What Is IRB Approval, and Why Does It Matter?
If your research involves people — surveys, interviews, experiments, observations, or even secondary data that can identify someone — there is a good chance you need ethical approval before you collect a single response. In the United States, that approval comes from an Institutional Review Board (IRB). In the UK it may be a Research Ethics Committee (REC); in India, an Institutional Ethics Committee (IEC); in Pakistan, an Institutional Review Board or Ethical Review Committee at your university or hospital. The names differ, but the job is the same: an independent group reviews your study to make sure participants are treated fairly, safely, and with respect.
Getting approval is not a formality or a rubber stamp. It is the step that protects your participants — and protects you. Journals routinely ask for your ethics approval number before they will publish your work, and universities can refuse to accept a thesis that was conducted without approval. A study run without the required approval can be unpublishable, no matter how good the results are.
The good news: the process is straightforward once you understand what reviewers actually check. This guide walks you through how to get IRB approval for research, step by step, so you can start data collection with confidence.
Do You Actually Need IRB Approval?
Not every project needs full review. Before you start the application, find out which category your study falls into. Most boards use three levels:
- Exempt review: Minimal-risk studies such as anonymous surveys of adults, analyses of existing public datasets, or classroom observation with no identifying information. “Exempt” does not mean you skip the board — it means the board confirms the exemption. You still submit an application.
- Expedited review: Minimal-risk studies that involve identifiers, sensitive topics, or vulnerable participants — for example, an interview study about mental health, or a survey collecting email addresses. One or two reviewers assess it instead of the full board, so it is usually faster.
- Full board review: Anything above minimal risk — clinical trials, research with children, studies involving deception, or research that could cause more than everyday discomfort. The full committee meets, discusses your protocol, and may ask for revisions.
Two common traps: first, assuming your study is exempt and skipping the application altogether — only the board can grant an exemption, not you. Second, assuming a project using “existing data” needs no review — if the data can identify people, or if it was collected without consent for research use, you probably still need approval.
How to Get IRB Approval: 7 Steps
Step 1: Complete the Required Ethics Training
Most institutions require researchers to complete an ethics training course before they can submit. The best-known is the CITI Program (Collaborative Institutional Training Initiative), which covers human-subjects protection, informed consent, and research with vulnerable populations. Your university may use its own course instead. Complete it early — the certificate is often valid for three years, and the board will ask for it with your application. If you have co-investigators or research assistants who will interact with participants, they usually need the training too.
Step 2: Write Your Research Protocol
The protocol is the document the board actually reviews. It describes your study in enough detail for a stranger to judge its risks and benefits. A solid protocol covers:
- Your research question and objectives
- Who your participants are and how you will recruit them
- Exactly what participants will be asked to do, and for how long
- What data you will collect and how you will store it
- The risks participants face and how you will minimize them
- What participants gain — and what the study contributes to knowledge
Write it in plain language. Board members come from different disciplines, and some are community representatives with no research background at all. If a non-specialist cannot understand your protocol, it is not clear enough.
Step 3: Prepare Your Informed Consent Form
Informed consent is the heart of research ethics: participants must understand what they are agreeing to before they agree to it. Under the ethical framework of the Belmont Report — respect for persons, beneficence, and justice — consent must be informed, voluntary, and given by someone competent to decide.
A complete consent form explains, in plain language:
- Purpose: what the study is about and why it is being done
- Procedures: what the participant will be asked to do, and how long it will take
- Risks: any discomfort, embarrassment, or risk — including the risk of a data breach
- Benefits: what the participant might gain, if anything, and what the research may contribute
- Confidentiality: how you will protect their identity and data, and who will see it
- Voluntariness: participation is entirely voluntary, and they can withdraw at any time without penalty
- Contacts: who to contact with questions about the study, and who to contact about their rights as a participant
For online surveys, consent is usually a short information sheet followed by a “click to agree” statement. For interviews and experiments, use a written form the participant signs — and give them a copy. Avoid jargon and legalistic language; aim for a reading level an average adult can follow easily.
Step 4: Prepare Your Recruitment Materials and Instruments
The board reviews everything participants will see: recruitment emails, flyers, social media posts, and your questionnaire or interview guide. Attach them all. Make sure the wording matches what your protocol says — if your flyer promises a $10 gift card, your consent form must say the same, and the protocol must budget for it.
Step 5: Submit Your Application
Most institutions use an online system (such as Cayuse, IRBNet, or a university-built portal). You will upload your protocol, consent form, instruments, recruitment materials, and training certificates, and answer a structured set of questions about risk. Double-check that every attachment is the final version — submitting a draft questionnaire is one of the most common reasons for delays. If your study involves another institution (a hospital, a school, another university), mention it; you may need approval from both boards or a reliance agreement.
Step 6: Respond to Reviewer Comments
First-time applications are very often returned with questions — this is normal, not a rejection. Typical reviewer requests include:
- Clarifying a procedure that is vague in the protocol
- Adding a risk you overlooked (for example, emotional distress from sensitive interview questions)
- Simplifying the consent form or adding a missing element, such as the right to withdraw
- Strengthening data protection — for example, explaining how survey data will be stored and when identifiers will be removed
Respond point by point, politely and completely. State what you changed, and where. A clear, cooperative response usually earns approval in the next round.
Step 7: Receive Approval — and Keep Following the Rules
Approval is not the end of ethics; it is the beginning of doing the study as approved. If you change your questionnaire, your sample, or your procedures, you must submit an amendment and wait for approval before using the change. Report adverse events — for example, a participant becoming distressed — promptly. Approval typically lasts for one year; longer studies need a continuing review. And keep your records: consent forms, approval letters, and correspondence should be stored securely for as long as your institution requires, usually several years after the study ends.
A Worked Example: A Survey Study on Student Stress
Imagine you are a master’s student planning a survey of 200 undergraduates about academic stress and sleep, using a short online questionnaire. Here is how the process looks in practice:
You complete CITI training and write a short protocol: 200 students recruited through a departmental email, a 10-minute anonymous online survey, no identifying data collected. The risk is minimal — the questions touch on stress, which could briefly remind someone of a difficult time, so you add a line in the survey linking to the university counselling service. Your consent page explains the purpose, the 10-minute time commitment, that participation is voluntary, and that no one can identify their responses.
You submit the application with the protocol, consent page, questionnaire, and recruitment email. Because the study is anonymous and minimal-risk, the board grants an exemption — but it still reviews your materials and asks you to add one sentence: how students can withdraw (by closing the survey before submitting). You add it, resubmit, and receive the exemption letter with an approval number. Total time: about two weeks. That number goes on your thesis and on any journal submission.
Common Mistakes That Delay Approval
- Starting data collection before approval. Even “just a pilot” with real participants needs approval first. Data collected without approval usually cannot be used.
- Copy-pasting a consent form from another study. Reviewers notice instantly when the study title, risks, or contact details do not match your protocol.
- Understating the risks. Saying “there are no risks” is almost never true. A survey about a sensitive topic carries a risk of emotional discomfort; a study collecting names carries a risk of a confidentiality breach. Name the real risks and explain how you will reduce them.
- Forgetting vulnerable participants. Children, prisoners, people with cognitive impairments, and employees asked about their workplace all need extra protections. If your participants include any vulnerable group, say so and explain the safeguards.
- Vague data-protection plans. “Data will be kept safe” is not a plan. Say where it will be stored, who can access it, whether it is encrypted, when identifiers will be removed, and when it will be deleted.
- Submitting a draft questionnaire. Every item the participants will see must be final. If you revise the questionnaire after approval, you need an amendment.
How Long Does IRB Approval Take?
It depends on the review level and your institution. Exempt determinations often take one to three weeks. Expedited reviews commonly take two to six weeks. Full board review can take one to three months, because the board meets on a fixed schedule and usually asks for revisions. Build this time into your research plan — a thesis timeline that starts data collection in the same week you submit the application is a timeline that will slip. Submit early, and submit complete: an incomplete application is the single biggest cause of delay.
Frequently Asked Questions
Do I need IRB approval for a class project?
It depends on your institution. Many universities exempt classroom projects that will never be published or presented outside the class, but some still require a review. Ask your instructor or the board — do not decide this yourself.
Can I collect data while my application is under review?
No. Data collection must wait until you have written approval or an exemption determination. Data collected early is usually unusable.
What if my study involves participants in another country?
You will typically need approval from your own institution and from an ethics committee in that country — or at least a letter of permission. International research raises additional issues, such as local consent norms and data-transfer rules, so flag it early.
Do I need consent for research using social media posts or public data?
Sometimes. Publicly available data may qualify for exemption, but “public” is contested — a post on a public forum is not the same as a private group, and people rarely expect their words to appear in a study. Ask the board rather than assuming.
What happens if I change my study after approval?
Submit an amendment describing the change and wait for approval before implementing it. Minor changes, such as fixing a typo in a survey item, are usually approved quickly; changes to the sample, procedures, or risks take longer.
The Bottom Line
Getting IRB approval is a skill, not an obstacle. Understand which level of review your study needs, write a clear protocol, prepare an honest consent form, attach everything participants will see, and respond to reviewer comments point by point. Do that, and the process is a few weeks of careful paperwork — and the approval letter that makes your thesis and your publication possible.