What is an Institutional Review Board (IRB) and how does it work?
Institutional Review Boards (IRBs) are independent groups that review research studies involving human subjects to make sure they're safe and ethical according to regulations.
Research studies subject to IRB review are subject to regulations set forth by the FDA. The purpose of an IRB is to make sure research participants' rights and welfare are protected and respected.
It’s an important process, but confusing for many researchers. It can feel like you’re walking in the dark without a headlamp.
This guide helps you traverse the tricky path ahead and reach your research goals faster.
We’ll walk you through:
But before we do, note that the types of studies that are not human subject research and do not require IRB approval are clearly laid out by the University of Iowa.
What is an Institutional Review Board (IRB)?
Institutional Review Boards (IRBs) are administrative bodies designed to protect the rights and welfare of human subjects recruited to participate in research.
IRBs are actually required by U.S. law. Research studies that involve human subjects must get approval from a research oversight committee before starting research — even before enrolling participants.
Typically, IRBs review and monitor all biomedical and behavioral research. So, while software companies testing their UI won't be subject to IRB scrutiny, a biotech company conducting user research on a medical device would, for example.
The history of IRBs
Research with human subjects has a long and often troubling history in the U.S. (e.g. Tuskegee Syphilis Trial) and in the world (e.g. Nazi war crimes against humanity) where people were either forced to participate or participated in research without proper consent or knowledge.
Unethical research and abuses led to the creation of research ethics codes. The Belmont Report (1979) outlines three ethical principles for research: Respect for persons; Beneficence; and Justice. These principles led to new rules in the U.S. Department of Health and Human Services (HHS) Code of Federal Regulations (45 CFR 46).
After The Belmont Report came “The Common Rule” (a short name for “The Federal Policy for the Protection of Human Subjects”) in 1991, which established rules and standards for U.S. researchers. It lists criteria for IRB approval of a research plan that are directly related to the three Belmont principles.
According to the Common Rule, researchers must design studies with the following in mind:
Respect for persons
Obtain informed consent from subjects, communicating information about the research, including its risks and benefits, clearly and understandably
Protect the privacy of individuals
Ensure the protection of vulnerable populations, including children, prisoners, and pregnant women, fetuses, and neonates which require additional consent and other precautions.
Beneficence
There is minimal risk to subjects
Risks to subjects are reasonable in relation to anticipated benefits
Where appropriate, the research plan makes adequate provision for monitoring data collection to ensure safety of subjects
Adequate provisions are made to protect the privacy of individuals and maintain confidentiality of data
Justice
Human subjects must be selected equitably, taking into account the purposes of the research and the setting in which the research is taking place.
Another key protection established by the Common Rule required that all research that includes human subjects must be approved by IRBs.
What purpose do IRBs serve?
IRBs review proposed research and ongoing research activities, ensuring they meet specific criteria for approval. Their role includes protecting participants' welfare, providing guidance to researchers, and ensuring adherence to ethical standards.
Researchers who conduct IRB-approved activities have to be fully educated on the rules, and they have to be ethically committed to protecting the rights and welfare of all human subjects involved.
Who makes up an Institutional Review Board?
IRB members can include accountants, doctors, church members, lawyers, community members, and fellow researchers.
Basically, IRB committees are open to anyone who applies for membership and is accepted on the basis of having an interest in preserving the rights and welfare of research participants.
When do you need an IRB?
Research falling under the following categories requires IRB approval. Some applications move quicker than others, depending on the complexity and potential of risk to people.
Social and behavioral research. Social science or UX research that investigates human behavior, attitudes, opinions, cognition, emotions, social interactions, or cultural practices (This sort of research may fall under the umbrellas of psychology, sociology, education, and anthropology).
Biomedical research. Clinical trials, FDA-regulated products, and product development (e.g., drugs, food supplements, medical devices).
Research involving identifiable private information. Studies accessing or using identifiable private information – medical records, biological specimens, school records, or personal data – even if the data is de-identified/anonymized.
Institutions requiring IRB oversight include:
Federal agencies and departments: Research funded by federal agencies may use either internal or external IRBs to obtain an assurance of compliance. (Some institutions have their own IRBs, while others use external ones. More on that later.) The IRB must register with the Office for Human Research Protection (OHRP), under the Department of Human and Health Services.
Academic institutions: Universities and colleges often have in-house IRBs to oversee work conducted by faculty, staff, and students.
Medical and healthcare institutions: Research conducted within hospitals, clinics, and other healthcare settings, including clinical trials and studies with patient data.
Nonprofit and Non-Governmental Organizations (NGOs): IRBs govern research conducted by nonprofits when they use federal funds for studies involving human participants.
Private companies: Clinical investigations of products such as drugs, biological products, and medical devices require approval from an IRB and compliance with FDA regulations. The FDA has different regulations regarding human volunteers: for example, researchers conducting a study supported by HHS must sign an “assurance”, while researchers conducting a study supported by the FDA do not. An assurance is a document essentially verifying that a study will comply with HHS regulations. The FDA and HHS Human Subject Protection Regulations are compared in this table.
International collaborations: If research involves participants outside the U.S., but is either funded by federal agencies or involves FDA-regulated products, it must also be IRB-approved.
Private companies like Google or Pinterest also conduct non-medical research, like UX research, for example. This research isn’t regulated by the Common Rule and doesn’t require IRB approval.
However, many organizations follow ethical guidelines and require informed consent. Some also offer incentives, and many decide to partner with Tremendous.
How IRBs are structured
As of 2023, there are about 2,300 US-based IRBs operated by about 1,800 separate organizations. These IRBs were set up and registered with the OHRP.
Klitzman categorized IRBs into two main types: centralized and local.
Centralized or Independent IRBs: For-profit organizations. These are the “big box” review boards that may offer some advantages like streamlined reviews, but also have their challenges.
Local IRBs: Generally not-for-profit boards. Local IRBs, like informal university boards, can provide local knowledge and "curbside consults" for research teams.
The Association for the Accreditation of Human Research Protection Programs, Inc. (AAHRPP) is a non-profit accrediting body for IRBs.
Their search engine browses local and vetted IRBs – quite useful at the beginning of your research journey.
The three types of IRB review
The three types of IRB review are 'exempt', 'expedited', and 'full.'
Exempt review: Studies receive an exemption if the research involves minimal risk to participants. If a study receives an exemption, they aren't subject to specific regulations and requirements. Benign behavioral interventions and research that only involves educational testing are examples of research methods that would receive an exempt review. A full list of the types of research studies that are considered 'exempt' is available here.
Expedited review: Studies that involve minimal risk to participants but are outside the scope of benign behavioral interventions, educational testing, or other research methods listed under 'exempt' are subject to expedited review. This includes testing that involves voice data collection or image recordings, data collection related to group behavior, and data collection via non-invasive procedures. Take a look at the complete list of research methods that are eligible for expedited review here.
Full review: Full review is exactly what it sounds like. Any study that is subject to IRB review but doesn't qualify for exempt or expedited review falls under the umbrella of full review. Studies that receive full review are subject to all IRB regulations and requirements.
The IRB process
Here’s a look at the IRB process at a topline level.
Expect lots of forms, documents, and back and forth between you and your IRB.
Research design and development
IRB application
Pre-review and revisions
IRB review
Feedback and revisions
IRB approval
Beyond the IRB approval
How long does the review process take?
Submission to response time could take anywhere between a few weeks to six months.
It all depends on the following:
What type of review is being conducted?
How complete is the original application? Completeness of the application
How complex is the research protocol? Complexity of the research protocol
What is the IRB’s current bandwidth, and how often do they hold committee meetings?
Do they have sufficient resources at the IRB you’re using? Do they have adequate processes? Insufficient resources or poor processes at the IRB (Liberale & Kovach, 2017).
Applications are typically reviewed in the order they’re received. So best to get ahead of schedule and check upcoming deadlines.
How to successfully collaborate with an IRB
Your goal as a researcher is to push the boundaries of science and make discoveries. An IRB wants to ensure you know what you ’re doing (and that no one gets hurt). This can make things a bit tense.
We looked at tactics and spoke with two research directors for advice to smooth things out: Susan Montgomery, professor and librarian at Rollins College, and Holly Cole, CEO of ResearchOps Community.
Tip 1: Build a relationship with your IRB
Cartwright et al. (2013) emphasize the importance of building personal connections with IRB staff. Committees appreciate when you demonstrate expertise in your area of focus and minimize admin stress.
Both experts we interviewed agree.
“An IRB is not a black box. Know who the players are and connect with them, so they understand your goals and game plan,” says Susan.
Tip 2: Start early
Schedule meetings with IRB committee chairs, members, or administrators and seek counsel. They will give guidance on the application process and warn of any potential risks to address.
Think back to your undergraduate days – office hours and assistant profs are there to help you figure things out. Don’t be a stranger. Meet with them.
Tip 3: Manage the bureaucracy at the IRB
Learn their policies and preferences, and learn from other researchers’ successes.
This useful study has more advice: spend some time within the IRB.
You can:
Get involved in local research oversight
Volunteer as an ad hoc reviewer
Partner with IRB administrators to host educational sessions
Work with the IRB to find creative solutions to common challenges faced by researchers.
Email your local IRB and see how you can help. Because investing in relationships can save you headaches and loads of time.
Building a good rapport with the IRB will be important as you write your proposal. Writing, getting approval from IRBs, and planning an incentive structure is a multi-step endeavor.
Ready to start your IRB application? Check out our guide to navigating the process.
