What Is an Institutional Review Board (IRB) in Research?

An Institutional Review Board, or IRB, is an independent committee that reviews research involving human subjects to make sure participants are protected. Every federally funded or federally regulated study that involves people has to pass through an IRB before enrollment can begin. The board weighs whether the study’s potential benefits justify its risks, whether participants will be told what they need to know, and whether the research is designed and conducted fairly.

Why the IRB System Exists

IRBs came out of research scandals. The best known was the U.S. Public Health Service’s Untreated Syphilis Study at Tuskegee, which ran for 40 years and withheld treatment from Black men with syphilis without their knowledge or consent. After the study became public in 1972, Congress passed the National Research Act of 1974, which required federally supported human-subjects research to be reviewed by an IRB before it could proceed.¹ The same law created the commission that produced the Belmont Report, whose principles of respect for persons, beneficence, and justice still anchor IRB decision-making.²

Those principles translate into concrete requirements. An IRB is not an advisory body. It has authority to approve a study, require changes, or refuse to let it go forward at all.

What an IRB Reviews Before Approving a Study

Federal regulations set out seven criteria, and all of them must be satisfied before an IRB can approve research.³

Risks to participants are minimized through sound research design, using procedures already being performed for diagnostic or treatment purposes when possible.
Risks are reasonable in relation to anticipated benefits, considering only the risks and benefits that come from the research itself.
Selection of participants is equitable, so studies do not lean on vulnerable groups simply because they are easy to reach.
Informed consent will be sought from each prospective participant or their legally authorized representative.
Informed consent will be appropriately documented, unless the documentation requirement is waived under specific rules.
Where appropriate, the research plan provides for monitoring the data collected to protect participant safety.
Adequate provisions protect participants’ privacy and the confidentiality of their data.

This is where many proposals stall. A consent form written in dense jargon, a recruitment plan that targets a captive population, or a vague data security plan will send a protocol back for revisions. Researchers who treat the IRB submission as a formality tend to face several rounds of them.

The Three Levels of Review

Not every study gets the same scrutiny. Federal regulations sort research into three tiers based on risk.

Exempt Research

Some low-risk research falls outside the full IRB process. Common exempt categories include studies in normal educational settings that involve standard teaching practices, research limited to anonymous educational tests or surveys, and research involving harmless behavioral tasks where participants agree in advance.⁴ Even so, an IRB determination confirming exempt status is typically required. A researcher cannot self-declare a study exempt.

Expedited Review

Studies that pose no more than minimal risk and fit categories published by the Secretary of HHS can go through expedited review. The IRB chair or one or more experienced members handle it, without convening the full committee. Minor changes to previously approved research qualify too. One key limit: a reviewer conducting an expedited review can approve a study but cannot reject it. Only the full board can disapprove a protocol.⁵

Full Board Review

Research involving more than minimal risk goes to the full IRB at a convened meeting. That includes randomized treatment studies, trials of investigational drugs or devices, and behavioral studies involving sensitive data or observation of illegal activity. A majority of members must be present, including at least one nonscientific member, and approval requires a majority of those present.

What Informed Consent Has to Include

Informed consent is the core of participant protection, and federal rules spell out what it must contain. The consent document cannot include language that waives a participant’s legal rights or releases researchers from liability for negligence.⁶

At a minimum, consent has to cover:⁶

A clear statement that this is research, what it aims to accomplish, how long participation lasts, what procedures are involved, and which procedures are experimental.
A description of any reasonably foreseeable risks or discomforts.
Any benefits the participant or others may reasonably expect.
Alternative procedures or treatments available outside the study.
How participant records will be kept confidential.
For research involving more than minimal risk, whether medical treatment is available if injury occurs.
Who to contact with questions about the research, about participant rights, and in the event of injury.
A statement that participation is voluntary and that a person can refuse or withdraw at any time without penalty or loss of benefits they would otherwise be entitled to.

The consent has to be written in language the participant can actually understand, not medical or legal jargon. It also has to begin with a concise summary of the key information most likely to help someone decide whether to participate, instead of burying it under pages of boilerplate.

Oversight Continues After Approval

The IRB’s role does not end when a study is approved. Research posing more than minimal risk requires continuing review at least once a year. Under the revised Common Rule, minimal-risk studies reviewed after 2018 generally do not require annual continuing review, though the IRB can still require it for specific protocols, particularly those regulated by the FDA.⁷

Investigators also have to report problems as they come up. If an unexpected event puts participants at risk, the investigator must report it to the IRB promptly. For serious adverse events, the recommended reporting window is within one week. Other unanticipated problems should be reported within two weeks.⁸ The IRB then decides whether the study needs to be modified, whether participants must be re-consented with updated risk information, or whether the study should be stopped.

Certain populations get additional protections beyond the standard criteria. Subpart B covers pregnant women, fetuses, and neonates; Subpart C covers prisoners; Subpart D covers children.⁹ When those subparts apply, the IRB has to meet both the standard approval criteria and the additional requirements.

Which Rules Apply: Common Rule and FDA

Two overlapping sets of federal regulations govern IRBs, and which one applies is easy to get wrong.

The Common Rule, codified at 45 CFR Part 46, applies to research funded or conducted by the 15 federal departments and agencies that have adopted it, including HHS, the Department of Defense, the EPA, and NASA. Three additional agencies (the CIA, the Department of Homeland Security, and the Social Security Administration) follow the same rules without formally codifying them.¹⁰

The FDA’s regulations at 21 CFR Part 56 govern IRB review of clinical investigations involving FDA-regulated products: drugs, medical devices, biologics, and certain food additives.⁷ FDA jurisdiction is triggered by what is being studied, not by who is paying. A privately funded drug trial with no federal dollars still needs IRB review under FDA rules. When a study is both federally funded and involves an FDA-regulated product, both sets of rules apply at once.

For multi-site studies under the Common Rule, the revised regulations require a single IRB of record instead of separate reviews at each site. That requirement took effect on January 20, 2020, and applies to cooperative research initially approved on or after that date.¹¹

What Happens When Someone Doesn’t Comply

Enforcement comes from more than one direction. The Office for Human Research Protections (OHRP) at HHS oversees compliance with the Common Rule. OHRP evaluates allegations from any source and can impose corrective actions ranging from procedural changes to recommendations for broader sanctions by other HHS officials.¹²

On the funding side, NIH can withhold future awards, suspend active grants, or terminate funding when an institution fails to comply with the terms of its award, which include IRB compliance. A terminated grant is reported to a federal performance system, and that record follows the institution for five years. Any agency considering a new award during that period has to weigh that history.¹³

The FDA has its own track. If an inspection turns up non-compliance, the FDA can prohibit an IRB from approving new studies, stop enrollment in ongoing ones, or terminate active studies. In the most serious cases, the FDA can disqualify an IRB entirely. A disqualified IRB cannot review any FDA-regulated clinical investigation, and the FDA can refuse to accept data from studies that IRB reviewed, potentially rendering years of clinical trial work unusable for a drug or device approval. The FDA can also pursue civil or criminal judicial proceedings independently of any administrative action.¹⁴

1
CDC. Effects on Research – The U.S. Public Health Service Untreated Syphilis Study at Tuskegee
2
HHS.gov. The Belmont Report
3
eCFR. 45 CFR 46.111 – Criteria for IRB Approval of Research
4
eCFR. 45 CFR 46.104 – Exempt Research
5
eCFR. 45 CFR 46.110 – Expedited Review Procedures
6
eCFR. 45 CFR 46.116 – General Requirements for Informed Consent
7
eCFR. 21 CFR Part 56 – Institutional Review Boards
8
U.S. Department of Health & Human Services (HHS) – Office for Human Research Protections (OHRP). Reviewing and Reporting Unanticipated Problems Involving Risks to Subjects or Others and Adverse Events
9
eCFR. 45 CFR Part 46 – Protection of Human Subjects
10
eCFR. 45 CFR 46.107 – IRB Membership
11
National Institutes of Health (NIH). Single IRB for Multi-Site or Cooperative Research
12
NIH Grants and Funding. 4.1.15 Human Subjects Protections
13
National Institutes of Health (NIH). Remedies for Noncompliance or Enforcement Actions: Suspension, Termination, and Withholding of Support
14
eCFR. 21 CFR Part 56 Subpart E – Administrative Actions for Noncompliance