IRB Continuing Review for Greater-Than-Minimal-Risk Studies: The Annual Floor, the Expiration Cliff, and What Still Needs Renewing

At a glance

• For greater-than-minimal-risk research, the floor is not-less-than-annual continuing review. Under FDA’s 21 CFR Part 56, the IRB must review “at intervals appropriate to the degree of risk, but not less than once per year.” The same annual floor for convened-IRB research appears in the revised Common Rule at 45 CFR 46.109(e).
• “Greater than minimal risk” is the trigger that locks in annual review: because the study cannot be handled by expedited review, it stays on the convened IRB’s calendar and does not fall into the Common Rule’s no-continuing-review carve-out.
• Approval is time-limited. When it lapses, you have no current IRB approval, and an investigator’s duty to keep the study under continuing IRB review (21 CFR 312.66; ICH E6(R3) §3.1) does not pause for an administrative miss.
• The 2018 Common Rule did remove mandatory continuing review for many minimal-risk, expedited, and data-analysis-only studies (45 CFR 46.109(f)(1)), but FDA-regulated trials under Part 56 did not adopt that carve-out, so dual-regulated drug and device trials still get reviewed annually.
• Treat the renewal as a calendar-driven workflow with a 30-to-45-day filing buffer, a named owner, and a fixed submission packet, not a once-a-year scramble.

This is a workflow article, not a glossary. If you run open, enrolling, greater-than-minimal-risk studies, your real question is not “what does continuing review mean” but “when is mine due, what do I file, and what breaks the day it lapses.” Here is the operational answer.

The one-line answer: at least once a year, because the risk level locks it in

The exam-stem version of this question (“continuing review of an approved protocol must be conducted how often?”) has a clean regulatory answer for greater-than-minimal-risk work: at least once per year. FDA’s 21 CFR Part 56 requires that an IRB conduct continuing review of research at intervals appropriate to the degree of risk, but not less than once per year. The revised Common Rule states the same annual floor for research that requires review by the convened IRB at 45 CFR 46.109(e).

The phrase “greater than minimal risk” is doing the load-bearing work here. Minimal risk means the probability and magnitude of harm or discomfort anticipated are not greater than those ordinarily encountered in daily life or during routine physical or psychological examinations (21 CFR 56.102; 45 CFR 46.102). A study that exceeds that threshold cannot be handled through expedited review, so it stays with the convened board and inherits the convened board’s annual obligation. The risk label is not a one-time approval stamp; it is the switch that keeps your study on the renewal calendar for its entire active life.

ICH E6(R3) frames the same duty in process terms: the IRB/IEC should conduct continuing review of each ongoing trial at intervals appropriate to the degree of risk to participants (E6(R3) §1.2.4), and trials should be subject to periodic IRB/IEC review in accordance with applicable regulatory requirements (E6(R3) §3.2). E6(R3) sets the expectation of ongoing oversight; Part 56 and the Common Rule set the hard annual number.

What the IRB re-reviews (not a rubber stamp)

Continuing review is a substantive re-approval, not a date extension. The IRB’s review-and-approve authority over all covered research activities is the same authority it exercised at initial review (21 CFR 56.109; 45 CFR 46.109(a)), and at renewal it re-applies the approval criteria to the study as it now stands.

Build your renewal packet around what the board actually weighs:

• Enrollment to date against the approved target, and whether accrual is on track.
• Adverse events and unanticipated problems involving risks to subjects or others since the last review. Under both regimes the investigator must promptly report these and any changes in the research, and may not make changes without IRB approval except to eliminate apparent immediate hazards to subjects (21 CFR 312.66; 45 CFR 46.108).
• Protocol deviations and any approved amendments since the last review.
• The current, IRB-approved consent document, plus any new risk information that should reach subjects. The IRB can require that information be added to consent when, in its judgment, it would meaningfully add to subject protection (21 CFR 56.109; 45 CFR 46.109(b)).
• Complaints, withdrawals, and a short progress summary putting the numbers in context.

If something in that packet shifts the risk-benefit balance, the IRB can require modifications, and it retains authority to suspend or terminate approval of research not conducted per its requirements or associated with unexpected serious harm to subjects (21 CFR 56.113; 45 CFR 46.113). Treat the renewal as the board’s scheduled chance to act on accumulated risk, and write it accordingly.

The expiration cliff: what legally happens the day approval lapses

This is the part the exam-answer pages skip, and it is the part that ends careers in clinical ops. IRB approval is granted for a defined period. When that period ends without a re-approval on file, you do not have “approval pending”; you have no current approval.

The regulatory mechanism is straightforward. ICH E6(R3) §3.1 requires that a trial be conducted in compliance with the protocol that received prior IRB/IEC approval/favourable opinion, and §2.4.2 requires a documented, dated IRB/IEC approval before initiating the trial. For FDA-regulated drug trials, 21 CFR 312.66 makes it the investigator’s own assurance that an IRB complying with Part 56 is responsible for the initial and continuing review and approval of the study. None of those obligations are satisfied by an expired approval. The practical consequence: research activities that depend on current approval stop. New enrollment stops. Study-specific interventions and procedures done solely for the research stop.

The one narrow exception is safety. Both FDA and the Common Rule build in the same carve-out for changes “necessary to eliminate apparent immediate hazards to the human subjects” (21 CFR 312.66; 45 CFR 46.108). That is the legal hook for continuing to protect a subject already exposed, for example completing a taper or providing follow-up care that protects someone mid-treatment. It is not a license to keep enrolling or to keep running the protocol because stopping is inconvenient. A lapse is reportable, disruptive, and entirely preventable.

Lapse playbook (callout)

• Stops immediately: new enrollment, research-only interventions and procedures, and any study activity that requires current IRB approval.
• May continue, narrowly: actions necessary to protect the safety of already-enrolled subjects, under the immediate-hazards exception. Document the clinical rationale contemporaneously.
• Reinstate: file the continuing review as a lapse, notify your IRB per its SOP, do not backdate, and expect to account for any activity during the gap. Re-approval restores normal operations; it does not retroactively bless work done without approval.

FDA vs. the 2018 Common Rule: still mandatory vs. no longer required by default

Here is the reconciliation the quiz pages never make, and getting it wrong leads teams to over-comply or under-comply.

The 2018 revised Common Rule genuinely narrowed continuing review. Under 45 CFR 46.109(f)(1), unless the IRB determines otherwise, continuing review is not required for research eligible for expedited review, research undergoing limited IRB review, or research that has progressed to data analysis only or to accessing follow-up clinical data from procedures subjects would undergo as part of clinical care. For many minimal-risk and late-stage studies under Common-Rule-only oversight, annual renewal stopped being automatic on and after January 21, 2019.

FDA did not adopt that carve-out. 21 CFR Part 56 continues to require continuing review at intervals appropriate to risk but not less than once per year, with no equivalent “not required” provision (21 CFR 56.109). So the two in-scope regimes diverge on the same point: the Common Rule eliminates default continuing review for certain studies (45 CFR 46.109(f)(1)), while Part 56 still mandates not-less-than-annual review for FDA-regulated investigations (21 CFR 56.109). This is a genuine tension between the in-scope regulations, not a drafting nuance to smooth over. Where a study is both FDA-regulated and Common-Rule-covered, such as a federally funded drug or device trial, you do not get to pick the lighter rule: the FDA annual floor still applies. And critically for this article’s audience, the Common Rule relief is aimed at expedited and minimal-risk work; a greater-than-minimal-risk study does not qualify for the 46.109(f)(1) carve-out in the first place, which is exactly why the risk level keeps it on the annual calendar.

Use this to scope your own studies:

Risk level	FDA-regulated (Part 56)	Common-Rule-only, post-2019 (45 CFR 46)	Continuing review required?	Interval
Greater than minimal risk (convened IRB)	Yes	Yes	Yes, both regimes	Not less than once per year
Minimal risk, expedited-eligible	Yes	n/a	Yes (FDA has no carve-out)	Not less than once per year
Minimal risk, expedited-eligible	n/a	Yes	Not required unless IRB decides otherwise (46.109(f)(1)(i))	n/a by default
Data-analysis-only / follow-up clinical data	Yes	n/a	Yes (FDA has no carve-out)	Not less than once per year
Data-analysis-only / follow-up clinical data	n/a	Yes	Not required unless IRB decides otherwise (46.109(f)(1)(iii))	n/a by default
Dual-regulated (FDA + Common Rule)	Yes	Yes	Yes (FDA floor governs)	Not less than once per year

When in doubt, your IRB’s determination controls the cadence, because both regimes let the IRB require review more often than annually and require it to keep written procedures for which projects need that closer scrutiny (21 CFR 56.108; 45 CFR 46.108).

The continuing review submission and the lead-time buffer

Renewal failures are almost never substantive; they are calendar failures. The fix is operational discipline.

Own the calendar explicitly. In most sites the coordinator owns the renewal tracker and the PI owns the sign-off, but the failure mode is a study where everyone assumes the other person is watching the expiration date. Assign it by name. Set your internal trigger 30 to 45 days before the IRB-stated expiration date so there is room for a convened-board meeting cycle, IRB-requested clarifications, and PI review, none of which run on your schedule.

What to file (the copy-ready checklist):

• Enrollment to date versus approved target, with current accrual status.
• Adverse events and unanticipated problems since the last review, with the reportable ones already submitted.
• Protocol deviations since the last review, with corrective actions.
• Amendments approved since the last review, reflected in the current documents.
• Current IRB-approved consent form, plus any new risk information warranting re-consent.
• Complaints and withdrawals since the last review.
• Progress summary putting the numbers in context for the reviewer.
• Lead-time check: submitted 30 to 45 days before the expiration date on the current approval letter.

This packet maps directly to the records the IRB itself must keep, including progress reports submitted by investigators and records of continuing review activities (21 CFR 56.115; 45 CFR 46.115), so filing it cleanly serves both your study and the board’s recordkeeping obligations.

Adjacent workflows worth keeping tight alongside renewals: protocol deviation logging, adverse event and unanticipated problem reporting, informed consent re-consent when new risk information emerges, and protocol amendment submissions. Each of those feeds the continuing review packet, and a gap in any of them shows up at renewal.

Where teams get it wrong

• Treating “greater than minimal risk” as a label instead of a trigger. It is the reason your study cannot use the Common Rule carve-out and stays on the annual calendar.
• Assuming the 2018 Common Rule relief applies to an FDA-regulated trial. Part 56 kept the annual floor; the carve-out at 45 CFR 46.109(f)(1) does not reach Part 56 investigations.
• Believing a filed-but-not-yet-approved renewal keeps the study live. Approval is the operative event; a pending submission is not current approval.
• Backdating or quietly continuing through a lapse. Only immediate-hazard safety actions survive a lapse, and even those must be documented and reported.
• Filing on the expiration date. Convened boards meet on their own cadence; a same-week submission has no margin for IRB questions.

Renewal is not a compliance certificate you earn once. Keeping continuing IRB approval current is an ongoing investigator responsibility under both ICH E6(R3) and the in-scope FDA rule; the calendar discipline above is how you discharge it.

Sources

• ICH E6(R3) Good Clinical Practice, version r3, ICH — https://www.ich.org/page/efficacy-guidelines
• 21 CFR Part 56 Institutional Review Boards, version 2024, FDA — https://www.govinfo.gov/content/pkg/CFR-2024-title21-vol1/pdf/CFR-2024-title21-vol1-part56.pdf
• 21 CFR Part 312 Investigational New Drug Application, version 2026-04, FDA
• 45 CFR 46 Protection of Human Subjects (Common Rule), version 2018, HHS — https://www.govinfo.gov/content/pkg/CFR-2024-title45-vol1/pdf/CFR-2024-title45-vol1-part46.pdf