Research · 6 min read
What an Institutional Review Board Actually Approves
A committee has to agree a study may start before anyone is enrolled. The regulation says who sits on it, what it must determine, how often it must look again, and what it has to write down.
Key takeaways
- 21 CFR 56.102 defines board approval as a determination that a study may be conducted within stated constraints — a permission to proceed, not a scientific endorsement.
- Institution officials may add a further layer of review, but under 56.112 they may not approve research the board has not approved.
- Section 56.111 lists the determinations required for approval, covering minimized and reasonable risks, equitable selection, consent and its documentation, data monitoring, and privacy and confidentiality.
- Membership rules require at least five members, a scientific and a nonscientific voice, and at least one member unaffiliated with the institution; conflicted members may not participate in the review.
- Continuing review is required at least once a year, and an expedited reviewer may do anything the board can do except disapprove research.
- Board records must be kept at least three years after completion, and FDA may refuse to consider a study if inspection of those records is refused.
Answer first: it is a committee with a defined job and a defined vote
The definition is at 21 CFR 56.102(g). An institutional review board means any board, committee, or other group formally designated by an institution to review, to approve the initiation of, and to conduct periodic review of, biomedical research involving human subjects. The primary purpose of such review, the same definition says, is to assure the protection of the rights and welfare of the human subjects.
The regulation is careful about what approval means. Under 56.102(m), board approval means the determination that the clinical investigation has been reviewed and may be conducted at an institution within the constraints set forth by the board and by other institutional and federal requirements. It is a permission to proceed under stated constraints — not a scientific endorsement, and not a prediction about the result.
Section 56.109 gives the board its powers: it shall review and have authority to approve, require modifications in order to secure approval, or disapprove all research activities covered by the regulations. And 56.112 settles the direction of the relationship with the institution around it. Research approved by a board may be subject to further review and approval or disapproval by officials of the institution — but those officials may not approve research that the board has not approved.
So an institution can overrule a yes. It cannot overrule a no.
The determinations a board has to make before it can approve
Section 56.111 lists what a board must determine, and all of them must be satisfied. Risks to subjects are minimized, by using procedures consistent with sound research design that do not unnecessarily expose subjects to risk and, whenever appropriate, by using procedures already being performed for diagnostic or treatment purposes. Risks are reasonable in relation to anticipated benefits, if any, to subjects and to the importance of the knowledge that may be expected to result. Selection of subjects is equitable. Informed consent will be sought from each prospective subject or their legally authorized representative. Informed consent will be appropriately documented. Where appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects. And where appropriate, there are adequate provisions to protect the privacy of subjects and maintain the confidentiality of data.
The regulation then narrows the risk-benefit determination in a way that is worth quoting because it cuts against a common assumption. In evaluating risks and benefits, the board should consider only those risks and benefits that may result from the research, as distinguished from risks and benefits of therapies that subjects would receive even if not participating. And it should not consider possible long-range effects of applying knowledge gained in the research — for example, the possible effects of the research on public policy — as among the research risks within its responsibility.
There is an additional determination where the population is vulnerable. Where some or all subjects are likely to be vulnerable to coercion or undue influence — the regulation names children, prisoners, pregnant women, handicapped or mentally disabled persons, and economically or educationally disadvantaged persons — additional safeguards must have been included in the study to protect their rights and welfare.
Who has to be in the room
Section 56.107 sets a composition, and the specifics are more consequential than they look.
Each board must have at least five members with varying backgrounds. It must be sufficiently qualified through the experience and expertise of its members and their diversity — including consideration of race, gender, cultural backgrounds, and sensitivity to community attitudes — to promote respect for its advice and counsel in safeguarding subjects' rights and welfare. No board may consist entirely of members of one profession, and every nondiscriminatory effort will be made to ensure no board consists entirely of men or entirely of women.
Each board must include at least one member whose primary concerns are in the scientific area and at least one whose primary concerns are in nonscientific areas. And each must include at least one member who is not otherwise affiliated with the institution and who is not part of the immediate family of a person who is affiliated with it.
There is a conflict rule too: no board may have a member participate in the initial or continuing review of any project in which the member has a conflicting interest, except to provide information the board requests. Boards may invite outside experts to assist on complex issues, but those individuals may not vote.
The voting rule sits in 56.108(c). Except where an expedited procedure is used, the board must review proposed research at convened meetings at which a majority of members are present, including at least one member whose primary concerns are in nonscientific areas, and the research must receive the approval of a majority of those present.
Approval is not permanent, and there is a faster route for small things
Under 56.109(f), a board must conduct continuing review at intervals appropriate to the degree of risk, but not less than once per year, and has authority to observe or have a third party observe the consent process and the research itself.
Section 56.110 provides an expedited procedure, and its limits are the point. FDA publishes a list of categories of research that may be reviewed this way. A board may use the expedited procedure for research on that list found to involve no more than minimal risk, and for minor changes in previously approved research during the period of one year or less for which approval was authorized. Under that procedure, review may be carried out by the chairperson or by one or more experienced reviewers designated from among the members. Those reviewers may exercise all of the authorities of the board except one: they may not disapprove the research. A research activity may be disapproved only after review at a convened meeting.
Minimal risk has its own definition, at 56.102(i): the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.
The board can also stop a study. Under 56.113 it has authority to suspend or terminate approval of research that is not being conducted in accordance with its requirements or that has been associated with unexpected serious harm to subjects. Any suspension or termination must include a statement of reasons and be reported promptly to the investigator, appropriate institutional officials, and FDA.
What gets written down, and why that matters to anyone outside
Section 56.115 requires documentation, and the list is specific: copies of all research proposals reviewed, any scientific evaluations accompanying them, approved sample consent documents, progress reports submitted by investigators, and reports of injuries to subjects.
It also requires minutes in sufficient detail to show attendance, actions taken, the vote on those actions including the number voting for, against and abstaining, the basis for requiring changes in or disapproving research, and a written summary of the discussion of controverted issues and their resolution. Plus records of continuing review activities, correspondence with investigators, a list of members with degrees and any employment or other relationship to the institution, written procedures, and statements of significant new findings provided to subjects.
Those records must be retained for at least three years after completion of the research and must be accessible for inspection and copying by authorized FDA representatives. And 56.115(c) supplies the enforcement: FDA may refuse to consider a clinical investigation in support of an application for a research or marketing permit if the institution or the board that reviewed it refuses to allow an inspection.
For anyone reading a company's claims about a study, the useful conclusion is a limited one. Board approval establishes that a committee with a defined composition determined, before enrollment, that risks were minimized and reasonable, that selection was equitable, and that consent would be sought and documented. It does not establish that the study was well designed to answer a commercial question, and it says nothing at all about whether the drug worked.
Sources
- 21 CFR 56.102 — Definitions, and 21 CFR 56.107 — IRB membershipThe definitions of institutional review board, IRB approval and minimal risk; and the membership requirements including at least five members, varying backgrounds and diversity, at least one scientific and one nonscientific member, at least one unaffiliated member outside the immediate family of an affiliated person, the bar on a board consisting entirely of one profession or entirely of one sex, the conflicting-interest bar on participation, and the rule that invited outside experts may not vote.
- 21 CFR 56.108 — IRB functions and operations, and 21 CFR 56.109 — IRB review of researchThe board's authority to approve, require modifications in, or disapprove research; the quorum and majority voting rule at convened meetings including the required nonscientific member; and the requirement of continuing review at intervals appropriate to risk but not less than once per year, with authority to observe the consent process and the research.
- 21 CFR 56.110 — Expedited review procedures, and 21 CFR 56.111 — Criteria for IRB approval of researchThe scope of expedited review, the reviewer's exercise of all board authorities except disapproval, and the rule that disapproval requires a convened meeting; and the full list of determinations required for approval, the instruction to consider only risks and benefits resulting from the research and not long-range policy effects, and the additional-safeguards requirement for populations vulnerable to coercion or undue influence.
- 21 CFR 56.112 — Review by institution, 21 CFR 56.113 — Suspension or termination of IRB approval, and 21 CFR 56.115 — IRB recordsThat institution officials may not approve research the board has not approved; the board's authority to suspend or terminate approval for noncompliance or unexpected serious harm with reasons reported to the investigator, institutional officials and FDA; the list of records that must be kept including minutes recording votes for, against and abstaining and summaries of controverted issues; the three-year retention period and FDA access; and FDA's ability to refuse to consider an investigation if inspection is refused.
Frequently asked questions
What is an institutional review board?
Under 21 CFR 56.102(g), it is any board, committee or other group formally designated by an institution to review, approve the initiation of, and conduct periodic review of biomedical research involving human subjects, whose primary purpose is to assure the protection of subjects' rights and welfare.
What does the board have to decide before approving a study?
Under 21 CFR 56.111 it must determine that risks are minimized; that risks are reasonable in relation to anticipated benefits and the importance of the knowledge expected; that subject selection is equitable; that informed consent will be sought and appropriately documented; that where appropriate the plan provides for monitoring data to ensure safety; and that where appropriate there are adequate provisions for privacy and confidentiality.
Who has to be on the board?
At least five members with varying backgrounds. At least one whose primary concerns are scientific and at least one whose primary concerns are nonscientific. At least one member not otherwise affiliated with the institution and not in the immediate family of someone affiliated. No board may consist entirely of one profession, and a member with a conflicting interest may not participate in review of that project except to provide requested information.
How often must a board look at a study again?
At intervals appropriate to the degree of risk, but not less than once per year, under 21 CFR 56.109(f). The board also has authority to observe, or have a third party observe, the consent process and the research.
What is expedited review, and can it be used to reject a study?
It is a procedure under 21 CFR 56.110 for research on an FDA-published list found to involve no more than minimal risk, and for minor changes in already-approved research. A designated reviewer may exercise all the board's authorities except one: they may not disapprove the research. Disapproval requires review at a convened meeting.
Does board approval mean a drug works?
No. Approval is defined as a determination that the investigation has been reviewed and may be conducted within stated constraints. It is a permission to proceed based on subject protection, not a finding about effectiveness.