An institutional review board (IRB) must approve most human subjects research before it starts. This guide takes you through the process in the order you will meet it: deciding whether you need review, picking the review level, building the package, answering the board and keeping approval current.
Free sandbox · No credit card · 21 CFR Part 11 aligned
weeks
Protocol, consent, recruitment, data plan
Longer if a convened meeting is needed
Getting IRB approval in brief
The basics
An IRB is a committee that reviews research involving people to protect their rights and welfare. In the United States, FDA rules at 21 CFR Part 56 and the HHS Common Rule at 45 CFR Part 46 set out how IRBs are constituted and what they review. Under the Common Rule an IRB has at least five members, with at least one scientist, one non-scientist and one member not affiliated with the institution, and members with a conflict of interest do not take part in the review of that project, except to provide information the board asks for. Under FDA rules an IRB has the authority to approve, require modifications to secure approval, or disapprove research.
The questions the board asks are consistent. Are the risks minimised and reasonable compared with the possible benefit? Is the selection of participants fair? Will consent be properly obtained and documented? Is there a plan to monitor the data for participant safety? Are privacy and confidentiality protected? Your package needs to answer each of these before the board has to ask. If you want a definition of the body itself, see the glossary entry on the institutional review board.
This page covers the US framework in the main, because it is the one most readers search for. Outside the US, ethics committees (research ethics committees in the UK, ethics committees in EU member states) follow national law. The steps below, from scoping to responding to the board, still apply in spirit, but the forms, timelines and legal tests differ. Ask the committee for its own guidance.
Step by step
Ask whether your project is research (a systematic investigation designed to produce generalisable knowledge) and whether it involves human subjects. Quality improvement, public health surveillance and some program evaluations may not be. Use your institution's determination form rather than guessing, and keep the answer.
Most institutions require human subjects protection training for everyone on the team before a submission is accepted. Complete and file the certificates at the start, since they can delay a submission by days.
The Common Rule lists eight categories of exempt research in its 2018 version, such as certain educational and survey research, but exempt does not mean no review: a designated person usually confirms exemption. Expedited review is available for research that is no more than minimal risk and fits a published list of categories, and for minor changes to approved research. Everything else goes to a convened board. Reviewers using expedited procedures cannot disapprove research; that needs full-board review.
For multi-site research funded by the US federal government, the revised Common Rule requires US sites to rely on a single IRB for the cooperative research, with limited exceptions, from 20 January 2020. FDA proposed a similar rule for FDA-regulated research in September 2022, and we have not confirmed whether it has been finalised. For a multi-site study, work out early which IRB is the reviewing IRB and what reliance agreements the sites need.
Use the IRB's templates if they exist. The protocol states the rationale, design, population, procedures, risks and benefits, and the data and safety monitoring plan. The consent form must be understandable to the participant, with key information up front. See how to write an eConsent form for drafting tips.
Include advertisements, scripts, screening questions, the data collection instruments and a description of how data are stored, who has access and how identifiers are protected. A blank copy of the data forms lets the board see exactly what will be collected. The IRB submission checklist goes through the data capture plan in detail.
Many IRBs have administrative pre-review that checks completeness and may ask for changes before the board sees it. Submit in time for the next meeting date if a convened review is needed.
The usual outcomes are approval, approval with modifications (sometimes called stipulations or conditional approval), deferral and disapproval. Respond point by point, with revised documents showing tracked changes and a short cover letter.
Do not enrol until you have the approval letter and the stamped consent form. Submit amendments before changing anything that affects participants. FDA guidance says IRBs conduct continuing review at least once a year for FDA-regulated research, and your IRB will set its own schedule. Report unanticipated problems and protocol deviations as local policy requires.
Choosing a route
A simplified comparison of US review levels. The institution's policy and the applicable regulations decide.
| Level | Typical use | Who reviews | What to expect |
|---|---|---|---|
| Exempt | Research in listed low-risk categories, such as certain surveys or educational settings | IRB staff or a designated member determine exemption | Shortest path. Not exempt from ethics: the determination is documented. |
| Expedited | No more than minimal risk and in a listed category; minor changes to approved research | The chair or experienced reviewers designated by the chair | Faster than a meeting. Reviewers can approve or ask for changes but cannot disapprove. |
| Full board (convened) | Greater than minimal risk, including most investigational drug and device trials | The convened board, with a majority of members present including a non-scientific member | Tied to meeting dates. Expect questions and modifications. |
Build your eCRFs and consent flow in the free sandbox, then export a blank eCRF PDF for the submission. No credit card, no time limit.
What to include
Most delays come from incomplete or inconsistent packages, not from the science. A common pattern is a consent form that describes visits the protocol does not contain, or a protocol that lists a questionnaire that is not attached. Before you submit, read the package once as a board member who has never heard of your study. Do the documents tell the same story?
Be specific about the data. Boards want to know what you collect, why each item is needed, where it is stored, who can see it, and what happens at the end. A blank case report form, with every form printed empty, is the clearest way to show this. Capture can export a blank eCRF PDF with a cover page, form index, visit-by-form matrix and every approved form printed empty, for ethics or IRB submission. For electronic consent, the board will usually want to see the consent text exactly as the participant will, and to understand the signing and countersigning steps. The consent templates in the library, such as the basic clinical trial consent template, give a starting structure, and the informed consent form generator helps assemble one.
Explain your safety monitoring. For greater-than-minimal-risk research, say who reviews safety data, how often and what would trigger a stop. For an adverse event process, see the SAE reporting timelines guide for how reports flow.
Before you submit
Items most boards expect. Your IRB's own form is the final authority.
Check every question; do not leave blank fields.
Version and date on the title page.
Plain language, key information first, matching the protocol.
Ads, scripts, flyers, screening questions.
Blank eCRFs or questionnaires, including licences where they apply.
Storage, access, identifiers, retention.
CVs and human subjects training certificates.
For multi-site studies and external sites.
Timing
There is no standard answer. Exempt determinations can be quick, expedited reviews take longer, and convened reviews depend on the meeting calendar and on the number of rounds of questions. An independent commercial IRB may meet more often than an academic board. Ask your IRB for its published turnaround times and meeting deadlines, and build in time for at least one round of modifications. If you also need regulatory submissions, such as an IND, plan them in parallel. Our fastest way to launch a clinical trial guide shows which start-up steps can overlap.
The biggest controllable factor is the quality of the first submission. Use a checklist, have a colleague review it and respond to stipulations the same week.
Decide whether your project needs IRB review, complete required training, choose the review level (exempt, expedited or full board), prepare the protocol, consent, recruitment and data plan, submit through your IRB, answer any stipulations and wait for the approval letter before enrolling anyone.
It varies by IRB, review level and the number of revision rounds. Exempt determinations are usually quickest and convened board reviews depend on meeting dates. Ask your IRB for its published times and plan for at least one round of modifications.
Exempt research falls into listed low-risk categories and is determined by IRB staff or a designated member. Expedited review is for research that is no more than minimal risk and in a listed category, handled by designated reviewers. Everything else goes to the convened board.
Often yes, though many surveys qualify for exempt review. Whether you need a determination depends on whether it is human subjects research and your institution's policy. Ask your IRB rather than deciding on your own.
No. Recruitment materials and consent procedures are part of what the IRB approves. Do not contact or enrol participants until you have the approval letter and any stamped documents.
Approval with modifications is common. Respond to each point in a cover letter, submit tracked-changes and clean versions, and keep consistency across the protocol and consent.
For US federally funded cooperative research, the revised Common Rule requires a single IRB with limited exceptions. FDA proposed a similar rule in 2022, and we have not confirmed that it is final. Check your funder's and sponsor's requirements.
No. Only an IRB or ethics committee can approve a study. Capture helps you prepare the package: you can export a blank eCRF PDF for submission and build eConsent from templates. The approval and your responsibilities remain with you and your IRB.
Keep exploring
IRB submission checklist
The data capture plan reviewers approve.
Institutional review board
The body defined.
How to write an eConsent form
Draft the consent document.
Informed consent form generator
Assemble a consent form.
Basic clinical trial consent
A starting template.
eConsent software
Choose and test software.
Fastest way to launch a trial
Overlap start-up steps.
SPIRIT checklist generator
Protocol completeness.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.