Institutional Review Board (IRB)

An institutional review board (IRB) is an ethics committee, set up by a research institution or operating independently, that reviews, approves, and monitors research involving human subjects. Known as a Research Ethics Committee (REC) in many countries outside the United States, the IRB evaluates whether proposed studies adequately protect the rights, welfare, and safety of participants.

IRBs serve as a primary safeguard between researchers and human participants. Their existence reflects hard won lessons from historical research abuses, codified in the Nuremberg Code, the Declaration of Helsinki, and the Belmont Report. In the United States, the Common Rule (45 CFR 46) requires IRB review of nonexempt human subjects research conducted or supported by the federal departments and agencies that follow it, and FDA regulations (21 CFR 50 and 56) require IRB review of clinical investigations of FDA regulated products, whatever their funding. Many institutions apply IRB review, by their own policy, to all human subjects research regardless of funding source. Internationally, equivalent bodies operate under national legislation and international ethical guidelines. For researchers, understanding the IRB process is essential for conducting compliant and ethical research.

The IRB reviews research protocols to assess several key elements. It evaluates whether risks to participants are minimized through sound research design and are reasonable in relation to anticipated benefits. It examines whether the selection of participants is equitable, avoiding the exploitation of vulnerable populations. It assesses whether informed consent will be obtained and appropriately documented. It reviews data monitoring plans, confidentiality protections, and any additional safeguards for vulnerable populations such as children, prisoners, pregnant individuals, or people with cognitive impairments.

In the United States, human subjects research under the Common Rule follows one of three review paths. Exempt research fits one of the categories in 45 CFR 46.104(d), such as surveys or interviews recorded so that participants cannot readily be identified, or secondary research with identifiable data that are publicly available; some exemptions require a limited IRB review. A study that only uses information whose source the investigator cannot readily identify, without interacting with anyone, is not human subjects research at all, so it needs no exemption. Expedited review, by the IRB chair or experienced members the chair designates, is available for research involving no more than minimal risk that falls into categories on a list published by HHS and FDA (45 CFR 46.110, 21 CFR 56.110), such as collection of blood samples by venipuncture within set limits or noninvasive data collection using procedures routinely employed in clinical practice. Research that is neither exempt nor eligible for expedited review, including any study involving greater than minimal risk, is reviewed by the convened board (full board review); many institutions also send some minimal risk studies involving vulnerable populations to the full board.

In the United States, IRB membership must include at least five members with varying backgrounds (45 CFR 46.107, 21 CFR 56.107), including at least one member whose primary concerns are in scientific areas, one whose primary concerns are in nonscientific areas, and one member not otherwise affiliated with the institution (often a community member). This composition ensures that reviews reflect diverse perspectives, including scientific expertise, ethical reasoning, and community values. Board members disclose conflicts of interest and recuse themselves from reviews of protocols in which they are involved.

Ongoing oversight extends beyond initial approval. In the United States, investigators must promptly report unanticipated problems involving risks to participants or others to the IRB, and many IRBs also set their own rules for reporting adverse events and protocol deviations. Continuing review checks that the risk benefit balance remains acceptable as the study progresses. FDA regulations require it at least once a year (21 CFR 56.109(f)). Under the 2018 Common Rule requirements it is generally not required for research eligible for expedited review, or for research that has reached the stage of only data analysis or accessing follow up clinical data, unless the IRB decides otherwise and documents why; other research approved by the convened board is reviewed at least once a year (45 CFR 46.109(e) and (f)). Protocol amendments require IRB approval before implementation unless the change is necessary to eliminate apparent immediate hazards to participants. Under the 2018 Common Rule requirements, US institutions engaged in cooperative (multisite) research must generally rely on a single IRB for the US part of the study (45 CFR 46.114(b), required since January 20, 2020), unless law requires more than one IRB or the supporting federal department or agency decides that a single IRB is not appropriate.

In the United States, IRB review is required before starting nonexempt human subjects research covered by the Common Rule and clinical investigations covered by FDA regulations. Depending on the design and the exemption categories, this can include clinical trials, observational studies with identifiable data, qualitative studies involving interviews or focus groups, survey research with identifiable respondents, and secondary analysis of datasets containing identifiable information. Even studies that appear to qualify for exemption are best sent for a formal determination: OHRP recommends that investigators not decide on their own that their research is exempt, and many institutions require the IRB or a designated office to make that call.

A frequent mistake is beginning data collection before receiving required IRB approval or an exemption determination, which in the United States is a regulatory violation for research covered by the Common Rule or FDA regulations and can result in data being unusable, sanctions against the researcher, and institutional liability. Another error is submitting protocols that lack sufficient detail about recruitment procedures, consent processes, or data security, leading to delays as the IRB requests revisions. Researchers sometimes underestimate the time required for the review process, particularly for full board reviews, which at many institutions take place at monthly meetings. Failing to submit protocol amendments, including changes to recruitment materials, consent forms, or data collection procedures, is another common compliance failure.

A nursing researcher at a US university proposes a study involving interviews with 30 elderly residents of assisted living facilities about their experiences with pain management. Because the participants are older adults in a dependent care setting and the topic involves sensitive health information, the IRB requires full board review. The board requests revisions to the consent process, including the addition of a capacity assessment procedure for participants with mild cognitive impairment and a provision allowing participants to have a family member present during the consent discussion. After these revisions are approved, the study proceeds with annual continuing review.