Allied Health & Imaging · Independent exam preparation
Certified IRB Professional (CIP®) Exam Study Guide
Practise IRB review decisions on risk, consent, exemptions, vulnerable populations, reportable events, and institutional oversight for the US-focused CIP exam.
By CertMedbry · Updated 30 October 2026
Learn to distinguish research from other activities, choose an appropriate review pathway, evaluate consent and safeguards, and recognize events requiring institutional action. This selective guide develops 60 concepts across all three CIP domains. The official CIP Body of Knowledge/Content Outline defines the full examination scope; use its complete topic list and the official references alongside this guide.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which examination and professional pathway does this guide address?
This guide addresses PRIM&R’s Certified IRB Professional (CIP®) Exam, overseen by the Council for Certification of IRB Professionals. The handbook title, Certification Examination for IRB Professionals, refers to the same examination. The descriptive listing name Institutional Review Board Professional Certification does not identify a separate pathway. CIP assesses professional human research protection knowledge rather than nursing licensure or a clinical specialty.
Certified IRB Professional (CIP®) Exam · About the CIP® Council · Certification Examination for IRB Professionals: Candidate Handbook
How many questions are scored, and how long is the examination?
The examination contains 130 multiple-choice questions: 115 scored questions and 15 unscored pretest questions. The pretest questions are distributed throughout the examination and are not identified to candidates. The testing period is three hours.
CIP® Exam Resources · Certification Examination for IRB Professionals: Candidate Handbook
How is the examination delivered, and is it adaptive?
The examination is computer based and offered continuously at testing centers and through live remote proctoring. Notes and reference materials are prohibited. The official examination information does not identify the examination as computer adaptive; computer-based delivery alone does not establish adaptivity.
Certified IRB Professional (CIP®) Exam · CIP® Exam Resources
What item styles should candidates expect?
PRIM&R describes objective multiple-choice questions and expressly states that the examination does not use true/false questions, double negatives, or scenario-based questions. Specific regulatory citation numbers are not requested. The application vignettes in this guide are independent teaching exercises that strengthen regulatory reasoning; they do not reproduce the official examination’s wording or format.
Which blueprint and document dates apply?
The currently linked outline has a filename labeled 2025 and assigns Human Subjects Protection 29%, IRB Responsibilities 54%, and Institutional Responsibilities 17%. It states no separate effective date. The linked handbook is dated June 12, 2025; the references document was updated September 23, 2025. These document dates are not interchangeable with an outline effective date.
CIP® Exam Body of Knowledge/Content Outline · Certification Examination for IRB Professionals: Candidate Handbook · CIP® Exam References and Resources
How does this guide distribute its learning material?
The guide contains 17 Human Subjects Protection concepts, 33 IRB Responsibilities concepts, and 10 Institutional Responsibilities concepts. The questions and flashcards each contain 6, 11, and 3 items in those domains, respectively. These allocations approximate the official weights. Sixty concepts provide a selective foundation rather than exhaustive coverage of the official outline.
Which jurisdictions and versions of requirements should candidates study?
CIP focuses on human subjects research review under United States rules and regulations. The official references also identify international ethical standards, including Nuremberg, Helsinki, CIOMS, and ICH GCP E6. PRIM&R excludes pending draft guidance and outdated pre-2018 Common Rule questions. Individual institutions’ additional policies are not tested. Study the complete reference list, including FDA pathways, HIPAA, FERPA, and PPRA, rather than assuming Common Rule knowledge covers everything.
Who is eligible, and what passing-score claim is supported?
PRIM&R describes a minimum of 24 months of qualifying full-time experience within the preceding seven years, with duties substantially involving IRB activities. Candidates must satisfy the detailed eligibility requirements. The official examination information cited here does not establish a numerical passing score. A published historical passing rate describes candidate outcomes and must not be treated as the percentage of questions required to pass.
Certified IRB Professional (CIP®) Exam · CIP® Exam Resources
The CIP is a professional credential for people substantially involved in IRB operations within a human research protection program. These independently authored learning materials support preparation for PRIM&R’s US-focused examination and are not official examination questions or a prediction of passing.
Outline used: Current officially linked CIP Body of Knowledge/Content Outline, filename labeled 2025; no separate effective date stated in the outline. Cross-checked against the currently linked Candidate Handbook dated June 12, 2025, and Exam References and Resources updated September 23, 2025. Verified October 12, 2026. The workbook label 'Institutional Review Board (IRB) Professional Certification (CIP)' maps to PRIM&R's Certified IRB Professional (CIP®) Exam; the assigned slug is preserved.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
Human Subjects Protection29%
1.Why is voluntary consent central to the Nuremberg Code?
The Nuremberg Code treats voluntary consent as essential to human experimentation. The person must have legal capacity, freedom from coercion, and enough knowledge and comprehension to make an informed decision. Disclosure must address the experiment’s nature, purpose, duration, methods, reasonably expected hazards, and effects on health. The discriminating issue is meaningful, freely exercised choice: obtaining a signature does not establish that the person understood the experiment or could refuse without pressure.
Apply it
A supervisor recruits employees into an experiment during mandatory performance meetings. Even with a detailed consent form, the educator identifies a voluntariness problem and recommends recruitment that separates employment evaluation from the participation decision.
Common pitfall: Treating a signed document as complete ethical protection overlooks comprehension and freedom of choice. The historical Code also should not replace current regulatory analysis.
2.When should an experiment stop under the Nuremberg Code?
The Nuremberg Code assigns stopping responsibilities to both participants and investigators. A participant should be free to end participation when continuing becomes physically or mentally impossible. The scientist must be prepared to terminate an experiment when professional judgment indicates that continuation is likely to cause injury, disability, or death. These protections operate during the experiment, showing why an initially acceptable consent decision cannot justify continuing exposure after important conditions change.
Apply it
An experiment produces a pattern of serious injuries that was not anticipated. The investigator argues that every participant consented to risk. The educator explains that prior consent does not eliminate the investigator’s independent obligation to stop dangerous experimentation.
Common pitfall: Relying entirely on participants to withdraw transfers the investigator’s protective responsibility to people who may lack the information needed to recognize emerging danger.
3.How does respect for persons shape research decisions?
Belmont’s respect for persons combines recognition of autonomous choice with protection for people whose autonomy is diminished. Its consent framework emphasizes information, comprehension, and voluntariness. The practical question is whether this particular person can understand the decision and exercise meaningful choice under the actual circumstances. Additional protection should respond to the source of diminished autonomy without automatically excluding everyone who belongs to a broad social or diagnostic category.
Apply it
An adult understands a low-risk interview study when information is explained slowly in familiar language. The reviewer supports an accessible consent process rather than assuming that limited literacy alone makes the person incapable of deciding.
Common pitfall: Equating limited education with incapacity can unnecessarily deny autonomous choice. Respect also requires protection when a person’s decision-making ability actually is impaired.
4.How does beneficence guide assessment of research risk?
Belmont’s beneficence requires efforts to avoid harm, maximize possible benefits, and minimize possible harms. Review therefore examines both the design’s scientific value and whether its procedures impose avoidable burdens. A study cannot justify unnecessary exposure simply by invoking an important research question. Distinguish benefits to individual participants from the value of knowledge to society, and examine the probability and magnitude of physical, psychological, social, legal, and economic harms.
Apply it
A protocol adds a painful research procedure even though an existing clinical specimen can answer the same question. Applying beneficence, the reviewer asks the investigator to use the less burdensome scientifically adequate approach.
Common pitfall: Assuming that a socially valuable question justifies every proposed procedure skips the separate obligation to minimize avoidable risks before weighing remaining risks against benefits.
Read the Belmont Report · 45 CFR 46.111: Criteria for IRB approval of research
5.Which recruitment patterns raise Belmont justice concerns?
Justice concerns the fair distribution of research burdens and benefits. Selection should reflect the research question and relevant circumstances rather than investigators’ convenience, a population’s easy availability, or its limited ability to refuse. Both unfair inclusion and unjustified exclusion deserve scrutiny. The key clue is a mismatch between who bears research burdens and why that population was selected, particularly when a disadvantaged group is recruited for benefits expected mainly elsewhere.
Apply it
A study recruits only economically disadvantaged clinic patients because recruitment is inexpensive, although the question applies to the wider community. The reviewer asks for a scientific justification and a fairer selection strategy.
Common pitfall: Calling recruitment efficient does not establish equitable selection. Conversely, excluding an entire disadvantaged population can deny fair access when participation is scientifically appropriate and adequately protected.
6.How do international ethical standards fit US regulatory review?
International ethical standards and legally applicable US requirements have related but distinct roles. CIP’s reference list includes Nuremberg, Helsinki, CIOMS, and ICH GCP E6, while the examination remains focused on US human research protection practice. Ethical acceptability does not itself establish regulatory exemption, consent-waiver authority, or an approval pathway. For research abroad, applicable foreign protections also require attention; the Common Rule does not simply displace them because a US institution participates.
Apply it
A US-supported overseas study cites an international ethics statement as its sole justification for omitting consent. The reviewer separately examines applicable US waiver criteria and the host jurisdiction’s requirements before evaluating whether omission is permissible.
Common pitfall: Treating every ethical standard as interchangeable with federal law obscures which source supplies a binding criterion, an ethical principle, or an additional applicable protection.
CIP® Exam References and Resources · 45 CFR Part 46: Protection of Human Subjects
7.What makes an activity research under the Common Rule?
The Common Rule defines research as a systematic investigation, including development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Both the organized investigative approach and the activity’s design matter. Publication plans alone do not establish research, and labeling an activity quality improvement does not exclude it. After determining that an activity is research, assess human-subject involvement, regulatory applicability, and possible exemption as separate questions.
Apply it
A hospital systematically compares two discharge interventions to produce conclusions intended for use across hospitals. The reviewer examines that design and purpose rather than accepting the project’s quality-improvement label as a complete regulatory determination.
Common pitfall: Using publication intent as the sole test confuses dissemination with design. An activity can be research without publication or nonresearch despite later publication.
8.When does research involve a human subject?
Under the Common Rule, a human subject is a living individual about whom an investigator obtains information or biospecimens through intervention or interaction and uses, studies, or analyzes them, or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. Either route can apply independently. A chart-only project may involve human subjects without direct contact, while research solely involving deceased individuals falls outside this particular definition.
Apply it
An investigator analyzes living patients’ identifiable clinical records without contacting anyone. The reviewer recognizes human-subject involvement through identifiable private information, then considers applicability and exemption rather than stopping at the absence of interaction.
Common pitfall: Assuming that no direct contact means no human subjects overlooks the identifiable-information route. Other privacy requirements can also apply outside the Common Rule definition.
9.How does identifiability affect secondary research determinations?
Private information includes information supplied for specific purposes with a reasonable expectation that it will not become public, such as medical records. It is identifiable when an individual’s identity is or may readily be ascertained by the investigator or associated with the information. Removing names does not necessarily remove identifiability. Assess the actual information, available linkages, and investigator access to a coding key before deciding whether the identifiable-private-information route applies.
Apply it
A dataset replaces names with codes, but the analyst has access to the code key. The reviewer treats the records as potentially identifiable instead of accepting the word coded as proof that human-subject requirements cannot apply.
Common pitfall: Equating coded with anonymous ignores whether identity can readily be ascertained. HIPAA de-identification and Common Rule identifiability also require their own analyses.
10.Which activities are expressly excluded from the Common Rule research definition?
The Common Rule identifies specified activities as not research, including certain scholarly and journalistic activities focused directly on particular individuals, authorized public health surveillance, specified criminal justice activities, and authorized national security operational activities. These are bounded exclusions with stated conditions. Evaluate what the activity actually does and who authorizes it where relevant. A project does not qualify merely because its sponsor calls it public health, journalism, or government work.
Apply it
A public health authority authorizes collection needed to identify and monitor an outbreak. The reviewer checks the surveillance purpose and authorization rather than automatically treating every systematic collection of health information as Common Rule research.
Common pitfall: Broad labels can conceal research components outside an exclusion. A later study using surveillance information needs its own research and human-subject determination.
11.How do intervention and interaction differ in the human-subject definition?
Intervention includes physical procedures that gather information or biospecimens and manipulations of a subject or the subject’s environment for research purposes. Interaction includes communication or interpersonal contact between investigator and subject. The distinction matters because an environmental manipulation can involve human subjects even without a conversation, and an interview can involve subjects without a physical procedure. For this route, the investigator must also use, study, or analyze the resulting information or biospecimens.
Apply it
Researchers change classroom lighting to study students’ attention and analyze the resulting observations. The reviewer identifies a research intervention through environmental manipulation even though the researchers never interview or physically examine the students.
Common pitfall: Limiting intervention to invasive medical procedures misses environmental manipulation. Limiting interaction to face-to-face meetings misses other communication between investigators and research participants.
12.What does minimal risk compare?
Minimal risk means that the probability and magnitude of anticipated harm or discomfort are not greater than those ordinarily encountered in daily life or during routine physical or psychological examinations or tests. Both probability and magnitude matter. The classification concerns research risks rather than whether investigators expect a benefit. It does not automatically establish exemption or expedited eligibility. Initial expedited approval of nonexempt research requires an authorized category and no more than minimal risk; expedited procedures also permit qualifying minor changes and limited IRB review required by specified exemptions.
Apply it
A reviewer evaluates an interview about illegal behavior. Although physically harmless, disclosure could create serious legal consequences. The reviewer examines confidentiality protections and disclosure risk before deciding whether the study is minimal risk.
Common pitfall: Calling a study noninvasive does not establish minimal risk. Social, psychological, legal, and economic harms can determine the classification even when physical risk is absent.
45 CFR 46.102: Definitions · 45 CFR 46.110: Expedited review procedures
13.When does the Common Rule apply to research?
Common Rule applicability depends on the activity and the relevant federal department or agency’s regulatory coverage, including covered research conducted, supported, or otherwise regulated by that department or agency. Human-subject involvement alone does not establish every jurisdictional element. Institutional policy may extend similar protections beyond federal coverage, but that policy decision is distinct from the federal basis. Determine applicable agencies, exemptions, and any other regulatory systems before assigning the required review pathway.
Apply it
A privately funded interview study has no identified federal connection. The reviewer checks institutional commitments and other applicable requirements rather than asserting that every US human-subject study is automatically federally covered by the Common Rule.
Common pitfall: Confusing an institution’s broader policy with federal applicability can produce an incorrect explanation even when the institution appropriately requires the same practical review.
14.Why must FDA applicability be assessed separately from HHS coverage?
FDA and HHS oversight arise from different regulatory authorities. A device investigation can require FDA and IRB oversight even when HHS does not fund it. Conversely, HHS-covered research need not involve an FDA-regulated product. When both systems apply, approval must satisfy both sets of applicable requirements. Determine the investigation’s product and regulatory purpose rather than using funding alone, and do not transfer a Common Rule exemption or waiver automatically into FDA review.
Apply it
A manufacturer funds a significant-risk device investigation without federal support. The reviewer recognizes that private funding does not remove FDA requirements and examines the needed FDA authorization alongside IRB approval before enrollment.
Common pitfall: Using absence of federal funding to dismiss FDA oversight mistakes one agency’s applicability trigger for another’s. Overlapping regulation requires separate, compatible determinations.
IDE Institutional Review Boards (IRB) · 45 CFR Part 46: Protection of Human Subjects
15.Which approvals are needed for a significant-risk device investigation?
A significant-risk device investigation requires FDA approval of an investigational device exemption and IRB approval before it begins. The IRB evaluates the study’s risk classification and human-subject protections; a sponsor’s nonsignificant-risk assertion is not conclusive. Device risk considers the proposed use and potential serious harm, rather than simply whether the device is familiar or commercially available. FDA makes the final determination when there is disagreement about significant-risk status.
Apply it
A sponsor proposes using a device in a way that presents potential serious harm and labels the study nonsignificant risk. The IRB evaluates that classification independently and requires the appropriate FDA pathway if it finds significant risk.
Common pitfall: Treating IRB approval as a substitute for an approved significant-risk IDE misses an independent authorization. Sponsor risk labels do not control the IRB’s assessment.
16.Which populations receive additional protections in HHS Subparts B, C, and D?
HHS Subpart B addresses pregnant women, human fetuses, and neonates; Subpart C addresses prisoners; and Subpart D addresses children. These provisions add population-specific conditions to the basic protections in Subpart A when applicable. Subpart E concerns IRB registration rather than another participant population. Knowing the structure helps identify the correct additional analysis, but it does not establish that every Common Rule department has adopted every HHS subpart.
Apply it
A protocol follows newborns immediately after delivery. The reviewer recognizes that neonatal protections may require Subpart B analysis and separately evaluates whether Subpart D applies, rather than treating every newborn issue as only an assent question.
Common pitfall: Reducing Subpart B to pregnancy alone misses fetal and neonatal protections. Subpart E registration requirements should not be confused with additional safeguards for subjects.
45 CFR 46 · Subpart B: Additional Protections for Pregnant Women, Human Fetuses and Neonates Involved in Research
17.How do NIH’s single-IRB policy and the Common Rule cooperative-research requirement differ?
NIH’s single-IRB policy applies to covered NIH-funded domestic multisite nonexempt human-subject research in which sites use the same protocol. The revised Common Rule cooperative-research provision separately requires US institutions engaged in covered cooperative research to rely on a single IRB for the US portion, subject to its exceptions. NIH funding and the same-protocol condition distinguish NIH policy applicability; the Common Rule provision can apply to research supported by another Common Rule agency. A study can fall under both authorities, so an exception under one does not automatically settle the other. See [NIH’s policy explanation](https://www.grants.nih.gov/policy-and-compliance/policy-topics/human-subjects/single-irb-policy-multi-site-research).
Apply it
Three US institutions conduct nonexempt research using the same protocol under a covered NIH award. Both NIH policy and the revised Common Rule require assessment. If instead the project is supported solely by another Common Rule agency, NIH’s funding-based policy does not apply, but the Common Rule cooperative-research requirement may still require single-IRB reliance.
Common pitfall: Treating the NIH policy as the source of every federal single-IRB obligation misses the independent Common Rule requirement. Neither authority establishes a universal requirement for every foreign site.
IRB Responsibilities54%
18.What composition must an IRB have under the Common Rule?
An IRB must have at least five members with varied backgrounds and sufficient experience and expertise to review research. Membership must include at least one person whose primary concerns are scientific, one whose primary concerns are nonscientific, and one who is unaffiliated with the institution and not an immediate family member of an affiliated person. Diversity and relevant expertise support adequate review; a numerically sufficient committee can still lack required perspectives or competence.
Apply it
A proposed board has six institutional scientists and an unaffiliated scientist. The reviewer identifies that the nonscientific membership requirement still needs to be satisfied despite the board exceeding the minimum number of members.
Common pitfall: Counting members without checking their roles can overlook a composition defect. An unaffiliated member is not automatically a nonscientist merely because of affiliation status.
19.When must an IRB member withdraw from review?
An IRB member may not participate in the initial or continuing review of a project in which that member has a conflicting interest, except to provide information requested by the IRB. Disclosure alone does not authorize deliberation or voting. The board must manage the member’s departure so that quorum is maintained for official action. A consultant may supply needed expertise but does not thereby become a voting IRB member or cure a quorum deficiency.
Apply it
A member is an investigator on the protocol under discussion. The chair requests factual clarification, then excludes the member from deliberation and voting and checks whether the remaining members can still conduct business.
Common pitfall: Allowing a conflicted member to remain and merely abstain does not satisfy the participation restriction. Requested factual information is a limited exception, not general permission.
45 CFR 46.107: IRB membership · Minutes of Institutional Review Board (IRB) Meetings
20.How are quorum and approval votes determined?
Convened review requires a majority of IRB members to be present, including at least one member whose primary concerns are nonscientific. Approval requires a majority of members present at the meeting. Quorum must persist during the relevant review and vote; departures and recusals can interrupt it. Abstentions do not reduce the approval denominator while members remain present. Meeting records must allow a reviewer to understand attendance, voting, and whether valid action occurred.
Apply it
An IRB has nine members and five attend, including a nonscientist. One member leaves before a vote. The remaining four cannot approve the protocol because the meeting no longer has the required majority present.
Common pitfall: Counting only votes cast can falsely suggest approval. A numerical majority without a nonscientific member also fails the convened-review quorum requirement under the Common Rule.
Subpart A of 45 CFR Part 46: Basic HHS Policy for Protection of Human Subjects · Minutes of Institutional Review Board (IRB) Meetings
21.How does IRB authority relate to institutional approval?
An IRB may approve research, require modifications to secure approval, or disapprove it. Institutional officials may subject approved research to additional review and may decline to permit it, but they may not approve research that the IRB has disapproved. When disapproving research, the IRB must provide written reasons and an opportunity for the investigator to respond. Institutional interests in funding, recruitment, or prestige do not substitute for the IRB’s required protective findings.
Apply it
A department chair wants to launch a study that the IRB disapproved. The research administrator explains that departmental authorization cannot override disapproval and directs the investigator toward addressing the IRB’s stated reasons through the appropriate process.
Common pitfall: Assuming that institutional leadership can override disapproval confuses organizational authority with regulatory approval. Conversely, IRB approval does not compel the institution to conduct research.
45 CFR 46.109: IRB review of research · 45 CFR Part 46: Protection of Human Subjects
22.When can adult survey or interview research qualify for exemption?
Common Rule exemption category 2 can cover research limited to educational tests, surveys, interviews, or observation of public behavior when specified information-risk conditions are met. These include recording information without readily ascertainable identities, disclosures that would not reasonably create listed harms, or an identifiable-information route with limited IRB review. A sensitive topic is not automatically disqualifying, but the reviewer must match the actual recording and disclosure conditions to a permitted route.
Apply it
An adult survey records names and asks about conduct that could threaten employment if disclosed. The reviewer examines whether the identifiable-information route with limited IRB review can apply rather than assuming that all surveys are automatically exempt.
Common pitfall: Selecting exemption because data collection uses a questionnaire ignores identifiability and disclosure consequences. Exemption criteria must be satisfied for the actual population and procedures.
23.How do children change the availability of survey exemptions?
For research subject to HHS Subpart D, exemption category 2 is limited to educational tests or observation of public behavior when investigators do not participate in the activities being observed. Its survey and interview provisions do not extend to children. The identifiable-information route requiring limited IRB review also does not apply to children. Distinguish an educational test from an interview, and check investigator participation when public-behavior observation is proposed.
Apply it
A researcher interviews children about playground friendships and requests category 2 exemption because responses will be anonymous. The reviewer explains that anonymity does not make the category’s interview provisions available under Subpart D.
Common pitfall: Importing adult survey rules into children’s research overlooks explicit restrictions. A low-risk child interview may be approvable through another pathway without being exempt.
45 CFR 46.104: Exempt research · Subpart D: Additional Protections for Children Involved as Subjects in Research
24.When can secondary research qualify for exemption category 4?
Category 4 provides several routes for secondary research using identifiable private information or identifiable biospecimens. Examples include publicly available sources; recording information without readily ascertainable identity while avoiding contact and reidentification; and specified information-only uses regulated under HIPAA. The applicable route determines the conditions. Secondary research need not automatically be nonidentifiable, but neither prior clinical collection nor the word retrospective establishes exemption without checking the relevant conditions.
Apply it
An analyst reviews identifiable records but records study information without identities or links, will not contact individuals, and will not reidentify them. The reviewer evaluates that specific category 4 route rather than requiring all source records to be anonymous.
Common pitfall: Requiring anonymous source records for every category 4 determination is too restrictive. Assuming every retrospective chart review qualifies is equally incorrect because routes have distinct conditions.
25.What does limited IRB review accomplish?
Limited IRB review is a specified condition of certain Common Rule exemptions, rather than a general substitute for full approval review. For the identifiable-information route in exemption category 2, the IRB determines that appropriate provisions protect privacy and maintain confidentiality. Other limited-review exemptions involve broad-consent conditions. Identify the exact exemption before deciding what findings are required; the term limited does not mean that every approval criterion applies or that no IRB determination is needed.
Apply it
An identifiable adult interview study proposes exemption category 2 with limited IRB review. The reviewer evaluates the privacy and confidentiality provisions required by that route rather than treating the submission as either entirely unreviewed or automatically convened research.
Common pitfall: Calling limited IRB review a universal review level obscures its connection to particular exemptions. It also differs from expedited approval of nonexempt research.
45 CFR 46.104: Exempt research · 45 CFR 46.111: Criteria for IRB approval of research
26.Which research and determinations can use expedited procedures?
Under the Common Rule, initial expedited approval of nonexempt research requires an authorized expedited category and no more than minimal risk. Expedited procedures also permit minor changes in previously approved research during its authorized approval period and limited IRB review required by specified exemptions. These are separate authorizations; the category-list requirement for initial nonexempt approval should not be imposed on every use of expedited procedures. The chair or experienced IRB members designated by the chair conduct the review and apply the findings required for the particular route.
Apply it
A new nonexempt minimal-risk protocol fits no authorized expedited category, so minimal risk alone cannot support its initial expedited approval. By contrast, an adult interview study qualifying for an exemption that requires limited IRB review may receive that limited review through expedited procedures without fitting a category on the nonexempt expedited list.
Common pitfall: Equating expedited with fast or minimal risk alone misses initial-review eligibility. Requiring a listed category for qualifying minor changes or specified limited IRB reviews makes the opposite error.
27.What can an expedited reviewer decide?
An expedited reviewer may exercise the IRB’s review authorities except disapproval. The reviewer can approve eligible research or require changes needed for approval, but research can be disapproved only through the convened procedure. Referral is appropriate when concerns cannot be resolved within expedited review or the study is ineligible. This division protects the investigator’s access to collective board consideration while preserving the same substantive protections required for approval.
Apply it
An expedited reviewer concludes that a protocol’s risks cannot be justified and the investigator will not revise it. The reviewer refers the matter for convened consideration instead of issuing a final disapproval alone.
Common pitfall: Assuming a designated reviewer has every convened-board power overlooks the explicit disapproval limit. Referral does not mean that the reviewer must approve unresolved research.
28.How do risk minimization and risk reasonableness differ?
Approval requires risks to be minimized through sound research design and, when appropriate, procedures already being performed for diagnosis or treatment. Separately, remaining risks must be reasonable in relation to anticipated benefits, if any, and the importance of expected knowledge. Consider research-related risks and benefits rather than those of care participants would receive anyway. These are separate findings: eliminating avoidable procedures does not automatically establish that the remaining exposure is justified.
Apply it
A study removes an unnecessary biopsy but retains a burdensome procedure with little prospect of useful knowledge. The reviewer recognizes improved risk minimization while still questioning whether the remaining risks are reasonable.
Common pitfall: Treating lower risk as sufficient for approval skips the risk-benefit judgment. Expected societal benefit cannot excuse avoidable procedures that lack a sound design rationale.
29.How does an IRB assess equitable subject selection?
The IRB must determine that subject selection is equitable, taking account of the research purpose and setting and being particularly attentive to populations vulnerable to coercion or undue influence. Examine inclusion and exclusion criteria, recruitment locations, and reasons for choosing particular groups. Equity does not require identical enrollment of every demographic group in every study; it requires a defensible relationship between the scientific question, participant selection, and distribution of burdens and opportunities.
Apply it
A study excludes older adults solely because scheduling their visits takes longer, although age does not affect the question or safety. The reviewer asks the investigator to justify or revise that selection criterion.
Common pitfall: Demanding identical demographic representation in every protocol can ignore scientific relevance. Accepting convenience alone can overlook unjustified exclusion or disproportionate burdens on accessible groups.
30.When is a data monitoring plan needed?
When appropriate, the research plan must make adequate provision for monitoring collected data to ensure subjects’ safety. The needed arrangements depend on the study’s risks, design, accumulating information, and opportunities to detect harm. Monitoring can identify emerging patterns that individual event reports miss. The regulation does not require an independent monitoring board for every protocol; the IRB must assess whether the proposed responsibilities, review frequency, information flow, and stopping responses are adequate.
Apply it
A study’s individual adverse events appear expected, but their frequency could reveal an emerging safety problem. The reviewer asks who will examine aggregate data, how often, and what findings will trigger protective action.
Common pitfall: Substituting a promise to report serious events for a monitoring plan may miss cumulative risk. Requiring a monitoring board universally also exceeds the stated criterion.
31.How do privacy and confidentiality require different safeguards?
Privacy concerns access to individuals and the circumstances in which information is collected; confidentiality concerns protection of information entrusted to researchers. The IRB must find appropriate provisions for both when applicable. A private recruitment and interview process can protect a person from unwanted exposure, while access controls, secure storage, and restricted sharing protect recorded information. One protection does not substitute for the other, and both should address realistic threats in the study’s setting.
Apply it
A study encrypts interview files but conducts sensitive interviews where coworkers can overhear. The reviewer identifies a privacy problem during collection even though the storage system provides a meaningful confidentiality safeguard.
Common pitfall: Describing encryption as the complete privacy plan overlooks recruitment and collection circumstances. Conversely, a private interview does not protect files that are later shared carelessly.
32.When can HIPAA research authorization be waived?
An IRB or Privacy Board may approve a waiver or alteration of HIPAA research authorization when the use or disclosure of protected health information (PHI) involves no more than minimal risk to individuals’ privacy, supported by three safeguards: an adequate plan to protect identifiers from improper use and disclosure; an adequate plan to destroy identifiers at the earliest opportunity consistent with the research, unless retention has a health or research justification or is required by law; and adequate written assurances that PHI will not be reused or disclosed except as required by law, for authorized research oversight, or for other research uses permitted by the Privacy Rule. Two separate impracticability findings are also required: the research could not practicably be conducted without the waiver or alteration, and it could not practicably be conducted without access to and use of the PHI.
Apply it
For a covered hospital’s retrospective records study, the reviewer evaluates a plan restricting identifiable records to authorized study personnel through controlled access and secure storage. If identifiers are needed to link encounters, the plan specifies their destruction after linkage and validation, at the earliest opportunity consistent with the research, or explains a qualifying reason for retention. The investigator provides the required written assurances limiting reuse and disclosure. The reviewer separately assesses evidence that obtaining authorization would make conducting the research impracticable, such as substantial inability to locate former patients, and that identifiable PHI is necessary for accurate linkage. Neither finding follows automatically from the study’s retrospective design.
Common pitfall: A Common Rule exemption or consent waiver does not itself authorize a covered entity’s research disclosure of PHI. HIPAA authorization requires separate analysis. Likewise, secure storage alone does not establish all three privacy safeguards: the identifier-destruction plan and written assurances are also necessary. A large sample or added expense alone does not establish impracticability; the justification must explain why the research cannot practicably proceed with authorization and why access to and use of PHI are necessary.
33.What permits research use of a HIPAA limited data set?
A HIPAA limited data set excludes specified direct identifiers but may retain information, including certain dates and geographic details, that would not fit the Safe Harbor de-identification method. It remains protected health information. Research use or disclosure can proceed without individual authorization when the applicable limited-data-set requirements are met, including a data use agreement that restricts uses, disclosures, identification, and contact. Calling a dataset limited does not itself establish compliance.
Apply it
Researchers need admission dates and city-level information but no direct identifiers. The covered entity evaluates whether a limited data set will meet the study’s needs and establishes the required data use agreement.
Common pitfall: Treating a limited data set as fully de-identified overlooks its continuing HIPAA status. A confidentiality promise alone does not replace the required data use agreement.
34.How should consent information support an actual decision?
Common Rule consent must use language understandable to the subject or legally authorized representative and provide the information a reasonable person would want when deciding about participation. Except for broad consent obtained under 45 CFR 46.116(d), informed consent must begin with a concise, focused presentation of key information most likely to help someone understand reasons to participate or decline. This presentation must facilitate comprehension. The process must provide an opportunity to discuss the information, sufficient time to consider participation, and circumstances minimizing coercion or undue influence. The broad-consent exception does not remove the requirements for understandable language and meaningful discussion.
Apply it
A conventional study consent form opens with administrative definitions and postpones major burdens until its final pages. The reviewer requests an opening explanation emphasizing the study's purpose, major procedures, risks, alternatives, and reasons someone might decline. The reviewer also checks whether prospective subjects have time and an opportunity to ask questions. For broad consent under section 46.116(d), the opening key-information requirement does not apply, but the applicable broad-consent elements and general protections still do.
Common pitfall: Treating the opening key-information requirement as universal incorrectly includes broad consent under section 46.116(d). Treating it as a fixed legal paragraph also misses its purpose: information should help people make a meaningful decision, rather than merely appear somewhere in a technically complete form.
35.Which basic consent elements distinguish research from ordinary care?
Basic consent information includes that the activity is research, its purposes, expected duration, procedures, experimental procedures, reasonably foreseeable risks, expected benefits, appropriate alternatives, confidentiality, contacts, and voluntariness. For more-than-minimal-risk research, it includes compensation and medical treatments available if injury occurs. Research collecting identifiable private information or identifiable biospecimens must also state either that identifiers might be removed and the information or specimens could then be used or distributed for future research without additional consent, or that they will not be used or distributed for future research even after identifiers are removed. This future-use disclosure differs from broad consent for secondary uses that retain identifiability.
Apply it
A clinician describes an experimental intervention as simply the next treatment step and omits alternatives. The study also collects identifiable specimens for possible later distribution after identifiers are removed. The reviewer requires clear research and alternatives disclosures and the applicable statement about future use without additional consent; that statement does not authorize future identifiable uses through broad consent.
Common pitfall: A clinical relationship does not supply adequate research disclosure. The basic statement about future use after removing identifiers must not be mistaken for broad consent to identifiable storage or secondary research.
36.When must consent address findings, costs, and withdrawal consequences?
Additional consent elements apply when appropriate, including possible additional costs, consequences and procedures for withdrawal, investigator-initiated termination, and significant new findings that may affect willingness to continue. Other elements address matters such as commercial profit, return of clinically relevant results, and whole-genome sequencing when applicable. These are contextual obligations, not interchangeable boilerplate. The IRB should connect the required disclosures to the actual study and anticipate decisions participants may face after enrollment.
Apply it
A study includes repeated visits with substantial parking costs and a withdrawal procedure needed to stop an intervention safely. The reviewer asks for those relevant disclosures rather than accepting a generic voluntariness sentence alone.
Common pitfall: Adding every optional-sounding statement mechanically can obscure relevant information. Omitting an applicable additional element because it is not on a local template is also incorrect.
37.What findings support a general Common Rule consent waiver?
Under the general waiver provision, the IRB must find no more than minimal risk; impracticability without the waiver or alteration; no adverse effect on subjects’ rights and welfare; and additional pertinent information afterward when appropriate. If identifiable private information or biospecimens are used, the research must also be impracticable without using them in identifiable form. Each condition needs a study-specific rationale. Recruitment difficulty or preference for avoiding consent does not independently satisfy the criteria.
Apply it
A records study claims a waiver because contacting patients would be inconvenient. The reviewer asks for evidence of impracticability and why identifiable records are necessary, alongside the minimal-risk and rights-and-welfare findings.
Common pitfall: Treating inconvenience as impracticability weakens the required justification. A waiver also cannot be granted under this provision after an individual refuses requested broad consent.
38.When can the signature requirement be waived?
Under 45 CFR 46.117(c)(1), an IRB may waive signed consent documentation through three distinct routes. First, the consent document would be the only record linking the subject and the research, and the principal risk would be potential harm from a confidentiality breach; each subject or legally authorized representative must be asked whether documentation linking the subject with the research is wanted, and that choice governs. Second, research presents no more than minimal risk and involves no procedures for which written consent is normally required outside research. Third, subjects or their legally authorized representatives belong to a distinct cultural group or community where signing forms is not the norm, the research presents no more than minimal risk, and an appropriate alternative mechanism documents that informed consent was obtained. A documentation waiver does not itself waive informed consent.
Apply it
An anonymous minimal-risk interview involving no procedures ordinarily requiring written consent outside research may qualify through the second route. Separately, a study with a community where signing forms is not the norm may qualify through the cultural route if the IRB establishes the relevant community practice, finds no more than minimal risk, and approves an alternative such as an investigator-maintained record that consent was obtained. A general dislike of paperwork does not establish that cultural route.
Common pitfall: Confusing a signature waiver with a consent waiver eliminates protections that remain required. The cultural route requires all three conditions, including alternative documentation. The only-link route requires honoring each subject's or representative's documentation preference. The IRB may require a written statement about the research even when it waives signatures.
39.How is consent documented using a short form?
The short-form procedure documents that required consent elements were presented orally and that key information was presented first. A witness observes the oral presentation. The subject or legally authorized representative signs the short form; the witness signs both the short form and the written summary; and the person obtaining consent signs the summary. The subject receives copies of both documents. This method changes documentation, while preserving disclosure, comprehension, and voluntary agreement.
Apply it
A participant receives an approved oral presentation using a short form. Before completing enrollment, the coordinator confirms the witness’s required signatures, the presenter’s summary signature, the participant’s short-form signature, and delivery of both copies.
Common pitfall: Having the participant sign only a full summary does not follow the specified short-form arrangement. A witness signature alone cannot substitute for the required consent presentation.
40.How does broad consent differ from study-specific consent?
Broad consent is an optional Common Rule pathway for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens. It requires specified information about potential future research and related arrangements rather than permission for an unlimited range of undisclosed activities. It is not a substitute for consent to the primary intervention. If a person is asked for broad consent and refuses, the IRB cannot later waive consent for the covered storage or secondary uses.
Apply it
A repository asks patients for broad consent to future identifiable specimen research. One patient refuses. The reviewer flags that refusal rather than assuming a later general waiver can authorize the same covered uses.
Common pitfall: Describing broad consent as permission for anything ignores required disclosures and limits. An institution need not adopt broad consent to use other lawful pathways.
45 CFR 46.116: General requirements for informed consent · 45 CFR 46.104: Exempt research
41.How should an IRB determine whether children can assent?
Assent means a child’s affirmative agreement to participate; mere failure to object is insufficient. The IRB evaluates children’s capacity by considering age, maturity, and psychological state, either for all children in the study or individually. Parental permission and child assent are distinct protections. Assent requirements have specified exceptions, including circumstances in which children cannot reasonably be consulted or an important direct benefit is available only through the research intervention.
Apply it
A capable adolescent remains silent while a parent signs permission. The coordinator should seek an affirmative participation decision through an appropriate assent process rather than treating silence as sufficient agreement.
Common pitfall: Using a single fixed age as the entire capacity test ignores maturity and psychological state. Parent permission does not automatically establish the child’s assent.
Subpart D: Additional Protections for Children Involved as Subjects in Research
42.Which risk-benefit categories govern HHS research involving children?
Subpart D permits no-greater-than-minimal-risk research under section 46.404. Under section 46.405, greater-than-minimal-risk research with a prospect of direct benefit requires risk justified by anticipated benefit and a benefit-risk relationship at least as favorable as available alternatives. Under section 46.406, research without direct benefit requires only a minor increase over minimal risk, experiences reasonably commensurate with the children’s actual or expected medical, dental, psychological, social, or educational situations, and generalizable knowledge of vital importance for understanding or ameliorating their disorder or condition. Research outside these categories requires the separate federal consideration pathway. Assent provisions apply unless an exception or waiver is justified. The IRB may find one parent’s permission sufficient under sections 46.404 and 46.405; sections 46.406 and 46.407 generally require both parents, with specified exceptions.
Apply it
A pediatric study offers no direct benefit and a minor increase over minimal risk while seeking vital disorder-related knowledge. Approval under section 46.406 also requires reasonably commensurate experiences and adequate assent and parental-permission provisions. If a procedure instead offers direct benefit under section 46.405, the reviewer must compare its benefit-risk relationship with available alternatives.
Common pitfall: Minor increased risk and valuable knowledge alone do not satisfy section 46.406. Direct benefit cannot be borrowed from an unrelated procedure, and parental permission cannot replace the required risk-category findings or assent.
Subpart D: Additional Protections for Children Involved as Subjects in Research
43.Which protections are distinctive in prisoner research?
HHS Subpart C adds restrictions on permissible research and requires findings addressing the prison environment’s effects on choice. The IRB must include a prisoner or appropriately qualified prisoner representative, and most members, excluding prisoner members, must have no association with the involved prisons apart from IRB service. Review addresses selection, understandable information, advantages that could impair choice, and assurances that parole decisions will not consider participation. Prisoners must be clearly informed about the parole protection.
Apply it
A prison study offers benefits that substantially exceed ordinary prison living conditions. The reviewer considers whether those advantages could impair voluntary judgment and checks both the permitted research category and required prisoner representation.
Common pitfall: Assuming signed consent resolves incarceration-related pressure overlooks structural constraints. Ordinary IRB membership and a general minimal-risk finding do not replace Subpart C requirements.
Subpart C: Additional Protections for Research Involving Prisoners
44.How do Subpart B findings depend on the subject's condition?
Subpart B distinguishes pregnant women and fetuses, neonates of uncertain viability, and nonviable neonates. Under 45 CFR 46.204, scientifically appropriate preclinical studies, including studies on pregnant animals, and clinical studies, including studies on nonpregnant women, must provide data for assessing potential risks to pregnant women and fetuses. Fetal risk must arise solely from interventions or procedures offering prospective direct benefit to the woman or fetus. If neither has a prospect of direct benefit, fetal risk must be no greater than minimal and the research must develop important biomedical knowledge unobtainable by other means. Any risk must be the least possible for achieving the research objectives. The pregnant woman's consent is required when research offers direct benefit to her, to both her and the fetus, or to neither under the permitted minimal-fetal-risk pathway. When direct benefit is solely to the fetus, both the woman and father ordinarily must consent. The father's consent is unnecessary if he is unavailable, incompetent, or temporarily incapacitated, or the pregnancy resulted from rape or incest. Everyone providing consent must be fully informed of reasonably foreseeable effects on the fetus or neonate. Pregnant children require assent and parental permission under Subpart D. Research must provide no inducements to terminate pregnancy, and research personnel cannot participate in decisions about pregnancy termination or determine neonatal viability. Under section 46.205, both uncertain-viability and nonviable-neonate research require scientifically appropriate preclinical and clinical studies supplying risk-assessment data. Everyone providing consent must be fully informed of reasonably foreseeable neonatal effects, and research personnel cannot determine viability. For uncertain viability, the IRB must find either a prospect of enhancing survival to viability with the least possible risk, or important biomedical knowledge unobtainable otherwise with no added neonatal risk. Either parent may consent. If neither can consent because of unavailability, incompetence, or temporary incapacity, either parent's legally authorized representative may consent; the father's or his representative's consent is unnecessary for pregnancy resulting from rape or incest. For nonviable neonates, vital functions cannot be artificially maintained, research cannot terminate heartbeat or respiration, no added risk is permitted, and important biomedical knowledge must be unobtainable otherwise. Both parents ordinarily must consent. One parent's consent suffices if the other is unavailable, incompetent, or temporarily incapacitated; paternal consent is unnecessary after rape or incest. Legally authorized representatives cannot consent, and the general consent-waiver provisions cannot replace the required parental consent. Viable neonates are governed by Subparts A and D.
Apply it
A fetal study offering no direct benefit to the pregnant woman or fetus cannot justify greater-than-minimal fetal risk merely because its scientific question is important. It must satisfy the minimal-fetal-risk ceiling, produce important biomedical knowledge unobtainable otherwise, and use the least possible risk. A study offering benefit solely to the fetus ordinarily requires paternal consent in addition to maternal consent. For an uncertain-viability neonate, a study without a survival prospect must add no neonatal risk. Before either uncertain-viability or nonviable-neonate enrollment, the reviewer also checks the prior-study evidence, disclosure of foreseeable neonatal effects, and independence of the viability determination from research personnel.
Common pitfall: Maternal consent alone does not ordinarily satisfy the solely fetal-benefit pathway. Minimal fetal risk in pregnancy research differs from the no-added-risk standard for nonviable neonates and the no-survival-prospect pathway for uncertain viability. Parental agreement cannot override these risk limits. Uncertain viability permits representative consent under specified conditions; nonviability does not.
45.How should additional safeguards address impaired decision-making?
When subjects are likely to be vulnerable to coercion or undue influence, the IRB must include additional safeguards in the study. For impaired decision-making, safeguards should address the actual limitation: accessible explanations, assessment of understanding, appropriate involvement of a legally authorized representative, and attention to changing capacity where relevant. A diagnosis alone does not resolve capacity. The representative’s legal authority must also be established under the applicable framework rather than assumed from a family relationship.
Apply it
A study enrolls adults whose cognition fluctuates during hospitalization. The reviewer asks how consent capacity will be assessed when decisions occur and how the team will respond if an enrolled participant later loses capacity.
Common pitfall: Assuming every relative can provide legally effective permission confuses family involvement with legal authority. A one-time capacity judgment may also miss meaningful later changes.
45 CFR 46.111: Criteria for IRB approval of research · 45 CFR 46.116: General requirements for informed consent
46.When is continuing review unnecessary under the revised Common Rule?
Unless the IRB determines otherwise, continuing review is not required for research eligible for expedited review, research reviewed through specified limited-review pathways, or research that has progressed to only data analysis or specified follow-up clinical data access. These exceptions concern the revised Common Rule and should not be transferred automatically to FDA-regulated research. Ending routine continuing review does not eliminate obligations concerning amendments, reportable events, or other protections that remain applicable.
Apply it
An HHS-only study has completed all interventions and now performs data analysis alone. The reviewer evaluates the continuing-review exception while reminding the team that the absence of annual review does not end all oversight obligations.
Common pitfall: Applying a universal annual-review rule ignores revised Common Rule exceptions. Treating an exception as complete release from reporting and change-control duties makes the opposite error.
47.When may an investigator change approved research before IRB review?
Approved research generally must not be changed without IRB review and approval, except when a change is necessary to eliminate an apparent immediate hazard to subjects. The exception is tied to immediate protection, not operational convenience or a sponsor’s timeline. The investigator should implement the necessary protective action and follow the applicable reporting procedures. Later review evaluates what occurred and any continuing changes; the emergency exception is not prospective authorization for unrelated protocol modifications.
Apply it
A newly recognized equipment defect poses an immediate danger during study visits. The investigator stops the hazardous procedure and reports the protective change rather than waiting for approval while continuing to expose participants.
Common pitfall: Using the immediate-hazard exception to improve recruitment or scheduling expands it beyond its purpose. Planned changes ordinarily still require review before implementation under applicable procedures.
45 CFR Part 46: Protection of Human Subjects · Subpart A of 45 CFR Part 46: Basic HHS Policy for Protection of Human Subjects
48.Which events meet OHRP’s unanticipated-problem framework?
OHRP’s framework asks whether an incident, experience, or outcome is unexpected, related or possibly related to research participation, and suggests that the research places subjects or others at greater risk of harm than previously known or recognized. All three features matter. An adverse event is not automatically an unanticipated problem, and an unanticipated problem need not involve an injury. A confidentiality breach can reveal an increased risk even before measurable harm occurs.
Apply it
An investigator loses an unencrypted file containing sensitive identifiable study information. Although no participant injury has been documented, the reviewer evaluates unexpectedness, research relatedness, and increased risk under the unanticipated-problem framework.
Common pitfall: Reporting every adverse event as an unanticipated problem obscures the required distinctions. Requiring actual injury can miss confidentiality incidents that already reveal greater risk.
Reviewing and Reporting Unanticipated Problems and Adverse Events: OHRP Guidance
49.How do noncompliance and research misconduct require different analyses?
Noncompliance is failure to follow applicable requirements or approved research conditions. Under the PHS framework, research misconduct consists of fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or reporting results. Fabrication means making up data or results and recording or reporting them. Falsification means manipulating research materials, equipment, or processes, or changing or omitting data or results so the research record is inaccurate. Plagiarism means appropriating another person’s ideas, processes, results, or words without appropriate credit. Honest error and differences of opinion are excluded. Subject-protection review and research-integrity review remain separate processes even when the same conduct raises both concerns.
Apply it
Performing an unapproved procedure requires noncompliance review but is not, by itself, fabrication, falsification, or plagiarism. Inventing safety observations and recording them as real raises fabrication concerns and may also conceal participant risk. The IRB addresses immediate protections and applicable reporting while the institution’s integrity process evaluates misconduct.
Common pitfall: A protocol deviation, honest recording error, or scientific disagreement is not automatically research misconduct. Conversely, waiting for an integrity investigation must not delay necessary participant protection or regulatory reporting.
Federal Register :: Request Access · Federal Register :: Request Access · 45 CFR Part 46: Protection of Human Subjects
50.What must meeting minutes show about IRB decisions?
Minutes must document attendance, actions taken, votes with numbers for, against, and abstaining, the basis for requiring changes or disapproving research, and a written summary of controverted issues and their resolution. They should support verification of quorum and required findings. A verbatim transcript is unnecessary, but a bare approval statement is insufficient. Accurate records connect the board’s decision with the substantive issues it considered and establish whether official action was procedurally valid.
Apply it
Minutes state only that a protocol was approved after discussion. The reviewer requests the vote counts, relevant attendance changes, and a summary of the disputed risk issue and how the board resolved it.
Common pitfall: Recording only the final outcome prevents assessment of quorum and reasoning. Conversely, producing a transcript does not excuse omission of required findings and vote documentation.
45 CFR 46.115: IRB records · Minutes of Institutional Review Board (IRB) Meetings
Institutional Responsibilities17%
51.How does reliance affect an institution’s responsibility for research?
In cooperative research, each institution remains responsible for safeguarding subjects’ rights and welfare and complying with applicable requirements, even when relying on another IRB. Reliance assigns review functions; it does not erase institutional accountability. The relying institution must understand retained responsibilities and ensure that the reviewing IRB receives information needed for valid review. Investigators’ qualifications, local implementation, reporting, and applicable institutional requirements therefore need an explicit operational arrangement.
Apply it
A site relies on an external IRB and assumes it no longer needs a process for reporting local consent errors. The institution clarifies the reporting route and retained responsibilities before further enrollment occurs.
Common pitfall: Treating reliance as a transfer of all accountability leaves gaps in local implementation. Reviewing-IRB approval cannot compensate for responsibilities that neither party has agreed to perform.
52.When does the Common Rule require a single IRB?
For cooperative research covered by the Common Rule, US institutions engaged in the research generally must rely on approval by a single IRB for the portion conducted in the United States. Exceptions include research for which law requires more than single-IRB review and research for which the supporting or conducting federal department or agency determines that single-IRB use is inappropriate. The requirement is bounded by regulatory coverage and geography rather than applying to every multisite project everywhere.
Apply it
A cooperative study includes US and foreign sites. The administrator identifies the covered US portion for the single-IRB requirement and separately determines the appropriate review arrangements for the foreign research sites.
Common pitfall: Assuming every multisite study must use one IRB worldwide overlooks coverage, geographic limits, and exceptions. Local preference alone does not establish a regulatory exception.
53.Why does a reviewing IRB need local context?
A reviewing IRB needs enough information about the research setting and relevant requirements to apply approval criteria appropriately. Local context may affect recruitment, consent language, available resources, participant vulnerabilities, and legally authorized representative determinations. Reliance procedures should establish how that information reaches the reviewing IRB and how site-specific conditions are communicated back. A common protocol can support efficient review while still requiring differences in implementation across participating sites.
Apply it
A central consent template assumes a legally authorized representative arrangement unavailable at one site. The relying institution provides the relevant local information so the reviewing IRB can evaluate an appropriate site-specific consent approach.
Common pitfall: Equating single-IRB review with identical implementation everywhere can miss legal or contextual differences. Repeating full local review is not the only way to communicate local needs.
45 CFR 46.107: IRB membership · 45 CFR 46.114: Cooperative research · 45 CFR 46.116: General requirements for informed consent
54.Which written procedures support required IRB oversight?
Required written procedures address initial and continuing review, reporting findings and actions, determining which projects need more frequent review or independent verification, and ensuring that changes are not initiated without approval except to eliminate apparent immediate hazards. Separate procedures address prompt reporting of specified problems, noncompliance, and suspensions or terminations. Effective procedures identify who acts, what information is needed, and how decisions are communicated, so obligations remain workable rather than merely stated.
Apply it
An institution’s policy says that problems must be reported but identifies neither a recipient nor a route for external reporting. The administrator revises the procedures to assign responsibilities and connect internal determinations with required notifications.
Common pitfall: Possessing a policy manual does not establish that required procedures are operational. Institution-specific additions also should not be mistaken for universal federal examination requirements.
45 CFR Part 46: Protection of Human Subjects · Subpart A of 45 CFR Part 46: Basic HHS Policy for Protection of Human Subjects
55.What documentation is required when an institution relies on another IRB?
When an institution relies on an IRB it does not operate, the institution and reviewing organization must document the reliance and each entity’s responsibilities for compliance with the Common Rule. The regulation permits different documentation methods, including an agreement, institutional policy, or study-specific protocol arrangement. The essential feature is a clear allocation of duties. Records should make it possible to determine who handles review, relevant information exchange, and required compliance activities.
Apply it
Two organizations agree informally that one will review a study, but neither identifies who communicates reportable events. The administrator documents the reliance arrangement and assigns that duty before relying on the external review.
Common pitfall: Assuming that an approval letter alone documents every reliance responsibility can leave important tasks unassigned. A particular commercial agreement format is not the sole permissible method.
56.How should researcher and institutional conflicts be distinguished from member conflicts?
A reviewer’s conflicting interest triggers the Common Rule restriction on IRB participation. Researcher and institutional conflicts raise different concerns: they can affect recruitment, design, interpretation, or institutional oversight even when no conflicted individual sits on the IRB. Relevant interests must reach the appropriate review and management processes. An IRB member’s recusal addresses that member’s participation but does not itself resolve a principal investigator’s financial interest or the institution’s competing organizational incentives.
Apply it
An institution holds an interest in a product being studied, and a conflicted IRB member recuses. The administrator recognizes that the recusal does not by itself assess or manage the institution’s separate interest.
Common pitfall: Treating every conflict as solved by member recusal overlooks researcher and institutional influences. Management should address the actual source of risk under applicable requirements and policies.
45 CFR 46.107: IRB membership · CIP® Exam Body of Knowledge/Content Outline
57.Which determinations trigger institutional regulatory reporting?
Common Rule procedures must ensure prompt reporting of unanticipated problems involving risks to subjects or others, serious or continuing noncompliance, and suspensions or terminations of IRB approval. The applicable procedures identify institutional officials and federal recipients; HHS-covered reporting includes OHRP as appropriate. These triggers are distinct and can overlap. An event need not satisfy the unanticipated-problem framework to be reportable as serious noncompliance, and lack of injury does not automatically eliminate a reporting obligation.
Apply it
The IRB determines that a team’s repeated consent violations constitute continuing noncompliance, although no injury occurred. The institution follows its required reporting process instead of dismissing the matter because it was not an adverse event.
Common pitfall: Using injury as the universal reporting threshold misses noncompliance and suspension triggers. Internal notification alone does not necessarily satisfy required external reporting under the applicable system.
45 CFR Part 46: Protection of Human Subjects · Subpart A of 45 CFR Part 46: Basic HHS Policy for Protection of Human Subjects
58.How long must Common Rule IRB records be retained?
Common Rule records generally must be retained for at least three years, and records relating to research that is conducted must be retained for at least three years after its completion. Required records include relevant proposals, approved consent documents, minutes, correspondence, and other specified materials. They must be accessible for authorized inspection and copying. Other applicable requirements may demand longer retention, so the federal minimum is a starting point rather than permission to destroy every file immediately.
Apply it
A study closes three months after its final approval letter. The records manager calculates the research-related minimum from study completion rather than from the approval date, then checks whether another applicable rule requires longer retention.
Common pitfall: Starting the research-retention clock at initial approval can cause premature destruction. Keeping only the final protocol also omits records needed to reconstruct review and oversight.
59.How should an HRPP design useful education?
Education should connect personnel’s actual responsibilities with the requirements and decisions they must apply. Investigators, coordinators, reviewers, and institutional officials need different practical competencies, especially when regulations change or recurring errors reveal a gap. Case discussion, feedback, and assessment of applied understanding can reveal weaknesses that completion certificates alone miss. CIP includes educational programs in institutional responsibilities, but that scope statement does not establish a universal annual course, fixed training provider, or single educational format.
Apply it
Repeated short-form signature errors occur despite completed general training. The education lead develops targeted practice on the required signatures and document distribution, then checks whether staff can correctly apply the procedure.
Common pitfall: Counting training certificates without examining performance can miss persistent errors. Conversely, presenting an institution’s preferred annual training schedule as a universal regulatory requirement overstates its authority.
CIP® Exam Body of Knowledge/Content Outline · 45 CFR 46.117: Documentation of informed consent
60.How do institutional assurances and IRB registration differ from study approval?
An institutional assurance addresses the institution’s commitment to comply with applicable human-subject protection requirements for covered research. IRB registration supplies required information about an IRB under the applicable registration provisions. Neither action approves a particular protocol or establishes that a study satisfies consent, risk, or population-specific conditions. Institutions must distinguish these organizational obligations from project review and maintain accurate arrangements when they operate an IRB or rely on an external one.
Apply it
A newly registered IRB tells an investigator that registration allows immediate enrollment. The administrator explains that registration concerns the board’s organizational status and that the protocol still requires its applicable review and approval.
Common pitfall: Treating registration or an assurance as a blanket research license bypasses study-specific protections. Reliance likewise does not erase the institution’s applicable organizational commitments.
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Give IRB Responsibilities the largest share of study time: distinguish exemption, limited IRB review, expedited review, and convened review before applying the relevant findings.
- Separate regulatory systems. For each problem, identify Common Rule, HHS population subpart, FDA, and HIPAA applicability rather than transferring one system’s permission into another.
- Practise consent distinctions: the consent process, required disclosures, consent waiver, documentation waiver, short-form documentation, parental permission, assent, and broad consent.
- Compare similar event categories: adverse event, unanticipated problem, noncompliance, research-integrity concern, and suspension or termination.
- Calculate quorum and approval votes using attendance and recusals; connect the result with the minutes needed to demonstrate valid action.
- Use the complete official references for topics this selective guide does not fully develop, including drug and biologic regulations, humanitarian use devices, expanded access, emergency use, Certificates of Confidentiality, FERPA, PPRA, and international standards.
- Distinguish institutional accountability from reviewing-IRB functions, and connect reliance documentation, local context, reporting, retention, and education.
A practical preparation plan
1. Map the full official scope
Read the official outline and references together. Mark each topic as familiar, partly understood, or unfamiliar. Use the 29%, 54%, and 17% domain weights as an initial allocation, then add time for requirements outside your everyday IRB work.
2. Build an applicability decision sequence
For each activity, determine research status, human-subject involvement, governing agencies, and possible exemption. Add FDA, HIPAA, and population-specific requirements separately. Explain why each determination follows from the stated facts.
3. Compare criteria side by side
Create comparison notes for consent versus documentation waivers, exemption versus expedited review, and adverse events versus unanticipated problems. Record the decisive criterion and a fact that would change the outcome.
4. Practise operational decisions
Work through membership, quorum, short-form signatures, continuing review, and reliance examples. State both the substantive finding and the documentation or communication needed to make the decision effective.
5. Use the questions diagnostically
Answer the 20 questions before reading explanations. For every missed item, explain why the selected option failed and identify the governing condition. These independent drills assess learning gaps rather than predict examination performance.
6. Revisit weak topics with active recall
Use the flashcards to explain rules aloud without notes. Return to the applicable primary reference when an answer depends on an exception or jurisdiction, and revisit the complete official outline before concluding preparation.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- Certified IRB Professional (CIP®) Exam
- About the CIP® Council
- CIP® Exam Resources
- CIP® Exam Body of Knowledge/Content Outline
- Certification Examination for IRB Professionals: Candidate Handbook
- CIP® Exam References and Resources
- Read the Belmont Report
- Nuremberg Code: Directives for Human Experimentation
- 45 CFR 46.102: Definitions
- 45 CFR 46.104: Exempt research
- 45 CFR 46.107: IRB membership
- 45 CFR 46.109: IRB review of research
- 45 CFR 46.110: Expedited review procedures
- 45 CFR 46.111: Criteria for IRB approval of research
- 45 CFR 46.114: Cooperative research
- 45 CFR 46.115: IRB records
- 45 CFR 46.116: General requirements for informed consent
- 45 CFR 46.117: Documentation of informed consent
- 45 CFR 46
- Subpart A of 45 CFR Part 46: Basic HHS Policy for Protection of Human Subjects
- Minutes of Institutional Review Board (IRB) Meetings
- IDE Institutional Review Boards (IRB)
- HIPAA and Research
- Subpart C: Additional Protections for Research Involving Prisoners
- Subpart D: Additional Protections for Children Involved as Subjects in Research
- Reviewing and Reporting Unanticipated Problems and Adverse Events: OHRP Guidance
- 45 CFR Part 46: Protection of Human Subjects
- Subpart B: Additional Protections for Pregnant Women, Human Fetuses and Neonates Involved in Research
- The Nuremberg Code | Holocaust Encyclopedia
- Federal Register :: Request Access
- Federal Register :: Request Access
- Definition of Research Misconduct | ORI - The Office of Research Integrity
- download
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.