What Is an Institutional Review Board (IRB)?

An Institutional Review Board (IRB) is a formally constituted committee, required under US federal regulation, that reviews, approves, requires modification of, or disapproves any research involving human subjects before that research may begin — and continues to oversee it for as long as it runs. The IRB is the mechanism that stands between a researcher who wants to study people and the people being studied: it exists to check, independently of the investigator running the study, that the risks to participants are minimized, reasonable relative to what the research might learn, and that participants are told what they’re agreeing to before they agree to it. No IRB approval, no enrollment — that’s true whether the study is a multi-site oncology trial or a short survey run by a single graduate student.

Why the IRB Requirement Exists

IRBs exist because researchers, however well-intentioned, are not a reliable check on their own research. The regulatory system in place today in the United States is a direct response to documented cases where investigators pursued scientific questions at real cost to the people enrolled in the study, without any outside body positioned to say no. Rather than leave that judgment to the researcher alone, US policy requires an independent committee — with no stake in whether the particular study goes forward — to review the plan before anyone is enrolled.

That committee doesn’t evaluate scientific merit in the way a journal peer reviewer or a funding-agency study section does (though weak science can itself be an ethical problem, since it exposes people to risk for no compensating benefit). Its job is narrower and more specific: minimize risk, weigh risk against benefit, protect the consent process, and pay closer attention when the people being studied are less able to protect themselves.

Who Needs IRB Review

Two overlapping federal regulatory tracks require IRB review, and a given study can fall under either or both:

• The Common Rule (45 CFR 46). The general federal policy governing human-subjects research that is conducted or funded by any of the federal departments and agencies that have adopted it. An institution formalizes its commitment to follow the Common Rule through a Federalwide Assurance (FWA) filed with HHS’s Office for Human Research Protections (OHRP).
• 21 CFR Part 56. FDA’s parallel IRB regulation, which applies to clinical investigations supporting an FDA product application — an IND, IDE, or related submission — regardless of whether the study receives any federal funding at all. A drug or device trial run entirely on industry money still needs IRB review under this track.

Because the two tracks trigger on different things — funding source versus FDA product jurisdiction — a single study is often subject to both at once (an NIH-funded drug trial, for example), in which case both sets of requirements have to be independently satisfied. A study that is neither federally funded nor FDA-regulated may still require IRB review if the researcher’s own institution has voluntarily extended its policies to cover it, which is common at universities and academic medical centers.

What an IRB Actually Reviews

A typical initial submission to an IRB includes the research protocol itself, the informed consent document (or a justification for why consent or its documentation should be waived), any recruitment materials such as flyers or advertisement scripts, the data collection instruments, and information about the investigators’ qualifications and conflicts of interest. The IRB is checking that risks are minimized by good design, that the risk-benefit balance is reasonable, that subject selection is equitable, that consent will genuinely be sought and documented, and — where the population is one that’s vulnerable to coercion or undue influence, such as children, prisoners, or people with impaired decision-making capacity — that extra safeguards are built in. Approval isn’t a one-time event either: most studies carry ongoing obligations for amendment review before a protocol change takes effect, and for reporting unanticipated problems that raise new risk.

The Three Review Pathways

Not every protocol goes in front of a full committee meeting. Which pathway a study takes is a determination the IRB makes, not something an investigator can decide for themselves:

• Exempt. Research that fits one of the categories set out at 45 CFR 46.104 — certain low-risk educational research, some anonymous survey or interview work, specified secondary use of existing data — is exempt from the Common Rule’s general review requirements. The exemption determination is still made by the IRB or another designated official, never self-certified by the researcher. CASRAI’s full breakdown of exempt categories 1 through 8 covers exactly which studies qualify and why.
• Expedited. Research that is no more than minimal risk and fits one of the federally enumerated expedited categories (minor blood or specimen collection, data collected through noninvasive procedures already routine in clinical practice, certain survey and interview research, and similar low-risk activity) can be reviewed by the IRB chair or a chair-designated experienced reviewer under 45 CFR 46.110, without waiting for a convened meeting. That reviewer can exercise every authority of the full board except one: they cannot disapprove a study. Disapproval requires full-board review.
• Full board (convened) review. Research that carries more than minimal risk, or doesn’t fit an expedited category, must go before a convened meeting under 45 CFR 46.108 — a majority of members present, including at least one non-scientist member, with approval requiring a majority vote of those present.

Informed Consent’s Role

Consent isn’t a separate process that happens to run alongside IRB review — it’s one of the specific things the IRB is checking. Under 45 CFR 46.116, the IRB has to confirm that consent will genuinely be sought (voluntary, in language the participant can understand, disclosing what a reasonable person would want to know) and that it covers the required elements: purpose and procedures, risks, benefits, alternatives, confidentiality, and a statement that participation is voluntary. Documentation of that consent — the signed form itself — is regulated separately, under 45 CFR 46.117, which is why an IRB can sometimes waive the signed-form requirement (for instance, minimal-risk research where a signature would be the only thing linking a participant’s name to the study) without waiving the underlying obligation to actually obtain informed consent.

Where This Comes From: The Belmont Report and the Common Rule

The current US framework traces back to the Belmont Report (1979), issued by the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. Belmont set out three ethical principles — respect for persons, beneficence, and justice — and translated them into three concrete applications that still structure IRB review today: informed consent, assessment of risks and benefits, and fair selection of subjects. Those principles were later codified into federal regulation as the Common Rule (45 CFR 46), first adopted in 1991 and substantially revised in 2018. The IRB itself is the operational mechanism the Common Rule created to put Belmont’s principles into practice on every individual protocol, rather than leaving them as abstract guidance.

IRB vs. Adjacent Concepts

“IRB” gets used loosely, and a few distinctions are worth being precise about:

• IRB vs. IEC / REC / REB / HREC. “IRB” is the US term. The same functional role — independent ethics and scientific review of human-subjects research before it starts — goes by different names in different countries: REC (Research Ethics Committee) in the UK, REB (Research Ethics Board) in Canada, HREC (Human Research Ethics Committee) in Australia, and IEC (Independent Ethics Committee), the term ICH’s Good Clinical Practice guideline uses broadly across jurisdictions. None of these bodies operate under identical regulations, but they occupy the same structural position in the research-oversight process. A multinational trial typically needs review from the appropriate body in every participating country, not just IRB approval in the US.
• IRB vs. IACUC. An IACUC (Institutional Animal Care and Use Committee) is the parallel oversight body for research involving live vertebrate animals, not human subjects — a genuinely separate committee, separate regulations (the Animal Welfare Act and PHS Policy rather than the Common Rule), and a separate approval a study needs if it involves animal subjects instead of, or alongside, human ones.
• IRB vs. HIPAA. These are two independent legal regimes that frequently apply to the same study at once. The Common Rule and FDA’s human-subjects regulations govern IRB review and consent to participate in research; HIPAA’s Privacy Rule separately governs use and disclosure of protected health information by a covered entity, independent of participation consent. A combined consent-and-authorization form is common in practice, but the two underlying approvals remain legally distinct. See CASRAI’s What Is HIPAA? guide for the privacy side of that pairing.
• IRB review vs. Good Clinical Practice. ICH’s Good Clinical Practice standard is the broader quality framework a clinical trial is run under — protocol conduct, data handling, monitoring, safety reporting — and IRB/IEC review is one specific, non-negotiable component of it. See CASRAI’s What Is Good Clinical Practice? guide for how the two fit together.

A Special Pathway: Humanitarian Use Devices

IRB review looks a little different for a Humanitarian Use Device (HUD) — a device intended for a rare condition, cleared through FDA’s Humanitarian Device Exemption (HDE) pathway on a lower evidentiary bar than standard premarket approval. Because an HDE device hasn’t been shown effective in the way a normally-approved device has, the IRB takes on a heavier role: for most uses, local IRB approval is required at each institution before the device can be used there at all, functioning as an ongoing local check that a standard 510(k) or PMA clearance doesn’t need in the same way. CASRAI’s Humanitarian Use Device (HUD) and HDE: IRB Approval guide walks through that process in full.

Who Deals With This in a Research Organization

IRB requirements touch more roles than just the investigator submitting a protocol. Research compliance staff and IRB coordinators manage the submission, review, and continuing-review workflow itself. Regulatory affairs staff track which regulatory track (or both) a given study falls under and keep the institution’s FWA and IRB registration current. Principal investigators and study teams are the ones actually held to the approved protocol and consent document day to day — a protocol amendment needs IRB sign-off before it takes effect, not after. And in clinical and lab settings, anyone responsible for how a study is physically run — specimen handling, device use, equipment operation — is working inside boundaries the IRB-approved protocol already set, even if they never interact with the IRB directly.

Go Deeper: CASRAI’s IRB Library

This page is a starting point. CASRAI’s existing library covers the mechanics in more depth:

• IRB (Institutional Review Board) — the reference-length definition, with membership requirements, approval criteria, continuing review, and single-IRB reliance arrangements covered in full.
• IRB Approval: Review Types, Process, and Timelines — a step-by-step walkthrough of what actually gets submitted, reviewed, and returned.
• IRB Exempt Categories 1-8 — the full breakdown of which studies qualify for exemption under 45 CFR 46.104, and why.
• Humanitarian Use Device (HUD) and HDE: IRB Approval — the special-case pathway covered above, in full.
• The Human Subjects Protection & Research Ethics hub — every CASRAI page on this topic, organized in one place.

Frequently Asked Questions

Does a quality-improvement project need IRB approval?

Not automatically. The regulatory trigger for IRB review is whether an activity meets the definition of human-subjects research intended to produce generalizable knowledge. A quality-improvement project designed only to improve a specific institution’s own practice, with no intent to publish or generalize findings beyond that setting, commonly falls outside IRB jurisdiction — but that determination should be made by the IRB or an institutional official, not assumed by the project team, since QI and research can shade into each other in practice.

How long does IRB review take?

Federal regulation sets no fixed timeline, so it varies by institution and by review pathway: exempt and expedited determinations are typically faster because they don’t wait for a convened meeting, while full-board review is bound to the committee’s own meeting schedule. Institutional IRB offices publish their own typical turnaround expectations, and incomplete submissions are the most common cause of delay.

What happens if research proceeds without IRB approval?

Consequences run from the institutional to the regulatory. Internally, unapproved human-subjects research is typically halted and can trigger a formal noncompliance review. Where FDA-regulated research is involved, FDA can decline to rely on data collected without initial and continuing IRB oversight, which can jeopardize the underlying application the data was meant to support.

Is IRB approval only required for federally funded research?

No. FDA-regulated research needs IRB review under 21 CFR Part 56 regardless of funding source, and many institutions voluntarily extend Common Rule-equivalent protections to all the human-subjects research they conduct, not just the portion that’s federally funded or supported.