized design before submitting — the IRB timeline is long enough that front-loading the initial submission and amending later is usually faster than delaying.

The required elements under 45 CFR 46.116 include a statement of research purpose, description of procedures, duration, risks, benefits, alternatives, confidentiality protections, contact information, and a voluntariness statement. The revised Common Rule also requires a key information summary at the top of the form.

Target an eighth-grade reading level, which is the readability standard most IRBs enforce. Use short sentences, plain language, and second-person voice ("you" rather than "the participant"). Most rejected consent forms fail on readability rather than on missing elements.

A waiver of documentation (no signature required) is authorized under 45 CFR 46.117(c) and is common for anonymous online surveys. A waiver of consent (no consent process at all) is authorized under 45 CFR 46.116(f) and is reserved for narrow cases like secondary analysis of fully de-identified data. The two are often confused — cite the correct one in your protocol.

Yes. Assent is the child's own agreement to participate, separate from parental permission. Assent forms are written at an age-appropriate reading level. For very young children, assent may be obtained verbally and documented by the researcher; for older children and adolescents, a written form is standard.

Yes, and for online studies it is standard. Place a key information summary at the top, require an explicit click-through to confirm agreement, and offer a printable PDF of the full form. The electronic consent must satisfy the same content requirements as a paper consent.

Federal regulations specify additional protections for children (Subpart D), prisoners (Subpart C), and pregnant individuals, fetuses, and neonates (Subpart B). Other groups — decisionally impaired adults, undocumented individuals, economically or educationally disadvantaged individuals — are not formally named in Subparts but are treated as requiring additional protections by most IRBs.

Research with minors requires both parental permission and child assent, documented separately. Subpart D at 45 CFR 46.401-409 sorts research into four risk categories with different approval requirements. Most minimal-risk minor research (category 1) is approvable with assent and one-parent permission.

Research involving prisoners is governed by Subpart C of the federal regulations. Approval requires a full board that includes a prisoner representative, and the permissible categories of research are narrow. Most student researchers should avoid prisoner populations unless the research specifically concerns incarceration.

Undocumented status is not named in federal regulations but is treated as a significant confidentiality risk because disclosure could cause legal, economic, and social harm. Reviewers expect heightened confidentiality protections, often a waiver of written documentation so no signed record links participants to the study, and careful recruitment to avoid coercion.

The data management plan covers the full lifecycle: what data is collected, how it is identified (identifiable, coded, or de-identified), where it is stored, encryption at rest and in transit, who has access, retention period, sharing arrangements, and destruction method. Vague language ("stored securely on a password-protected computer") is one of the most common reviewer complaints.

Coded data has direct identifiers removed and replaced with a study ID, with a separate linking file maintained. De-identified data has no link back to identifiers at all. The two have different IRB implications — coded data is still identifiable because the link exists.

Most institutions require retention of 3 to 7 years after study completion, with longer requirements for federally funded research. Specific retention periods are institutional policy and sometimes funder policy — check both. State the retention period and the destruction method in your protocol.

Data sharing is increasingly expected by funders and journals, but your consent language must align with your sharing plan. If you promise participants that only the research team will see the data and then deposit in a public repository, you have a consent problem. Describe the sharing plan in both the protocol and the consent form.

An amendment is a formal request to modify an approved protocol. Any substantive change — new recruitment channels, new personnel, modified consent language, new instruments, expanded sample size — requires an amendment under 45 CFR 46.109. You cannot implement the change before the amendment is approved, with narrow exceptions for immediate safety hazards.

Continuing review is the periodic re-approval of an active protocol, typically annual. The 2018 Common Rule revisions at 45 CFR 46.109(f) eliminated continuing review for many minimal-risk studies, but full board studies, FDA-regulated studies, and studies the IRB flags for continuing review still require it.

Report unanticipated problems and serious adverse events to the IRB promptly — most institutions require reporting within 10 business days, with some categories requiring faster reporting. Use your institution's adverse event form and describe what happened, what you did, and what you will change.

File a study closure with the IRB when data collection and analysis are complete and no further interaction with participants is planned. Closure is a formal step — simply not filing the next continuing review is not closure. Maintain data per your retention plan after closure.

A lapsed study cannot enroll new participants or collect new data from existing participants until re-approval is obtained. Submit the continuing review packet at least 30 days before the due date to avoid a lapse. Lapses are one of the most common IRB compliance issues and are almost always avoidable with calendar reminders.

CITI (Collaborative Institutional Training Initiative) is the web-based human subjects protection training that most US institutions require before IRB submission. The modules cover ethical history, regulations, consent, privacy, risk assessment, and special populations. Certificates typically expire after three years and must be current at the time of submission.

The basic Human Subjects Protection course takes approximately 6 to 10 hours, spread across multiple sittings. Refresher courses for recertification are shorter, typically 2 to 3 hours. Budget several days, not a single evening, if you want the material to actually stick.

Your institution decides based on your role. Biomedical researchers take the Biomedical Researchers track; most student and social science researchers take the Social-Behavioral-Educational (SBE) track. When in doubt, ask your IRB coordinator before registering — taking the wrong track means retaking modules.

An expired certificate at the time of continuing review or amendment will hold up the review. Set a calendar reminder for the expiration date and complete the refresher course well before expiration. All listed personnel — PI, co-investigators, research assistants — need current certificates.