To get IRB approval for research involving human participants, you determine your study’s risk category, build an application around a detailed protocol and consent documents, submit it through your institution’s Institutional Review Board, address any modifications the reviewers require, and then keep the study in compliance until it closes. Federal regulations under 45 CFR Part 46, known as the Common Rule, require this review before you recruit, enroll, or collect data from anyone.
The process is procedural, but it is not a formality. Getting the sequence right saves weeks.
Start by Identifying Your Review Category
Everything about your timeline and paperwork flows from one question: how much risk does your study pose to participants? Federal regulations define minimal risk as harm or discomfort no greater than what a person encounters in ordinary daily life or during a routine physical or psychological exam. Where your study sits against that benchmark decides which of three tracks it follows.
Exempt Research
Certain low-risk activities fall into exempt categories written into the regulations. Common examples include research in normal educational settings that studies instructional methods, anonymous surveys or interviews, and observation of public behavior. Surveys and interviews can qualify when disclosure of responses would not put participants at risk of legal trouble or damage to their reputation, finances, or employment. One thing to be clear about: you do not decide your own study is exempt. The IRB makes that determination.
Expedited Review
If your study is minimal risk but does not fit an exempt category, it may qualify for expedited review. The IRB chair or one or more experienced members review the protocol without convening the full board. Expedited review also handles minor changes to already-approved studies. A reviewer working expedited can approve a study or require modifications, but cannot disapprove it. Only the convened board can reject a protocol.
Full Board Review
Any study exceeding minimal risk goes to the convened IRB. That typically means novel medical interventions, procedures with significant physical or psychological risk, and studies enrolling vulnerable populations like children or prisoners. A majority of voting members must approve the protocol. It is the most thorough and the slowest track, and it is the only path for higher-risk work.
Build the Application Package
A complete IRB application has several distinct pieces. If any of them is missing, administrative screening bounces the submission back before a reviewer ever sees it.
The Research Protocol
Your protocol is the operational blueprint. It should describe your research objectives, methodology, recruitment plan, participant procedures, and how you will collect and handle data. The IRB uses it to judge whether your design minimizes unnecessary risk and whether the remaining risks are reasonable against the expected benefits. Vague or incomplete protocols are the single most common reason applications stall.
Informed Consent Materials
Federal regulations spell out required elements that every informed consent form must address. At minimum, the document has to explain that the project is research and describe its purpose, duration, and procedures; disclose foreseeable risks and reasonably expected benefits; note alternative procedures or treatments; describe how confidentiality will be protected; explain any compensation or treatment available for injury in studies above minimal risk; provide contacts for questions about the research, participants’ rights, and research-related injury; state clearly that participation is voluntary and can be withdrawn at any time without penalty; and address whether identifiers may be stripped and materials used for future research.
Consent forms cannot contain language that waives or appears to waive a participant’s legal rights or that releases the investigator or institution from liability for negligence. IRBs flag this kind of exculpatory language automatically, and it triggers a revision request every time.
Submit your recruitment materials as well. Flyers, email templates, social media posts, and verbal scripts all go to the IRB, which checks that nothing is coercive or misleading.
Human Subjects Training
Every team member must complete training in human subjects protection before the IRB approves your study. Most institutions accept the Collaborative Institutional Training Initiative (CITI) program or the OHRP Human Research Protection Foundational Training course. Requirements vary, so check with your IRB office to confirm which program your institution recognizes. Certifications expire, so verify everyone’s documentation is current before you submit.
Data Security Plan
Your application must describe how participant data will be stored, who has access, and what safeguards protect confidentiality. Studies involving protected health information have to address HIPAA compliance specifically. The HIPAA Privacy Rule governs when covered entities can use or disclose health information for research, and often requires either participant authorization or documented IRB approval of an authorization waiver. If you plan to access medical records without individual consent, the IRB must document that the research could not practicably be conducted otherwise.
Vulnerable Populations
Studies involving children, prisoners, or pregnant women bring in additional subparts of 45 CFR Part 46. Research with children under Subpart D may require both parental permission and the child’s assent. Studies with prisoners under Subpart C carry additional IRB composition requirements and apply to anyone who becomes a prisoner while already enrolled. Research involving pregnant women and neonates under Subpart B has its own safeguards. When participants fall into more than one group, all applicable subparts apply at once. Missing these protections is a common reason higher-risk protocols get deferred.
Financial Disclosures
For federally funded research, investigators must disclose significant financial interests that could bias the study’s design, conduct, or reporting. Disclosures cover the investigator, their spouse, and dependent children, and must be updated at least annually throughout the funding period. Your institution’s compliance office can tell you what forms and thresholds apply.
Submit Through Your Institution
Most institutions use a dedicated electronic portal. You will upload the protocol, consent forms, recruitment materials, training certificates, data security plan, and any supplemental documents. That portal is your single point of contact with the IRB for the life of the study.
Before you submit, get the required institutional sign-offs. Faculty sponsors (for students), co-investigators, and often a department head must sign, confirming that the research has been vetted departmentally and that the resources are in place.
Once submitted, the IRB office screens the application for completeness. If something is missing, it comes back to you before any substantive review begins. That screening delay is preventable with careful preparation, but it catches a surprising number of applicants.
What to Expect During Review
Timelines depend heavily on your review category and your institution’s meeting schedule. Exempt determinations often come back in days. Expedited reviews generally take a few weeks, since they depend on the designated reviewer’s availability. Full board reviews take the longest because the protocol has to land on the agenda for a convened meeting, and those meetings may happen only once or twice a month. Plan for four to eight weeks for a full board review at many institutions, though this varies.
Federal regulations authorize three actions on your protocol: approve it, require modifications before approval, or disapprove it. In practice, many IRBs also use a “deferred” or “tabled” designation when the board identifies substantial issues that need resolution before it can vote. Outright disapproval is rare and generally reserved for protocols with fundamental ethical problems that revision cannot fix.
When the board requires modifications, you receive specific feedback. Address every point directly, explain what you changed and why, and resubmit through the portal. Treat the feedback as a roadmap. Fighting each comment invites multiple rounds of revision; addressing them thoroughly the first time usually ends the process. Once all concerns are resolved, the institution issues a formal approval letter with an effective date. No recruitment, contact, or data collection may begin before that date.
Staying in Compliance After You Get Approved
Approval is not a one-time event. For studies reviewed by the full board, continuing review is required at least once a year, at intervals the IRB sets based on risk. Under the revised Common Rule, continuing review is generally not required for research eligible for expedited review or for studies that have moved into data analysis only. Your approval letter tells you which rules apply and when the next review is due.
What Happens If Approval Lapses
There is no grace period. If your approval expires before continuing review is complete, all research activities involving human participants must stop immediately. You cannot enroll new participants, and you generally cannot continue interventions with existing participants unless doing so is in their best interest, such as when stopping a treatment mid-course would pose greater risk. A lapsed approval is one of the most preventable compliance failures in human subjects research. Set reminders well before the expiration date.
Protocol Amendments
Any change to an approved protocol needs a formal amendment submitted before you implement it. That includes changes to recruitment, adding a new survey, changing the study population, or updating the consent form. Minor modifications typically qualify for expedited review. Substantive changes to a study originally approved by the full board may need to return to the convened committee. The principle is simple: the IRB approved a specific version of your study, and any deviation needs its own review.
Reporting Unanticipated Problems
You are obligated to report promptly any unanticipated problems that involve risks to participants or others: an adverse reaction, a data breach, an unforeseen risk. For federally supported research, the institution must also report these events to OHRP. Do not wait for the next continuing review to disclose them.
If Your Research Involves More Than One Site
If your study runs at multiple U.S. institutions, you almost certainly need a single IRB of record rather than separate approvals at each site. The revised Common Rule requires U.S. institutions engaged in cooperative research to rely on a single IRB for the domestic portion of the study. The funding agency or lead institution identifies the reviewing IRB. For NIH-funded multi-site research, this has been in effect since 2018 for new competing applications. Exceptions are narrow, covering situations where another law (including tribal law) requires multiple reviews or where the supporting federal agency documents that a single IRB is not appropriate. The NIH has stated that cost is not a compelling justification for an exception, so build single-IRB fees into your budget from the start.
Why the Requirement Matters
The penalties for conducting human subjects research without proper IRB oversight fall on both the researcher and the institution. An institution that fails to comply with its Federalwide Assurance, the written commitment it files with OHRP to follow human subjects protections, can lose that assurance entirely. That loss makes the institution ineligible to conduct or receive funding for any federally supported human subjects research, a consequence that can shut down an entire university’s research enterprise.
Individual investigators face their own exposure. The FDA can initiate disqualification proceedings against clinical researchers who repeatedly or deliberately violate regulations or submit false information; a disqualified investigator is barred from receiving investigational drugs or devices. Institutions typically add their own sanctions, from mandatory retraining to termination. Reputable journals will not publish findings from studies conducted without proper ethical oversight, and funding agencies can require the return of grant money spent on non-compliant activities. Skipping IRB review does not save time. It puts the study, the career, and the participants’ trust at risk.