Ethical Considerations in Research with Human Participants: A Guide to IRB Approval

Researchers who plan to study human participants must obtain Institutional Review Board (IRB) approval before starting data collection. This approval process exists to protect the rights, welfare, and privacy of people who volunteer for research. The IRB reviews study protocols to ensure they meet ethical standards grounded in historical lessons about research abuses. This guide explains the ethical foundations of human subjects research, the types of IRB review, practical steps for preparing an application, and common pitfalls that delay or derail approval.

At a Glance: IRB Review Pathways and When They Apply

The table below summarizes the main categories of IRB review and the circumstances under which each applies. Note that specific thresholds and categories vary by institution and by the funding source of your research.

The distinction between these pathways matters for planning your timeline. Full board review typically takes longer than expedited review, and exempt determinations still require you to submit an application for the IRB to make that determination. You cannot self-designate your research as exempt without institutional confirmation.

The Historical Foundation of Human Subjects Protections

The current system of IRB oversight in the United States emerged from a long history of research abuses. Understanding this history helps researchers see why certain requirements exist and why reviewers ask specific questions about consent, risk, and vulnerable populations.

The atrocities committed by Nazi scientists and physicians during World War II represent one of the most extreme examples of unethical research. After the war, the resulting war crimes trials produced the Nuremberg Code, which established that voluntary consent of the human subject is absolutely essential. This principle became a cornerstone of subsequent research ethics frameworks.

Infamous cases in the United States also shaped the regulatory landscape. The Tuskegee Syphilis Study withheld treatment from African American men with syphilis to observe the natural progression of the disease, even after effective treatment became available. The Willowbrook study involved institutionalized children with intellectual disabilities who were deliberately infected with hepatitis. These cases demonstrated that even in democratic societies, researchers could exploit vulnerable populations without adequate oversight.

The Belmont Report emerged from this history and established three core ethical principles that continue to guide IRB review: respect for persons, beneficence, and justice. Respect for persons requires acknowledging the autonomy of research participants and protecting those with diminished autonomy. Beneficence requires maximizing possible benefits and minimizing possible harms. Justice requires fair distribution of the burdens and benefits of research.

The regulations that govern IRBs, including the Common Rule, trace their origins directly to these ethical principles. When you understand this history, you can see direct links between past abuses and the specific requirements in the regulations. For example, the emphasis on informed consent reflects the principle of respect for persons, while the requirement to minimize risks reflects beneficence.

Defining Human Subjects Research

Before you can determine which review pathway applies, you must first determine whether your project meets the regulatory definition of human subjects research. This determination shapes whether IRB review is required at all.

Research is generally defined as a systematic investigation designed to develop or contribute to generalizable knowledge. This includes surveys, interviews, behavioral experiments, clinical trials, and analysis of identifiable data. Activities that are not designed to produce generalizable knowledge, such as quality improvement projects or classroom exercises that stay within the classroom, may not meet this definition.

A human subject is a living individual about whom an investigator conducting research obtains data through intervention or interaction with the individual, or obtains identifiable private information. If you are collecting data from living people through surveys, interviews, or observations, you are likely working with human subjects. If you are analyzing existing data that is fully de-identified and cannot be traced back to individuals, the research may not involve human subjects under the regulatory definition.

Teaching students about the ethics of human subjects research should be a fundamental component of their education about research. Analysis of IRB websites at top-ranked liberal arts colleges in the United States shows that most provide information about undergraduate research, and most include information about classroom-based research. These institutions use their websites to inform and educate about issues including informed consent and to highlight resources for students such as their research advisor and disciplinary standards.

If you are uncertain whether your project meets the definition of human subjects research, contact your IRB office before submitting an application. Many IRB offices offer preliminary consultations to help researchers determine whether review is needed.

Core Ethical Principles in Practice

The three principles from the Belmont Report translate into specific practical requirements in your research protocol. Each principle has direct implications for how you design your study and what you include in your IRB application.

Respect for Persons and Informed Consent

Respect for persons requires that participants enter research voluntarily and with adequate information. This principle underlies the informed consent process. Participants must understand what the research involves, what risks they might face, what benefits might accrue, and that they can withdraw at any time without penalty.

The consent form is the primary tool for documenting that participants have been informed. However, the consent form itself has limitations. Scholars who have spent decades reviewing and editing consent forms on IRBs have noted that consent forms may not be the best method for ensuring that subjects are thoroughly informed about all aspects of the proposed research. The form is a document, but informed consent is a process that involves ongoing communication between researcher and participant.

For your IRB application, you should describe beyond what the consent form says, but how you will ensure participants understand it. This might include reading the form aloud, allowing time for questions, using plain language, or using comprehension checks for complex studies. The consent process should be tailored to the population you are studying and the complexity of the research.

Beneficence and Risk Minimization

Beneficence requires that you maximize possible benefits and minimize possible harms. In practice, this means you must identify all potential risks of your research, no matter how minor, and describe how you will minimize them.

Risks in human subjects research extend beyond physical harm. Psychological risks include stress, anxiety, or discomfort from sensitive questions. Social risks include potential embarrassment or stigma if data are disclosed. Economic risks include costs participants might incur. Legal risks include potential exposure to criminal or civil liability. Your IRB application should address each category of risk that applies to your study.

For research involving controlled human infection trials, where healthy participants are deliberately exposed to a pathogen, symptom burden is a significant consideration. Survey research comparing controlled human infection trial participants with phase I clinical trial participants found that those in infection trials experienced more severe symptoms and reported symptoms as an important factor in their decision to participate. Despite this, participation was a well-informed decision, with symptom burden taken into account. This finding suggests that when risks are significant, the informed consent process must give particular attention to helping participants understand what they might experience.

Justice and Fair Subject Selection

Justice requires that the benefits and burdens of research be distributed fairly. This principle has implications for who you recruit and who you exclude from your research.

Contemporary considerations of vulnerability in human research examine access to research opportunities, impacts on the consenting process, selection bias, and the generalisability of results. Using broad categories to treat cohorts of research participants as homogenous classes and label some participants as vulnerable merely because they are members of a particular class can strip individuals of their ethical equality. Labeling people as vulnerable does not help researchers develop an understanding of the complexities of applying the principles of respect and of justice in ethical decision-making.

Conversely, defining specific cohorts of research participants as needing nuanced ethical consideration may imply that other population groups need not be considered vulnerable. This assumption is erroneous. All research participants deserve careful ethical consideration, and vulnerability should be assessed in context instead of through a checkbox approach.

For your IRB application, you should explain why you are including or excluding specific groups. If you are excluding pregnant women, children, or non-English speakers, you should have a scientific justification. If you are including populations that might be considered vulnerable, you should describe the additional protections you will provide.

Types of IRB Review and Application Requirements

Understanding the differences between review pathways helps you prepare the right materials and plan your timeline. Each pathway has specific requirements and limitations.

Exempt Research

Exempt research involves minimal risk and fits specific regulatory categories. Common examples include anonymous surveys, educational tests, and analysis of existing de-identified data. The term exempt means the research is exempt from the full regulatory requirements, not that it is exempt from ethical consideration.

Even for exempt research, you must submit an application to your IRB. The IRB makes the exempt determination, and you cannot make this determination yourself. Your application should describe the research activities and explain which exemption category applies.

Expedited Review

Expedited review applies to minimal risk research that fits specific categories defined by federal regulations. The Food and Drug Administration has published categories of research that may be reviewed through an expedited procedure. These categories include collection of blood samples by finger stick or venipuncture, collection of data through noninvasive procedures, and research on individual or group characteristics or behavior.

Expedited review is conducted by one or more IRB members instead of the full board. This typically results in a faster decision than full board review. However, the reviewer still evaluates the same ethical considerations, including risk minimization, informed consent, and privacy protections.

Full Board Review

Full board review is required for research that presents more than minimal risk or that involves certain vulnerable populations. This includes clinical trials, research involving prisoners, and studies with invasive procedures. The full IRB reviews the protocol at a convened meeting, and approval requires a majority vote of the members present.

Full board review takes longer than expedited review because it must be scheduled around the IRB meeting calendar. If your research falls into this category, plan your timeline accordingly and submit your application well before your intended start date.

Preparing Your IRB Application

A complete IRB application typically includes several components. Preparing these materials carefully reduces the likelihood of revisions and delays.

The Research Protocol

The protocol is the core document that describes your research. It should include the research question, background and significance, study design, participant population, recruitment methods, consent process, data collection procedures, data security measures, and plans for data analysis.

For research involving artificial intelligence, the protocol should address unique risks. AI research shifts risk from individual research subjects to larger populations affected by AI-driven decisions and data handling. Traditional IRBs often struggle to keep pace with the non-linear and iterative nature of AI development, which can lead to gaps in risk assessment and delays in the review process. Supplemental questions added to the IRB process can serve as an efficient risk mitigation technique. These questions elicit information necessary to inform the review of AI proposals, including how the AI system was developed, what data it was trained on, and how its outputs will be validated.

A risk-based oversight model for AI research aligns ethical and regulatory review with a project's stage of maturity and potential human impact. By aligning the level and timing of IRB review with the types of risks present at each stage of AI system development, this approach supports appropriate regulatory pathways and documentation expectations while maintaining effective protection of human subjects.

The Consent Form

The consent form should be written in plain language that participants can understand. Avoid technical jargon and legalistic phrasing. The form should include the purpose of the research, what participants will be asked to do, potential risks and benefits, alternatives to participation, confidentiality protections, and contact information for questions.

The consent form should also address the possibility of incidental findings. Incidental findings are findings beyond the aims of the study that are of potential health or reproductive importance to the individual research participant. Researchers have an obligation to address the possibility of discovering incidental findings in their protocol and communications with the IRB, and in their consent forms and communications with research participants. You should establish a pathway for handling incidental findings and communicate that to the IRB and research participants.

Recruitment Materials

Recruitment materials include flyers, emails, social media posts, and scripts for in-person recruitment. These materials must be submitted to the IRB for review. They should accurately describe the research, avoid coercive language, and include contact information for the research team.

Data Security Plan

Your application should describe how you will protect participant data. This includes where data will be stored, who will have access, how data will be encrypted, and when data will be destroyed. For research involving sensitive information, you should describe additional protections such as data use agreements or certificates of confidentiality.

Managing Incidental Findings

Incidental findings present a particular challenge in human subjects research. These are findings beyond the aims of the study that are of potential health or reproductive importance to the individual research participant. Empirical studies document incidental findings in a wide range of research studies, including genetic and genomic research and imaging research.

No consensus yet exists on how to handle incidental findings in human subjects research. However, researchers have an obligation to address the possibility of discovering incidental findings in their protocol and communications with the IRB, and in their consent forms and communications with research participants. You should establish a pathway for handling incidental findings and communicate that to the IRB and research participants.

A recommended pathway categorizes incidental findings into those that must be disclosed to research participants, those that may be disclosed, and those that should not be disclosed. Findings that are clinically actionable and life-threatening typically fall into the must disclose category. Findings of uncertain significance may fall into the may disclose category. Findings that are not clinically actionable and could cause unnecessary anxiety may fall into the should not disclose category.

Your IRB application should describe your plan for handling incidental findings, including who will review findings, how participants will be notified, and what follow-up care will be offered. This plan should be developed in consultation with relevant clinical experts and should be communicated clearly in the consent form.

Special Considerations for Vulnerable Populations

Certain populations require additional protections in research. These include children, prisoners, pregnant women, individuals with cognitive impairments, and economically or educationally disadvantaged persons. The regulations specify additional requirements for research involving these populations.

However, the concept of vulnerability requires careful consideration. Using broad categories to treat cohorts of research participants as homogenous classes can strip individuals of their ethical equality. Labeling people as vulnerable does not help researchers or ethics committee members develop an understanding of the complexities of applying the principles of respect and of justice in ethical decision-making.

Instead of relying solely on categorical designations, consider the specific circumstances that might affect a participant's ability to make voluntary and informed decisions. A person with a serious illness might feel pressure to participate in research because they hope for therapeutic benefit. A student might feel pressure to participate in their professor's research because of the power dynamic. A person with limited income might be unduly influenced by payment for participation.

For each population you plan to include, describe the specific protections you will provide. This might include additional consent procedures, ongoing assent for children, or independent monitors for participants with cognitive impairments.

Compensation and Payment for Research Participation

Payment for research participation raises ethical questions about undue influence and coercion. Payment should be reasonable and should not be so high that it causes participants to overlook significant risks.

Research on compensated oocyte donation for stem cell research provides insights into participant motivations. In a nine-year program, women who participated in oocyte donation for research were contacted in a phone interview and completed a standardized questionnaire. Of 114 participants, 98 completed donation, donating 1787 mature oocytes and a total of 86 skin biopsies. The complication rate, including minor complications, was 8.1 percent. Participants were incentivized primarily by money and a desire to help others and reported an overall favorable experience.

Most, but not all, participants recalled that they had donated for research, and approximately half recalled that their oocytes were being used specifically for stem cell research. This finding highlights the importance of ensuring that participants understand the specific purpose of their donation, even when they are compensated.

In controlled human infection trials, reimbursement was a less prominent motivator compared to phase I clinical trials, with more altruistic factors reported. This finding suggests that participant motivations vary across research contexts and that payment should be calibrated to the specific study.

Your IRB application should describe your payment plan, including the amount, schedule, and method of payment. You should explain how the payment amount was determined and why it is not coercive. For research involving significant risks, you should describe additional safeguards to ensure that payment does not unduly influence participation decisions.

Multisite Research and Single IRB Review

Multisite research presents additional ethical and logistical challenges. Revisions to the Common Rule and NIH policy require the use of a single Institutional Review Board for the review of most federally funded, multisite research, with the intent of streamlining the review process.

However, since initial implementation, many IRBs and institutions continue to struggle with the logistics of implementing this requirement. Major barriers include new responsibilities for study teams, persistent duplicative review processes, the lack of harmonization of policies and practices across institutions, the absence of additional guidance from federal agencies, and the need for greater flexibility in policy requirements.

Addressing these problems requires providing additional resources and training to research teams, the commitment of institutional leaders to harmonize practice, and policymakers to critically evaluate the requirement and provide flexibility in applicability.

If your research involves multiple sites, plan for the additional time and resources needed to coordinate single IRB review. Identify the reviewing IRB early, understand its specific requirements, and build time into your timeline for the coordination process.

Common Failure Patterns in IRB Applications

Understanding common reasons for IRB revisions and delays helps you prepare a stronger application. The following patterns appear frequently across institutions.

Incomplete Risk Descriptions

Many applications fail to identify all potential risks or provide vague descriptions such as minimal risk without explaining why the risk is minimal. Reviewers need specific information about the likelihood and magnitude of each risk and the measures you will take to minimize it.

Inadequate Consent Processes

Applications often describe the consent form but not the consent process. Reviewers want to know how you will ensure participants understand the research, how you will handle questions, and how you will document consent. For research with non-English speakers, you should describe translation and interpreter services.

Insufficient Data Security Measures

Applications frequently provide vague descriptions of data security, such as data will be stored securely. Reviewers need specific information about where data will be stored, who will have access, how data will be encrypted, and when data will be destroyed.

Unclear Recruitment Plans

Applications sometimes describe recruitment methods that are coercive or that do not adequately protect privacy. For example, recruiting through a physician who will identify potential participants without their prior consent raises privacy concerns. Your recruitment plan should describe how potential participants will be identified and approached in a way that protects their privacy.

Failure to Address Incidental Findings

Many applications do not address the possibility of incidental findings, even when the research involves imaging or genetic testing. Reviewers increasingly expect researchers to have a plan for handling incidental findings, even if the plan is to not look for them.

Records and Documentation Requirements

Maintaining thorough records is essential for compliance with IRB requirements and for demonstrating that you have followed your approved protocol.

Required Records

Your records should include the approved protocol, the IRB approval letter, the approved consent form, and any approved recruitment materials. You should also maintain documentation of consent for each participant, including the date of consent and the version of the consent form used.

Protocol Modifications

Any changes to your approved protocol must be submitted to the IRB for review before implementation. This includes changes to recruitment materials, consent forms, study procedures, and data collection instruments. Minor changes may be reviewed through expedited procedures, while significant changes may require full board review.

Continuing Review

Most approved research requires continuing review at least annually. The IRB will send you a notice when your continuing review is due. You must submit a progress report describing the number of participants enrolled, any adverse events, any protocol deviations, and any new information that might affect the risk-benefit assessment.

Adverse Events

You must report any adverse events to the IRB according to your institution's policies. This includes serious adverse events, unexpected problems involving risks to participants or others, and protocol deviations that might affect participant safety.

Professional Escalation Criteria

Certain situations require you to escalate concerns beyond the IRB. These include situations where you believe a participant is in immediate danger, where you discover research misconduct, or where you have concerns about the ethical conduct of a colleague.

If you believe a participant is in immediate danger, contact emergency services first, then notify the IRB and your institution's research integrity office. If you suspect research misconduct, such as fabrication of data or failure to obtain consent, report your concerns to your institution's research integrity officer. If you have concerns about the ethical conduct of a colleague, you may also contact the Office of Research Integrity or a similar body.

Your institution should have policies describing how to report concerns and protecting whistleblowers from retaliation. Familiarize yourself with these policies before you need them.

Limitations of IRB Oversight

IRB oversight has limitations that researchers should understand. The system relies on self-reporting by researchers, and the IRB cannot monitor every aspect of ongoing research. Some research activities that fall outside of IRB review may still raise ethical concerns.

Concerns have been raised about significant resources committed to nonstudy interventions, some described as training, which fall outside of IRB review and its human subject protections. A broad initiative for evidenced-based research, particularly psychosocial and behavioral research, could become marginalized with limited resources redirected to technology-focused quick fixes and data collection during training.

Researchers should view IRB approval as the minimum ethical standard, not the complete ethical analysis. You should continuously evaluate your research for ethical issues and seek guidance when you encounter situations not addressed in your approved protocol.

Frequently Asked Questions

What is the difference between exempt and expedited review?

Exempt review applies to minimal risk research that fits specific regulatory categories, such as anonymous surveys or analysis of existing de-identified data. The research is exempt from the full regulatory requirements, but you must still submit an application for the IRB to make the exempt determination. Expedited review applies to minimal risk research that fits other specific categories, such as collection of blood samples by finger stick or moderate behavioral interventions. Expedited review is conducted by one or more IRB members instead of the full board and typically results in a faster decision.

How long does IRB approval take?

The timeline varies by review type and institution. Exempt determinations and expedited reviews may take a few weeks. Full board review takes longer because it must be scheduled around the IRB meeting calendar. For multisite research requiring single IRB review, additional time is needed for coordination. Plan your timeline accordingly and submit your application well before your intended start date.

Can I start my research before I receive IRB approval?

No. You must receive IRB approval before you begin any research activities, including recruitment, data collection, and pilot testing. Research activities conducted without IRB approval may be considered noncompliance and can result in serious consequences, including suspension of your research and disciplinary action.

What should I do if my research protocol changes after approval?

Submit a modification request to the IRB before implementing any changes. This includes changes to recruitment materials, consent forms, study procedures, and data collection instruments. Minor changes may be reviewed through expedited procedures, while significant changes may require full board review. Do not implement changes until you receive IRB approval.

How should I handle incidental findings in my research?

Develop a plan for handling incidental findings before you begin your research and include this plan in your IRB application. Categorize potential findings into those that must be disclosed, those that may be disclosed, and those that should not be disclosed. Communicate this plan to the IRB and to research participants through the consent form.

What are the requirements for informed consent?

Informed consent requires that participants enter research voluntarily and with adequate information. The consent form should include the purpose of the research, what participants will be asked to do, potential risks and benefits, alternatives to participation, confidentiality protections, and contact information for questions. The consent process should ensure that participants understand this information, which may involve reading the form aloud, allowing time for questions, or using comprehension checks.

How should I compensate research participants?

Payment should be reasonable and should not be so high that it causes participants to overlook significant risks. Describe your payment plan in your IRB application, including the amount, schedule, and method of payment. Explain how the payment amount was determined and why it is not coercive. For research involving significant risks, describe additional safeguards to ensure that payment does not unduly influence participation decisions.

What should I do if I have concerns about the ethical conduct of a colleague?

Report your concerns to your institution's research integrity officer or follow your institution's policies for reporting concerns. Your institution should have policies describing how to report concerns and protecting whistleblowers from retaliation. If you believe a participant is in immediate danger, contact emergency services first, then notify the IRB and your institution's research integrity office.

Related Articles

• Bioinformatics PhD Applications: Planning the Research Fit Process
• Responding to Peer Review: A Structured Revision and Response Process
• National Human Genome Research Institute: Leading the Genomic Revolution
• Research Ethics in Data-Intensive Biology: Questions to Ask Before Sharing
• Why Do Dogs Lick Human Feet? Behavioral Explanations and Health Considerations

References and Further Reading

• Research Data Framework. National Institute of Standards and Technology.
• EQUATOR Network. EQUATOR Network.
• Experimental Design Assistant. NC3Rs.
• NCBI Literature Resources. National Center for Biotechnology Information.
• PubMed. National Library of Medicine.
• Human Subjects Research Guidelines for Undergraduate Researchers: An Analysis of Institutional Review Board (IRB) Websites at Top Liberal Arts Colleges in the United States.. Journal of empirical research on human research ethics : JERHRE, 2023.
• The History of Human Subjects Research and Rationale for Institutional Review Board Oversight.. Nutrition in clinical practice : official publication of the American Society for Parenteral and Enteral Nutrition, 2021.
• Managing incidental findings in human subjects research: analysis and recommendations.. The Journal of law, medicine & ethics : a journal of the American Society of Law, Medicine & Ethics, 2008.
• Informed Consent Forms for Research with Human Subjects: Time to End the Charade.. American journal of law & medicine, 2024.
• Vulnerability in human research.. Monash bioethics review, 2020.
• Biobanking Research and Human Subjects Protections: Perspectives of IRB Leaders.. IRB, 2015.
• Compensating human subjects providing oocytes for stem cell research: 9-year experience and outcomes.. Journal of assisted reproduction and genetics, 2018.
• The need for reform of human subjects protections in military health research.. Military medicine, 2012.
• Motivations and experiences in controlled human infection trials vs. phase I clinical trials: a survey study.. 2026.
• Human-AI Interaction in Low- and Middle-Income Countries: Qualitative Study of How Local Human Factors Influence AI Development and Deployment.. 2026.
• Drawing lines: how the public defines "Serious" genetic conditions for reproductive testing.. 2026.
• Demystifying the IRB: Human Subjects Research in Academic Libraries. 2010.
• Streamlining IRB review of AI human subjects research (AIHSR): the three-stage framework. Frontiers in Systems Biology, 2026.
• Implementation of single IRB review for multisite human subjects research: Persistent challenges and possible solutions. Journal of Clinical and Translational Science, 2023.
• Demystifying the IRB: Human Subjects Research in Academic Libraries. 2010.
• Informing the ethical review of human subjects research utilizing artificial intelligence. Frontiers Comput. Sci., 2023.
• Undergraduate Research with Human Subjects: IRB Guidelines. Scholarship and Practice of Undergraduate Research, 2022.
• Human subjects issues and IRB review in practice-based research. Annals of Family Medicine, 2005.
• Protection of human subjects: categories of research that may be reviewed by the Institutional Review Board (IRB) through an expedited review procedure--FDA. Notice.. Federal Register, 1998.

This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.