What research sites need to know about central IRBs, local IRBs, and reliance agreements

A multisite clinical trial used to mean one protocol and many separate ethics reviews. Each site sent the same study package to its own in-house Institutional Review Board, and each board reviewed, questioned, and approved it independently. The result was months of delay, inconsistent consent wording across sites, and duplicate work that added nothing to participant protection. Since January 20, 2020, that model has been replaced for most federally funded multisite research in the United States by a single Institutional Review Board (IRB) of record, and FDA-regulated trials are expected to follow a similar path.

For research sites, the shift is bigger than it sounds. Ceding review to an outside IRB does not reduce institutional accountability. It changes who performs the review, not who answers for how the study is run. Understanding what moves to the reviewing IRB and what stays at the site prevents the start-up delays and audit findings that still appear under the single IRB model.

Two IRBs, two rulebooks

Every IRB in the United States operates under one or both of two federal frameworks. Research supported by federal agencies such as the National Institutes of Health falls under 45 CFR Part 46, commonly called the Common Rule. Research involving products regulated by the Food and Drug Administration, including investigational drugs, biologics, and devices, falls under 21 CFR Part 56. Many trials fall under both. The regulations define what an IRB is, what it must review, and what expertise its members must have. They do not require the IRB to be internal to the site.

A local IRB is the board run by the site's own institution, typically a hospital, academic medical center, or health system. A central IRB, also called a single IRB, reviewing IRB, or IRB of record, is a single committee that reviews a multisite study on behalf of every participating site. The central IRB may be an independent commercial organization, an academic institution's IRB serving a research network, or a federal IRB such as the National Cancer Institute Central IRB or the Veterans Affairs Central IRB. The regulatory authority is identical across types; what differs is who runs it, who pays for it, and how it fits into the site's workflow.

What a reliance agreement actually does

A reliance agreement, sometimes called an IRB Authorization Agreement (IAA), is the written contract that lets one institution rely on another organization's IRB for ethics review. Under 45 CFR 46.103(e), when an institution relies on an IRB it does not operate, the two entities must document the reliance and spell out which responsibilities each will undertake. That documentation becomes part of the site's IRB records under 45 CFR 46.115(a)(9), which means it is one of the first things an inspector will ask to see.

Reliance agreements come in three practical forms: a study-specific IAA for one protocol, a commercial IRB master agreement between the institution and an independent IRB for fast activation across many studies, and a master reciprocal agreement such as SMART IRB that lets any signatory institution rely on any other for any eligible study without renegotiating terms. SMART IRB now covers more than 1,400 participating institutions, which makes it the backbone of federally funded multisite research in the United States.

Signing a reliance agreement does not remove the site from the research. Under 45 CFR 46.114(a), each institution engaged in research remains responsible for safeguarding the rights and welfare of the people enrolled at its facilities. The reviewing IRB handles the review; the site handles the conduct.

When single IRB review is required

The single IRB mandate applies to cooperative research involving more than one U.S. institution that is conducted or supported by a Common Rule agency. Compliance has been required since January 20, 2020, under 45 CFR 46.114(b). The National Institutes of Health has required single IRB review for its multisite studies since January 25, 2018, under a separate but aligned policy. The funding agency or the lead institution identifies the reviewing IRB, and other sites rely on it. A few categories sit outside the mandate: research subject to tribal law requiring additional review, research granted a federal agency exception, and studies initially approved before January 20, 2020. Veterans Affairs research operates under its own framework in VHA Directive 1200.05.

For FDA-regulated trials that are not federally funded, 21 CFR 56.114 currently permits but does not require reliance. The FDA has proposed a mandate harmonized with the Common Rule and the 2026 HHS Unified Agenda lists a December 2026 final-rule target. Sites should treat that date as a planning signal, not a certainty, and watch the Federal Register. Broader quality expectations under the current Good Clinical Practice revision reinforce the site's obligations regardless of where the IRB sits, as the ICH E6(R3) readiness guide for research sites explains.

The sponsor usually picks the reviewing IRB for FDA-regulated industry trials and absorbs its fees, but the site still decides whether to accept the reliance. That decision rests with the institutional official named on the site's Federalwide Assurance (FWA), not with the principal investigator. Many institutional policies also condition reliance on the external IRB holding accreditation from the Association for the Accreditation of Human Research Protection Programs (AAHRPP).

What moves to the IRB of record, and what stays at your site

The reviewing IRB takes over the formal review activities. It issues initial approval, reviews amendments, determines whether events qualify as unanticipated problems or serious noncompliance, approves the master consent template, and conducts continuing review when it is required. The reviewing IRB also sets the reporting definitions and timelines the site must follow. Those often differ from the local IRB's old thresholds, which is a frequent source of confusion in the first weeks of a relying study.

The site retains everything institutional. Local context review covers the pieces of a study that depend on where the research is actually happening: applicable state laws, institutional policies, investigator and staff training and qualifications, conflict of interest management, and community considerations. Ancillary reviews stay at the site, including radiation safety, biosafety, pharmacy and investigational drug services, scientific or cancer center protocol review, privacy and security vetting of vendors, nursing operations, and billing coverage analysis. The site also owns site-specific additions to the consent form, such as institutional injury language, costs, contacts, and any state-mandated attachments like California's Experimental Subject's Bill of Rights.

The reviewing IRB sets the ethical and regulatory frame; the site makes sure that frame fits the building, the staff, the local law, and the patients walking through the door. The single IRB model saves time only when the site keeps its local intake lean. The same arc applies to monitoring, as what sites still verify under risk-based monitoring shows: the external party does part of the job, and the site retains the part only the site can do.

Making reliance work at the site

A relying study runs on two tracks. The local track covers the HRPP's reliance determination, ancillary reviews, and a local acknowledgment. The IRB-of-record track covers local context submission, insertion of institutional language into the master consent, and approval of the site-specific consent. The coordinator never edits an approved consent locally; any change goes back to the reviewing IRB for a site-specific amendment. Reportable events are submitted to the reviewing IRB on its timelines, with a parallel copy to the local HRPP when institutional policy requires one. Start-up pace depends on how quickly contracts, budgets, and ancillary reviews move in parallel with IRB submission, as a stage-by-stage look at site activation explains.

An inspector does not care where the ethics review happened. They care whether the site can produce a complete, version-controlled regulatory record for the research conducted at that location: the executed reliance agreement, every approval letter from the reviewing IRB, every version of the site-specific consent and HIPAA documents, the local acknowledgment, ancillary approvals, local context submissions, training and conflict-of-interest records, and the full correspondence trail. The documentation burden shifts under reliance; it does not shrink. For a continuous state of inspection readiness, the eTMF audit-proofing guide shows how to structure the record so reliance documentation and IRB-of-record decisions are easy to retrieve.

Three friction points recur in the literature on single IRB implementation. A 2026 survey of 756 researchers in Ethics & Human Research found that 77 percent of single IRB users still had to submit all or part of their package to the local HRPP, and that group reported higher administrative burden and more frequent timeline delays. The lesson is to strip the local application down to what reliance actually requires, not to recreate the old review in a different form. The second friction point is consent harmonization: surface state law and institutional template requirements during the local context stage and request a site-specific consent version. The third is reportable event confusion, which a single internal crosswalk between institutional policy and the IRB of record's rules prevents.

Participant-facing recruitment materials remain subject to IRB review under reliance, and the reviewing IRB is the one that must approve them. Advertisements, pre-screening questionnaires, call scripts, text message templates, and web listings all require IRB-of-record approval before use, regardless of who produced them. The institutional reflex is the same for any external party: define the handoff, document it, and build an internal process that preserves oversight without duplicating effort. Sites that already work with external recruitment vendors without losing control tend to find reliance governance familiar.

DecenTrialz, a United States clinical trial recruitment, pre-screening, and participant management platform, uses AI-assisted participant matching and registered-nurse-led pre-screening to route qualified referrals to research site teams. The platform supports recruitment and pre-screening workflow. It does not conduct ethics review, make eligibility determinations, obtain informed consent, or enroll participants; those decisions remain with the authorized research site and study team under the IRB of record.

Frequently asked questions from site teams

If we cede review, do we lose oversight?

No. Reliance transfers the ethics review role, not institutional accountability. The site decides whether to rely, continues to run ancillary reviews, oversees investigators, and can impose site-level restrictions on research at its facilities. If serious concerns arise, the institution can withdraw from reliance.

What if our policies conflict with the central IRB's approved consent?

Raise the conflict during the local context stage, before approval. The site identifies local legal and institutional requirements and communicates them to the reviewing IRB, which must take them into account. Never modify an approved consent locally; request a site-specific version. If the conflict cannot be resolved, the institution can decline to participate.

Who signs the reliance agreement at our institution?

Typically the institutional official named on the Federalwide Assurance, or a delegated HRPP director. The principal investigator and the coordinator do not sign. Under SMART IRB, the institution signs the master agreement once, and study-level reliance is documented by authorized points of contact in the Reliance System.

Do we still need to report adverse events to our local HRPP?

Regulatory reporting runs to the reviewing IRB on its timelines. Whether the site also notifies the local HRPP depends on institutional policy; many institutions require parallel notice for serious noncompliance, unanticipated problems, and suspensions. Sponsor safety reporting under IND or IDE is a separate obligation and is unchanged by reliance.

Does ceding review mean we no longer need a Federalwide Assurance?

No. The site institution still holds and maintains its Federalwide Assurance. Reliance is executed under the FWA, not instead of it, and the institution remains the assured entity for federally funded research conducted on its premises.

What the shift means for sites

The single IRB model is settled policy for federally funded multisite research, and the trajectory for FDA-regulated trials points the same way. Sites that have treated reliance as an exception will find the next two years harder than those that have redesigned their intake, documentation, and reporting workflows around external review. Ethics review moves to a different committee; the responsibility to run safe, compliant, well-documented research at a specific location stays exactly where it has always been.