Institutional Review Boards (IRBs): Role in Human Subjects Research
Before a researcher can enroll a single participant in a study involving human subjects, an independent committee must review and approve the plan. That committee is an Institutional Review Board — and its authority sits at the intersection of research ethics and integrity, federal regulation, and institutional accountability. This page covers what IRBs are, how the review process works, the kinds of research they govern, and where the lines are drawn between different levels of scrutiny.
Definition and scope
An Institutional Review Board is a formally designated committee required by federal regulation to review research involving human subjects before that research begins. The legal foundation is 45 CFR 46, the Federal Policy for the Protection of Human Subjects — commonly called the "Common Rule" — which was substantially revised in 2018. The Food and Drug Administration maintains a parallel set of IRB regulations at 21 CFR 56 governing clinical research that falls under FDA jurisdiction.
The core mandate: protect the rights and welfare of human research participants. That's it. Everything else — the forms, the timelines, the committee composition requirements — flows from that obligation.
IRBs are not optional decorations on an institution's compliance wall. Any organization that receives federal research funding must have an IRB (or rely on an external one under a formal authorization agreement). The Office for Human Research Protections (OHRP) at the U.S. Department of Health and Human Services oversees compliance, and institutions can face suspension of all federally funded human subjects research for violations — a consequence that tends to concentrate minds wonderfully.
Membership rules under 45 CFR 46.107 require at least 5 members with varying backgrounds, including at least one member whose primary concerns are nonscientific, and at least one member who is not affiliated with the institution. The nonscientific member isn't a checkbox — they represent community perspectives that disciplinary insiders can miss.
How it works
The IRB process has three levels of review, determined by the nature and risk profile of the proposed research:
-
Exempt review — Applies to research that falls into specific low-risk categories defined in 45 CFR 46.104, such as studies using publicly available data where participants cannot be identified. Despite the name, an institution must still determine that the exemption applies — researchers cannot self-certify.
-
Expedited review — Covers research that presents no more than minimal risk and fits one of nine categories verified in the federal regulations (updated in the 2018 Common Rule revision). A single IRB member, rather than the full board, can approve these. Examples include collection of blood samples from healthy adults via routine venipuncture, or research on individual or group behavior using surveys.
-
Full board review — Required for research that does not qualify for exemption or expedited review, including any research involving greater than minimal risk. The full committee meets, votes, and may require modifications before approval.
Researchers submit a protocol — a detailed plan that includes study objectives, participant recruitment procedures, consent processes, data protection measures, and risk-benefit analysis. The IRB evaluates whether risks are minimized, whether they are reasonable in relation to anticipated benefits, and whether the informed consent process genuinely protects participants rather than simply producing a signed document.
Approval isn't permanent. Ongoing studies require continuing review, and researchers must report unanticipated problems or adverse events to the IRB.
Common scenarios
The breadth of what IRBs govern surprises people who associate the process only with clinical medicine. A clinical trials overview context is the obvious case — pharmaceutical trials, device studies, behavioral interventions — but IRBs reach much further.
Research scenarios that routinely go through IRB review include:
The deception scenario is instructive. A researcher cannot simply tell participants the study is about one thing when it's about another — at least not without explaining why deception is necessary, why it cannot be achieved otherwise, and how participants will be informed after the fact. The IRB evaluates whether the deception is scientifically justified and whether it compromises the voluntariness of participation in a way that crosses ethical lines.
Decision boundaries
The central distinction IRBs navigate is between research and practice — a line that matters because standard clinical care and public health surveillance generally fall outside IRB jurisdiction, while systematic investigation designed to produce generalizable knowledge does not.
A hospital treating patients with an established drug is engaged in practice. A hospital systematically varying that drug's dosage across patient groups to study comparative outcomes is engaged in research, regardless of whether anyone calls it a "quality improvement initiative." The 2018 Common Rule clarifications addressed some gray areas, but the underlying judgment call remains genuinely difficult in real cases.
The risk threshold also marks a hard boundary. Research involving prisoners, children, pregnant women, or economically disadvantaged populations triggers additional protections under Subparts B, C, and D of 45 CFR 46 — recognizing that voluntariness cannot be assumed when structural pressures operate on a participant's decision-making.
For investigators, the practical takeaway from IRB review isn't bureaucratic friction — it's a structured pressure test on whether the study design, consent process, and risk management are actually sound. Studies with robust IRB protocols tend to hold up better under peer review, which is not a coincidence. Ethical rigor and methodological rigor share the same underlying logic.
The broader landscape of how science governs itself — including IRBs, data integrity standards, and conflict-of-interest policies — is navigable through the National Science Authority home.