Institutional Review Board – Review Types and Approval Process

An Institutional Review Board, commonly called an IRB, is an independent committee that reviews research involving human participants. Its purpose is to protect participants’ rights, safety and welfare by evaluating risks, informed consent, participant selection, privacy, confidentiality and the scientific justification for exposing people to research procedures.

Introduction

Research involving people can produce valuable knowledge, but it can also create physical, psychological, social, legal, financial or privacy-related risks. An Institutional Review Board provides independent ethical oversight before covered research begins and, where required, while it continues.

This article explains what an IRB is, when review may be required, how exempt and expedited review differ, what committees evaluate, how researchers apply for approval, and what responsibilities remain after approval. It also explains U.K. and international terminology and considers online, data-intensive and artificial-intelligence research.

Important: IRB requirements depend on the applicable laws, funder, sponsor, country and institutional policy. Researchers should obtain a written determination from their institution rather than relying only on a general online explanation.

Key takeaways

• An IRB protects the rights and welfare of people involved in research.
• Review is generally required before covered human-subjects research begins.
• “Exempt” does not necessarily mean that researchers may make the decision themselves or ignore ethical safeguards.
• Expedited review is a regulatory review procedure, not a guarantee of rapid approval.
• IRBs evaluate risk, consent, equitable selection, privacy, confidentiality and safety monitoring.
• Approval is an ongoing responsibility: amendments, new risks and reportable events may need further review.

What is an Institutional Review Board?

An Institutional Review Board is a formally designated committee that reviews research involving human subjects. It may approve a study, require changes before approval, defer a decision until more information is supplied, or disapprove the study.

In the United States, the Common Rule defines an IRB as a board established for the purposes expressed in the federal human-subject protection policy. FDA regulations similarly describe an IRB as a formally designated group that reviews biomedical research to protect participants’ rights and welfare.

IRBs may be operated by:

• Universities.
• Hospitals and healthcare systems.
• Government agencies.
• Research institutes.
• Independent or commercial ethics-review organizations.

The committee is not simply an administrative office. It is part of a broader Human Research Protection Program, which may also involve investigators, research institutions, sponsors, compliance offices, data-security specialists and participant advocates.

What is the main purpose of an IRB?

The main purpose of an IRB is to ensure that research involving people is ethically acceptable and that participants receive appropriate protection.

An IRB does not determine whether every possible risk has been eliminated. Many worthwhile studies involve some risk. Instead, the committee determines whether risks have been minimized, are reasonable in relation to expected benefits and knowledge, and are communicated appropriately to prospective participants.

Its responsibilities normally include evaluating whether:

1. The research question and design justify involving human participants.
2. Unnecessary procedures or risks have been removed.
3. Risks are reasonable in relation to potential benefits and expected knowledge.
4. Participants are selected fairly.
5. Consent will be voluntary and understandable.
6. Privacy and confidentiality safeguards are adequate.
7. Additional protections are provided where participants may be vulnerable to coercion or undue influence.
8. Safety monitoring is appropriate.
9. Recruitment and compensation are not misleading or coercive.

Ethical foundations of IRB review

The Belmont Report

U.S. human-subject protections are strongly influenced by the Belmont Report, which identifies three foundational ethical principles:

Respect for persons

Individuals should be treated as autonomous decision-makers. People with limited autonomy may require additional protection.

In practice, this principle supports voluntary informed consent, understandable information, respect for withdrawal decisions, and safeguards for participants whose decision-making ability may be reduced.

Beneficence

Researchers should avoid unnecessary harm, minimize unavoidable risk and seek a favorable balance between risks and potential benefits.

Beneficence does not mean that every participant must receive a direct benefit. Some studies produce socially valuable knowledge without offering a clinical or personal benefit to each participant.

Justice

The benefits and burdens of research should be distributed fairly.

Researchers should not select a population merely because it is convenient, dependent, disadvantaged or easy to influence. They should also avoid excluding groups without a scientifically or ethically defensible reason.

The Common Rule

The U.S. Common Rule is contained in Subpart A of 45 CFR Part 46. It establishes requirements relating to institutional assurances, IRB operations, review, consent and cooperative research.

Additional HHS subparts address certain research involving:

• Pregnant women, human fetuses and neonates.
• Prisoners.
• Children.
• IRB registration.

FDA regulations

FDA-regulated clinical investigations may be subject to FDA requirements, including:

• 21 CFR Part 50 on informed consent.
• 21 CFR Part 56 on Institutional Review Boards.
• Product-specific requirements for drugs, biologics and medical devices.

A project can be subject to both the Common Rule and FDA regulations. Researchers must identify all applicable frameworks rather than assuming that one automatically replaces the other.

International principles

The World Medical Association’s 2024 Declaration of Helsinki states that medical-research protocols should be submitted to an independent research ethics committee before research begins. It also emphasizes scientific quality, participant engagement, informed consent, privacy, risk assessment, appropriate inclusion and dissemination of results.

These international principles influence research practice but do not replace national law or local ethics-review requirements.

When is IRB approval required?

IRB approval is generally required when an activity:

1. Meets the applicable definition of research.
2. Involves human subjects.
3. Falls within the scope of a law, regulation, funding condition, sponsor requirement or institutional policy requiring review.

Under the Common Rule, research is a systematic investigation designed to develop or contribute to generalizable knowledge.

A human subject is a living individual about whom an investigator conducting research:

• Obtains information or biospecimens through intervention or interaction and uses, studies or analyzes them; or
• Obtains, uses, studies, analyzes or generates identifiable private information or identifiable biospecimens.

Examples commonly requiring submission

• A clinical trial testing a drug or medical device.
• Interviews conducted for a dissertation intended to generate generalizable findings.
• A survey about mental health, discrimination or illegal behavior.
• An experiment that manipulates participants’ environment or experiences.
• Research using identifiable medical, employment or educational records.
• Collection of blood, saliva, tissue or other biospecimens.
• Observation in a setting where individuals reasonably expect privacy.
• An AI study in which model recommendations affect participant care or treatment.
• A multi-site study using the same human-subjects protocol.

Institutional policy may require submission even where federal regulations do not independently require review.

What activities might not require IRB approval?

An activity may fall outside IRB oversight when it is not research, does not involve human subjects, or qualifies for a regulatory exemption. These are different conclusions and should not be used interchangeably.

Activities that may not meet the definition of research

Depending on their purpose and design, examples may include:

• Internal program administration.
• Routine operational monitoring.
• Some quality-improvement activities intended only to improve a local service.
• Some classroom exercises not intended to produce generalizable knowledge.
• Certain journalism, biography, oral history, literary criticism or legal research focused on specific individuals.
• Public-health surveillance authorized by a public-health authority.

A plan to publish does not by itself determine whether an activity is research. Conversely, calling a project “quality improvement” does not automatically remove it from research rules. Purpose, design, institutional policy and intended use of the findings all matter.

Activities that may not involve human subjects

Examples may include:

• Analysis of fully de-identified information when investigators cannot readily ascertain identities.
• Laboratory research that does not use identifiable human information or material.
• Research involving deceased individuals only, although other legal, privacy or institutional rules may apply.
• Analysis of some genuinely public, non-identifiable datasets.

Researchers should be cautious with “anonymous” or “de-identified” claims. Combining variables can make people identifiable even when names have been removed.

Exempt human-subjects research

The Common Rule contains specified exemption categories, including certain research involving:

• Normal educational practices.
• Educational tests.
• Surveys and interviews.
• Observation of public behavior.
• Benign behavioral interventions with adults.
• Secondary research uses of information or biospecimens.
• Public-benefit or service programs.
• Taste and food-quality evaluation.

Each exemption has detailed conditions. A survey is not exempt merely because it uses a questionnaire, and secondary-data research is not exempt merely because the data already exist.

Many institutions require an IRB office or designated reviewer to confirm exemption before activities begin.

Exempt, expedited and full-board review

Review pathway	What it means	Common examples	Who usually reviews it
Not human-subjects research	The activity does not meet one or both regulatory definitions	Some internal evaluations or analysis of non-identifiable data	Authorized institutional official or IRB office, depending on policy
Exempt research	Human-subjects research fits a specified exemption category	Some low-risk educational, survey, interview, observation or secondary-data studies	Designated reviewer or institutional process
Limited IRB review	A focused review required for certain exemption categories	Some identifiable survey, behavioral or secondary-use studies	IRB chair or designated reviewer
Expedited review	Eligible minimal-risk research is reviewed outside a convened meeting	Some interviews, record reviews, non-invasive collection or minor amendments	IRB chair or experienced IRB member
Convened/full-board review	The study is discussed and voted on at a committee meeting	Greater-than-minimal-risk research, many clinical trials, or research presenting complex ethical issues	Convened IRB with a quorum

What is exempt review?

Exempt research is still human-subjects research, but it falls within one or more exemption categories. Some exempt studies remain subject to limited IRB review, privacy safeguards, consent-related requirements or institutional policies.

Exempt does not necessarily mean:

• No submission.
• No consent discussion.
• No confidentiality safeguards.
• No responsibility to report changes.
• No institutional oversight.

What is expedited review?

Expedited review allows eligible research to be reviewed by the IRB chair or one or more experienced IRB members rather than at a convened meeting.

The study generally must present no more than minimal risk and fit an eligible category, or involve only a minor change to already approved research.

An expedited reviewer may approve a study or require modifications. Under the Common Rule, the reviewer cannot issue a final disapproval; disapproval requires review through the non-expedited procedure.

The word expedited describes the regulatory procedure. It does not guarantee same-day or rapid approval.

What is full-board review?

Full-board review, also called convened review, occurs at a meeting where the required quorum is present. It is commonly used for studies presenting more than minimal risk or ethical complexity that cannot be resolved through another pathway.

Examples may include:

• Interventional clinical trials.
• Invasive procedures performed solely for research.
• Studies involving substantial psychological or social risk.
• Research involving deception with significant potential harm.
• Higher-risk research involving children, prisoners or people with impaired decision-making capacity.
• Deployment of an AI system that can directly influence clinical decisions.

A full-board study may be approved, approved subject to specified changes, deferred pending substantial revision, or disapproved.

What does an IRB evaluate?

1. Scientific and methodological justification

An ethically acceptable study must be capable of answering a meaningful question. A seriously flawed design can expose participants to inconvenience or harm without producing useful knowledge.

The IRB may therefore consider:

• Whether the research question is clear.
• Whether the design can answer the question.
• Whether the sample size is justified.
• Whether procedures are necessary.
• Whether another scientific review has occurred.
• Whether stopping rules or monitoring plans are needed.

The IRB is not necessarily a replacement for a specialist funding or peer-review panel, but scientific validity is ethically relevant.

2. Risks to participants

Risks may include more than physical injury.

Risk type	Examples
Physical	Pain, infection, medication side effects, injury
Psychological	Anxiety, distress, embarrassment, retraumatization
Social	Stigma, damaged relationships, discrimination
Legal	Disclosure of illegal behavior or immigration information
Economic	Job loss, insurance consequences, financial loss
Informational	Data breach, re-identification, unauthorized sharing
Group-level	Stigmatization or harm to a community represented in the findings

Researchers should describe the probability, magnitude, duration and reversibility of each reasonably foreseeable risk.

3. Potential benefits

Benefits must be described accurately. Payment, course credit and free testing are not normally classified as research benefits; they are compensation or participation arrangements.

Potential benefits may include:

• A direct clinical benefit.
• Access to an intervention.
• Increased understanding or self-reflection.
• Improvement of future services.
• Knowledge that may benefit society.

Researchers should not promise benefits that are uncertain.

4. Risk–benefit relationship

The IRB assesses whether risks are reasonable in relation to:

• Anticipated benefits to participants, if any.
• The importance of the knowledge expected from the study.

A low-benefit study may still be acceptable when risks are minimal and the knowledge has value. A potentially beneficial study may remain unacceptable if risks are excessive or poorly controlled.

5. Participant selection

Selection should be equitable and scientifically justified.

The IRB considers:

• Inclusion and exclusion criteria.
• Who bears research burdens.
• Who may benefit from the findings.
• Whether a convenient population is being overused.
• Whether exclusion creates unfair evidence gaps.
• Whether recruitment relationships create pressure.

6. Recruitment practices

Recruitment materials are part of the ethical review.

The IRB may examine:

• Advertisements.
• Emails and text messages.
• Social-media posts.
• Posters and flyers.
• Clinician recruitment scripts.
• Participant databases.
• Snowball-sampling methods.
• Screening questionnaires.

Recruitment must not exaggerate benefits, hide material risks or create inappropriate pressure.

7. Informed consent

Informed consent is an ongoing communication process, not merely a participant’s signature.

A valid process generally requires:

• Relevant information.
• Understandable language.
• Sufficient opportunity to consider participation.
• Answers to participants’ questions.
• Comprehension appropriate to the circumstances.
• Voluntary agreement without coercion or undue influence.
• Continued communication when important new information emerges.

Under the Common Rule, consent should begin with a concise presentation of key information that helps a reasonable person understand why they might or might not participate.

8. Privacy and confidentiality

Privacy concerns when, where and how researchers interact with people or obtain information about them.

Confidentiality concerns how information is handled after researchers receive it.

An IRB may examine:

• Whether interviews occur in private.
• Which identifiers are collected.
• Whether identifiers are necessary.
• Encryption and access controls.
• Separation of identity keys from study data.
• Recording and transcription methods.
• Cloud-storage locations.
• Vendor contracts.
• Data-sharing plans.
• Retention and destruction schedules.
• Re-identification risks.
• Whether anonymity is being claimed accurately.

9. Compensation and undue influence

Participant payment is not automatically unethical. The IRB considers whether the amount, method and schedule could impair voluntary decision-making.

Researchers should explain:

• Total compensation.
• Payment per visit or task.
• Reimbursement of expenses.
• Prorating when a participant withdraws.
• Bonuses.
• Course-credit alternatives.
• Referral incentives.

Payment should not be presented as a research benefit.

10. Additional safeguards

Additional safeguards may be required when participants could be vulnerable to coercion, undue influence or harm.

Relevant circumstances may involve:

• Children.
• Prisoners.
• People with impaired decision-making capacity.
• Employees recruited by supervisors.
• Students recruited by their teachers.
• Economically disadvantaged participants.
• People receiving essential services from the research team.
• People in dependent clinical relationships.
• Communities affected by conflict, displacement or discrimination.

Vulnerability should be assessed contextually rather than treated only as a permanent label.

Who serves on an IRB?

Under the Common Rule, each IRB must have at least five members with varied backgrounds. It must include:

• At least one member whose primary concerns are scientific.
• At least one member whose primary concerns are nonscientific.
• At least one member unaffiliated with the institution.

Membership should collectively provide appropriate professional competence, cultural awareness and sensitivity to community attitudes.

When the board regularly reviews research involving a population vulnerable to coercion or undue influence, it should consider including members with relevant knowledge and experience.

A member with a conflicting interest may not participate in the review except to provide information requested by the board.

The IRB may invite a specialist consultant when additional expertise is needed, but a consultant who is not a board member does not vote.

How to apply for IRB approval

Step 1: Contact the appropriate ethics office early

Identify the institution responsible for oversight. Multi-institution studies may require a single IRB, reliance agreement or coordinated review.

Contact the office before finalizing recruitment dates, signing data agreements or promising a sponsor a specific approval date.

Step 2: Complete required training

Institutions frequently require human-subject protection training for:

• Principal investigators.
• Student researchers.
• Supervisors.
• Research coordinators.
• Personnel accessing identifiable data.
• Anyone obtaining consent.

Clinical studies may require additional Good Clinical Practice or product-specific training.

Step 3: Determine whether the activity is research

Describe:

• The purpose of the activity.
• Whether it is systematic.
• Whether it is intended to produce generalizable knowledge.
• How results will be used.
• Whether findings may be published or presented.
• Whether the project is research, quality improvement, evaluation or another activity.

Seek an institutional determination when the boundary is unclear.

Step 4: Determine whether human subjects are involved

Ask whether the study will:

• Interact or intervene with living individuals.
• Collect information through communication.
• Manipulate participants or their environment.
• Access identifiable private information.
• Use identifiable biospecimens.
• Generate information that could readily be linked to individuals.

Step 5: Develop the protocol

The protocol should clearly explain:

• Research objectives.
• Background and significance.
• Study design.
• Participant population.
• Sample-size justification.
• Recruitment.
• Screening.
• Consent.
• Procedures.
• Data collection.
• Risks and safeguards.
• Benefits.
• Compensation.
• Privacy and confidentiality.
• Data analysis.
• Data retention and sharing.
• Safety monitoring.
• Plans for study closure.

Step 6: Prepare participant-facing materials

Submit the exact materials participants will see or hear, including:

• Recruitment advertisements.
• Invitation emails.
• Social-media posts.
• Telephone scripts.
• Information sheets.
• Consent forms.
• Assent forms.
• Parental-permission forms.
• Surveys.
• Interview guides.
• Debriefing statements.
• Translated materials.

Step 7: Explain data flow

A useful data-flow description identifies:

1. What information is collected.
2. Where it comes from.
3. Whether it contains identifiers.
4. How it is transferred.
5. Where it is stored.
6. Who can access it.
7. Whether third-party vendors process it.
8. When identifiers are removed.
9. Whether data will be shared.
10. When data will be destroyed or archived.

Step 8: Submit a complete and internally consistent application

Dates, procedures, sample sizes and data practices should match across the protocol, application, consent form, recruitment materials and funding proposal.

Incomplete or inconsistent applications are a common cause of avoidable revisions.

Step 9: Respond to reviewer comments

Respond point by point. Identify where each change was made, upload clean and marked versions where requested, and explain respectfully when a recommendation cannot be followed.

Step 10: Wait for written authorization

Do not recruit, consent participants, access covered identifiable data or perform study procedures until the required approval or determination has been issued.

Funding approval, supervisor approval and submission confirmation are not substitutes for IRB approval.

Documents commonly required

An application may require:

• Completed electronic application.
• Research protocol.
• Investigator qualifications.
• Training certificates.
• Scientific-review documentation.
• Funding or sponsor information.
• Conflict-of-interest disclosures.
• Recruitment materials.
• Consent and assent documents.
• Surveys and interview guides.
• Data-collection forms.
• Data-security plan.
• Data-sharing agreement.
• Site permission.
• Letters of cooperation.
• Translation certification.
• Safety-monitoring plan.
• Investigator’s brochure for certain clinical studies.
• Device or drug documentation.
• Single-IRB or reliance information.

Requirements vary by institution and study type.

Possible IRB decisions

Approved

The study meets the applicable approval criteria and may begin after all other required permissions are obtained.

Modifications required to secure approval

The study can be approved after specified changes are completed and verified.

Deferred

Substantial issues prevent approval at the current review. The revised application may require further committee consideration.

Disapproved

The IRB determines that the study cannot satisfy the approval criteria in its present form. A final disapproval normally follows convened review rather than expedited review.

Determined exempt

An authorized reviewer determines that the study fits an applicable exemption category.

Not human-subjects research

The office determines that the activity does not meet the applicable definition of research involving human subjects.

How long does IRB approval take?

There is no universal approval time.

The timeline depends on:

• Review pathway.
• Study complexity and risk.
• Committee meeting schedules.
• Application quality.
• Reviewer workload.
• Need for specialist consultation.
• Number of institutions or countries.
• Required contract or data-security review.
• Speed of investigator responses.

Exempt or expedited studies may be reviewed without waiting for a convened meeting, but they can still require several revision rounds. A full-board study may need to meet a submission deadline before being placed on an agenda.

Researchers should avoid promising recruitment or data-collection dates until written authorization is received.

What happens after IRB approval?

IRB approval does not end the researcher’s responsibilities.

Follow the approved protocol

The study must be conducted as approved. Staff should use the approved versions of consent forms, recruitment materials and research instruments.

Obtain approval for changes

Protocol changes generally require review before implementation, unless an immediate change is necessary to eliminate an apparent hazard to participants.

Changes may include:

• New recruitment methods.
• Revised eligibility criteria.
• Additional questions.
• New study sites.
• Increased sample size.
• New data sources.
• Different compensation.
• New AI or transcription tools.
• Changes in storage or sharing.
• New investigators.
• Revised consent language.

Report required events

Institutional policy may require reports concerning:

• Unanticipated problems involving risks.
• Serious or continuing noncompliance.
• Protocol deviations.
• Data breaches.
• Unexpected serious harm.
• Complaints from participants.
• Suspensions or terminations.
• Certain adverse events.

Not every clinical adverse event is automatically an unanticipated problem, and reporting rules differ by framework and institution.

Complete continuing review where required

Under the revised Common Rule, continuing review is not automatically required for every expedited study or for projects that have progressed only to data analysis or follow-up clinical-data access. An IRB may nevertheless require it, and FDA-regulated or other studies may remain subject to continuing review.

Researchers should follow the approval letter rather than assuming annual review is unnecessary.

Close the study

Submit a closure or final report when required. A project may not be ready for closure while investigators are still:

• Interacting with participants.
• Collecting identifiable information.
• Conducting research interventions.
• Accessing identifiable records.
• Performing analysis that remains subject to active oversight under institutional policy.

Examples of IRB determinations

Example 1: Anonymous teaching survey

A lecturer wants to compare two ordinary teaching methods and collect an anonymous survey about student satisfaction.

The project may qualify for an educational or survey exemption if the regulatory conditions are met. However, the lecturer’s authority over students, voluntariness, access to grades and institutional policy still require attention.

Example 2: Interviews about workplace discrimination

A doctoral student records identifiable interviews about discrimination by named employers.

Even if the physical risk is minimal, disclosure could affect employment, reputation or legal interests. The study may be eligible for expedited review, but it requires a strong confidentiality plan, careful consent language and secure handling of recordings.

Example 3: Public, non-identifiable dataset

A researcher downloads a genuinely public dataset that contains no information allowing identities to be readily ascertained.

The project may not involve human subjects or may qualify for a secondary-research exemption, depending on the data and applicable policy. The researcher should document the institutional determination.

Example 4: Drug trial

A research team prospectively assigns patients to an investigational drug or control condition.

The study ordinarily requires convened IRB review, informed consent, safety monitoring and compliance with FDA and other clinical-trial requirements.

Example 5: Social-media research

A researcher collects posts from a technically public online community discussing addiction recovery.

“Publicly accessible” does not eliminate all ethical questions. The IRB may consider users’ expectations, platform terms, quotations that can be searched, sensitive group identities, re-identification and whether researchers will interact with users.

Example 6: AI-supported clinical decision study

A study deploys an AI model whose recommendation is displayed to clinicians and may influence treatment.

The IRB will likely examine model validation, performance across demographic groups, human oversight, error escalation, model updates, data provenance, cybersecurity and how AI-related uncertainty is explained to participants.

IRB versus related committees

Body	Main responsibility
Institutional Review Board	Ethical review of covered human-subjects research
Human Research Protection Program	Institution-wide system for protecting research participants
Research Ethics Committee	Common international and U.K. term for a human-research ethics committee
Institutional Animal Care and Use Committee	Oversight of research involving covered live vertebrate animals in the U.S.
Institutional Biosafety Committee	Oversight of specified biological agents and recombinant or synthetic nucleic-acid research
Data and Safety Monitoring Board	Independent monitoring of accumulating safety and efficacy data in an ongoing study
Scientific review committee	Evaluation of scientific quality, feasibility or merit
Privacy or data-protection office	Compliance with privacy, data-protection and information-security requirements

One study may require review by several bodies.

IRB in the United States, United Kingdom and internationally

United States

The term IRB is widely used. Applicable requirements may include:

• The Common Rule.
• HHS regulations at 45 CFR Part 46.
• FDA regulations at 21 CFR Parts 50 and 56.
• Other federal-agency requirements.
• State, Tribal or local law.
• Sponsor and funder conditions.
• Institutional policy.

The Common Rule generally requires a single IRB for covered cooperative research conducted in the United States, subject to applicable exceptions. NIH also maintains a single-IRB policy for specified domestic multi-site, non-exempt human-subjects research.

United Kingdom

The usual term is Research Ethics Committee rather than Institutional Review Board.

NHS Research Ethics Committees safeguard the rights, safety, dignity and wellbeing of participants in relevant health and social-care research. University research outside the NHS may instead be reviewed through a higher-education institution’s own ethics system.

Researchers should determine whether they need:

• NHS REC review.
• HRA Approval.
• University ethics review.
• Confidentiality or data-governance approval.
• Medicines or medical-device authorization.
• Local site capacity and capability confirmation.

These processes are related but not interchangeable.

International research

International projects may require review in:

• The sponsoring institution’s country.
• The host country.
• Each participating institution.
• A national or regional committee.
• A specialist regulatory authority.

Approval by a U.S. IRB does not automatically override local requirements. Research teams should address language, cultural context, local standards of care, community engagement, data transfers, participant compensation and post-study responsibilities.

Do students and dissertation researchers need IRB approval?

Student status does not remove ethics-review requirements.

A dissertation, thesis, capstone project or undergraduate study may need review when it constitutes research involving human subjects under the institution’s policies.

Students commonly make three mistakes:

1. Assuming supervisor approval is equivalent to IRB approval.
2. Collecting pilot data before submission.
3. Treating a class assignment as exempt even after deciding to publish or expand it.

Students should consult their supervisor and ethics office before recruitment or access to identifiable data.

Digital and remote research

Modern studies may recruit, consent, interact with and observe participants entirely online.

An IRB may examine:

• Identity and age verification.
• Electronic signatures.
• Remote consent comprehension.
• Platform privacy.
• Recording notifications.
• Location of cloud servers.
• Encryption in transit and at rest.
• Access from personal devices.
• Third-party videoconferencing.
• Automated transcription.
• International data transfers.
• Digital exclusion.
• Emergency procedures for distressed remote participants.
• Whether online quotations can identify users through search engines.

Electronic consent can be valid, but the process must still provide understandable information, adequate opportunity for questions and voluntary agreement.

Artificial intelligence and IRB review

AI does not replace an IRB, and an AI-generated ethics assessment is not an approval.

AI may become relevant when researchers use it for:

• Recruitment.
• Eligibility screening.
• Consent chatbots.
• Translation.
• Interview transcription.
• Coding and analysis.
• Prediction or diagnosis.
• Participant monitoring.
• Adaptive interventions.
• Clinical recommendations.
• Synthetic-data generation.
• De-identification.

AI-related questions researchers should answer

1. What system, model and version will be used?
2. Will the system change or continue learning during the study?
3. Where did the training and validation data come from?
4. Has performance been evaluated for the study’s population and setting?
5. Are performance differences across groups known?
6. What identifiable or sensitive data enter the system?
7. Does the vendor retain inputs or use them for model training?
8. Where are data processed and stored?
9. What human oversight is maintained?
10. How will errors, unsafe outputs and model failures be detected?
11. Who is accountable for decisions influenced by the system?
12. How will participants be informed about material AI use?

Using generative AI to prepare an application

Researchers may use an institutionally permitted AI system to improve grammar or organize non-confidential text, but they remain responsible for the accuracy and completeness of the submission.

They should not enter identifiable participant information, protected health information, confidential protocols or restricted institutional data into a consumer AI service unless the institution has expressly approved that use and appropriate contractual and security protections exist.

AI-generated consent text, translations and risk descriptions require human verification. A fluent output can still be inaccurate, culturally inappropriate or legally incomplete.

Advantages of IRB review

IRB review can:

• Protect participants from avoidable harm.
• Improve consent and recruitment materials.
• Identify privacy and confidentiality weaknesses.
• Promote fair participant selection.
• Provide independent scrutiny.
• Clarify investigator responsibilities.
• Support public trust.
• Help institutions comply with legal and sponsor requirements.
• Improve consistency across a research program.
• Encourage planning before data collection begins.

Limitations of IRB review

IRB approval does not guarantee that:

• A study is risk-free.
• Every researcher will follow the protocol.
• Data will never be breached.
• Findings will be scientifically important.
• Participants will fully understand every detail.
• All legal or institutional requirements have been satisfied.
• The project will be ethically acceptable in every cultural context.

Other limitations include:

• Variation between committees.
• Delays caused by incomplete submissions or complex coordination.
• Possible overreliance on biomedical models for social research.
• Duplication in multi-institution studies.
• Limited ability to monitor every study activity.
• Tension between standardized rules and local context.

An IRB should be understood as one part of an ongoing system of ethical research conduct.

Common IRB mistakes

Starting research too early

Do not begin recruitment, consent, interventions or covered data access before written authorization.

Self-declaring a project exempt

Follow the institution’s process for documenting exemption or non-human-subjects status.

Describing data as anonymous when it is only confidential

Data are not anonymous when investigators retain a code key, IP addresses, contact details, recordings or combinations of variables that permit identification.

Submitting inconsistent documents

The application may state one sample size while the consent form states another. All materials should agree.

Using vague data-security language

“Data will be kept secure” is insufficient. Explain encryption, storage, access, transfer, retention and destruction.

Treating consent as a form only

Explain who will obtain consent, when, where and how comprehension and voluntariness will be protected.

Overstating benefits

Do not tell participants that they will benefit when the benefit is uncertain or primarily societal.

Ignoring power relationships

Teachers recruiting students, doctors recruiting patients and managers recruiting employees must address dependence and possible pressure.

Making unapproved changes

New questions, tools, sites, staff, recruitment methods or data-sharing arrangements may require an amendment.

Using unapproved AI or cloud tools

Changing to a transcription, translation, storage or AI provider can change the risk profile and data flow.

IRB application checklist

Before submission, confirm that:

• The research question and objectives are clear.
• The design is scientifically defensible.
• The participant population is justified.
• Inclusion and exclusion criteria are stated.
• The sample size is explained.
• Recruitment materials are attached.
• Consent and assent processes are described.
• All participant-facing documents are included.
• Risks are specific and realistic.
• Risk-mitigation measures match each risk.
• Benefits are not exaggerated.
• Compensation is described.
• Privacy protections are explained.
• The confidentiality and data-security plan is detailed.
• Data-sharing and secondary-use plans are disclosed.
• AI and third-party vendors are identified.
• Vulnerable-population safeguards are included.
• Team members have completed required training.
• Site and data-owner permissions are available.
• All documents contain consistent information.
• No research activities will begin before authorization.

Simple IRB protocol template

Study title

Provide a specific, descriptive title.

Investigators and roles

List the principal investigator, student investigator, supervisor and all personnel who will interact with participants or identifiable data.

Background and rationale

Summarize existing knowledge, the research gap and why the study is needed.

Research aims

State the main research question, objectives or hypotheses.

Study design

Describe the methodology, setting, duration and sequence of procedures.

Participants

Explain the target population, inclusion criteria, exclusion criteria and sample-size justification.

Recruitment

Identify who will approach participants, how contact information will be obtained and what materials will be used.

Consent

Describe the information provided, setting, person obtaining consent, time for consideration, documentation method and any waiver requested.

Procedures

Explain exactly what participants will experience and how long participation will take.

Risks and safeguards

List each foreseeable risk and the corresponding measure used to minimize it.

Benefits

Separate potential participant benefits from societal or scientific benefits.

Compensation

State the amount, schedule, prorating and alternatives where relevant.

Privacy and confidentiality

Describe the interaction setting, identifiers, coding, access, storage, transfer, retention, destruction and sharing.

Analysis

Explain the planned qualitative, quantitative or mixed-method analysis.

Monitoring and reporting

Describe safety monitoring, withdrawal procedures, complaint handling and reportable-event plans.

Dissemination

Explain how findings will be published, presented or shared with participants and communities.

Conclusion

An Institutional Review Board is an independent committee that determines whether covered human-subjects research provides appropriate protection for participants. It evaluates risk, consent, fairness, privacy, confidentiality and safety before research begins and may continue oversight afterward.

Researchers should involve the appropriate ethics office early, submit a complete and consistent protocol, wait for written authorization, and treat approval as the beginning of an ongoing ethical responsibility rather than a one-time administrative requirement.

References

• Health Research Authority. (2025). UK policy framework for health and social care research.
• Institutional Review Boards, 21 C.F.R. Part 56 (2026).
• National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. (1979). The Belmont report. U.S. Department of Health and Human Services.
• National Institutes of Health. (2026). Single IRB for multi-site or cooperative research.
• Protection of Human Subjects, 45 C.F.R. Part 46 (2026).
• U.S. Food and Drug Administration. (n.d.). Institutional Review Boards frequently asked questions.
• University of California, Irvine. (2026). Artificial intelligence and human subject research.
• University of Washington. (2026). School of Medicine research using artificial intelligence.
• World Medical Association. (2024). Declaration of Helsinki: Ethical principles for medical research involving human participants.