IRB (Institutional Review Board) and REC (Research Ethics Committee) review exists to protect the rights and welfare of people who participate in research. The mechanics of “getting IRB approval” are one of the most-searched practical questions in research administration, and also one of the most misunderstood — “exempt” doesn’t mean “no review,” “expedited” doesn’t mean “fast,” and whether a given project needs review at all depends on a specific regulatory test, not on how risky the project feels. This guide covers what actually triggers review, the three review pathways, what’s genuinely outside IRB/REC scope, realistic timelines, how the process differs across institution types and jurisdictions, and — CASRAI’s specific angle — how approval status should be represented and tracked once it exists, as data that other institutional systems need to see.
This guide is deliberately general rather than jurisdiction-specific, because IRB/REC rules vary by country and by institution. For the operational definition of the committee itself, see the CASRAI Dictionary entries for IRB (Institutional Review Board) and REC (Research Ethics Committee). Always confirm current requirements with your own institution’s IRB/REC or research ethics office — this guide explains the general framework, not a specific institution’s procedure.
What actually triggers IRB/REC review
In the United States, the baseline regulatory framework is the Common Rule (45 CFR 46), the federal policy for protection of human subjects, adopted by roughly twenty federal departments and agencies and revised in 2018 (the “2018 Requirements,” with a general compliance date of January 21, 2019). Under 45 CFR 46.102, a project needs IRB review if it meets both parts of a two-part test:
- It’s “research” — a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
- It involves a “human subject” — a living individual about whom an investigator obtains data through intervention or interaction, or obtains identifiable private information.
Both conditions have to be true. This is the single most common source of confusion in “does this need IRB approval” questions: a project can involve people and still not need review (if it isn’t designed to produce generalizable knowledge — internal quality improvement is the classic example), and a project can be entirely archival and still need review (if it uses identifiable private information about living people). Federally regulated products add a second, separate layer: research involving drugs, biologics, or devices regulated by the FDA falls under FDA’s own human-subjects regulations (21 CFR Parts 50 and 56), which largely parallel the Common Rule but are not identical to it — FDA’s rules don’t include the Common Rule’s exemption categories, for instance, and continuing review requirements differ. Research subject to both frameworks has to satisfy both.
Outside the US, the equivalent gatekeeping function is usually performed by a Research Ethics Committee (REC) under a national or institutional framework rather than a single federal regulation — the underlying question (does this involve people, and could it cause them harm or violate their rights/autonomy) is similar, but the specific legal test and committee structure vary by country. Don’t assume a US Common Rule exemption category maps directly onto a non-US REC’s exemption or “proportionate review” category.
The three review pathways
Once a project is determined to need review, it goes through one of three pathways. This determination is itself made by an authorized reviewer (the IRB chair, a designated staff reviewer, or the board) — a researcher self-certifying their own project as exempt is not how the process works at most institutions, even when the project genuinely qualifies.
Exempt
“Exempt” is a common source of confusion: it does not mean no review happens. It means a study is reviewed against one of the regulatory exemption categories and, if it qualifies, is exempted from the rest of the Common Rule’s requirements (ongoing continuing review, in particular). Under the 2018 Requirements, 45 CFR 46.104(d) sets out eight exemption categories, covering areas like normal educational practice, certain educational tests/surveys/interviews/observation of public behavior, benign behavioral interventions, secondary research use of identifiable information or specimens already collected (under specified conditions), and certain public benefit or food-taste studies. Each category has specific conditions attached — qualifying requires more than a project loosely fitting the category description.
Expedited
Expedited review applies to research that presents no more than minimal risk to participants and falls into one of the categories on OHRP’s expedited-review list (originally published in the November 9, 1998 Federal Register, jointly with FDA). It’s reviewed by the IRB chair or one or more experienced reviewers designated by the chair, rather than by the full convened board — “expedited” refers to who reviews it, not necessarily how quickly.
Full board
Research that’s more than minimal risk, doesn’t fit an exemption or expedited category, or otherwise warrants full committee attention goes to a convened meeting of the full board, which needs a quorum (including at least one non-scientific member) and decides by majority vote.
What typically does not need IRB/REC review
Real search demand around this topic clusters heavily around specific borderline cases. General principles (not a substitute for an actual determination from your IRB/REC office):
- Quality improvement (QI) and program evaluation — activities intended to improve a local process or program, without the intent to produce generalizable knowledge, generally fall outside the Common Rule’s definition of “research.” The line can blur when a QI project is later written up and submitted for publication with generalizable claims — that shift in intent is exactly the kind of thing an IRB/REC pre-determination exists to catch.
- Case reports — a report on a single patient’s clinical course is traditionally treated as outside human-subjects research (it isn’t designed to be generalizable), though many journals and institutions still require documented IRB/REC input, a HIPAA authorization or waiver, or patient consent for identifiable details. Policy varies by institution and by journal.
- Publicly available or properly de-identified secondary data — analysis of data that’s already public, or that has been irreversibly stripped of identifiers such that the investigator cannot readily re-identify subjects, commonly doesn’t meet the “human subject” half of the test. Whether a given de-identification approach is sufficient is a determination, not an assumption a researcher should make unilaterally.
- Oral history and journalism — some institutions have formal policies excluding oral history and journalism from IRB purview on the grounds that they aren’t designed to produce generalizable knowledge in the regulatory sense; this is institution-specific rather than a blanket federal exemption, so check local policy rather than assuming it applies everywhere.
Conversely, surveys, interviews, and retrospective or secondary data analysis studies frequently do need review (often at the exempt or expedited level) precisely because they involve identifiable private information or direct interaction with people, even when they feel low-risk. “Minimal risk” affects which pathway applies, not whether review is required at all.
One further scope note: IRB/REC review covers human-subjects research specifically. Research involving live vertebrate animals is reviewed by a separate committee — in the US, the IACUC (Institutional Animal Care and Use Committee) — under a different regulatory framework. The two committees, and the two approval numbers, are not interchangeable.
How long approval actually takes
Timelines vary substantially by institution, IRB workload, and how complete the initial submission is, so treat any number here as a general planning range, not a commitment. Reported ranges commonly cited by university research-compliance offices: exempt determinations often complete within roughly one to four weeks; expedited review often runs four to six weeks; full board review is commonly budgeted at six to eight weeks or more, since it depends on the board’s meeting schedule and often requires revisions before final approval. Multi-site studies add coordination time on top of whichever pathway applies. Building in buffer time before a grant start date or data-collection window is standard practice, and resubmission cycles after requested revisions are the most common reason a review takes longer than the stated range.
Approval is also not indefinite. Under the pre-2018 rules, essentially all approved protocols needed continuing (annual) re-review; the 2018 Requirements narrowed that — some expedited and all exempt categories no longer require continuing review, but most expedited and full-board-reviewed protocols still do, on an interval the IRB sets (often annual). Research generally may not begin before approval (or an exemption determination) is issued — retroactive approval for research already underway is not how the framework is designed to work, and institutions that discover unapproved human-subjects research underway typically treat it as a reportable compliance issue rather than something to simply backdate.
How the process differs across institution types
- Academic/university IRBs review the bulk of federally funded and student/faculty-initiated human-subjects research, typically under an institution-wide Federalwide Assurance (FWA) with OHRP.
- Hospital and health-system IRBs often review a mix of federally funded research, FDA-regulated clinical investigations, and institution-initiated clinical studies — commonly navigating both the Common Rule and FDA’s 21 CFR 50/56 for the same protocol.
- Independent (commercial) IRBs — for-profit boards contracted by a study sponsor or by institutions without the capacity to run their own — are common for industry-sponsored multi-site clinical trials, reviewing the same protocol once on behalf of many participating sites.
- Single IRB (sIRB) for multi-site research — since January 25, 2018, NIH policy has required a single IRB of record for the domestic sites of NIH-funded multi-site studies using the same protocol, specifically to cut the delay of each site separately re-reviewing an identical protocol. The 2018 Revised Common Rule extended a version of this expectation to Common Rule-covered multi-site research more broadly.
- Outside the US, review runs through the applicable national or institutional REC framework instead — for example, in the UK, the Health Research Authority (HRA) combines NHS Research Ethics Committee review with study-wide governance assessment through a single application (via IRAS), rather than the FWA/OHRP model used in the US. Committee composition, review categories, and timelines all differ from the Common Rule framework — don’t assume US terminology (exempt, expedited) transfers directly.
Tracking IRB/REC approval status in institutional systems
Most of what’s written about IRB approval online stops at “how do I get it.” The part that matters just as much for a research office, and is largely absent from generic explainers, is what happens to that approval status after it’s granted — because it doesn’t live in one place, and it changes state over time (approved, modified, expiring, lapsed, closed).
Operationally, protocol-level compliance data (protocol number, approval date, expiration date, continuing-review due date, current status) typically lives inside a dedicated electronic IRB/REC submission system — commercial and institutional eIRB platforms are common in the market alongside locally built systems. That system is usually separate from the institution’s research information system / CRIS (Pure, Symplectic Elements, InfoEd, Converis, and similar RIM platforms — see CASRAI’s CRIS and RIM entries) and separate again from grants management and financial systems. A protocol can lapse in the eIRB system without that fact automatically reaching the project record a grants office, a funder-reporting workflow, or a publication-submission system relies on. This is a real, unresolved interoperability gap, not a solved problem with a name — informatics research specifically on eIRB systems and their integration with adjacent clinical-research-informatics systems has been comparatively limited relative to other parts of the research lifecycle.
The standards path that does exist points in a specific direction: anchor compliance status to the same persistent identifiers already used to model the project elsewhere, rather than treating the eIRB system as an island. CASRAI’s own Dictionary already models this pattern for grants and CRIS records — a Project (CRIS) record, ideally carrying a persistent Project ID (RAiD-anchored) (RAiD, ISO 23527), gives a stable join key that a compliance status, a grant record, a publication, and a repository deposit can all reference without needing direct point-to-point integrations between every pair of systems. The mechanics for that kind of exchange — CRIS interoperability via CERIF, OAI-PMH, and PID-based joins — are the same mechanics already used to move research-output metadata between institutional CRIS platforms and national/funder aggregators.
There is a real, currently-in-development standard specifically for the IRB side of this: HL7 International’s Single IRB (sIRB) Implementation Guide, built on FHIR, defines standardized Questionnaire/QuestionnaireResponse exchange (and an optional ResearchStudy resource) so that IRB submission forms and review outcomes can move between a central reviewing IRB and participating sites electronically instead of as ad hoc PDF packets — directly targeting the coordination burden the NIH sIRB mandate created. As of this writing it remains a Trial-Use (STU) implementation guide under active development, not a finalized normative standard, and it’s scoped to the IRB-to-site exchange problem specifically rather than the broader eIRB-to-CRIS/grants-system gap described above. It’s still the clearest sign that standards bodies recognize IRB approval data as something that needs to move between systems in a structured way, not just live in a single institution’s submission portal.
The practical takeaway for a research office building or evaluating systems: treat “IRB/REC approval status” as project-level metadata that should be able to travel with a persistent project identifier, the same way funder award numbers and ORCID iDs already do, rather than as a fact that only exists inside the eIRB system’s own login. Where an institution’s eIRB platform can export or expose protocol status via an API, mapping that export to the project’s RAiD (or equivalent persistent project ID) is the concrete step that closes part of the gap today, ahead of any single system-to-system standard reaching general adoption.
Frequently asked questions
What is IRB approval?
IRB approval is a formal determination by an Institutional Review Board that a research study involving human subjects meets the applicable regulatory criteria for protecting participants — informed consent, an acceptable risk/benefit balance, equitable subject selection, and (where applicable) protections for vulnerable populations — before the study may begin, or after review that it qualifies for an exemption from most of those ongoing requirements.
Which studies need IRB approval?
Any project that meets the Common Rule’s two-part test — it’s “research” designed to produce generalizable knowledge, and it involves obtaining data through interaction/intervention with living people or their identifiable private information — needs an IRB determination, even if that determination turns out to be “exempt.” The determination itself has to be made by an authorized reviewer, not assumed by the investigator.
Do surveys need IRB approval?
Usually yes, at least a determination — surveys typically involve interaction with living people and often collect identifiable or potentially identifiable information. Many qualify for exempt or expedited review rather than full board review, but “it’s just a survey” is not itself a basis for skipping the determination.
Do quality improvement projects need IRB approval?
Generally not, if the project is genuinely intended only to improve a local process and there’s no intent to produce generalizable knowledge. If the project is later written up for publication with generalizable claims, that shift can bring it back into IRB/REC scope — worth flagging to the compliance office before, not after, submission.
Do case reports need IRB approval?
Single-patient case reports are often treated as outside the regulatory definition of human-subjects research, but many institutions and journals still require documented ethics-office sign-off, patient consent, or a privacy authorization/waiver for identifiable clinical details. Policy varies — check both your institution’s and the target journal’s requirements.
How long does IRB approval take?
It depends heavily on the pathway and the institution: commonly cited ranges run from roughly one to four weeks for exempt determinations, four to six weeks for expedited review, and six to eight-plus weeks for full board review, with resubmission cycles after requested revisions being the most common source of delay beyond those ranges.
What’s the difference between an IRB and a REC?
They perform the same core function — reviewing research involving people for ethical acceptability before it proceeds — but “IRB” specifically denotes the US committee operating under the Common Rule (and, for FDA-regulated research, 21 CFR 56), while “REC” is the more general international term used in the UK and elsewhere, typically operating under a different national legal framework with its own categories and timelines.
Related CASRAI Dictionary terms
IRB (Institutional Review Board) · REC (Research Ethics Committee) · Common Rule (45 CFR 46) · Informed consent · IACUC (Institutional Animal Care and Use Committee) · Fundamental research exemption · CRIS · RIM · Project (CRIS) · Project ID (RAiD-anchored) · CRIS interoperability
