IRB and Ethics Committee Management Software: What Happens When an Approval Expires Mid-Enrollment

Why an IRB office breaks the workflow tool it was given

A study coordinator calls on a Thursday. Enrollment has been stopped because approval expired on Tuesday. The submission for continuing review went in five weeks earlier, sat in pre-review waiting for a missing document, was assigned to a reviewer who was on leave, and nobody was watching the clock because the clock lives in four places: a spreadsheet the analyst maintains, a calendar reminder, the expiration field in the system, and the memory of the coordinator who is now on the phone. The consequences are real and immediate. Research stops. Subjects already enrolled need a decision about continued participation. Somebody has to determine whether this is reportable.

That is the shape of the whole category. An IRB is not a document approval workflow with a committee attached. It is a set of overlapping legal clocks running against different regulatory bases, applied to submissions whose type determines their entire path, reviewed by people whose eligibility to review depends on their disclosed interests and on who else is in the room. Any system that models this as a request queue will be worked around within a year.

Problem 1: the submission type determines everything, and it is not knowable up front

An investigator does not know whether their project is exempt, expedited or requires full board review. Frequently they do not know whether it is human subjects research at all. So the front door cannot be a form picker. It has to be a smart form that asks questions in the order a determination actually requires, branches on the answers, collects only what that path needs, and produces a recommended determination that a staff analyst confirms or overrides.

Huron Research Suite does this seriously and is built for large academic institutions, which also means it is heavy: configuration is a specialist skill and a change to a smart form is a project rather than an afternoon. Advarra CIRBI is excellent if Advarra is your reviewing IRB, because the system is shaped around that service, and correspondingly less natural as the system of record for your own board's local rules. IRBNet is widely used, affordable and genuinely useful at smaller institutions, and it is document routing at heart: thin on branching determination logic, on computed expectedness and on the analytics an accreditation review will ask for. WCG IRB is a review service rather than a platform you operate. None of that is a criticism of the products. It is a statement about which institution they were built for, and whether that is yours.

What a custom build does: it treats the determination pathway as versioned rules that your own HRPP staff can read and change. Your institution's exempt category guidance, your local requirements above the federal floor, your extra questions for studies involving prisoners, children or identifiable biospecimens. When policy changes, the change is made once, versioned, and applied to submissions from an effective date, with old submissions still reconstructable under the rules that governed them.

Problem 2: four clocks, and only one of them is in the system

Initial review has a turnaround expectation your leadership measures you on. Continuing review has an expiration date that is a legal cliff. Amendments have their own review path and can change the expiration. Reportable new information has short internal deadlines and sometimes external ones. Meanwhile the 2018 revisions to the Common Rule removed the annual continuing review requirement for certain minimal-risk studies, while FDA-regulated research still expects periodic continuing review, so a single institution now runs several regimes simultaneously depending on funding and regulatory basis of each study.

The build has to compute, per study, which regime applies and what is due when, then surface that as work rather than as a report. A daily queue for the analyst: expiring in 60 days with nothing submitted, submitted but stalled in pre-review for 14 days, assigned to a reviewer who has not opened it in 10 days, approved but the letter has not gone out. Once that queue exists, lapses stop happening, and that single outcome usually justifies the project to the institutional leadership who funds it.

Problem 3: quorum, eligibility and the meeting that has to be reconstructable

Committee composition is regulated. A convened meeting needs a majority present, including at least one member whose primary concerns are in nonscientific areas, and members with a conflicting interest must not participate in the vote on that study. Minutes must record the vote, including those for, against and abstaining, and the basis for required determinations. Get this wrong and the review is invalid, which is a far worse problem than a late letter.

Model the roster properly: member roles, scientific or nonscientific designation, affiliation status, alternates and who they may substitute for, term dates, expertise tags for consultant assignment. Then the agenda builder is constrained by quorum rather than being a list somebody types. Conflict screening runs against disclosed interests and against the study team roster automatically, so a member is removed from the vote before the meeting rather than after minutes review. And the minutes assemble from structured events, votes, attendance at the time of each vote, determinations made, with staff editing and approving the narrative. That is a legitimate role for language generation, drafting from recorded structured facts and never inventing them, with a human approving before the record is final.

Problem 4: reliance, ceded review and the single IRB world

NIH-funded multi-site research operates under a single IRB expectation, and the practical effect on an institution is that it now spends real effort on studies it does not review. You are either the reviewing IRB for sites you do not employ, or you are a relying site tracking someone else's approvals, local context reviews, ancillary approvals and reporting obligations. Reliance agreements, including those built on the SMART IRB framework, have to be tracked as objects with parties, scope, effective dates and per-study invocations.

This is where packaged systems most often force a spreadsheet, because the institution's obligations as a relying site are administrative rather than deliberative and do not fit the review workflow. The build should carry a ceded study as a first-class record: the external IRB, the approval documents received, the local ancillary reviews still required, the local context requirements, the expiration to watch, and the internal notifications when the external board changes something. Nobody outside an IRB office understands how much time this consumes and how little of it is visible in most tools.

Problem 5: the investigator experience determines your submission quality

Most of your pre-review delay is incomplete submissions. Every hour an analyst spends emailing an investigator for a missing document is an hour not spent on review. The lever is the front door: validation at submission, contextual help written in your institution's language, templates for consent documents that carry required elements, and a pre-submission completeness check.

That completeness check is the second honest use of a model here. Read the submitted package and flag what a human would flag: a consent form that omits a risk described in the protocol, a study team member without current human subjects training, a procedure in the protocol that has no corresponding item in the consent, a recruitment advertisement whose claims exceed the protocol. It does not make determinations. It produces a checklist for the analyst and, more usefully, for the investigator before they submit. In our experience this is where submission turnaround improves most, because the delay was never the review, it was the round trip.

What this costs and how long it takes

A first release with branching submission smart forms, determination pathways, reviewer assignment, expedited and convened review, the clock queue and agenda and minutes generation runs $80,000 to $160,000 and ships in 12 to 18 weeks, based on Digital Heroes delivery experience. A full platform adding reliance and ceded review, conflict of interest screening against disclosures, reportable new information workflows, investigator and department dashboards, industry study fee billing and accreditation reporting runs $200,000 to $500,000 phased over 7 to 14 months.

What drives price up specifically in an IRB build: integration with your grants and research administration systems, since the link between a protocol and its funding is where institutions want reporting and where identifiers rarely match. Conflict of interest, if you want live screening against an existing disclosure system rather than an annual import. Migration of historical protocols, which matters because auditors ask about studies approved years ago. Multi-committee support, if you also run an IBC, IACUC or radiation safety committee and want one platform. And accreditation evidence, if you are pursuing or maintaining AAHRPP status and want the reporting to be a query rather than a project. What keeps it down: launching with new submissions only and keeping legacy studies in the old system until they close naturally.

Build versus buy, and when buying is the honest answer

Buy if you review a few dozen studies a year, cede most multi-site work, and have no local requirements above the federal floor. IRBNet or an external board will cost less than any build and free your staff for the work that actually protects subjects. Buy also if you are already deep in Huron for grants and awards, because the integration value of one research administration suite is real and should not be given up lightly.

Build when two or more of these are true. You process more than roughly 800 submissions a year. Your smart forms encode institution-specific policy that you change more than once a year and currently cannot change without a vendor. You serve as reviewing IRB for external sites and your reliance tracking lives in a spreadsheet. You run several committees and want one submission front door for investigators. Or your last accreditation or audit cycle produced a finding you could not evidence your way out of because the data was spread across systems. The tipping point is that your determination rules and reliance arrangements are institutional policy, and policy you cannot change on your own schedule is policy someone else owns.

How to choose a developer for IRB and ethics committee software

Ask them to whiteboard the clock model before you sign. A partner who has done this draws study, submission, review, determination and expiration as separate objects, and asks immediately how an amendment affects the expiration date. A partner who draws a request with a status field has built a helpdesk.

Ask how quorum and conflict eligibility are enforced at agenda build, not at minutes review. Ask how the system reconstructs which policy version governed a submission approved two years ago, because that is the question an auditor asks and it is not answerable by a system that only holds current rules.

Ask what happens when your institution updates its exempt category guidance. If the answer is a change request, you have bought the same problem in a new colour. Then confirm in writing before kickoff that you own the repository, the infrastructure accounts and the data export path. At Digital Heroes that belongs to the client from the first commit, and any partner hedging on it is building a dependency into an office whose job is independence.