Do You Actually Need IRB Review? A Decision Guide for First-Time Researchers

One of the most anxiety-producing moments in graduate school is the first time an advisor says "you'll need to start your IRB." That sentence raises more questions than it answers. Does a pilot interview with two classmates count? What about a program evaluation at the nonprofit where you work? What if the data already exists in a public repository? The Common Rule (45 CFR 46) provides a specific, answerable decision framework, but institutions rarely teach it in advance — students usually encounter it inside the application portal, at which point the learning curve gets expensive. This guide walks the decision the way a regulator would, so you know what category your project falls into before you fill out a single form field.

What Is an IRB, and Why Does It Exist?

An Institutional Review Board (IRB) is a committee that reviews research involving human subjects to ensure it meets ethical and regulatory standards. IRBs exist because of documented harms. The Tuskegee Syphilis Study withheld effective treatment from Black men for forty years. The Willowbrook hepatitis studies infected institutionalized children. The US Public Health Service Guatemala experiments deliberately exposed prisoners and psychiatric patients to sexually transmitted infections without consent. These were funded, published, and defended by their principal investigators.

The National Research Act of 1974 created the commission whose 1979 Belmont Report articulated three principles: respect for persons, beneficence, and justice. Those principles became federal regulation through 45 CFR 46, revised in 1991 as the Common Rule — the common human-subjects policy shared across fifteen federal agencies. The 2018 Revised Common Rule updated exemption categories, redefined "human subject," introduced broad consent for future secondary research, and removed continuing review for many minimal-risk studies. Make sure any guide you read cites the post-2018 version.

An IRB's statutory job under 45 CFR 46.111 is narrow: confirm that risks are minimized, reasonable in relation to benefits, that participant selection is equitable, informed consent is sought and documented, data safety is adequate, and privacy is protected. It is not evaluating whether your research question is interesting or your theoretical framework is sound. It checks the ethics envelope around the study.

IRB approval is required before human subjects research begins. Starting data collection first and seeking approval after — even for "just a pilot" — makes the data unusable and creates a compliance incident.

The Two Questions That Decide Everything

Federal regulations define two terms that govern whether an IRB is involved at all:

1. Is your project "research" as the Common Rule defines it?
2. Does it involve "human subjects" as the Common Rule defines them?

You need a "yes" to both. If either is "no," you do not need IRB approval — although most institutions require a determination letter on file confirming the project falls outside IRB jurisdiction.

Is it "research"?

45 CFR 46.102(l) defines research as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." Two phrases carry the weight: systematic investigation and generalizable knowledge. Systematic means defined methodology and structured data collection. Generalizable means intent to inform people beyond the local setting through publication, presentation, or dissemination.

Activities explicitly not research under the post-2018 Common Rule include scholarly and journalistic activities focused on specific individuals, public health surveillance, criminal justice or intelligence activities, and national security operations. In practice, the commonly encountered "not research" categories are:

• Quality improvement (QI) projects intended only to improve local operations.
• Program evaluation used internally to decide whether a program continues.
• Classroom exercises where findings are not disseminated beyond the course.
• Oral history and journalism in most configurations.
• Public health surveillance authorized under public health authority.
• Needs assessments used for local program planning.

The fault line is intent. A needs assessment your health department uses to plan programming is evaluation. The same instrument with intent to publish as a contribution to the literature is research. Common edge case: a clinician runs a local QI project, then decides six months later that the findings are publishable. At the moment the intent shifts, the activity becomes research, and IRB review must be obtained before the data can be used.

Does it involve "human subjects"?

45 CFR 46.102(e) defines a human subject as a living individual about whom an investigator obtains information or biospecimens through intervention or interaction, or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.

Four words do the heavy lifting. "Living" — research on deceased individuals is not human subjects research (though HIPAA may still apply). "Identifiable" — if the data cannot readily be re-identified by anyone on the research team, it may not meet the definition, but indirect identifiers (zip code + age + rare condition) can render a nominally de-identified dataset re-identifiable. "Private information" — information about behavior in a context where an individual can reasonably expect no observation, or information provided for specific purposes expected not to be made public. "Intervention or interaction" — changing the participant's environment or communicating with them.

Public observation of public behavior often falls outside the definition. But "public" is narrower than most students assume. A public tweet from a verified account is arguably public speech. A post in a closed Facebook group for survivors of domestic violence is private information even if the group is nominally searchable. When in doubt, ask.

The "Do I Need IRB Review?" Decision Flow

    Is the activity a systematic investigation designed to
    contribute to generalizable knowledge?
                    │
         ┌──────────┴──────────┐
         │                     │
        No                    Yes
         │                     │
   Not research.         Does it involve human subjects
   IRB not required      (interaction/intervention OR
   (but get a            identifiable private info)?
   determination                │
   letter).            ┌────────┴────────┐
                       │                 │
                      No                Yes
                       │                 │
                 Not human            IRB REVIEW
                 subjects             REQUIRED → choose
                 research.            review category

If you land at "IRB review required," the next decision is which category. Each has its own statutory criteria, reviewer, timeline, and documentation burden.

The Three Review Categories

Exempt Review

Projects that qualify for exemption meet one of the eight narrow categories defined at 45 CFR 46.104(d):

1. Research in established educational settings on normal educational practices.
2. Educational tests, surveys, interviews, or observation of public behavior where subjects cannot readily be identified, disclosure would not reasonably place subjects at risk, or the IRB conducts a limited review.
3. Benign behavioral interventions with adults who prospectively agree, limited to verbal, written, or audiovisual media, and brief, harmless, and not physically invasive.
4. Secondary research on identifiable private information or biospecimens where the information is publicly available, recorded without identifiers, or regulated under HIPAA.
5. Federal research on public benefit or service programs.
6. Taste and food quality evaluation involving wholesome foods or approved additives.
7. Storage or maintenance of identifiable private information for potential secondary research, with broad consent (added 2018).
8. Secondary research use of identifiable private information with broad consent (added 2018).

"Exempt" does not mean "skip IRB." The IRB — not the researcher — makes the determination. Typical turnaround: 1–3 weeks.

Expedited Review

Expedited review applies to minimal-risk research that does not qualify for exemption. "Minimal risk" means harm no greater than what participants encounter in daily life or routine examinations. The nine expedited categories:

1. Clinical studies of drugs or medical devices where an IND is not required or the device is cleared for its intended use.
2. Blood samples by finger stick, heel stick, ear stick, or venipuncture within volume limits from healthy adults.
3. Prospective collection of biological specimens by non-invasive means (hair, saliva, sputum, urine).
4. Non-invasive clinical procedures routinely employed in practice (MRI, EEG, ultrasound, ECG).
5. Materials collected for non-research purposes (data, documents, records, pathological or diagnostic specimens).
6. Voice, video, digital, or image recordings made for research purposes.
7. Research on individual or group characteristics or behavior — cognition, perception, identity, communication, cultural beliefs, employment — including surveys, interviews, focus groups.
8. Continuing review of previously approved research where no additional risks have been identified.
9. Continuing review of minimal-risk research not fitting categories (2)–(8).

Expedited reviews are conducted by the IRB chair or a designated reviewer, not the full board, and submit on a rolling basis. Typical turnaround: 2–6 weeks.

Full Board Review

Full board review is required for research that is more than minimal risk, involves vulnerable populations, uses deception without adequate debriefing, or involves drugs or devices under an IND/IDE. Subpart B governs research with pregnant individuals, fetuses, and neonates. Subpart C governs research with prisoners and requires specific IRB composition. Subpart D governs research with children, distinguishing four levels of permissible research with different consent and assent requirements.

The full convened IRB meets monthly at most institutions. Submission deadlines are typically 3–4 weeks before the meeting. A clean submission with minor revisions can close in 6–8 weeks. A submission that generates substantive revisions and goes back to the full board can easily run 10–16 weeks. Realistic timeline: 6–12 weeks minimum, with 3–6 months common for complex protocols.

Common Scenarios, Quickly Decoded

"I want to interview five classmates for a methods course assignment." Not research (classroom exercise, no dissemination). No IRB needed.

"I am running a program evaluation at the nonprofit where I work, and I will not publish it." Not research. IRB not required.

"I am running that same evaluation and want to write it up as a thesis." Now it is research. IRB required. Likely exempt or expedited.

"I am surveying anonymous adults online about workplace experiences." Research involving human subjects. Often exempt under 46.104(d)(2).

"I am interviewing nurses about burnout and recording audio." Research involving human subjects — voice is an identifier. Typically expedited under category 7.

"I am analyzing a fully de-identified public dataset released by NCHS." Likely not human subjects research. Request a determination letter.

"I am studying minors in a school setting with parental consent." Research involving a vulnerable population (Subpart D). Expedited or full board depending on risk.

"I am conducting community-based participatory research with a tribal community." Research involving human subjects. Tribal IRB approval may be required in addition to your institutional IRB, and data sovereignty agreements govern what can be published.

"I am writing an autoethnography of my own graduate school experience." Autoethnography analyzing only your own experience is generally not human subjects research. The moment you include identifiable data from others — advisors, peers, family — those others become subjects and review is required.

"I am conducting oral history with Vietnam-era veterans for a book." Oral history designed to create a historical record of specific individuals — not to contribute to generalizable knowledge about a population — is typically not research under 46.102(l)(1). Get a determination letter.

"I am analyzing archival records from a closed hospital with patient names redacted." If truly de-identified with no team member able to re-identify, not human subjects research. If not, likely exempt under 46.104(d)(4).

"I am analyzing public Twitter posts about vaccine hesitancy." Gray zone. Large-N aggregate analysis is often treated as not human subjects research; verbatim quotes that re-identify users usually require exempt review. Ask.

"I am evaluating whether my clinic's new intake protocol reduces wait times, and I plan to present at a national QI conference." Local QI posters usually remain QI. Peer-reviewed publication with intent to inform practice elsewhere is research. Many institutions have QI-vs-research determination forms for exactly this case.

"I am running a multisite international study with partners in Kenya and Brazil." Research involving human subjects. US IRB, Kenyan NACOSTI, and Brazilian CONEP/CEP approval all required, on different timelines. Plan 6–12 months for full ethics clearance.

When in doubt, submit a determination request, not a guess.

Special Situations to Flag Early

• Secondary data analysis. Check identifiers, data use agreements, and original consent scope. Reusing identifiable data beyond the original consent is a problem, particularly for clinical trial data.
• Social media research. The 2018 Common Rule did not resolve the gray zone. Most IRBs treat public posts cautiously and private group posts as private information. Reproducing verbatim quotes is treated more strictly.
• Community-based participatory research. Community consent, individual consent, and data-sharing agreements all apply. Tribal communities often operate their own IRBs with data sovereignty provisions.
• International research. US IRB approval is necessary but not sufficient. In-country ethics approval is also required. Some countries have foreign-researcher registration requirements that add months.
• FDA-regulated research. Drugs, devices, and biologics trigger 21 CFR 50, 21 CFR 56, and 21 CFR 312 requirements your IRB coordinates.
• Research with minors. Subpart D distinguishes minimal risk (46.404), greater than minimal risk with direct benefit (46.405), greater than minimal risk with no direct benefit but generalizable knowledge about the subject's disorder (46.406), and otherwise-not-approvable research requiring federal review (46.407). Structure is parental permission plus child assent.
• Deception research. Requires justification and adequate debriefing. Full board review is typical.

A Pre-Submission Checklist

A clean IRB application starts well before the portal opens:

1. Finalize your research question and design. Most IRB revisions are requested because the protocol is methodologically vague, not because of ethics issues. Use a research question builder and a theoretical framework builder to tighten the study first.
2. Confirm your category determination. Work the two-question decision, then the three-category decision, on paper. If unclear, submit a determination request first.
3. Complete CITI training for your institution's required modules — typically 6–10 hours. The free research ethics course covers foundational material that makes CITI faster.
4. Draft the protocol and consent form. The protocol should read as a complete methods section: population, recruitment, procedures, instruments, data management, analysis, risks, benefits, confidentiality. The consent form generator produces a starting draft; the four principles of biomedical ethics provide the ethical frame underneath the consent language.
5. Build the supporting bundle. Recruitment materials, instruments, translated materials, letters of support, data use agreements.
6. Walk through a pre-submission checklist. The research ethics checklist catches confidentiality, data-security, and analysis-plan items IRBs most often flag.
7. Work through the decision tool and category pathway. For the institution-agnostic version of the decision tool, exempt/expedited/full-board protocol templates, and annotated consent-form walkthroughs, see IRB Ready, which walks through each category pathway with templates adapted to common study designs.

Bring the full bundle to your advisor before submitting. A thirty-minute review catches most issues that would otherwise generate revision requests.

What Happens If You Start Without IRB

Starting data collection before approval is a compliance incident, not a footnote.

• The data cannot be used. Findings collected without IRB approval cannot ethically be published or defended. Journals increasingly require IRB approval numbers and will retract papers if prior approval cannot be documented.
• Retrospective approval is rare and narrow. Some IRBs will issue a "noted for the record" letter for minor unauthorized preliminary work, but this is discretionary.
• Institutional reporting. The institution must report serious or continuing noncompliance to OHRP for federally funded work. This can trigger audits of other studies.
• Advisor and department consequences. Active grants can be frozen pending review. Your department's reputation with the IRB will affect future submission review times.
• Student consequences. Thesis defenses can be delayed, degree conferral held, and IRB noncompliance is reportable on many residency and licensure applications.

The fix is boring but effective: treat IRB submission as part of the research timeline, not an afterthought. Build four to eight weeks into your proposal calendar for review.

The Takeaway

IRB review is not a gatekeeping ritual. It is a structured check on a specific question: are participants protected, and is the risk justified by the knowledge the study will produce? The process feels opaque because the Common Rule is technical, but the decision framework is answerable. Work it in order. Is it research — a systematic investigation designed to contribute to generalizable knowledge? Does it involve human subjects — living individuals you interact with, or about whom you obtain identifiable private information? Which category fits the risk — exempt, expedited, or full board? Then submit the right application, not the one you guessed at.

The students who struggle most with IRB are not the ones with difficult protocols. They are the ones who treat submission as a writing task after the design is done, instead of an analytical task inside the design itself. Work the decision. Submit the right application. Get back to the research.

Related Guides

• Free Research Ethics Course — Foundational ethics training that complements CITI modules and clarifies the Belmont principles underneath the regulatory language.
• Free Consent Form Generator — Generate a starting consent draft aligned with 45 CFR 46.116 required elements.
• Free Research Ethics Checklist — Pre-submission review covering the items IRBs most often request revisions on.
• Four Principles of Biomedical Ethics — Beauchamp and Childress's four-principle framework, the ethical foundation underneath the regulatory scaffolding.