IRB Approval for Your Dissertation: A Step-by-Step Guide

You can’t collect a single piece of data until your IRB says yes, and the approval rarely arrives as fast as students expect. Applications come back with questions, some boards meet only once a month and not at all over the summer, and a study that looked simple on paper turns out to need a full review. Ethics approval is the step that most often stalls a dissertation timeline.

In our 10 years of coaching students through their proposals and ethics applications, we’ve found most of those delays are avoidable. In this post, I’ll explain what the IRB looks for, which review level your study is likely to get and how long it really takes, then walk you through the application and the mistakes that send it back.

---

What is an IRB, and do you need one?

An institutional review board (IRB) is the committee at your university that reviews research involving people, to make sure participants are protected. In the US, the rules it applies come from federal regulations known as the Common Rule (45 CFR 46).

Your study needs IRB review if it counts as research involving human subjects. Under the Common Rule, research is a systematic investigation “designed to develop or contribute to generalizable knowledge,” and a human subject is a living person about whom a researcher, “whether professional or student,” either gathers information by intervening or interacting with them, or obtains identifiable private information about them. Surveys, interviews, focus groups, observations and experiments all qualify. So does analyzing records that identify people, such as school or patient data.

Some dissertations don’t involve human subjects at all, for example a study built only on published documents or fully anonymous public data. Even then, don’t make that call yourself. Many universities want you to submit a short determination request so the IRB can confirm it. Penn’s IRB, for example, says investigators “are not allowed to self-determine” that research with existing private data is not human subjects research, and Ohio State says investigators “are not permitted to make their own determinations of exemption.”

If you’re studying outside the US, the equivalent is a research ethics committee, and our guide to research ethics covers the principles every committee applies.

---

The three levels of IRB review

IRBs review proposed studies at one of three main levels, depending mainly on the risk to participants. The level decides how much scrutiny your application gets and how long you wait.

Level	What it means	Typical dissertation examples
Exempt	Minimal risk and fits a federal exemption category; a lighter review	An anonymous online survey of adults; interviews with adults on non-sensitive topics; analysis of de-identified existing data
Expedited	Minimal risk, not exempt, and fits one of the federal expedited categories; reviewed by one or more experienced reviewers rather than the full board	Identifiable interviews on sensitive topics; research that combines interviews with other procedures
Full board	More than minimal risk; reviewed by the whole committee at a convened meeting	Higher-risk research with prisoners or other vulnerable groups; studies that could cause distress or carry legal risk; some research with children

Federal rules also include a “limited IRB review” for certain exempt studies, such as identifiable survey or interview data, and a minimal-risk study that isn’t exempt and doesn’t fit one of the expedited categories goes to the full board. Check how your university describes its levels.

“Minimal risk” has a specific meaning: the harm or discomfort you could cause is no greater than people meet in daily life or in routine physical or psychological tests. Two details trip students up here.

First, “expedited” describes how a study is reviewed, not how fast. Under the federal rules, an expedited study goes to the IRB chair or one or more experienced reviewers the chair designates, rather than to the full committee at a meeting. That can make it quicker, because it doesn’t wait for the next meeting date. But it isn’t a fast track: the reviewers apply the same criteria as the full board, they can ask for the same revisions, and the process can still take weeks.

Second, the survey and interview exemption doesn’t cover research with children. Under the Common Rule, surveys and interviews with minors can’t be exempted on those grounds, so many studies that would be exempt with adults need expedited or full board review once participants are under 18. Classroom research on normal educational practices may still be exempt. Research with children also brings extra requirements, such as permission from a parent and the child’s own agreement (assent), so build those into your plan from the start.

Use the flowchart below as a first guess at your level, not a decision. Work through the three questions in order and notice where each answer sends you.

How long does IRB approval take?

There’s no federal deadline for an IRB decision, so the answer depends on your university and your review level. As an example, here’s what two universities publish:

• Seton Hall University’s IRB meets once a month from September to June, and asks researchers to “allow at least two months for the review process.”
• Saint Peter’s University aims to decide expedited reviews within 15 days and full board reviews within 30, while noting that these times are “not of the essence.”

The research on review times shows why a single number is hard to give. Varley and colleagues (2016) timed 277 protocols at 10 Veterans Affairs IRBs and found an average of 112 days from submission to approval, with only 18% approved within 60 days. Here’s how the median wait varied from board to board. Notice the spread, and where the 60-day goal the authors cite sits:

Those are hospital boards reviewing mostly medical studies, and the clock includes the time researchers spent on revisions and VA-specific sign-offs that add about three weeks, so read the figures as a sign of how long review can take rather than a forecast for your study.

A systematic review by Abbott and Grady (2011) of 43 studies found the same pattern across the research: US IRBs “differ in their application of the federal regulations, in the time they take to review studies, and in the decisions made.” In one study they review, six boards looking at the same surgical trial protocol asked for 121 changes between them, and 95% of those changes were requested by only one board.

What most guides leave out is the time before you submit. Your committee has to approve your proposal first, you’ll need to complete your university’s research ethics training (often CITI), and if you’re recruiting through an organization, you may need a permission letter from it. Here’s how those steps fit together:

So when you plan your timeline, count back from the date you want to start collecting data, and leave room for at least one round of revisions.

In our experience, being asked for revisions is the normal outcome, not a sign that your study is in trouble.

---

The IRB process, step by step

Every university’s process differs in the details, so check your IRB’s website first. The overall shape is much the same:

1. Get your proposal approved. Many programs require committee sign-off before you submit to the IRB. Ask your chair which comes first at your university, because it varies.
2. Complete the required training. Many universities require human subjects training, often through the CITI Program, before they’ll accept an application. Certificates expire, so check yours is current.
3. Arrange site permission. If you’re recruiting through a school, hospital or company, you’ll need a letter from someone with authority there. In our experience, some IRBs want it before they approve and others accept it afterward, so ask yours.
4. Draft the application. Most of it should come straight from your proposal: your purpose, research questions, design, sample, recruitment and data collection. Attach your consent form, recruitment materials and instruments.
5. Submit and respond. Expect the IRB to come back with questions or required changes. Answer each one directly, change every document it affects, and resubmit.
6. Receive approval, then collect data. Only start recruiting once you have the approval letter.
7. Amend if anything changes. If your design, sample, instruments or recruitment change after approval, submit an amendment before you act on the change.

The steps are the same whether your study turns out to be exempt or goes to the full board. What changes with the review level is mostly how long step 5 takes, so the care you put into steps 1 to 4 is what keeps the rounds of revisions down.

---

What goes into an IRB application

Application forms vary, but they ask the same core questions. The board wants to know who your participants are, what you’ll ask them to do, what could go wrong and what you’ll do about it. These are the fields students get stuck on most often, and what the board is looking for in each:

Field	What the IRB wants to see
Risks	The real risks, however small, each paired with a precaution. Claiming “no risk” raises a flag
Benefits	An honest statement. Often the benefit is to knowledge, not to the participant
Duration	Exactly how long participation takes, stated early and consistently
Recruitment	Who you’ll approach, how, and why they won’t feel pressured to take part
Consent	What participants are told, how they agree, and that they can withdraw
Confidentiality	Whether data is anonymous (you never know who said what) or confidential (you know, but protect it)
Data storage	Where data is kept, who can access it, and when it will be destroyed

The most useful habit is to treat the application as part of your methodology, not as separate paperwork. The design, sample and procedures you describe to the IRB should match your proposal word for word where they overlap. Much of what you write will reappear in your methodology chapter, so the work isn’t wasted.

The video at the top of this post explains the four ethical principles behind these questions: avoiding harm, informed consent, confidentiality and honesty. They’re worth knowing before you answer any of them.

---

Why IRB applications get sent back

In our experience, most send-backs come from a short list of avoidable problems. Before you submit, check your application against this list:

• Documents that don’t match. The consent form says 30 minutes and the protocol says an hour, or the recruitment email describes a different sample from the application.
• Missing site permission. You’re recruiting through an organization and haven’t included its letter (if your IRB requires it at this stage).
• Expired or missing training. Your ethics training certificate is out of date, or a co-investigator hasn’t completed it.
• A risk you haven’t named. Sensitive questions in a study you’ve described as low risk, or no plan for a participant who becomes distressed.
• Unsettled instruments. Your survey or interview guide is still a draft, so the board can’t judge what participants will face.
• Vague data handling. No clear answer on where recordings are stored, who sees them and when they’re deleted.

None of these is about the quality of your research.

They’re about consistency and completeness, which means a careful read-through before you submit catches most of them.

Research on what boards question most often points the same way. Lidz and colleagues (2012) observed 104 protocol reviews at 10 US academic medical centers and recorded, for each issue a board had grounds to raise, how often it asked questions or requested changes. Look at how far the first bar stands out:

In these mostly clinical reviews, consent drew questions most often, so treat your consent form as the document most likely to come back. Build it from your IRB’s template if it has one, and check every detail in it, from duration to data storage, against your protocol.

---

Researching your own workplace

Many doctoral students, especially in education, nursing and business, study the organization they work in. It gives you access and insight, but it raises ethical questions that an IRB will ask about.

Justine Mercer’s study of insider research in educational institutions (2007) likens it to “wielding a double-edged sword”: insiders “may enjoy easier access and greater rapport,” but participants have had years to form views of them. Add a reporting line between you and a participant, and that familiarity can make it hard for them to say no.

Expect your IRB to ask how you’ll handle:

• Pressure to participate. If you manage or supervise any potential participants, they may feel they can’t refuse. Recruiting through a neutral third party, or excluding people who report to you, are common answers.
• Site permission. You’ll need approval from someone with authority over the site, separate from your own role there.
• Confidentiality in a small setting. In a single school or ward, a job title or a quote can identify someone. Plan how you’ll report findings so colleagues can’t recognize each other.

None of this rules out studying your own workplace. It just means answering these questions in your application before the board has to ask them: describe your role, how you’ll recruit without pressure and how you’ll protect identities. A board that sees you’ve thought it through is far more likely to approve it first time.

---

Mistakes that cost students months

These are the mistakes we see most often in coaching sessions. Each one can cost weeks, and some can cost you your data:

• Collecting data before approval. Interviews done or surveys sent before the IRB says yes usually can’t be used, however good they are.
• Treating a click as consent without planning it. An online survey can open with a consent page, but the IRB has to approve that process and wording, just like a signed form.
• Assuming “exempt” means no rules. Most universities still require an IRB determination for an exempt study, and ethically you still owe participants a clear explanation and confidentiality.
• Assuming your approval covers a changed study. Approval is for the study you described. A new instrument, sample or recruitment route needs an amendment first.
• Leaving the application until the proposal is finished. Prepare it alongside your final proposal revisions, so you can submit as soon as your committee signs off.

One distinction is worth holding onto: after approval, your analysis plan can usually evolve, but your sample, recruitment and instruments can’t change without the IRB’s agreement.

If you’d like a second pair of eyes on your application before it goes in, our coaches help students prepare their proposals and ethics applications. We’ll check it against what boards ask for, so it goes in complete the first time.

Still have questions?

How long does IRB approval take?

It varies by university and review level, and there’s no federal deadline. Some universities advise allowing at least two months, and a study may need one or more rounds of revisions.

What research doesn’t need IRB approval?

Research that doesn’t involve human subjects, such as analysis of published documents or data with no way to identify anyone, may not need IRB review. Some activities aren’t “research” under federal rules either. Your university’s IRB makes that determination, so ask it to confirm before you skip review.

Can I collect data before IRB approval?

No. You shouldn’t recruit participants or collect data until you have IRB approval, and data collected beforehand usually can’t be used in your dissertation. Piloting with real participants needs approval too, so check with your IRB first.

How hard is it to get IRB approval?

In our experience, approval itself isn’t the hard part for a minimal-risk dissertation; the delays come from applications that are incomplete or inconsistent. Expect at least one round of revisions and treat it as normal. Studies with more than minimal risk, or with children or other vulnerable groups, get closer scrutiny and take longer.

What is IRB exemption category 2?

It’s the federal exemption that covers research involving only educational tests, surveys, interviews or observation of public behavior. It applies when participants can’t readily be identified, when disclosing their answers wouldn’t put them at legal, financial, employment, educational or reputational risk, or when the IRB carries out a limited review of identifiable data. It doesn’t cover surveys or interviews with children, and your IRB decides whether your study qualifies.

Exempt vs expedited review: what’s the difference?

Both apply to minimal-risk research. Exempt studies fit one of the federal exemption categories and get a lighter review; expedited studies don’t fit an exemption but do fit one of a separate list of expedited categories, and are reviewed by one or more experienced reviewers. A minimal-risk study that fits neither goes to the full board. “Expedited” describes the type of review, not how fast it is.

Do I need IRB approval for a survey?

Usually, yes, if you’re surveying people for research. An anonymous survey of adults on a non-sensitive topic is often exempt, but the IRB still has to confirm that. Surveys of children, or surveys that collect sensitive answers people could be identified from, typically need a fuller review.

What happens if the IRB rejects my study?

In our experience, outright rejection is uncommon. Far more often, the IRB asks for changes, and you revise and resubmit. If a board does disapprove a study, it gives its reasons, and you can usually redesign the study to address them and apply again.

Can’t find your answer here? Ask a Grad Coach directly – the initial chat is free.

Speak with a friendly coach →