IRB and Research Compliance Software Problems: The 7 That Cost Real Money, and How to Avoid Them

Why does the smart form get built as a questionnaire rather than as policy?

Because it arrives looking like a form. Someone hands a developer the current submission packet as a PDF and asks for it online, and a generic team delivers a long web form with conditional show and hide rules. It demonstrates well and it is wrong in a way that only becomes visible after the first policy change.

An IRB submission is a decision tree that encodes your institution's policy. Which questions appear when the study involves children, prisoners or people with impaired consent capacity. When a HIPAA authorisation or a waiver is required. When the study is FDA regulated and therefore carries a second set of obligations in parallel with the Common Rule. What your local policy adds on top of the federal floor. Change one answer and half the remaining questions change.

The fix is to model the form as a versioned decision graph with the branching held as data and the version stamped onto every submission, so a study submitted in 2023 still renders under the form it was actually submitted against. Then run completeness validation before submission rather than after, which removes most of the administrative pre review that consumes coordinators. Ask any vendor or developer directly whether an old submission can be rendered under its original form version. If the answer is no, that is disqualifying for a compliance system, whatever else the product does well.

What goes wrong when you migrate active protocols and historic submissions?

Active studies are the hard part, for a reason nobody anticipates: they are mid lifecycle. A study has an approved protocol version, two approved modifications, a continuing review due in seven weeks, a consent form revised in March, and an amendment under review. Migrating it means reconstructing a state rather than a record, and getting the currently approved document set exactly right, because a monitor will ask which consent form was in use in March.

Historic submissions bring a different problem. They were completed under form versions that no longer exist anywhere except as PDFs, and the answers cannot be mapped into new fields without inventing meaning. Trying to normalise them is how institutions create a historical record that reads confidently and is fabricated.

The approach that works is to migrate active studies fully and structurally, with their approved document set, their determination, their review regime and their next due date reconciled item by item before cutover. Historic closed studies migrate as archived records: the submitted PDFs, the determination, the approval dates and the minutes reference, indexed and searchable but not reinterpreted. Then run one full board meeting cycle and one continuing review cycle in parallel before switching off the old system. The gaps coordinators find are always in the unusual studies rather than the ordinary ones.

Why do the training, grants and clinical integrations break after launch?

Human research training records are the first and most common failure. Training completions arrive from a provider and the join is on a person. Institutional identifiers change, people appear with two accounts, a coordinator completes training under a personal email, and the system decides an investigator is untrained and blocks a submission at the worst moment. The fix is explicit identity resolution with a review queue for ambiguous matches, rather than assuming a clean key exists.

Grants integration fails differently. A protocol is linked to an award, the award is amended or renumbered, and the link silently points at nothing, so anything depending on it, such as confirming that research on a federally funded award has current approval, reports a false clean.

Clinical systems are the third, and in an academic medical centre they are usually the largest single integration line. A study build in a clinical trial management system depends on the approved protocol version, and drift between the two is how a participant gets enrolled under superseded procedures.

The discipline in all three cases is the same. Alert on absence, so a training feed that stops delivering raises an alarm rather than looking like a quiet month. Never let an integration silently block a submission without telling a human why. Store what each integration asserted at the time, so a later dispute about whether someone was trained on a given date is answered from your record rather than a third party's current state.

What happens when reliance and reportable new information are not covered?

Single IRB review for multi site research is the default for NIH funded domestic studies and is embedded in the cooperative research provision of the revised Common Rule. If your system does not model it, external sites reach your office by email, local context documents live in an inbox, and the approved consent version for site seven is whatever the coordinator last attached.

Reportable new information is the parallel gap and it is where the clock hurts. Unanticipated problems have their own timeline, sponsors have their own notification expectations, and federal reporting obligations follow from the assessment. If those exist only in a coordinator's head, they slip during leave, and a late report is itself a finding.

The fixes are structural. External institutions get scoped accounts that see exactly one study and only their own site documents. Local context forms, local investigator training verification and site specific consent language live as site records under the parent study, so the approved version per site is never ambiguous. Reliance agreements are tracked as objects with an execution date, a scope and an expiry rather than as PDFs in a folder. Reportable new information gets a triage path with severity, a required assessment against the unanticipated problem definition, and the resulting reporting obligations generated as dated tasks with owners.

Should you build custom or configure what you already own?

Configure, and spend nothing more, if you review under about 200 protocols a year, almost all minimal risk social and behavioural research, with no FDA regulated studies and no reliance relationships. IRBNet is inexpensive and adequate at that scale.

This is also one of the few categories where building can genuinely be cheaper and faster than buying. Huron IRB, Cayuse IRB and Advarra are largely configuration shells, and a configuration project for a complex program routinely runs longer and costs more than a purpose built system, then leaves you unable to change anything without a change request. Our rule of thumb is blunt: if a consultant's configuration estimate exceeds roughly $250,000, get a build quote before you sign it. Below that, configure.

The build signals are specific. Your configuration project has already exceeded its timeline, which is the most common trigger we see. You carry FDA regulated research alongside Common Rule research and your system forces one framework onto studies that need both. You are the reviewing IRB for multi site studies and external sites reach you by email. Your submission form asks everyone everything because the conditional logic could not be expressed. Or expiration management depends on one person's reminders.

How do hidden costs get into the quote?

Five places. An FDA regulated portfolio is the first, because dual framework tracking and significant risk device determinations add real logic rather than extra fields. Reliance volume is the second, since scoped external access and site level records are a substantial subsystem rather than a permission setting.

Electronic health record or clinical trial management system integration is the third and, in an academic medical centre, usually the largest single line. Part 11 considerations are the fourth: whether your electronic signatures need to support FDA regulated records is a design decision made at the start, not retrofitted, and a quote that does not ask about it has not scoped it.

The fifth moves the schedule and never appears in an estimate: local policies that exist as practice rather than as written policy. Every program has determination criteria, escalation habits and exception paths living in institutional memory. Writing them down is discovery work, it takes weeks, and it has to happen before form logic can be built. If you do not have a current written policy manual, budget for producing one and treat it as a deliverable in its own right, because it has value independent of any software.

What separates a build that works from one that fails here?

The builds that work propose and never decide. The system evaluates submitted answers against the category definitions and surfaces the specific criteria that matched, and an analyst confirms or overrides with a recorded reason. That gives you consistency across reviewers and an artefact showing why a determination was made, which is exactly what an auditor asks for. Any developer offering fully automated exempt or expedited determinations has not understood where the regulatory liability sits, and that answer alone should end the evaluation.

They also make the clock structural rather than personal. Every study carries its own review regime derived from its determination, so the system knows which studies still require annual continuing review and which do not under the revised Common Rule. Escalation is layered from coordinator to principal investigator to department chair on a schedule you define, ending in an automatic administrative hold that blocks further approvals against a lapsed study. The failure mode being eliminated is a human being the clock, because that fails predictably during leave and turnover, and the cost of that failure is an enrolment under expired approval.

The builds that fail treat convened meetings as a calendar with attachments. Quorum has to be computed live, including the requirement for a member whose primary concerns are nonscientific, with the chair warned the moment a departure or a recusal breaks it. Conflicts are declared in advance and the member excluded from that vote automatically with the recusal recorded. Minutes assemble from actions captured during the meeting rather than written days later from handwritten notes, because thin documentation of controverted issues is one of the most common audit findings there is.

Settle ownership before kickoff, in writing: the repository, the infrastructure accounts and the right to hire another firm. At Digital Heroes the client owns the code from the first commit. These records are the evidence in any federal inspection of your program.