The Common Rule and How an IRB Decides a Study Can Proceed

In the United States, most research involving people is governed by a single regulation known as the Common Rule, codified at 45 CFR 46 and enforced through institutional review boards, or IRBs, that must approve a study before enrollment can begin. An IRB does not decide whether a research question is worth asking. It applies a fixed set of approval criteria, chiefly that risks are minimized and reasonable in relation to anticipated benefits, that subject selection is equitable, and that informed consent is genuinely sought and documented. A 2018 revision reshaped how consent is presented and trimmed oversight for lower-risk work, yet the core bargain has held since the rule was first codified in 1991.

What the Common Rule governs

The Common Rule is Subpart A of 45 CFR 46, the Department of Health and Human Services regulation for the protection of human subjects. It grew out of the 1979 Belmont Report and its three principles of respect for persons, beneficence, and justice. Fifteen federal departments and agencies codified the same policy text, which is where the word "common" comes from. Three further subparts layer on protections for people who cannot fully protect themselves: Subpart B for pregnant women, fetuses, and neonates; Subpart C for prisoners; and Subpart D for children. As the HHS Office for Human Research Protections documents, these subparts sit on top of the general rule rather than replacing it.

The IRB is the mechanism that makes the rule operate. An institution that conducts covered research registers one or more boards, and each board can approve a study, require changes, or disapprove it outright. Approval is neither a formality nor permanent.

The criteria a board applies

Section 46.111 sets out what a board must find before it can approve anything, and the requirements are cumulative, so failing one blocks approval. In the regulation's own terms, risks to subjects must be minimized; risks must be reasonable in relation to anticipated benefits and the importance of the knowledge expected to result; selection of subjects must be equitable; informed consent must be sought from each prospective subject and appropriately documented; where relevant, the plan must monitor data for safety; and there must be adequate provisions to protect privacy and confidentiality.

Two features of 46.111 are easy to miss. First, the board weighs only the risks and benefits of the research itself, not the broad social value of the knowledge or the risks of treatments a subject would receive even without the study. Second, "minimal risk" is a defined threshold, and studies at or below it can qualify for expedited review by a single experienced reviewer instead of the full convened board. When subjects are drawn from vulnerable groups, the board must add safeguards.

Who sits on the board

Membership rules under 46.107 are deliberately built against technical capture. Each IRB must have at least five members of varying backgrounds. At least one must bring primarily scientific concerns and at least one primarily nonscientific concerns, and at least one member must have no other affiliation with the institution and no immediate family member who does. The board must also be diverse enough in experience, and sensitive enough to community attitudes, to command respect for its judgments. The nonscientist and the unaffiliated member are structural checks, present so that a protocol cannot pass on scientific fluency alone.

Consent as a process, not a signature

The regulation treats informed consent as a conversation that a signed form merely records. Section 46.116 lists the required elements: a statement that the activity is research, its purpose and expected duration, the procedures involved, foreseeable risks, potential benefits, appropriate alternatives, how confidentiality is protected, and a clear statement that participation is voluntary and may be stopped at any time without penalty. A board may waive or alter these elements only under narrowly defined conditions.

What the 2018 revision changed

Sixteen federal departments and agencies published the revised Common Rule on January 19, 2017, and after two delays it took general effect on January 21, 2019, according to HHS. The most visible change is to consent. A form must now open with a "key information" section, a concise and focused presentation of the facts most likely to help a reasonable person decide whether to take part, organized to aid understanding.

Other changes traded oversight for proportionality. Continuing review, the periodic re-approval a board performs on an ongoing study, is no longer automatically required for most minimal-risk research that qualifies for expedited review. The rule expanded the categories of activity that are exempt, and it introduced "broad consent" as an optional pathway for storing and reusing identifiable data and biospecimens. It added a required consent statement noting that biospecimens, even with identifiers removed, may be used for commercial profit. And for cooperative research running across multiple US sites, 46.114 now generally requires reliance on a single IRB of record, a mandate whose compliance date was January 20, 2020.

Where the rule stops

Two limits deserve attention. The Common Rule governs federally conducted or supported research; studies of FDA-regulated products answer to a parallel set of FDA regulations at 21 CFR parts 50 and 56, and the agencies have worked to harmonize the two. And an IRB approves a protocol before the fact. It does not certify that a completed study was safe or that its conclusions are correct. Approval sets a floor for ethical conduct, not a verdict on scientific merit or a guarantee of results.

This article is educational and not legal or medical advice.