An “IRB application” is the actual submission package a researcher assembles and files with an Institutional Review Board (or, outside the US, a Research Ethics Committee) so a study can be reviewed — as distinct from the IRB/REC approval process itself, which is the regulatory framework governing how that submission gets evaluated (exempt, expedited, or full board) and how long it takes. This guide covers the application from the document side: what it typically contains, which supporting documents have to accompany it, how it’s usually filed today, and the specific, recurring reasons a complete-looking submission still gets sent back for revision.
Every institution’s application form and electronic system differ, and this guide is deliberately general rather than a substitute for your own IRB/REC’s instructions — always confirm current form requirements and submission mechanics with your institution’s human research protections office before relying on anything here as procedure.
What’s actually inside an IRB application packet
An application is rarely a single document. It’s a packet, and most of the individual pieces map onto specific regulatory questions the IRB has to answer before it can approve, exempt, or send the study to full board:
The protocol (or protocol summary)
The core narrative document describing the research: background and rationale, specific aims or research questions, study design, subject population and eligibility criteria, procedures in the order participants will actually experience them, and how risks and expected benefits are being assessed. IRB-specific protocol templates typically ask for this in plain, non-technical language distinguishing which procedures are being done for the research from which would happen anyway as part of standard care or practice — a distinction the board needs to isolate the actual research risk.
The informed consent document(s)
Whatever consent process the study uses — a full signed consent form, an information sheet for a waiver-of-documentation study, a short-form-plus-summary for non-English-speaking participants, or an assent form for minors — has to be submitted for review as part of the application, not written afterward. Consent language is one of the most heavily scrutinized parts of any submission; see CASRAI’s informed consent entry and the informed consent in research guide for what the required elements actually are. Where a study seeks a waiver or alteration of consent, or a waiver of documentation (a signature), that request is a separate, specifically justified section of the application — not something inferred from silence.
Recruitment materials
Anything a prospective participant will see or hear before enrolling — flyers, social media posts, phone/email scripts, clinic posters — is reviewed as part of the application, since recruitment materials are themselves a place undue influence or coercion can creep in (compensation language is a common flag; see the Common Rule’s voluntariness requirement at 45 CFR 46.116(a)(1)).
Study instruments and data collection tools
Surveys, interview guides, questionnaires, and case report forms are typically uploaded as attachments so the board can see exactly what’s being asked of participants, not just a description of the topic area.
HIPAA authorization or waiver request (where applicable)
Research that uses or discloses protected health information at a HIPAA-covered institution needs either a signed HIPAA authorization (often built into or attached to the consent form) or a documented waiver/alteration request reviewed under a separate regulatory standard (45 CFR 164.512(i)) from the Common Rule’s consent requirements — the two are legally distinct even though the same IRB or a Privacy Board often reviews both for the same study. See CASRAI’s HIPAA in clinical research entry.
Data management and security plan
Where identifiable data is collected, most applications ask how it will be stored, who has access, how long it’s retained, and how it will be de-identified or destroyed at the end of the study — increasingly reviewed against an institution’s own data-security standards rather than left to a general assurance.
Conflict-of-interest disclosure
Investigator and key-personnel financial or other conflicts related to the study are typically disclosed as part of the same submission, or cross-referenced from a separate institutional COI system — see CASRAI’s conflict of interest entry and the conflict-of-interest disclosure form guide.
Training documentation for key personnel
Most institutions require evidence that everyone listed on the application as key personnel has completed human-subjects-protection training — commonly through the CITI Program — before the application can be reviewed, not just before the study starts.
Sponsor and regulatory documents, for FDA-regulated or industry-sponsored studies
Where a study involves an investigational drug, biologic, or device, the application typically also needs the investigator’s brochure, the sponsor’s protocol (if separate from the local protocol document), and evidence of any required FDA correspondence (an IND or IDE number, for example) — these sit alongside, not instead of, the standard IRB packet.
How applications get filed today
Paper IRB submissions are largely gone. Most US institutions run a dedicated electronic IRB (eIRB) submission system — commercial platforms such as Cayuse IRB, IRBNet, Huron’s Click, and WCG’s IRBManager are common in the market, alongside locally built institutional systems — where the application is completed as a structured web form (smart-form questions that determine which sections and attachments are required) rather than a single static document, with consent forms, recruitment materials, and instruments uploaded as separate attachments. Outside the US, the equivalent filing typically runs through a national or regional platform — the UK’s Integrated Research Application System (IRAS), for example, is the single application researchers use for NHS Research Ethics Committee review and study-wide governance assessment together, rather than one application per review body.
One practical consequence of the smart-form model: the exact list of required attachments is often generated dynamically based on how the investigator answers upstream questions (does the study involve minors, protected health information, an investigational product, deception, more than minimal risk) — which is part of why a generic checklist can only get an investigator so far. Confirming the current required-documents list directly with your institution’s IRB/REC office before assembling the packet saves a resubmission cycle.
Why a complete-looking application still comes back for revision
Reviewers send back a real, recurring set of issues rather than a random assortment. The most common, across the categories above:
- Consent language above an appropriate reading level, or missing a required regulatory element — the Common Rule specifies required basic elements of informed consent (45 CFR 46.116(b)); a consent form missing one of them, or written well above the study population’s likely reading level, is one of the single most common reasons for a revision request.
- Protocol and consent form describing the study inconsistently — procedures, risks, or compensation described one way in the protocol narrative and a different way in the consent document.
- Recruitment materials that overstate benefit or understate risk relative to the approved protocol — including compensation language that reads as coercive.
- Vulnerable-population protections not addressed where the study involves children, prisoners, pregnant women, or people with impaired decision-making capacity, without the corresponding Subpart B/C/D-level protections built into the application (parental permission plus assent for minors, a prisoner representative on the reviewing board, and so on).
- Key personnel missing current human-subjects-protection training at the time of submission.
- HIPAA authorization and Common Rule consent treated as the same requirement when the study needs both — a signed consent form is not automatically a valid HIPAA authorization, and vice versa.
- Incomplete data security detail for studies collecting sensitive identifiable data, especially where the plan doesn’t match the level of risk the protocol itself describes.
None of this is arbitrary reviewer preference — each item traces back to a specific criterion the IRB has to affirmatively find before it can approve a study (the general approval criteria are at 45 CFR 46.111). Addressing the underlying criterion, not just rewording the flagged sentence, is what actually clears a revision request on the first resubmission rather than the second.
Frequently asked questions
What is an IRB application?
It’s the full submission package — protocol, consent documents, recruitment materials, study instruments, and supporting disclosures — filed with an Institutional Review Board so it can determine whether a study qualifies as exempt, expedited, or full-board human-subjects research, and if so, approve it. It is the document set reviewed; the approval process is the regulatory framework governing how that review happens.
What documents are needed for an IRB application?
At minimum, most applications need a protocol (or protocol summary), informed consent document(s), and recruitment materials. Depending on the study, they may also need study instruments, a HIPAA authorization or waiver request, a data security plan, conflict-of-interest disclosures, and key-personnel training records. The exact required list is usually generated dynamically by the institution’s electronic submission system based on the study’s characteristics.
How is an IRB application submitted?
Almost universally now through an institutional electronic IRB (eIRB) system rather than on paper — a structured online form with attachments, not a single document mailed or emailed to a committee. Platform names vary by institution (Cayuse IRB, IRBNet, Click, IRBManager, and locally built systems are all common), so confirm which one your institution uses before assembling materials.
Why do IRB applications get sent back for revision?
The most common reasons are consent-form language that’s missing a required regulatory element or is inconsistent with the protocol, recruitment materials that overstate benefit relative to the approved risk description, missing vulnerable-population protections, and key personnel who haven’t completed required human-subjects training at the time of submission.
Is an IRB application the same as IRB approval?
No. The application is the document package submitted for review. Approval (or an exemption determination) is the outcome of that review. A complete, well-prepared application shortens the path to approval but doesn’t guarantee a particular pathway or outcome — that’s determined by an authorized reviewer applying the regulatory criteria to what’s actually in the submission.
Related CASRAI Dictionary terms
IRB (Institutional Review Board) · REC (Research Ethics Committee) · Informed consent · Common Rule (45 CFR 46) · HIPAA in clinical research · Conflict of interest · IACUC (Institutional Animal Care and Use Committee) · IRB/REC Approval Process · CITI Program
