How to Get IRB Approval for Research: Requirements, Steps, and Timelines

What is IRB Approval and Who Needs It?

You’ve designed a study. You know who you want to recruit. Now someone has told you it needs to go through the IRB first, and you’re not sure what that involves or how long it will take.

IRB approval is the formal review of human-subjects research by an Institutional Review Board, which decides whether a study meets applicable ethical and regulatory requirements. In most cases, you need that review before you recruit anyone or touch any identifiable data.

Surveys, interviews, clinical procedures, and chart reviews with identifiers usually fall under this requirement. Some projects don’t. They qualify as exempt, or the IRB decides they aren’t human-subjects research at all, and the process looks different. One more thing before we go further. “IRB approval” and “IRB certification” get used interchangeably, and they aren’t the same. That distinction has its own section below, because getting it wrong wastes weeks.

Timelines? They range from a few days to a couple of months. What drives that difference is covered later.

What is an Institutional Review Board?

An IRB is a committee that reviews research involving people. Its job is protecting the rights, safety, and welfare of participants. It is not judging whether your study is interesting.

You’ll find IRBs at universities, hospitals, health systems, and research organizations. Independent and commercial boards also exist, mostly serving researchers who don’t have an institutional home.

Composition varies, but boards generally include scientists, at least one non-scientist, and at least one member with no affiliation to the institution. That last requirement exists on purpose. A board made entirely of insiders tends to see risk the way the institution sees it.

The ethical framework behind all of this is the Belmont Report, which sets out respect for persons, beneficence and justice as the three principles every board applies. It is short and worth reading once.

Researchers often confuse IRB review with peer review. Peer review asks whether your study is well designed and worth publishing. The IRB asks a narrower question: are participants adequately protected, and does the study meet the applicable rules? A methodologically weak study can still be approved. A brilliant one can be rejected over consent problems.

What Does an IRB Review?

Reviewers work through:

• Risks to participants, and whether you’ve done what you reasonably can to reduce them
• Whether those risks make sense given the expected benefits
• Your consent process and consent documents
• Privacy protections and how you’ll keep data confidential
• How participants get selected and recruited
• Extra safeguards if you’re enrolling children, prisoners, pregnant women, or people with impaired decision-making capacity
• Data collection, storage, and security
• Compensation, and whether it’s high enough to be coercive
• Safety monitoring, when the study warrants it

Who Needs IRB Approval for Research?

Plenty of people assume the IRB is a university problem. It isn’t. Review may apply if you’re:

• A graduate student or university researcher
• A medical student, resident, or fellow running a project
• Faculty conducting academic research
• A clinical investigator or trialist
• Based at a hospital or health system
• Working in industry or pharma
• An independent researcher with no institutional affiliation
• Running surveys, interviews, or focus groups
• Analyzing an existing dataset that still contains identifiers
• Working with human biological specimens

Now the part that trips people up.

Not every project involving people needs full IRB approval. What matters is how your project gets classified. It might be human-subjects research requiring review. It might be exempt. It might be eligible for expedited review. Or your institution might determine it isn’t human-subjects research in the first place, which happens often with quality improvement projects, program evaluations, and some record reviews.

Record reviews sit right on that line. How to do a retrospective chart review covers what separates a chart audit for local practice from a study designed to produce generalizable knowledge, which is the distinction the IRB will apply.

That classification isn’t yours to make. Your IRB or designated office decides, and you want their answer in writing before you build a timeline around it.

Do I Need IRB Approval?

Four questions, in order.

Does your project meet the definition of research?

Research generally means a systematic investigation designed to produce generalizable knowledge. A chart audit meant only to improve care on your own ward usually doesn’t qualify. The same audit, written up for publication with conclusions aimed at practice elsewhere, often does.

Design decides this more than intent does. Cross sectional study design in medical research and what is quantitative research both cover what makes an investigation systematic in the sense the definition means.

Does it involve human subjects?

That means interacting or intervening with living people, or using their identifiable private information or biospecimens.

Is it exempt, or otherwise outside the review requirement?

Some anonymous surveys and analyses of publicly available de-identified data fall into defined exempt categories.

If review is required, at what level?

Full-board review applies to studies with greater than minimal risk, or those enrolling vulnerable populations. The entire committee reviews it at a scheduled meeting.

Expedited review covers minimal-risk studies fitting specific regulatory categories. One or two designated reviewers handle it, and no meeting is needed.

Exempt determination applies to minimal-risk work in defined categories. You still submit something. The review is just shorter.

A common mistake: assuming your study is exempt and skipping submission entirely. Almost every institution still requires you to submit so the IRB can confirm the exemption. You don’t get to self-certify.

What Are the IRB Requirements for Research Approval?

Requirements shift by institution, study type, and jurisdiction. The core package looks fairly similar across boards, though.

Documents You’ll Likely Need

• The research protocol
• A completed IRB application form
• Informed consent form or consent script
• Assent forms, if you’re enrolling minors
• Recruitment materials, flyers, emails, social posts, scripts
• Surveys, questionnaires, interview guides
• Data collection instruments or case report forms
• Your privacy and confidentiality procedures
• A data management and storage plan
• Investigator CV or biosketch
• Human-subjects training certificates for everyone on the team
• Funding and sponsor information
• Conflict-of-interest disclosures
• Site permission letters, if you’re collecting data somewhere you don’t work
• Translated documents where participants don’t read the primary language

Pull your own IRB’s checklist before you start drafting. Using last year’s template, or another institution’s, is a routine reason submissions come back.

Two items on that list are the ones most often missing or wrong. Sample size calculation for clinical research covers the justification reviewers expect in the protocol, and REDCap is the usual answer to the data management and storage plan.

What Reviewers Are Actually Assessing

They’re checking whether risks are minimized through the design itself, not just acknowledged. Whether those risks are reasonable against anticipated benefits. Whether participant selection is equitable, or whether you’ve defaulted to a convenient population that bears the burden without sharing the benefit. Whether consent will genuinely be informed and properly documented. Whether privacy holds up. And whether vulnerable participants have the additional protections the rules require.

Address each of these directly in your protocol, and you’ll cut a round of questions.

How to Get IRB Approval for Research

Step 1: Find Out Whether You Need Review

Don’t guess in either direction. Contact your IRB office or use its determination tool. Get the answer documented before you go further, a verbal “you’re probably fine” from a colleague is worth nothing if questions come up at publication.

Step 2: Identify the Right IRB

Where you submit depends on where the research happens and who you work for.

University boards handle academic research. Hospital and health-system boards cover clinical studies at that site. Commercial and independent IRBs serve unaffiliated researchers. And when several institutions are involved, you’ll usually need a reliance arrangement, where one board reviews for everyone and the others formally defer to it. Most multi-site studies now require this rather than parallel reviews at every site.

Step 3: Complete Your Training

Most institutions require human-subjects protection training before you can submit, usually through CITI Program or something similar. Everyone listed on the study team needs current certification, not just the PI.

Start this early. The full course runs several hours, certificates expire, and discovering that a co-investigator’s training lapsed two months ago is a frustrating way to lose a week.

Step 4: Write the Protocol

This is the document reviewers actually read. Cover:

• Research question and background
• Objectives
• Design and setting
• Population, with inclusion and exclusion criteria
• Sample size and recruitment approach
• What participants will actually do, step by step
• Risks, and your plan for minimizing them
• Anticipated benefits
• Data handling, storage, and security
• The consent process
• Analysis plan

The analysis plan needs to name the tests, not describe them generally. Which statistical test to use in medical research covers how outcome type and study design determine that choice.

Write it so a non-specialist can follow it. Your reviewers include people from outside your field, and a protocol dense with unexplained jargon generates questions that have nothing to do with ethics.

Step 5: Assemble Supporting Documents

Use the checklist above. Then read everything side by side.

If your protocol says the interview takes 30 minutes and the consent form says 45, that discrepancy comes back as a revision request. Inconsistency across documents is one of the most common and most avoidable delays.

Step 6: Submit

Submissions typically go through an electronic portal. Upload everything, confirm you received a submission acknowledgment, and note your protocol number.

Step 7: Respond to Questions or Requested Changes

The board can approve, request modifications, require further review, issue an exempt determination, or disapprove.

Modification requests are normal. They aren’t a verdict on your competence, and most approved studies go through at least one round. Respond quickly, answer every point specifically rather than generally, and mark what changed in each revised document so reviewers can find it.

Step 8: Wait for the Letter

Don’t recruit, don’t collect, don’t screen. Not until the approval or determination letter is in your hands.

Starting early is the one mistake with no fix. Data gathered before approval is often unusable, journals may refuse the manuscript, and the institution may record a formal noncompliance finding.

How Long Does It Take to Get IRB Approval?

There’s no universal answer. Turnaround runs from a few days to several weeks or longer, depending on review level, how complete your submission is, institutional workload, and whether revisions are needed.

Factor	Effect on timeline
Complete, consistent application	Faster
Missing or outdated documents	Slower
Exempt determination	Often fastest
Expedited review	Usually faster than full board
Full-board review	Tied to meeting dates
Required revisions	Adds days to weeks
Complex or high-risk research	Additional review steps
Vulnerable populations	Extra scrutiny, more time
Multi-site or reliance agreements	Administrative delay on top

One scheduling detail worth knowing. Full boards meet on a fixed calendar, often monthly, with submission deadlines a week or two ahead. Miss the deadline by a single day, and you wait for the next meeting. Check that calendar before you promise anyone a start date.

Build the whole timeline backwards from that meeting date, not forwards from today. Research year before residency covers how to sequence approval, data collection and submission inside a fixed window.

How to Get IRB Certification

People search this phrase, meaning three different things, which is why the answers online contradict each other.

IRB approval and IRB certification are not automatically the same. Depending on who’s asking, “certification” might mean:

Documentation that your study was approved: This is what journals, funders, and ethics committees usually want. It’s your approval letter.

A human-subjects training certificate: Something like a CITI Program completion certificate. This certifies you, not your study.

Institutional certification or registration: An organization registering its own IRB with a federal oversight body. Relevant if you’re setting up a board, not if you’re running a study.

Before you chase any of these, ask whoever requested “IRB certification” which one they mean. The three take completely different amounts of work.

Getting Proof of IRB Approval

Contact the board that reviewed your study and request the approval or determination letter. It should list the protocol title, IRB reference number, approval date, and review type. Save it. Journals routinely ask for it at submission, sometimes years after the study closed.

Can Independent Researchers Get IRB Approval?

Most guides assume you have a university behind you. If you don’t, here’s what changes.

University boards generally review only research connected to their own institution, so you can’t simply approach the nearest one. Your realistic options are an independent or commercial IRB, or a partnership with an institution willing to serve as the reviewing body.

Not every board takes every kind of study. Some focus almost entirely on clinical trials and industry-sponsored work, and a qualitative interview study may not fit their portfolio. Fees vary widely and can run into the thousands, which is worth budgeting for at the proposal stage rather than discovering later.

Settle your reviewing IRB before you collect anything. There’s no retroactive approval for data you already have.

Can I Get IRB Approval Without a University?

Yes, potentially. The route depends on your study design, the regulations that apply, and which board you approach. Contact independent IRBs directly, describe your study, and confirm they accept work like yours before you commit money or time.

What Happens After IRB Approval?

Approval isn’t a permission slip you file and forget. Your obligations continue for the life of the study.

Run the study as written. Use only the stamped, approved versions of consent forms and recruitment materials. Keep your records and signed consents organized. Submit an amendment for any change to the protocol, and wait for approval before implementing it. Report unanticipated problems and adverse events on your board’s schedule. Complete continuing review when required, and file a closure report when you’re done.

Protocol deviations without prior approval are among the most common compliance problems researchers run into, and they’re almost always accidental. Someone adds a question to a survey, or extends recruitment to a new site, without realizing it needed an amendment.

Why Does IRB Approval Take So Long?

Usually the application, not the board. The recurring causes:

• Incomplete submissions with sections left blank
• Missing or outdated consent documents
• Vague recruitment procedures
• Risks listed but not addressed
• Thin data security plans
• Contradictions between the protocol, consent form, and application
• Expired or missing training records
• Multiple revision rounds because responses were too general
• Complex populations or procedures needing extra scrutiny
• Sheer institutional volume, plus fixed meeting schedules

The takeaway is counterintuitive. The fastest application isn’t the shortest one. It’s the one that’s complete, internally consistent, and easy enough to evaluate that no reviewer has to write back asking what you meant.

IRB Approval Checklist

Frequently Asked Questions About IRB Approval

Q1. What is IRB approval?

 The formal decision by an Institutional Review Board that a human-subjects study meets applicable ethical and regulatory requirements and can proceed.

Q2. How long does IRB approval take?

 Anywhere from a few days to several weeks. Review level, submission quality, and institutional workload drive most of the variation.

Q3. Do all research studies need IRB approval? 

No. Studies without human subjects, and certain exempt categories, may not require full review. Your IRB makes that call, not you.

Q4. Can an independent researcher get IRB approval?

 Usually yes, through an independent or commercial board, or a partnering institution. Expect fees and confirm eligibility first.

Q5. What are the IRB requirements for research? 

Typically a protocol, application form, consent documents, recruitment materials, data instruments, a security plan, and current training certificates.

Q6. Is IRB certification the same as IRB approval? 

Not necessarily. The phrase can mean study approval documentation, researcher training, or institutional registration. Ask which one is wanted.

Q7. How do I get IRB certification?

 For proof of approval, request the letter from your reviewing IRB. For training certification, complete a human-subjects course such as CITI Program.

Q8. Can I start my research before IRB approval?

 No. Data collected beforehand is often unusable and can create compliance problems that follow the study through to publication.

Q9. What happens if my IRB application is rejected or requires changes?

 Change requests are routine. Address each comment specifically, revise the affected documents, and resubmit. Outright disapproval is uncommon and normally comes with a path to revise.

Disclaimer:

Articles published by American Academy of Research & Academics are prepared by our team using information from direct experience, publicly available resources, and educational references. AI tools may be used to assist with drafting, proofreading, and formatting; however, all content undergoes review and approval before publication.
The information provided is intended for educational purposes only. Requirements, policies, and processes may change over time. Readers should consult official sources for the most current information.