Frequently Asked Questions - IRB


  • All data is governed by University policy and guidelines, not those of the IRB. IRB approval is completely separate from the approval of data requests. The IRB has no control over your access to data for your research. Institutional Research (IR) and the appropriate data steward (the Registrar in the case of student academic records), not the IRB, will make the decision on whether to grant your data request (see the data governance document here: and IRB approval merely documents that your study is designed with the ethical considerations necessary to protect your participants and any data you accumulate during your project. IR does want to see your IRB approval so that they know you have the appropriate plan in place to guard any data that they may release to you, but IRB approval is not the imprimatur for data release in and of itself

    Please also consult our student data information page for more details and a link to the FERPA consent form.

  • The University does not release FERPA-protected data without consent unless it is for an institutional purpose (see the data governance document here: and Note that the IRB has no purview over the data or its release. If you need identifiable data for your individual research project, we suggest you obtain consent from the relevant students for the particular pieces of data you need, then present that list of students to Institutional Research (IR) with documentation of the consent. The data belong to the student(s), and their consent is needed for the data to be released. The IRB office is able to help you craft the appropriate consent for your study, which needs to be signed (on paper or electronically with authentication of the identity of the student).

    Please also consult our student data information page for more details and a link to the FERPA consent form.

  • FERPA regulations dictate that directory information may be released without specific consent of the student, but that other components of a student record cannot (note that email addresses are not designated as directory items). Student data can be released for a “legitimate educational interest.” This would apply to the need for data to help the student in question (e.g., for advising) or for programmatic assessment, but not necessarily apply to academic pursuits that improve instruction in a general sense. To be able to release data without student consent for research to improve instruction, a university needs to declare this purpose in their annual FERPA notification. Please see and for more information about how FERPA regulations are applied at KSU. Note that student consent is required first, not that the data are never to be released. In addition, remember that the IRB does not have a role in faculty access to University data, other than ensuring protections for participants and their data.

    Please also consult our student data information page for more details and a link to the FERPA consent form.

  • Yes, you need to secure IRB approval for your project before requesting data. Part of the IRB approval process is an evaluation of your data security and retention plan, which is a very important part of research ethics with sensitive data and needs to be in place before you begin the project. Data requests go through Institutional Research ( They will need an IRB approval letter to fulfill any requests for sensitive information for a research project. IR will consult with the appropriate data steward and the University Data Governance committee. Student data cannot be released without consent, except for very limited purposes. The policy and guidelines for data release are determined at the University level, not by the IRB. The IRB has no control over your access to data for your research.

    Please also consult our student data information page for more details and a link to the FERPA consent form.


  • IRB review and approval is required for projects that:

    1. Meet the federal definition of research

    Federal regulations define research as "a systematic investigation, including development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."


    2. Involve human subjects

    Federal regulations define a human subjects as "a living individual about whom an investigator conducting research obtains (1) data through intervention or interaction with the individual or (2) identifiable private information."

  • Instructions for IRB application submission can be found here: Please note that while student investigators can prepare their IRB application and supporting documents, they are not authorized to submit their IRB application directly. The student's faculty advisor must first review and certify via Cayuse.  

  • There are three (3) types of review paths for an IRB application: Full Board, Expedited and Exempt. Please visit IRB Review Classifications for more information about these three types of human subjects review.  Very few projects require a Full Board Review, so please submit your documentation as soon as it is completed as the IRB reviews applications in the order they are received.  If you do not receive an email response within 10-14 business days of your submission, please contact us for a status update.
  • No. Federal regulations identify specific categories of research activities that are exempt from the federal regulations on the protection of human subjects in research. While a project may be exempt from the regulations, the ethical principles of conducting research with humans still apply (minimizing risk, maximizing benefit, ensuring privacy and secure data storage) and all of the rights and protection afforded to human subjects in research are required in exempt status cases. 

    The IRB (not the investigator) decides whether a particular study can be classified as exempt. Therefore, even if an investigator is certain that a research project qualifies as an exempt study, it must be submitted to the IRB for review. If the research is determined to be exempt, written approval will be provided to the investigator.

  • No. Expedited Review is for research projects that may be reviewed and approved without convening a meeting of the entire IRB. The term "expedited" can be misleading: reviews of this type are not "quicker" or conducted with less rigor. Rather, fewer reviewers are required. Expedited review can be considered when research activities present no more than minimal risk to human subjects and involve only procedures listed in one or more of the expedited review categories.
  • Per 45 CFR 46.102(i), minimal risk means that the probability and magnitude of harm or discomfort anticipated in the research are not greater in and of themselves than those ordinarily encountered in daily life or during the performance of routine physical or psychological examinations or tests.
  • Class projects or assignments involving human subjects are generally conducted for educational purposes or training solely to fulfill a course requirement; as such, an element of the definition of research - the intent to develop or contribute to generalizable knowledge - is lacking, so these activities do not meet the regulatory definition of research.  Therefore, most student class projects or assignments can be excluded from the requirement to submit an IRB application for review and approval; however, there are specific parameters that must be reviewed and followed to confirm exclusion from review.  

    Also to be considered is when faculty develop course-related activities or students propose independent research projects that are designed to provide opportunities to practice research methods (e.g., interview, observation and survey techniques, data analysis, and research design). If such class projects involve human subjects and systematic research methods, but are conducted primarily for instructional purposes, are limited in scope, present no more than minimal risk to participants, do not involve vulnerable populations and do not lead to generalizable results to be distributed outside the classroom, then they should also be eligible for exclusion from review.

    Please review the Student Class Project Guidelines & Procedures for more information and contact the IRB with any questions.  A faculty member must supervise all student class projects and both must follow the responsibilities detailed under the guidelines.

    NOTE:  Regardless of whether the class project or assignment falls under IRB review, it is expected that KSU students, faculty or staff will uphold the same ethical treatment of those participants as projects that are reviewed by the IRB.

  • Student research projects are reviewed in the same way as any other human subjects research conducted by faculty or staff. Any project conducted under the auspices of the college that meets the federal definition of research (systematic investigations leading to generalizable results) involving human subjects (living people whose personal data or private information are the subject of the investigation) requires review and approval by the IRB. 

    Examples of student research projects that require IRB review include systematic investigations with human subjects that will result in:

    • Publication (e.g., journals, books, electronic media, websites, blogs and student theses) or public presentation (i.e., outside the classroom and/or institution) of findings.
    • Preservation of data or information that may be included in a longer-term generalizable research project by the faculty or another researcher.

    Student investigators (after consultation with their faculty advisors) who are planning to conduct a research project involving human subjects must prepare an IRB application for their faculty advisors to submit on their behalf for review and approval prior to initiating any research activity/study procedures intended to produce generalizable knowledge. 

  • The faculty advisor is an active mentor to the student researcher and shares the responsibility for the ethical conduct of the research with the student. The advisor is expected to be familiar and discuss with the student researcher the ethical and regulatory requirements of human subjects research prior to the initiation of any project involving human subjects, help students determine whether their project requires Institutional Review Board (IRB) review and guide students through the IRB application process. The advisor must support the student in the conduct of the research project after IRB approval is attained, giving special attention to maintaining participant protections (including privacy, confidentiality and informed consent), minimizing risk and ensuring voluntary participation and withdrawal. It is also the faculty advisor’s responsibility to assure that ongoing IRB reporting requirements (e.g., unanticipated problems, continuing reviews, study closure, etc.) are met in a timely manner, even after the student graduates.

    While student investigators can prepare their IRB application and supporting documents, they are not authorized to certify their IRB application. The faculty advisor must certify the IRB application via Cayuse on the student's behalf. 

  • IRB review is required for research projects that involve human subjects and meet the federal definition of research, which is defined as “a systematic investigation designed to develop or contribute to generalizable knowledge.” Generalizable knowledge applies to research projects in which the researcher intends to draw conclusions that will contribute to general knowledge in the field or apply the findings to a larger population. Generalizable knowledge also occurs when the researcher intends to share the results with an audience outside the classroom or beyond those participating in the study, such as through journal articles, presentations at conferences or an online repository. As a result, if a student’s thesis involves human subjects research, IRB approval must be secured before that work can be made openly available in any way.

    If there is even a remote chance that the data or the report/manuscript will be used in the future for a conference presentation, scholarly journal or a related research project, then your project must be reviewed by the IRB prior to data collection.

  • If data collection will occur through the use of an online survey, special attention must be paid to how a participant’s data will be secured. This entails having a familiarity with the survey software being used, the types of information being collected (IP address, email address), the options the survey software provides regarding what information to collect, the ways in which information will be stored, how any identifying information will be de-linked from survey data, etc. All investigators using online surveys must ensure that personally identifiable information (PII) is not collected with survey responses unless specified within the protocol application.

    If you will be utilizing an online survey program to collect data, you must notify your participants in your online consent document as to whether Internet Protocol addresses will or will not be collected by the online program, and the first page of your online survey must contain the consent document.  

    When a participant is asked to complete an online survey, the IRB may grant a waiver of signed consent due to the impracticality of obtaining the participant's signature.  Therefore, the bottom of the consent document must contain participation agreement statements which uses skip logic for the response.

    If you are using Qualtrics as your survey tool, please note that by default, the Anonymous Link collects the user’s IP address, which is considered PII:

    You must enable the setting “Anonymize Response” in order to remove the respondents’ IP address and location data from your results. Instructions can be found here:

    Also by default, there is no limit to how many times a respondent can use the Anonymous link. If you want to prevent multiple responses from the same respondent, you must enable the setting “Prevent Ballot Box Stuffing.” Instructions can be found here:

    If you are using SurveyMonkey as your survey tool, please note that the default option for every collector type is to store certain information to help you track respondents.

    You can prevent IP addresses from being recorded in survey results by making results anonymous in your collector settings. Instructions can be found here:

  • Per 45 CFR 46.117(c), a waiver of documentation of informed consent is a request whereby a signed informed consent document is not required. Examples include implied and verbal consent. Consent will still be obtained from participants; however, they will not be required to sign the consent form. There are only two circumstances when the IRB may waive the requirement to obtain a signed consent form:

    • The only record linking the participant and the research would be the consent document and the principal risk would be potential harm resulting from a breach of confidentiality. Each participant will be asked whether the participant wants documentation linking the participant with the research, and the participant's wishes will govern; or
    • The research presents no more than minimal risk of harm to participants and involves no procedure for which written consent is normally required outside of the research context (for example, no risk surveys or interviews).

    The IRB will take into consideration the risks and potential harms involved in the research and consent process before granting a waiver of documentation of informed consent.  This will then require either an Online Survey Consent Form or a Cover Letter.

  • Implied consent is a type of a waiver of documentation of informed consent. Implied consent is the tacit indication that a person has knowingly agreed to participate in research by performing a research activity or task. By completing the research task (e.g., completion of a questionnaire, interview, survey, etc.), the participant has provided consent to participate in the research.
  • The IRB application and all supporting documents go to the IRB Director & Chair, who determines the type of review (e.g., exempt, expedited or full). If the chair determines that the research falls under expedited review, the chair and at least one other member of the committee will review the application; if the research requires a full-board IRB review, the IRB will convene at its next scheduled meeting

    Subsequent to the review, the IRB Director & Chair will respond with an emailed letter to the primary investigator (cc to a Faculty Advisor) with any comments, requests for clarifications, and/or suggested edits provided by the reviewing IRB committee members. The investigator will then be asked to return the materials highlighting any revisions made and providing responses to the reviewing IRB committee members' comments. 

    When the reviewing IRB committee members are satisfied with the revisions and/or clarifications, the IRB Director & Chair will then issue an approval letter.

  • The IRB seeks to be as timely and responsive to review requests as possible. While the IRB is typically able to review an application within three business days, it may take up to 14 business days to review an application depending on the classification. If your application requires the IRB to convene for a full-board IRB review, your application and supporting documents must be received at least one month before the next scheduled meeting.
  • No. There is no provision in the federal regulations that allow for IRB approval of research that has already been conducted. If data was collected for purposes that the IRB determines to be non-research (e.g., program evaluations for library or educational programs not initially intended to be used for research), IRB approval can be sought for the data analysis going forward.
  • Plans to deviate from the approved protocol and/or supporting documents must be submitted to the IRB as an amendment request via the Progress Report and approved by the IRB prior to the implementation of any changes, regardless of how minor, except where necessary to eliminate apparent immediate hazards to the subjects. 

    If the amendment request requires changes to supporting documents (i.e., consent form, survey, etc.) the revised documents must be submitted to the IRB by using the upload button at the bottom of the Progress Report form. Word or PDF files are only accepted and multiple files may be uploaded via a zip file only. The Progress Report should explain the changes to the most recently approved protocol. The IRB Director will determine whether or not the proposed changes require additional review. If there are significant changes, it might require submission of a new protocol.

  • The IRB typically requires a new IRB application (versus submitting an amendment request) when there are significant changes to two of the three following areas: 

    1. Purpose of the study
    2. Participant population
    3. Procedures (i.e., what you are asking participants to do, research activities being carried out, etc.)

    The IRB also usually requires a new application (versus submitting an amendment request) when there are significant changes to the study design or methodology that alter the study scope or aims, such as: 

    1. An addition or significant alteration of research questions or hypotheses
    2. An addition of instruments that significantly alter the original scope of the study

    If you are unsure whether your proposed changes can be submitted as an amendment request versus a new IRB application, please contact the IRB. Remember that plans to deviate from the approved protocol and/or supporting documents must be submitted to and approved by the IRB prior to the implementation of any changes, regardless of how minor, except where necessary to eliminate apparent immediate hazards to the subjects.  

  • Different regulations apply to how long you are required to store records after the completion of research, and you must keep records for the longest applicable period of time.  Federal regulations require research records to be retained for at least three years after the completion of the research (45 CFR 46). However, research that involves identifiable health information is subject to HIPAA regulations, which require records to be retained for at least six years after a participant has signed an authorization. Finally, research sponsors may require longer retention periods. In sum, you must keep your research records for at least three years and possibly longer, depending on the longest applicable standard. Another good practice is to retain data until there is no reasonable possibility that you will be required to defend against an allegation of scientific misconduct.

    Notice that these regulations do not specify when you must destroy data, only state the minimum amount of time you must retain it. As long as you can guarantee that your research records are secure, you can keep them indefinitely. However, when research records are to be destroyed instead of stored securely, you should remember to protect your participants’ confidentiality throughout the process.

  • Information regarding course selection and how to register for CITI can be found on the CITI Online Training page of our website.