The IRB Approval Lifecycle: Keeping Approval Continuously Valid Through Continuing Review, Amendments, and the Lapse You Must Avoid

At a glance

• IRB approval is not a one-time gate. It is a clock you keep winding: an initial-review track sets the rules, a recurring continuing-review deadline keeps approval alive, and event-driven amendment and prompt-report triggers fire in between.
• Your review track (full board, expedited, or exempt) is determined by risk and category, and it is the IRB’s determination to make, not yours. The greater-than-minimal-risk line is the fault line.
• Continuing review under FDA’s 21 CFR 56.109(f) must happen at intervals appropriate to risk and not less than once per year. There is a real cross-regulation tension here with the Common Rule that this guide spells out.
• Not every change is the same submission. A protocol change usually needs prospective IRB approval; an unanticipated problem or safety event is a prompt report. The one carve-out: you may act first to eliminate an immediate hazard, then report.
• The failure mode academic IRB pages bury: when approval expires, research activity must stop. Build a submission calendar that treats the continuing-review date as a hard stop, not a reminder.
• This is a compliance explainer for what the regulations require. No software, SOP, or calendar “makes you compliant.” The sponsor and investigator remain responsible.

This guide is written for the people who actually keep a study’s IRB relationship valid day to day: clinical research coordinators, site and sponsor regulatory and QA staff, and clinical-ops leads juggling continuing-review dates and amendments across multiple sites. The thesis is simple. Treat the IRB relationship as one continuous lifecycle, not three disconnected “how to submit” tasks. Most of the pages you find online cover one stage in isolation and assume a single local IRB and a lone academic researcher. The industry reality is a central IRB, a sponsor, several sites, and an investigator who carries a personal reporting duty. Miss the lifecycle view and you will eventually let approval lapse.

The IRB approval lifecycle at a glance

Picture the flow as a loop, not a line:

Initial submission to the IRB, then the IRB’s documented decision (approval, modifications required, or disapproval), then ongoing conduct, then the continuing-review loop that repeats at a set interval, with amendment submissions and prompt reports branching off whenever a trigger fires, and finally study closeout.

Three things drive the loop. ICH E6(R3) §1.2.2 lists what the IRB/IEC reviews up front: the protocol and amendments, the informed consent and assent materials and any updates, the Investigator’s Brochure or current product information, recruitment advertisements, and ongoing safety updates. ICH E6(R3) §1.2.3 then requires the IRB to document each review and clearly identify the trial, the documents reviewed, and the dates, recording its decision as an approval, a request for modifications, a disapproval, or a termination or suspension of a prior approval. That documented decision, with its date, is what your calendar hangs on.

The recurring engine is continuing review. ICH E6(R3) §1.2.4 requires the IRB/IEC to conduct continuing review of each ongoing trial at intervals appropriate to the degree of risk to participants. Everything else in the lifecycle, amendments and prompt reports, is event-driven: it fires when something changes or something goes wrong, independent of the continuing-review clock.

Step 1 — Pick the right review track: full board, expedited, or exempt

Your first question is which track your study falls into, because the track sets the cadence and the mechanics for everything downstream. The determining factor is risk, and the controlling line is “minimal risk.” Under 21 CFR 56.102(i), minimal risk means the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during routine physical or psychological examinations. The Common Rule uses the same definition in 45 CFR 46.102(j).

Use this decision table as a starting frame. The IRB makes the final call.

Track	When it applies	Who reviews	Practitioner note
Full board	Greater-than-minimal-risk research, and anything not eligible for expedited or exempt handling	Convened IRB with quorum	Under 21 CFR 56.108(c), approval requires a majority of members present at a convened meeting that includes a nonscientific member
Expedited	Certain minimal-risk research on FDA’s published category list, and minor changes to already-approved research	IRB chair or designated experienced reviewer	Under 21 CFR 56.110(b), an expedited reviewer may exercise all IRB authorities except disapproval; only the convened board can disapprove
Exempt	Narrow categories defined by regulation (for FDA, e.g., emergency use reported within 5 working days, and certain food evaluations)	Determination, not full review	Under 21 CFR 56.104, exemption is a regulatory determination; do not self-certify, let the IRB confirm

A key practitioner caution: expedited does not mean “you decide.” Under 21 CFR 56.110(b), the expedited route is available for listed minimal-risk research and for minor changes in previously approved research during the approval period, and the reviewer cannot disapprove. If a change is more than minor, or risk is more than minimal, it goes to the convened board.

Step 2 — Initial review: what the IRB must find before it approves

Before the IRB approves, it must affirmatively find that a defined set of criteria is satisfied. Under 21 CFR 56.111(a), the IRB must determine that risks to subjects are minimized, that risks are reasonable in relation to anticipated benefits, that selection of subjects is equitable, that informed consent will be sought from each subject or legally authorized representative, and that consent will be appropriately documented. Read those as the rubric your submission is graded against. If your protocol does not let the board make each finding, it will come back as “modifications required,” not “approved.”

Informed consent enters the lifecycle here, as an IRB approval criterion. We treat consent drafting as a sibling topic; for the IRB relationship, the load-bearing rule is timing. Under ICH E6(R3) §2.4.2, before initiating a trial the investigator must have documented and dated IRB/IEC approval for the protocol, the informed consent materials, and recruitment procedures. You cannot enroll on a verbal “we are fine with it.” You need the dated approval of the specific consent version in hand.

This is also where the multi-site picture matters. In an industry trial, the entity that holds the IND commits, under 21 CFR 312.23(a)(1)(iv) of the IND content rules, that an IRB complying with Part 56 will be responsible for the initial and continuing review and approval of each study, and that the investigator will report proposed changes to the IRB. Whether you run a single central IRB across sites or local IRBs per site, that Part 56 obligation attaches to every site’s research.

Step 3 — The continuing-review clock: when it is due and what the IRB re-checks

Continuing review is the heartbeat. Under 21 CFR 56.109(f), the IRB must conduct continuing review of research at intervals appropriate to the degree of risk, but not less than once per year. “Not less than once per year” is the outer bound; a higher-risk study can be put on a shorter interval. ICH E6(R3) §1.2.4 frames the same duty in risk-based terms.

What the IRB re-evaluates at continuing review tracks the original approval criteria: is risk still minimized and still reasonable against benefit, is consent still adequate, and have local issues or new safety information changed the picture. Your continuing-review submission should therefore carry, at minimum, enrollment progress, a summary of adverse events and any unanticipated problems, any amendments since last review, and the current consent version.

A continuing-review readiness checklist you can lift:

• Confirm the exact expiration date of current approval from the IRB’s dated decision letter, not from memory.
• Submit early enough for the convened board’s meeting calendar; build in a re-review cycle if modifications come back.
• Include enrollment numbers, withdrawals, and completion status.
• Summarize adverse events, serious adverse events, and any unanticipated problems reported since last review.
• List every amendment approved since the last continuing review.
• Attach the current IRB-approved consent form and confirm no participant signed a superseded version.
• Note any new safety information from the Investigator’s Brochure or sponsor safety letters.

The enrolling-versus-not nuance is where the two US regimes diverge, and you should know it cold. Under the Common Rule, 45 CFR 46.109(f) says that unless the IRB determines otherwise, continuing review is not required for research eligible for expedited review or for certain limited-review studies. FDA’s Part 56 contains no equivalent blanket exception: 21 CFR 56.109(f) requires continuing review not less than once per year for the research it covers. So for an FDA-regulated drug or device study, do not assume the Common Rule’s “no mandated continuing review” relief applies. This is a real cross-regulation tension, and it is surfaced, not reconciled, below.

Step 4 — Amendments versus prompt reports: different triggers, different timelines

Teams conflate these constantly, and the conflation causes both over-submission and dangerous under-submission. They are different mechanisms with different triggers.

An amendment is a planned change to approved research. The rule is prospective approval. Under ICH E6(R3) §1.4.7, no deviation from or change to the protocol should be initiated without prior documented IRB/IEC approval of an appropriate protocol amendment, except when necessary to eliminate an immediate hazard to participants or, where allowed, when the change is purely logistical or administrative. The investigator’s side of this is explicit in ICH E6(R3) §2.4.6: the investigator or sponsor should promptly communicate to the IRB any changes significantly affecting the conduct of the trial or increasing risk to participants.

A prompt report is a notification that something happened, not a request to change the protocol. Under ICH E6(R3) §1.4.8, the investigator or institution should promptly report to the IRB deviations made to eliminate immediate hazards, changes increasing risk or significantly affecting trial conduct, suspected unexpected serious adverse reactions, and new information that may adversely affect participant safety or trial conduct.

The one carve-out that links them is the immediate-hazard exception. Under ICH E6(R3) §2.5.4, the investigator should follow the protocol and deviate only where necessary to eliminate an immediate hazard, informing the sponsor promptly. Under ICH E6(R3) §2.5.5, the investigator should then report the hazard, the change implemented, and any subsequent proposed amendment to the IRB. In other words, you may act first to protect a participant, then you must report and, if the change is to persist, formalize it as an amendment.

Change or event	Action	Prospective IRB approval first?	Timing
Planned protocol change (eligibility, dosing, procedures)	Submit amendment	Yes (ICH E6(R3) §1.4.7)	Before implementation
Minor change to approved research	Amendment, may be expedited	Yes, but expedited review available (21 CFR 56.110(b))	Before implementation
Deviation to eliminate an immediate hazard	Act, then prompt report	No, act first (ICH E6(R3) §2.5.4)	Report promptly after (ICH E6(R3) §2.5.5)
Unanticipated problem / risk-increasing event	Prompt report	No (it is a notification)	Promptly (ICH E6(R3) §1.4.8)
Suspected unexpected serious adverse reaction (SUSAR)	Prompt report	No	Promptly per applicable rules (ICH E6(R3) §1.4.8)

The failure mode nobody pages on: expiration and lapse of approval

Here is the section most pages skip. IRB approval has an expiration date, and when it lapses, you do not get a grace period.

The mechanism is continuing review. Because 21 CFR 56.109(f) requires continuing review not less than once per year, your approval is granted for a period, and that period ends. If you have not secured re-approval by the expiration date, approval has lapsed. And the foundational requirement is unambiguous: under 21 CFR 56.103(a), an FDA-regulated clinical investigation requiring prior submission must not be initiated unless it has been reviewed and approved by, and remains subject to continuing review by, an IRB. “Remains subject to continuing review” is the operative phrase. Without current approval, the research is no longer covered.

Practically, that means research activity must stop: no new enrollment, and no research procedures, when approval has lapsed. The narrow, judgment-bound carve-out concerns already-enrolled participants for whom stopping would itself create a hazard. ICH E6(R3) §2.5.4 lets the investigator deviate to eliminate an immediate hazard to participants, which is the doctrine you lean on to continue a medically necessary intervention for an enrolled subject during a lapse, while you report under ICH E6(R3) §2.5.5 and rush re-approval. This is not a loophole to keep a study running. It is a participant-protection valve, and you document it.

Re-approval mechanics are simply continuing review under time pressure. The fix is calendar discipline, not heroics: anchor every study to its dated approval letter, submit well ahead of the convened board’s meeting schedule, and never let a continuing-review packet sit in someone’s inbox. In multi-site work, track each site’s expiration separately even under a single central IRB, because a lapse is site-specific in its operational effect.

Investigator and sponsor responsibilities to the IRB

In an industry trial the duties are distributed, and the investigator’s personal duty is the one teams forget. Under 21 CFR 312.66, the investigator must assure that an IRB complying with Part 56 is responsible for the initial and continuing review and approval of the study, must promptly report to the IRB all changes in the research activity and all unanticipated problems involving risk to subjects or others, and must not make any changes in the research without IRB approval except where necessary to eliminate apparent immediate hazards. That is a duty the investigator signs up to personally, reinforced by the Form FDA-1572 investigator commitment.

The sponsor carries parallel obligations through the IND. Under 21 CFR 312.23(a)(1)(iv), the sponsor commits in the IND that a compliant IRB will handle initial and continuing review for each study and that the investigator will report proposed changes per Part 56. Central-versus-local IRB choice does not dilute any of this: whether one central IRB serves every site or each site uses its own, the Part 56 review-and-report machinery applies to that site’s research, and someone must own each site’s continuing-review calendar.

Where teams get it wrong

• Treating approval as permanent. The most common and most damaging error. Approval is time-boxed by 21 CFR 56.109(f); plan for re-approval from day one.
• Reading the Common Rule’s continuing-review relief into an FDA study. 45 CFR 46.109(f) drops mandated continuing review for expedited and limited-review research; 21 CFR 56.109(f) does not. For drug and device trials, follow Part 56.
• Calling a prompt report an amendment, or vice versa. A planned change needs prospective approval (ICH E6(R3) §1.4.7). An event that already happened needs a prompt report (ICH E6(R3) §1.4.8). Misfiling one as the other either stalls a needed change or buries a safety signal.
• Implementing a change before approval. Only the immediate-hazard exception (ICH E6(R3) §2.5.4 and §2.5.5) lets you act first, and even then you report and formalize after.
• Self-certifying exempt or expedited status. Exemption is a regulatory determination under 21 CFR 56.104, and disapproval authority stays with the convened board under 21 CFR 56.110(b). Let the IRB make the call.

One closing reminder on framing. Nothing here certifies a study as compliant. The regulations define what the IRB must find, when continuing review is due, and which changes need prospective approval. Meeting those requirements is the sponsor’s and investigator’s continuing responsibility, supported by good calendars and SOPs but never replaced by them. Related topics on this site, including the informed consent explainer, the protocol deviations and amendments guide, and prompt and safety reporting, go deeper on the branches this lifecycle only frames.

Sources

• ICH E6(R3) Good Clinical Practice (version r3, ICH) — https://www.ich.org/page/efficacy-guidelines
• 21 CFR Part 56 Institutional Review Boards (version 2024, FDA) — https://www.govinfo.gov/content/pkg/CFR-2024-title21-vol1/pdf/CFR-2024-title21-vol1-part56.pdf
• 21 CFR Part 312 Investigational New Drug Application (version 2026-04, FDA)
• 45 CFR 46 Protection of Human Subjects (Common Rule) (version 2018, HHS) — https://www.govinfo.gov/content/pkg/CFR-2024-title45-vol1/pdf/CFR-2024-title45-vol1-part46.pdf