What Is an Institutional Review Board

By Kevin Fernando · Oct 13, 2026 · 9 min read

An institutional review board (IRB) is a committee that evaluates and approves research involving human subjects before data collection begins. It reviews study design, risks, informed consent procedures, and protections for participants to ensure the research meets ethical and regulatory standards under federal law.

An institutional review board (IRB) is a committee that reviews and approves research involving human subjects before data collection begins. It evaluates study design, participant recruitment, informed consent procedures, and safeguards against harm to ensure the research meets ethical standards and complies with federal law.

For researchers preparing to submit a study, an IRB review is a mandatory checkpoint. For anyone reading research that cites IRB approval, understanding what that approval means, and what it does not mean, shapes how you interpret the work. This guide explains what an IRB actually does, what triggers its involvement, and why the system exists.

What an institutional review board is

An institutional review board is a committee responsible for reviewing and approving research that involves human subjects. It operates under federal regulation, primarily the HHS rules at 45 CFR 46, which set minimum standards for research ethics and subject protection. The IRB's core function is to determine whether a proposed study adequately protects the people who participate in it before any data collection or intervention occurs.

Every IRB must have at least five members with varied professional backgrounds and expertise. This diversity ensures the committee can evaluate research from multiple angles: scientific rigor, ethical soundness, legal compliance, and community perspective. Members typically include scientists, non-scientists, and at least one person with no affiliation to the institution.

What research requires IRB review

Not all inquiry involving people requires IRB oversight. The key distinction is whether the work qualifies as "research" and involves "human subjects" under federal definitions. Research is a systematic investigation designed to develop or contribute to generalizable knowledge. A human subject is a living individual from whom researchers obtain data through intervention or interaction, or whose identifiable private information the researchers use.

This means a clinical trial requires IRB review. So does a survey of employees if their responses are linked to them. A journalist interviewing someone for a news story typically does not, because journalism is not research in the regulatory sense. A quality improvement project within a hospital may or may not, depending on whether it aims to generate knowledge beyond that institution or merely improve internal operations. IRBs make these boundary calls, and the answer affects whether a study can proceed.

Institutions that receive federal funding or hold a Federalwide Assurance (a formal commitment to the government) must ensure all nonexempt human subjects research conducted by their employees or agents receives IRB review. This creates a broad compliance requirement: if you work at a university or medical center, your study almost certainly needs IRB approval.

How an IRB evaluates a study

The IRB review process centers on a specific set of approval criteria written into federal regulation. The committee must determine that a study meets these standards before issuing approval. The evaluation covers three major dimensions: the balance of risk and benefit, the quality and voluntary nature of informed consent, and the adequacy of protections for vulnerable populations.

The review process begins when a researcher submits a protocol, a detailed plan describing the study's purpose, methods, participant recruitment, data handling, and safeguards. The IRB then determines which level of review is appropriate based on risk level.

Risk and benefit assessment

An IRB must determine that risks to participants are minimized by using sound research design that does not unnecessarily expose subjects to risk. This is not a judgment about whether risks exist; it is a check that the researcher has designed the study to keep harm as low as possible. If a study involves drawing blood, the IRB confirms the researcher uses sterile technique and appropriate needle sizes rather than leaving those details to chance. If a study involves sensitive questions about trauma, the IRB confirms the researcher has a protocol for supporting participants who become distressed.

The IRB must also determine that risks are reasonable in relation to anticipated benefits to participants and to the importance of the knowledge the research may produce. This risk-benefit judgment is not a simple calculus. A vaccine trial might expose participants to a small chance of side effects because the potential benefit to public health is substantial. A study of cosmetic preferences might involve no physical risk but still requires careful consent because psychological discomfort matters. The IRB weighs what is being asked of participants against what the research stands to accomplish.

Informed consent requirements

The IRB must determine that informed consent will be sought from each prospective subject or their legally authorized representative, in accordance with federal requirements. Informed consent means participants understand what the study involves, what risks and benefits they face, and that their participation is voluntary. It is not a single signature on a form; it is a process.

The IRB reviews the consent document to ensure it explains the research in clear language, describes what participants will do and for how long, discloses foreseeable risks and benefits, explains how data will be protected, identifies who to contact with questions or complaints, and states that participation is voluntary with no penalty for refusal. For vulnerable populations, children, pregnant people, people with cognitive impairments, the IRB confirms additional protections are in place, such as consent from a legally authorized representative or assent from the participant themselves.

Participant protection safeguards

The IRB ensures there are adequate provisions to protect participant privacy and maintain data confidentiality. This is especially important in studies involving sensitive topics such as substance use, mental health, sexual behavior, or criminal history. The IRB confirms the researcher has a plan to limit who can access data, how data will be stored and encrypted, when data will be destroyed, and whether anyone besides the research team can identify individual responses.

For research involving children, prisoners, pregnant people, or people unable to consent for themselves, the IRB applies heightened scrutiny. It confirms that risks are minimized and proportionate to benefits, that recruitment is fair, and that protections match the population's vulnerability. A study of medication side effects in teenagers requires different safeguards than a study of medication side effects in healthy adults.

How IRB decisions and ongoing oversight work

An IRB can render three types of decisions on a new protocol. The most common is approval, meaning the study meets all criteria and may proceed. The IRB also may issue a decision of modifications required to secure approval, which means the researcher must make specific changes, revising the consent form, adding a data security plan, limiting participant burden, and resubmit before the IRB grants final approval. The third option is disapproval, which occurs when the IRB determines it cannot approve the research and cannot describe modifications that would make it acceptable. Disapproval is uncommon because researchers and IRBs usually work through concerns iteratively.

The review timeline depends on complexity. Exempt determinations or expedited reviews typically take 1 to 3 weeks, while full board reviews usually take 4 to 8 weeks or longer. New minimal risk studies receiving expedited initial review are assigned a 2 year approval period.

Once a study is approved, the IRB does not disappear. Researchers must report any adverse events or unexpected harm to participants immediately. They must report changes to the protocol, such as a new recruitment site or modified eligibility criteria. They submit continuing review applications annually or at intervals set by the IRB. If a problem emerges, a participant is hurt, data is breached, or the researcher deviates from the approved protocol, the IRB can suspend or terminate the study.

Why IRBs exist and what they protect

The modern IRB system exists because of research abuses. The most notorious example is the Tuskegee Syphilis Study, conducted by the U.S. Public Health Service from 1932 to 1972. Researchers told men they had "bad blood" and enrolled them in a study claiming to treat it. In reality, the men had syphilis and were receiving no treatment; researchers wanted to observe the disease's progression. Even after penicillin became available as an effective cure, researchers withheld it from participants. The study continued for decades. Participants were never told they had syphilis or that treatment existed.

Public outcry over Tuskegee and other cases prompted Congress to pass the National Research Act in 1974. This law required institutions to establish IRBs and created the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. The Commission issued the Belmont Report on September 30, 1978, establishing three core ethical principles that remain the foundation of research oversight today: respect for persons (participants are autonomous agents deserving informed consent and special protection if they are vulnerable), beneficence (researchers should maximize benefit and minimize harm), and justice (the benefits and burdens of research should be distributed fairly).

IRBs exist to prevent a repeat of Tuskegee. They protect participants from being deceived, harmed without consent, or treated as means to an end rather than as people with rights. They hold researchers accountable to ethical standards before harm occurs.

Common IRB misconceptions

IRB oversight is sometimes misunderstood in ways that lead researchers to either underestimate its scope or mistakenly believe it guarantees outcomes it cannot control.

IRB approval is not a safety or efficacy guarantee

A common misreading is that IRB approval means a study is safe or will work as intended. IRB review does not assess scientific merit or predict whether a treatment will be effective. An IRB does not conduct a statistical power analysis or evaluate whether the sample size is sufficient to answer the research question. It does not review the study's scientific hypothesis or determine whether the research team is competent to carry it out. The IRB's mandate is narrower: it confirms that the research design protects human subjects ethically and that participants can make informed decisions about involvement.

A poorly designed study that will waste participants' time but cause them no harm can receive IRB approval. A scientifically brilliant study conducted by eminent researchers using proven methods will be disapproved if it does not adequately protect participants or obtain proper consent. IRB approval is an ethics checkpoint, not a quality assurance certificate.

IRB jurisdiction varies by institution and funding source

Different institutions apply IRB requirements differently. A study conducted at a university receiving federal funding must undergo IRB review. The same study conducted by a private company as internal market research may not, because the company has no Federalwide Assurance and the research is not federally funded. A study receiving a grant from the National Institutes of Health requires IRB approval; one funded entirely by a private foundation may not, depending on the funder's requirements and the researcher's institutional affiliation.

This creates a patchwork. The ethical principles, protecting participants, requiring informed consent, balancing risk and benefit, are universal. But whether and how rigorously they are applied depends on institutional policy, funding source, and the type of research. Before assuming a study required IRB review, the research context matters. Before assuming it did not, understanding the researcher's institution and funding sources matters too.

Where IRBs connect to the broader research ethics landscape

IRBs are the primary mechanism for human subjects protection in most academic and clinical settings, but they are not the only oversight mechanism researchers encounter. Data governance committees, privacy boards, and biosafety committees operate in parallel at many institutions, each with a specific mandate. A genetics study might require review by an IRB (to protect participants), a privacy officer (to safeguard genetic data), and a genetics committee (to address consent issues specific to genetic research).

Funded research also faces compliance review from the sponsor, whether a government agency, pharmaceutical company, or foundation. NIH grants require institutional assurance of IRB review. Industry-sponsored clinical trials are monitored by data safety monitoring boards separate from the IRB. International research may need approval from multiple IRBs if it involves partners in different countries.

For readers of research, seeing an IRB approval cited in a paper is important context. It means the study was designed with participant protection in mind and met federal ethical standards before it began. It does not mean the results are reliable, the conclusions are sound, or the findings will generalize to other populations. IRB approval is one check among many in the research process, a necessary but not sufficient foundation for good science.

Do this automatically

Evaluating whether a study qualifies for IRB review, assessing risks and benefits, verifying informed consent procedures, and documenting privacy safeguards requires institutional staff to review regulatory criteria, study protocols, and consent forms, a process that demands significant time investment across multiple reviewers and repeated submissions. Software systems can automate the screening of research proposals against federal definitions, flag potential gaps in risk mitigation or consent language, and track documentation requirements throughout the approval workflow. Academia research runs this kind of analysis end to end and cites every figure back to its original source, across as many subjects as you need, with Mimir attaching a citation to every figure. It will not write your paper for you. It gathers and cites the evidence; the argument stays yours, and deliberately so. Every plan includes it, including the free one.

Start your first report and run it on something you already know well.

This article is general information and research commentary. It is not professional advice, and it does not account for your particular circumstances.