Skip to Main Content

See our latest COVID-19 updates.

Academic Affairs

Institutional Review Board FAQ's

The IRB will decide if the research qualifies as exempt, expedited, or full-review. Once an application has passed the initial screening process, the average time frame for IRB review of exempt protocols is one week and two weeks for expedited protocols. Protocols requiring a full-review will be reviewed at the next scheduled IRB monthly meeting. The entire review time frame is lengthened if the application is not complete or is not submitted correctly and fails either the initial screening or the initial IRB review and requires revisions.

First, you should read and follow all directions and posted IRB procedures. Second, you should complete all required components within each section. Third, you should provide written responses that are clear and concise and which fully address all requested components in each section. It is recommended that researchers read through the application once before the begin to complete it, in order to familiarize themselves with what information should be included, and where that information should be included with in the application and/or addendum.

Each section is requires that you provide information related to a specific element of human research; tailor your answers to address those elements directly. Make sure that you have provided an answer for every item on the application. If an item does not apply to your research indicate that by putting "n/a" in that component. Do not leave any sections blank.

Make sure you include all required documents in the addendum.

Complete the Application Checklist (Word) before submitting your application and addendum.

A potential conflict of interest may result when there is a perception of undue influence or coercion. Two examples of a potential conflict of interest are a member of the research team has a financial interest in the outcome of the study or a member of the research team is the developer of the study's intervention. The potential conflict of interest may not prohibit the research from being conduct, but it requires disclosure on the part of the research team.

An outside performance site is any cooperating institution and/or location outside of the CSU campus that will be involved in recruiting participants, collecting data, and/or analyzing data. See a sample Letter of Cooperation (DOC) that is required for each outside performance site. A Letter of Cooperation must be written on the institution's letterhead and signed by the appropriate authorized official(s).

Data are considered anonymous when participants' identities are unknown to the research team (e.g., not requested or not given). If a sample is drawn from a small population (e.g., Sally Sue's fifth grade classroom), it is possible to use demographics, such as gender, racial classification, and behavioral characteristics, to identify the participant(s). If an outside individual can "figure out" the identity of one participant within the sample using the given demographic information, then the data are not anonymous.

De-identified data are data that have been stripped of all 18 HIPAA (Health Insurance Portability and Accountability Act of 1996, PL 104-191) identifiers. See the following link for more information:

For a quick reference:

The following 18 identifiers of a person, or of relatives, employers, or household members of a person must be removed, and the covered entity must not have actual knowledge that the information could be used alone or in combination with other information to identify the individual, for the information to be considered de-identified and not protected health information (PHI):

  • names;
  • * all geographic subdivisions smaller than a state, including county, city, street address, precinct, zip code," and their equivalent geocodes;
  • all elements of dates (except year) directly related to an individual;
  • all ages >89 and all elements of dates (including year) indicative of such age (except for an aggregate into a single category of age -90);
  • telephone numbers;
  • fax numbers;
  • electronic mail addresses;
  • Social Security numbers;
  • medical record numbers;
  • health-plan beneficiary numbers;
  • account numbers;
  • certificate and license numbers;
  • vehicle identifiers and serial numbers, including license plate numbers;
  • medical device identifiers and serial numbers;
  • Internet universal resource locators (URLs);
  • Internet protocol (IP) addresses;
  • biometric identifiers including fingerprints and voice prints;
  • full-face photographic images and any comparable images;
  • and any other unique identifying number, characteristic, or code, except that covered identities may, under certain circumstances, assign a code or other means of record identification that allows de-identified information to be re-identified.

Source: Adapted from 45 CFR § 164,514(b)(2)(i)].
* The first three digits of a zip code are excluded from the PHI list if the geographic unit formed by combining all zip codes with the same first three digits contains 220,000 persons.

Coded data are data including any information that can be linked to one or more participants in the study. If the data include an indirect link to the participant identifiers (e.g., unique identification codes created by the research team), the data are considered coded.

By using indirect coding, the researcher creates an unique code for identifying participants that has an indirect relationship with the participant. Only the researcher can associate the identification code with the participant. For example, Sally Sue Smith is assigned the identification code 12345 by the researcher. Only the researcher knows that number 12345 is Sally Sue Smith.

Coded data are data including any information that can be linked to one or more participants in the study.

Direct coding is an identification code that has a direct relationship with the participants. Individuals other than the researcher can associate the identification code with the participate. For example, the researcher uses Sally Sue Smith's college identification number as the identification code.

Researcher(s) can obtain a Certificate of Confidentiality from NIH after receiving IRB approval. More information about this certificate is available from NIH

All research requires informed consent, but may not require a signed consent form. In cases where requiring a signed informed consent would threaten the anonymity of the data, it may be possible to waive the requirement for documentation. For example, a study where the researchers are asking random persons to take an anonymous survey outside of a store. In this case the researcher would still be responsible for orally informing the participants of the nature of the study (all elements addressed in the CSU IRB Informed Consent template (Word)), or providing a written document outlining the same information.

The CSU IRB Informed Consent templates (Word) cover all of the required sections that must be clearly addressed by the informed consent process. Your informed consent should be written to the participants (not the IRB) and cover the details of the study in a clear and direct manner, easily understood by a layperson. Do not use technical jargon. For adult participants, the language should be geared towards someone with a 7th grade education. Informed consent forms for children should be written using language they will be able to understand based on the anticipated age group.

These IRB applications were created for educational purposes only.

In Microsoft Word, 1) open a new document, 2) "Save" the file, 3) move the cursor to the end of the document, 4) select "Insert" tab, 5) select the "Object" arrow then "Text From File", 6) locate and select the needed file, 7) select "Insert", and 8) "Save". You can repeat steps 3 through 8 until all documents are merged into one addendum.

If you want to insert a PDF or other type of file into the addendum, repeat the same process except in step 5, select "Object" instead of "Text From File". Then, select the appropriate object type, click "OK", locate and select the needed file, and click "Open".

In Adobe Reader, under "Edit", there is "take a snapshot" option. Open both the desired PDF file and the merged Word file. In the PDF, select the "take a snapshot" option, highlight one page of the PDF, then paste it into the Word file. If the PDF has more than one page, you will need to repeat the process

If you want to save it as a PDF, you can do so under the save options if you have Microsoft Word 2010 or later. You can download a free PDF conversion program from Then, you can use the print command to create the PDF. If you have access to a scanner, you can scan all of the documents into one PDF file.

If the Research Team needs to modify a currently approved research project with minor protocol modifications, complete a Project Modification Form (Word) and submit it for IRB review. Minor modifications include change of study title, changes to the research team, changes with participants, and procedural changes. Note: If the data collection and/or interventions for a given research project are determined to be major protocol modifications, then the Research Team will be asked to revise the approved Human Subjects Application (Word) and submit it for IRB review.