How to Write Your IRB Protocol

Your IRB protocol is the single document that explains your study to people who will never meet you. It must stand alone, because the reviewers will evaluate what is on the page — not what you intended to say. This guide walks through the nine sections most IRBs require, with language you can adapt and warnings about the mistakes that most often trigger revisions.

Every federal IRB requirement cited here draws from 45 CFR 46.111 (criteria for approval) and 45 CFR 46.116 (informed consent). Your institution may layer on additional required sections — always consult the local template.

Before you write

Decide which review pathway you are aiming for: exempt, expedited, or full board. The content of each section changes based on the tier. Also confirm your CITI training is current — see the CITI guide.

Background and rationale

State the problem, summarize the literature, and justify why this study is needed now. Keep it tight — one to two pages. Reviewers are not looking for a full literature review; they are looking for a clear gap that your study addresses.

Include: problem statement, brief literature summary with citations, identified gap, theoretical framework if relevant, and a one-sentence purpose statement.

Specific aims and hypotheses

List 2–4 specific aims. Each aim should be answerable with the data you plan to collect. Hypotheses are optional for qualitative studies but required for most quantitative and clinical research.

Bad: "Understand the experiences of caregivers." Better: "Aim 1: Characterize the strategies dementia caregivers use to manage medication adherence. Aim 2: Identify factors associated with caregiver burnout as measured by the Zarit Burden Interview."

Study design and setting

Name the design (cross-sectional survey, semi-structured interview, RCT, retrospective chart review, mixed methods), describe the setting, and justify the design choice. Reviewers check whether your design can actually answer your aims.

Include: study type, number of sites, single- or multi-site, duration of data collection, total project duration.

Participants and eligibility

Specify inclusion and exclusion criteria, sample size with justification, and the rationale for any population restrictions. Blanket exclusions (e.g., "non-English speakers") must be scientifically defensible, not administrative shortcuts.

Include: target population, inclusion/exclusion criteria, sample size and power analysis or saturation rationale, plan for vulnerable populations if any. See the special populations guide.

"Healthy adults only" is a red flag

Excluding pregnant people, older adults, or members of minority groups without scientific justification violates the equitable-selection requirement at 45 CFR 46.111(a)(3). If you must exclude, explain the science.

Recruitment

Describe exactly how you will identify, contact, and enroll participants. Reviewers want to know that the first contact is not coercive and that participants have time to consider.

Include: recruitment channels (email, flyers, social media, clinic referral), who makes first contact, screening process, consent process, and enrollment cap. Attach every recruitment script and flyer as an appendix.

Procedures

Walk the reviewer through what happens to a participant from first contact through last follow-up. Use a numbered sequence. If your procedures take 45 minutes, the reviewer should be able to close their eyes and picture every minute.

Include: a step-by-step sequence, time required at each step, any instruments or devices, training/credentials of study personnel, and a study flow diagram for multi-arm designs.

Risks and benefits

Name every foreseeable risk — physical, psychological, social, legal, economic — and describe mitigation for each. List direct benefits to participants and broader benefits to society. "No risks" is almost never a correct answer.

For minimal-risk studies, state "Risks are no greater than those ordinarily encountered in daily life or during routine physical or psychological examinations" with justification. For greater-than-minimal-risk studies, quantify probability and magnitude where possible.

Compensation is not a benefit

Under OHRP guidance, payment for participation is a recruitment tool, not a benefit of the research. List compensation in the recruitment section, and keep benefits tied to the research question.

Data management and confidentiality

Describe how data will be collected, stored, transmitted, analyzed, retained, and destroyed. Reviewers look for a clear chain of custody.

Include: what identifiers are collected, coding procedures, storage location and security (encrypted drives, access-controlled servers), retention period, who has access, and destruction plan. See the data management guide.

Analysis plan

Match the analysis to the aims. For quantitative studies, name the statistical tests, software, and handling of missing data. For qualitative studies, name the analytic approach (thematic analysis, grounded theory, framework analysis), coding procedures, and trustworthiness strategies.

Reviewers check whether your analysis plan can actually produce the findings promised in your aims. Vague plans signal that the study may fail to yield meaningful results — which weakens the risk/benefit balance.

Appendices you will attach

Informed consent document — see the consent form guide
All recruitment materials (flyers, emails, social media posts, scripts)
All instruments (surveys, interview guides, observation protocols)
CITI training certificates for all personnel
Data management plan
Letters of cooperation from external sites
Translator certifications if consent is offered in multiple languages
Data use agreements for secondary data

Pre-submission checklist

Consent form and protocol match word-for-word on procedures, risks, and compensation
Sample size is justified (power calculation or saturation rationale)
Every foreseeable risk has a named mitigation
Every instrument is attached as an appendix
CITI certificates are current for all personnel
Inclusion/exclusion criteria are scientifically defensible
Data storage, retention, and destruction are described concretely
At least one non-expert has read the protocol and can summarize it back to you

Common mistakes that trigger revisions

Treating the protocol like a grant proposal. Grant reviewers evaluate significance and innovation; IRB reviewers evaluate risk, consent, and equity. Strip promotional language.
Copying from a prior protocol without updating procedures. Mismatches between protocol and consent are the #1 revision request.
Describing "the researcher will obtain consent" without explaining who, where, and under what conditions.
Underestimating risk. A 45-minute interview about trauma is not "no risk." Naming risks and mitigating them builds trust with the board.
Promising analyses you cannot perform. Keep the analysis plan realistic for your sample size and expertise.

Write the consent form and protocol together

Drafting both documents in parallel keeps descriptions of procedures, risks, and compensation aligned. Reviewers flag every inconsistency.

Once your protocol is drafted, move to the consent form guide to prepare the required supporting documents, then the data management guide to strengthen your confidentiality plan.