IRB Approval: Review Types, Process, and Timelines

IRB (Institutional Review Board) and REC (Research Ethics Committee) review exists to protect the rights and welfare of people who participate in research. The mechanics of “getting IRB approval” are one of the most-searched practical questions in research administration, and also one of the most misunderstood — “exempt” doesn’t mean “no review,” “expedited” doesn’t mean “fast,” and whether a given project needs review at all depends on a specific regulatory test, not on how risky the project feels. This guide covers what actually triggers review, the three review pathways, what’s genuinely outside IRB/REC scope, realistic timelines, how the process differs across institution types and jurisdictions, and — CASRAI’s specific angle — how approval status should be represented and tracked once it exists, as data that other institutional systems need to see.

This guide is deliberately general rather than jurisdiction-specific, because IRB/REC rules vary by country and by institution. For the operational definition of the committee itself, see the CASRAI Dictionary entries for IRB (Institutional Review Board) and REC (Research Ethics Committee). Always confirm current requirements with your own institution’s IRB/REC or research ethics office — this guide explains the general framework, not a specific institution’s procedure.

What actually triggers IRB/REC review

In the United States, the baseline regulatory framework is the Common Rule (45 CFR 46), the federal policy for protection of human subjects, adopted by roughly twenty federal departments and agencies and revised in 2018 (the “2018 Requirements,” with a general compliance date of January 21, 2019). Under 45 CFR 46.102, a project needs IRB review if it meets both parts of a two-part test:

• It’s “research” — a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
• It involves a “human subject” — a living individual about whom an investigator obtains data through intervention or interaction, or obtains identifiable private information.

Both conditions have to be true. This is the single most common source of confusion in “does this need IRB approval” questions: a project can involve people and still not need review (if it isn’t designed to produce generalizable knowledge — internal quality improvement is the classic example), and a project can be entirely archival and still need review (if it uses identifiable private information about living people). Federally regulated products add a second, separate layer: research involving drugs, biologics, or devices regulated by the FDA falls under FDA’s own human-subjects regulations (21 CFR Parts 50 and 56), which largely parallel the Common Rule but are not identical to it — FDA’s rules don’t include the Common Rule’s exemption categories, for instance, and continuing review requirements differ. Research subject to both frameworks has to satisfy both.

Outside the US, the equivalent gatekeeping function is usually performed by a Research Ethics Committee (REC) under a national or institutional framework rather than a single federal regulation — the underlying question (does this involve people, and could it cause them harm or violate their rights/autonomy) is similar, but the specific legal test and committee structure vary by country. Don’t assume a US Common Rule exemption category maps directly onto a non-US REC’s exemption or “proportionate review” category.

The three review pathways

Once a project is determined to need review, it goes through one of three pathways. This determination is itself made by an authorized reviewer (the IRB chair, a designated staff reviewer, or the board) — a researcher self-certifying their own project as exempt is not how the process works at most institutions, even when the project genuinely qualifies.

Review pathways at a glance

The three pathways differ in who reviews a study, what continuing oversight applies, and how long review typically takes — not just in how risky the study feels. This table summarizes the practical differences; see CASRAI’s Expedited Review vs. Full Board Review comparison for a deeper procedural breakdown of those two pathways specifically.

Dimension	Exempt	Expedited	Full board
What qualifies	Fits one of the eight categories at 45 CFR 46.104(d) (e.g. certain educational research, benign behavioral interventions, secondary use of already-collected identifiable data under specified conditions)	No more than minimal risk and falls on OHRP’s expedited-review category list	More than minimal risk, doesn’t fit an exemption or expedited category, or otherwise warrants full-committee attention
Who reviews it	An IRB chair or designated reviewer makes the exemption determination — not a full committee vote	IRB chair or one or more experienced reviewers designated by the chair	The full convened board, with a quorum including at least one non-scientific member, deciding by majority vote
Approval criteria applied	Checked against the specific exemption category’s conditions, not the full 45 CFR 46.111 criteria set	Full 45 CFR 46.111 criteria apply	Full 45 CFR 46.111 criteria apply, discussed and voted on at a convened meeting
Continuing review required?	No, under the 2018 Common Rule — exempt studies generally aren’t subject to ongoing continuing review	Often yes, though some expedited categories no longer require it under the 2018 Requirements	Typically yes, on an interval the IRB sets (commonly annual)
Typical timeline	Roughly 1–4 weeks for a complete submission	Roughly 2–6 weeks, commonly landing around 3–4 weeks	Roughly 4–8+ weeks, gated by the board’s meeting calendar
Common examples	Anonymous survey research on non-sensitive topics; secondary analysis of a properly de-identified dataset	Minor changes to already-approved research; collection of small blood samples; minimal-risk survey or interview research not otherwise exempt	Clinical trials of an investigational drug or device; research involving vulnerable populations at greater than minimal risk

See CASRAI’s guide to how long IRB approval takes for what specifically extends or shortens each of these ranges.

Exempt

“Exempt” is a common source of confusion: it does not mean no review happens. It means a study is reviewed against one of the regulatory exemption categories and, if it qualifies, is exempted from the rest of the Common Rule’s requirements (ongoing continuing review, in particular). Under the 2018 Requirements, 45 CFR 46.104(d) sets out eight exemption categories, covering areas like normal educational practice, certain educational tests/surveys/interviews/observation of public behavior, benign behavioral interventions, secondary research use of identifiable information or specimens already collected (under specified conditions), and certain public benefit or food-taste studies. Each category has specific conditions attached — qualifying requires more than a project loosely fitting the category description.

Expedited

Expedited review applies to research that presents no more than minimal risk to participants and falls into one of the categories on OHRP’s expedited-review list (originally published in the November 9, 1998 Federal Register, jointly with FDA). It’s reviewed by the IRB chair or one or more experienced reviewers designated by the chair, rather than by the full convened board — “expedited” refers to who reviews it, not necessarily how quickly.

Full board

Research that’s more than minimal risk, doesn’t fit an exemption or expedited category, or otherwise warrants full committee attention goes to a convened meeting of the full board, which needs a quorum (including at least one non-scientific member) and decides by majority vote.

Approval criteria under 45 CFR 46.111

For research that goes through expedited or full board review, the IRB isn’t just checking a box — it has to make a specific, documented set of determinations before it can approve a study. Under 45 CFR 46.111, the IRB must find that:

• Risks to subjects are minimized (46.111(a)(1)) — by using procedures consistent with sound research design that don’t unnecessarily expose subjects to risk, including, where appropriate, reusing procedures subjects are already undergoing for diagnostic or treatment purposes.
• Risks are reasonable in relation to anticipated benefits (46.111(a)(2)) — weighed against any benefit to subjects and the importance of the knowledge the research may reasonably produce. The IRB evaluates only the risks and benefits the research itself adds, not the risks or benefits of care a subject would receive regardless of participation.
• Selection of subjects is equitable — accounting for the purposes of the research and the setting, and specifically considering the problems of research involving vulnerable populations.
• Informed consent will be sought from each prospective subject or their legally authorized representative, and appropriately documented, in accordance with 45 CFR 46.116 and 46.117 (or a specific, justified waiver of one or the other is granted).
• The research plan makes adequate provision for monitoring the data collected, where appropriate, to ensure subject safety.
• There are adequate provisions to protect the privacy of subjects and maintain confidentiality of data, where appropriate.
• Additional safeguards are in place for vulnerable subjects (46.111(b)) — where some or all subjects are likely to be vulnerable to coercion or undue influence (children, prisoners, individuals with impaired decision-making capacity, or economically or educationally disadvantaged persons), the study must include additional protections for their rights and welfare. Children and prisoners also trigger the dedicated additional protections in Subparts D and C respectively; the other vulnerable categories are handled through case-by-case IRB judgment under this general criterion rather than a separate subpart.

Exempt determinations are checked against a different, narrower test — the specific conditions of the applicable 45 CFR 46.104(d) exemption category — rather than being run through the full 46.111 criteria set, which is one of the structural reasons an exemption determination and a full IRB approval are not the same thing (see below).

What typically does not need IRB/REC review

Real search demand around this topic clusters heavily around specific borderline cases. General principles (not a substitute for an actual determination from your IRB/REC office):

• Quality improvement (QI) and program evaluation — activities intended to improve a local process or program, without the intent to produce generalizable knowledge, generally fall outside the Common Rule’s definition of “research.” The line can blur when a QI project is later written up and submitted for publication with generalizable claims — that shift in intent is exactly the kind of thing an IRB/REC pre-determination exists to catch.
• Case reports — a report on a single patient’s clinical course is traditionally treated as outside human-subjects research (it isn’t designed to be generalizable), though many journals and institutions still require documented IRB/REC input, a HIPAA authorization or waiver, or patient consent for identifiable details. Policy varies by institution and by journal.
• Publicly available or properly de-identified secondary data — analysis of data that’s already public, or that has been irreversibly stripped of identifiers such that the investigator cannot readily re-identify subjects, commonly doesn’t meet the “human subject” half of the test. Whether a given de-identification approach is sufficient is a determination, not an assumption a researcher should make unilaterally.
• Oral history and journalism — some institutions have formal policies excluding oral history and journalism from IRB purview on the grounds that they aren’t designed to produce generalizable knowledge in the regulatory sense; this is institution-specific rather than a blanket federal exemption, so check local policy rather than assuming it applies everywhere.

Conversely, surveys, interviews, and retrospective or secondary data analysis studies frequently do need review (often at the exempt or expedited level) precisely because they involve identifiable private information or direct interaction with people, even when they feel low-risk. “Minimal risk” affects which pathway applies, not whether review is required at all.

One further scope note: IRB/REC review covers human-subjects research specifically. Research involving live vertebrate animals is reviewed by a separate committee — in the US, the IACUC (Institutional Animal Care and Use Committee) — under a different regulatory framework. The two committees, and the two approval numbers, are not interchangeable.

How long approval actually takes

Timelines vary substantially by institution, IRB workload, and how complete the initial submission is, so treat any number here as a general planning range, not a commitment. Reported ranges commonly cited by university research-compliance offices: exempt determinations often complete within roughly one to four weeks; expedited review often runs four to six weeks; full board review is commonly budgeted at six to eight weeks or more, since it depends on the board’s meeting schedule and often requires revisions before final approval. Multi-site studies add coordination time on top of whichever pathway applies. Building in buffer time before a grant start date or data-collection window is standard practice, and resubmission cycles after requested revisions are the most common reason a review takes longer than the stated range.

Approval is also not indefinite. Under the pre-2018 rules, essentially all approved protocols needed continuing (annual) re-review; the 2018 Requirements narrowed that — some expedited and all exempt categories no longer require continuing review, but most expedited and full-board-reviewed protocols still do, on an interval the IRB sets (often annual). Research generally may not begin before approval (or an exemption determination) is issued — retroactive approval for research already underway is not how the framework is designed to work, and institutions that discover unapproved human-subjects research underway typically treat it as a reportable compliance issue rather than something to simply backdate.

What a protocol submission contains

Every institution’s application format differs, but a complete initial IRB/REC submission almost always includes: a description of the research protocol itself (objectives, design, procedures, and population); the informed consent document(s), or a justification for why consent should be waived or altered; any recruitment materials (flyers, scripts, advertisements); data security and privacy protections for how identifiable information will be collected, stored, and eventually destroyed or de-identified; and, where relevant, investigator conflict-of-interest disclosures and any collaborating-site or reliance information for multi-site research. Missing or inconsistent elements — consent language that doesn’t match the population, recruitment materials that describe a different procedure than the protocol — are the most common reason a submission gets sent back before substantive review even starts. See CASRAI’s guide to writing a research protocol for IRB submission and the IRB application for what to include and why submissions get bounced.

Modifications and reportable events after approval

Approval isn’t a one-time event for non-exempt research. Two distinct after-approval processes apply once a study is underway:

• Modifications (amendments) — any change to an already-approved protocol (a new procedure, a change to the consent form, a new recruitment site, added personnel) generally needs IRB review and approval before it’s implemented, except where a change is necessary to eliminate an immediate hazard to subjects. See CASRAI’s guide to amending an IRB-approved protocol and the comparison of protocol amendments vs. administrative changes for which changes need prior review and which don’t.
• Reportable events — unanticipated problems involving risks to subjects or others, serious or continuing noncompliance, and certain protocol deviations generally have to be reported to the IRB on a defined timeline, separate from the routine continuing-review cycle. See CASRAI’s guide to IRB noncompliance and unanticipated-problem reporting for what must be reported, by whom, and on what timeline.

IRB determination vs. exemption determination — why they get conflated

Two distinct things are routinely described with the same casual phrase, “IRB approval”:

• An IRB determination is the outcome of the IRB (or its authorized designee) reviewing a submission and deciding which of three things applies: the study doesn’t meet the regulatory definition of human subjects research at all, it qualifies for an exemption, or it needs expedited or full board review. This determination step happens for every submission, including ones that turn out to be exempt.
• An exemption determination is one specific possible outcome of that review — a finding that the study qualifies for one of the 45 CFR 46.104(d) exemption categories and is therefore exempt from most of the Common Rule’s ongoing requirements (continuing review, in particular). It is still a formal, documented determination made by an authorized reviewer; a researcher cannot self-declare a study exempt.

The practical confusion this causes: researchers sometimes assume “exempt” means “no IRB involvement was needed,” when in fact a reviewer had to make that exemption call in the first place. Conversely, some assume any project involving people automatically needs full committee review, when many qualify for exempt or expedited review instead. Both the initial determination and (if applicable) the specific exemption category should be documented and kept on file — a project number or determination letter, not just an informal email.

How the process differs across institution types

• Academic/university IRBs review the bulk of federally funded and student/faculty-initiated human-subjects research, typically under an institution-wide Federalwide Assurance (FWA) with OHRP.
• Hospital and health-system IRBs often review a mix of federally funded research, FDA-regulated clinical investigations, and institution-initiated clinical studies — commonly navigating both the Common Rule and FDA’s 21 CFR 50/56 for the same protocol.
• Independent (commercial) IRBs — for-profit boards contracted by a study sponsor or by institutions without the capacity to run their own — are common for industry-sponsored multi-site clinical trials, reviewing the same protocol once on behalf of many participating sites.
• Single IRB (sIRB) for multi-site research — since January 25, 2018, NIH policy has required a single IRB of record for the domestic sites of NIH-funded multi-site studies using the same protocol, specifically to cut the delay of each site separately re-reviewing an identical protocol. The 2018 Revised Common Rule extended a version of this expectation to Common Rule-covered multi-site research more broadly.
• Outside the US, review runs through the applicable national or institutional REC framework instead — for example, in the UK, the Health Research Authority (HRA) combines NHS Research Ethics Committee review with study-wide governance assessment through a single application (via IRAS), rather than the FWA/OHRP model used in the US. Committee composition, review categories, and timelines all differ from the Common Rule framework — don’t assume US terminology (exempt, expedited) transfers directly.

Tracking IRB/REC approval status in institutional systems

Most of what’s written about IRB approval online stops at “how do I get it.” The part that matters just as much for a research office, and is largely absent from generic explainers, is what happens to that approval status after it’s granted — because it doesn’t live in one place, and it changes state over time (approved, modified, expiring, lapsed, closed).

Operationally, protocol-level compliance data (protocol number, approval date, expiration date, continuing-review due date, current status) typically lives inside a dedicated electronic IRB/REC submission system — commercial and institutional eIRB platforms are common in the market alongside locally built systems. That system is usually separate from the institution’s research information system / CRIS (Pure, Symplectic Elements, InfoEd, Converis, and similar RIM platforms — see CASRAI’s CRIS and RIM entries) and separate again from grants management and financial systems. A protocol can lapse in the eIRB system without that fact automatically reaching the project record a grants office, a funder-reporting workflow, or a publication-submission system relies on. This is a real, unresolved interoperability gap, not a solved problem with a name — informatics research specifically on eIRB systems and their integration with adjacent clinical-research-informatics systems has been comparatively limited relative to other parts of the research lifecycle.

The standards path that does exist points in a specific direction: anchor compliance status to the same persistent identifiers already used to model the project elsewhere, rather than treating the eIRB system as an island. CASRAI’s own Dictionary already models this pattern for grants and CRIS records — a Project (CRIS) record, ideally carrying a persistent Project ID (RAiD-anchored) (RAiD, ISO 23527), gives a stable join key that a compliance status, a grant record, a publication, and a repository deposit can all reference without needing direct point-to-point integrations between every pair of systems. The mechanics for that kind of exchange — CRIS interoperability via CERIF, OAI-PMH, and PID-based joins — are the same mechanics already used to move research-output metadata between institutional CRIS platforms and national/funder aggregators.

There is a real, currently-in-development standard specifically for the IRB side of this: HL7 International’s Single IRB (sIRB) Implementation Guide, built on FHIR, defines standardized Questionnaire/QuestionnaireResponse exchange (and an optional ResearchStudy resource) so that IRB submission forms and review outcomes can move between a central reviewing IRB and participating sites electronically instead of as ad hoc PDF packets — directly targeting the coordination burden the NIH sIRB mandate created. As of this writing it remains a Trial-Use (STU) implementation guide under active development, not a finalized normative standard, and it’s scoped to the IRB-to-site exchange problem specifically rather than the broader eIRB-to-CRIS/grants-system gap described above. It’s still the clearest sign that standards bodies recognize IRB approval data as something that needs to move between systems in a structured way, not just live in a single institution’s submission portal.

The practical takeaway for a research office building or evaluating systems: treat “IRB/REC approval status” as project-level metadata that should be able to travel with a persistent project identifier, the same way funder award numbers and ORCID iDs already do, rather than as a fact that only exists inside the eIRB system’s own login. Where an institution’s eIRB platform can export or expose protocol status via an API, mapping that export to the project’s RAiD (or equivalent persistent project ID) is the concrete step that closes part of the gap today, ahead of any single system-to-system standard reaching general adoption.

Frequently asked questions

What is IRB approval?

IRB approval is a formal determination by an Institutional Review Board that a research study involving human subjects meets the applicable regulatory criteria for protecting participants — informed consent, an acceptable risk/benefit balance, equitable subject selection, and (where applicable) protections for vulnerable populations — before the study may begin, or after review that it qualifies for an exemption from most of those ongoing requirements.

Which studies need IRB approval?

Any project that meets the Common Rule’s two-part test — it’s “research” designed to produce generalizable knowledge, and it involves obtaining data through interaction/intervention with living people or their identifiable private information — needs an IRB determination, even if that determination turns out to be “exempt.” The determination itself has to be made by an authorized reviewer, not assumed by the investigator.

Do surveys need IRB approval?

Usually yes, at least a determination — surveys typically involve interaction with living people and often collect identifiable or potentially identifiable information. Many qualify for exempt or expedited review rather than full board review, but “it’s just a survey” is not itself a basis for skipping the determination.

Do quality improvement projects need IRB approval?

Generally not, if the project is genuinely intended only to improve a local process and there’s no intent to produce generalizable knowledge. If the project is later written up for publication with generalizable claims, that shift can bring it back into IRB/REC scope — worth flagging to the compliance office before, not after, submission.

Do case reports need IRB approval?

Single-patient case reports are often treated as outside the regulatory definition of human-subjects research, but many institutions and journals still require documented ethics-office sign-off, patient consent, or a privacy authorization/waiver for identifiable clinical details. Policy varies — check both your institution’s and the target journal’s requirements.

How long does IRB approval take?

It depends heavily on the pathway and the institution: commonly cited ranges run from roughly one to four weeks for exempt determinations, four to six weeks for expedited review, and six to eight-plus weeks for full board review, with resubmission cycles after requested revisions being the most common source of delay beyond those ranges.

What’s the difference between an IRB and a REC?

They perform the same core function — reviewing research involving people for ethical acceptability before it proceeds — but “IRB” specifically denotes the US committee operating under the Common Rule (and, for FDA-regulated research, 21 CFR 56), while “REC” is the more general international term used in the UK and elsewhere, typically operating under a different national legal framework with its own categories and timelines.

What are the criteria for IRB approval?

Under 45 CFR 46.111, the IRB must find that risks are minimized and reasonable in relation to benefits, subject selection is equitable, informed consent will be sought and documented, data monitoring and privacy/confidentiality protections are adequate where appropriate, and additional safeguards are in place for any vulnerable subjects. Exempt determinations are checked against a narrower, category-specific test instead.

What’s the difference between an IRB determination and an exemption?

A determination is the IRB’s decision about which review pathway applies (not human subjects research, exempt, expedited, or full board); an exemption is one specific possible outcome of that determination. Every submission gets a determination — exempt studies aren’t skipping IRB involvement, they’re receiving a specific type of determination.

Does IRB training expire, and who needs it?

Most institutions require investigators and study staff to complete human-subjects research training (commonly CITI Program modules) before a study can be approved, and require periodic renewal, often every 1–3 years depending on the institution’s policy. See CASRAI’s guide to CITI Human Subjects Research training for the biomedical vs. SBE tracks and renewal cycles.

What counts as human subjects research?

A project meets the regulatory definition when it’s both “research” — a systematic investigation designed to develop or contribute to generalizable knowledge — and involves a “human subject”, meaning a living individual an investigator obtains data about through intervention, interaction, or identifiable private information. See CASRAI’s guide to human subjects research under 45 CFR 46.102 for the full definitional test.

Related CASRAI Dictionary terms

IRB (Institutional Review Board) · REC (Research Ethics Committee) · Common Rule (45 CFR 46) · Informed consent · IACUC (Institutional Animal Care and Use Committee) · Fundamental research exemption · CRIS · RIM · Project (CRIS) · Project ID (RAiD-anchored) · CRIS interoperability · Exempt human subjects research · Human subjects research: definition under 45 CFR 46.102 · The IRB application · Amending an IRB-approved protocol · IRB noncompliance & unanticipated-problem reporting · CITI Human Subjects Research training · Federalwide Assurance (FWA) · Federalwide Assurance: Obtaining and Renewing · The Belmont Report principles and how they apply in practice