What Does An IRB Do?

What’s Happening

Here’s the thing: the IRB isn’t some optional advisory group. It’s actually a legal requirement under U.S. Department of Health and Human Services’ Office for Human Research Protections (OHRP) rules as of 2026. Think of it as the research equivalent of a referee—except instead of calling fouls, it’s protecting people from harm. The IRB enforces regulations like 45 CFR Part 46 and 21 CFR Part 56. Its job? To weigh study ambitions against participant safety by examining protocols, consent forms, recruitment materials, and risk-benefit analyses. High-risk studies—those involving vulnerable groups, medical interventions, or sensitive data—get the full board treatment with stricter oversight. And yes, the IRB doesn’t just approve studies; it keeps watching them long after that initial green light.

Step-by-Step Solution

1. Determine if your study requires IRB review.
   • Start by asking: “Does this count as research with human subjects?” Use OHRP’s definitions—if you’re collecting identifiable data or testing interventions, chances are it does. (Honestly, this is one of those cases where being overly cautious never hurts.)
   • If your work involves FDA-regulated products—think drugs, medical devices, or biologics—IRB approval isn’t just recommended, it’s mandatory under 21 CFR Part 56.
2. Choose the appropriate review pathway based on risk level.

   Review Type	Risk Level	Typical Timeline
   Exempt	No more than minimal risk (anonymous surveys, chart reviews)	About 2 weeks
   Expedited	Minimal risk only (simple blood draws, noninvasive imaging)	2–3 weeks
   Full (Convened)	Greater than minimal risk (interventions, vulnerable populations)	3–6 weeks or longer

   Now, don’t assume your study fits neatly into one category. The IRB might surprise you—especially when digital data collection gets involved. (Ever tried explaining Zoom consent to elderly participants? Yeah, that’s a thing.)

3. Prepare all required submission materials.
   • Log into your institution’s IRB portal—IRBNet, Cayuse IRB, or whatever system your university uses. Complete the application form there.
   • Gather your materials: protocol summary, informed consent forms, recruitment flyers, data collection tools, investigator brochure (if you’ve got one), and a solid risk-benefit analysis. Don’t skimp on the details—this isn’t the time to wing it.
   • If your study involves vulnerable groups—children, prisoners, cognitively impaired adults—you’ll need to explain why their inclusion is necessary and how you’ll protect them. The same goes for digital or remote data collection. Privacy isn’t just important here; it’s non-negotiable.
4. Submit through your institution’s IRB portal.
   • In your portal, click “New Study” > “Create Initial Submission.” Upload every document you’ve prepared. Double-check file names—nothing says “amateur hour” like a submission labeled “final_final_v3.docx.”
   • Follow your IRB’s formatting rules for consent forms and signatures. Some institutions want wet signatures; others accept e-signatures. Know the difference before you hit submit.
   • You’ll get a confirmation email with a reference number and next steps. Save this email. Lose it, and you’ll be hunting through your spam folder at 2 AM.
5. Address IRB feedback efficiently.
   • Expect comments within 5–10 business days. They’ll point out typos, unclear language, or gaps in your risk assessment. Respond using tracked changes or a formal response letter—no scribbled notes in the margins.
   • Resubmit through the portal with clear documentation of changes. Label each revision clearly—“Section 4.2, revised risk-benefit analysis” beats “fixed stuff” every time.
   • Avoid the trap of repeated minor edits. Consolidate all revisions into one clean submission. The IRB isn’t impressed by a flurry of tiny updates.
6. Receive final approval and maintain compliance.
   • Once approved, you’ll get a stamped consent form and an official approval letter. This isn’t just paperwork—it’s your golden ticket to start collecting data. Keep it somewhere safe.
   • Save every approval document. You’ll need them for grant reports, publications, and heaven knows what else. Digital copies are fine, but back them up.
   • Report any protocol deviations or adverse events to the IRB immediately. Even minor issues can snowball if ignored. The IRB isn’t the enemy here—it’s your safety net.

If This Didn’t Work

First, take a breath. Rejections sting, but they’re rarely personal. Start by checking the basics: Are all required fields filled out? Are the uploaded documents current? Common stumbling blocks include missing signatures, outdated consent templates, or risk-benefit justifications that read like they were written by a sleep-deprived grad student. (We’ve all been there.) Many institutions offer IRB office hours or pre-review services—use them. These folks can spot issues before you hit submit. For truly urgent studies, reach out to the IRB chair or compliance officer. But don’t assume you qualify for expedited review without confirming first. If your submission gets denied, revise based on feedback and resubmit. Appeals? They’re rare unless you’ve got new evidence that changes the game.

Prevention Tips

Start your application 6–8 weeks before you plan to collect data—especially if you’re aiming for a full-board review. That’s not just paranoia; it’s survival. Always use your institution’s pre-approved consent and recruitment templates. They exist for a reason. And yes, complete your human subjects training every three years. CITI Program is the gold standard here. Regulations evolve, particularly around digital health and remote data collection. Stay ahead of the curve. Finally, keep a detailed log of every submission, feedback, and revision. It’ll save your sanity during renewals or amendments. Trust me, future you will thank present you for not having to dig through three years of email threads to find that one approval letter.