The Three-Tier System: How the IRB Classifies Risk to Approve Human Subjects Research

The classification of human subjects research is determined entirely at the initial risk assessment, where an institutional administrator decides if a protocol exceeds the federal definition of minimal risk. This single determination dictates the project's entire timeline, separating studies that can begin data collection in 48 hours from those that will wait three to six months for a convened committee. By establishing the risk level before any scientific evaluation occurs, the review board ensures that administrative resources are concentrated exclusively on studies that pose genuine physical or psychological hazards to participants.[4][5]

For academic and clinical researchers, the Institutional Review Board (IRB) operates on a rigid three-tier system: exempt, expedited, and full board review. The dividing line across all three tiers is the federal definition of minimal risk. The U.S. Department of Health and Human Services (HHS) defines this threshold as harm no greater than what a person encounters in daily life or during routine medical and psychological examinations. If a study stays below this line, it qualifies for a faster track; the moment it crosses the line, it triggers mandatory full committee oversight.[1][4]

The lowest tier, known as 'exempt' research, does not mean the study is exempt from IRB oversight or ethical standards. Rather, it means the project is exempt from the ongoing, burdensome requirements of the federal Common Rule (45 CFR 46), such as annual continuing reviews. Under the significantly revised 2018 Common Rule, there are eight specific categories of exempt research. These typically include anonymous surveys, standardized educational tests, and benign behavioral interventions where the subjects cannot be identified and face no risk of criminal or civil liability if their responses are exposed.[3][4]

The Ochsner Journal outlines how the 2018 revisions shifted the regulatory landscape, introducing a mechanism called 'limited IRB review' for certain exempt categories. This procedural update allows researchers to collect sensitive, identifiable data without triggering a full board meeting, provided there are strict privacy and data security safeguards in place. 'The revised Common Rule expanded the categories of research that are exempt from IRB oversight,' the authors note, specifically to reduce the administrative burden on low-risk observational studies and accelerate the pace of academic data collection.[3]

If a study involves identifiable data or minor physiological interventions—such as collecting blood samples, taking an MRI, or recording moderate exercise—it moves up to the 'expedited' tier. Expedited review still requires the study to pose no more than minimal risk to the participants, but the methodology must fit precisely into one of nine specific categories published by HHS in 1998. These categories cover routine clinical practices and non-invasive data collection that are common in medical and behavioral research but require more scrutiny than an anonymous survey.[1][4]

Crucially, an expedited review does not mean a faster full board meeting. It means the protocol is reviewed and approved by a single IRB chair or a designated voting member, operating entirely outside of the monthly committee schedule. The University of California, San Francisco (UCSF) IRB notes that this single reviewer has the authority to approve the research or request specific modifications to the protocol. However, the single reviewer cannot outright disapprove a study; if they believe the research is unsafe or unethical, they must refer it to the full board for a formal vote.[4]

The regulatory framework splits sharply when medical products, rather than behavioral interventions, are involved. The Food and Drug Administration (FDA) maintains its own set of regulations (21 CFR 56) that run parallel to the HHS Common Rule. In a 2021 guidance document, the FDA clarified that while it accepts the general concept of expedited review categories, its threshold for clinical trials is structurally stricter, forcing dual-track compliance for medical researchers who receive federal funding but also test regulated products.[2]

For example, a study testing a new medical device cannot be expedited unless it is an already-cleared device being used strictly in accordance with its approved labeling. Any investigational new drug (IND) application automatically triggers a full board review, regardless of how minor the intervention might seem to the principal investigator. The FDA explicitly prohibits expedited review for any clinical trial where an IND or investigational device exemption (IDE) is required, ensuring that experimental medical products always face a convened panel of experts.[2]

The highest tier, full board review, is mandatory for any research involving greater than minimal risk or targeting vulnerable populations, such as prisoners, pregnant women, or children in certain high-risk contexts. This track requires a convened meeting with a quorum of IRB members. Federal law mandates that this quorum must include at least one member whose primary concerns are in nonscientific areas, ensuring that community standards and ethical considerations are weighed alongside the scientific merit of the protocol.[4][5]

Solutions IRB, a commercial review board, explains that full board reviews are highly resource-intensive and strictly scheduled. 'Full board review is required for research that is not eligible for exempt or expedited review,' the organization states. Because these institutional boards typically meet only once a month, missing a submission deadline by a single day can delay a project by 30 to 45 days. The committee must debate the risks, evaluate the informed consent documents, and vote on approval, modifications, or rejection.[5]

The pressure to streamline this rigid system drove the 2018 Common Rule overhaul. Prior to 2018, researchers conducting simple observational studies often found themselves trapped in the same continuing review cycles as those running phase III clinical trials. The updated regulations eliminated the requirement for annual continuing reviews for most expedited studies. This single policy change saved universities thousands of hours of compliance paperwork annually, allowing IRBs to focus their limited meeting time on high-risk, complex protocols that genuinely require ongoing ethical oversight.[3]

The efficiency of this three-tier system relies heavily on the accuracy of the initial protocol submission. If an investigator misjudges the risk level and submits a minimal-risk survey as a full-board protocol, the IRB will process it as such, consuming valuable committee time. The determining factor remains the institutional administrator who first screens the application, matching the proposed methodology against the eight exempt and nine expedited federal categories to set the regulatory track and dictate the pace of the research.[1][3][4]