An IRB approval letter looks like paperwork you file and forget. It behaves more like a license with an expiration date, and treating it as a one-time event is the ordinary way a study drifts out of compliance without anyone deciding to let that happen.
What the letter is actually approving
Read the letter for what it names, specifically: a protocol version and date, and a consent form version and date. That specificity is the point. A study doesn’t get approved once and then run indefinitely under whatever the protocol happens to say later — every amendment, however minor it feels to the team making it, is either approved through an expedited procedure under 21 CFR 56.110 or reviewed at the board’s next full meeting, and using an unapproved version of either document is a real finding, not a technicality. This is where regulatory affairs earns its keep on a study team that’s otherwise focused on enrollment: knowing exactly which version is the currently approved one, and making sure every site is actually using it, is document control applied to a moving target.
The clock the letter starts
The continuing review date on the letter is a deadline, not a formality. If the IRB doesn’t complete that review on time, the approval lapses on its own — nobody has to revoke it, and silence from the board is not an extension. A lapsed approval generally means enrollment and study interventions have to stop until the IRB reinstates it, which is a materially worse problem to discover mid-study than to track proactively. It’s also worth being precise about what each approval covers: FDA’s approval of an IDE for a significant-risk device study runs on its own timeline and its own criteria, and it does nothing to extend or substitute for a lapsed IRB approval at a site. The two clocks run in parallel, not as backups for each other.
- The protocol version and date approved.
- The consent form version and date approved.
- Any conditions of approval, and whether they’re satisfied yet.
- The continuing review due date.
Where this goes wrong
Treating approval as good until told otherwise
It expires on its own schedule under Part 56’s continuing-review requirement. Nobody has to notify the site that time is up; the obligation runs the other direction.
Losing track of which consent version is current across sites
A multi-site study where one site is still consenting subjects on a superseded form is one of the more common findings in a monitoring visit, and it’s entirely preventable with basic version control.
None of this is exotic — it’s the same document-version discipline regulatory affairs applies to a submission, aimed at a document that expires on a schedule instead of one that just needs to stay internally consistent. The letter is short. What it’s actually committing the site to keeping current is not.
Sources & further reading
- eCFR — 21 CFR 56.109, IRB Review of Research ecfr.gov
- eCFR — 21 CFR 56.110, Expedited Review Procedures ecfr.gov
- Regulatory Academy — How to Read an FDA IDE regulatoryacademy.com
- Regulatory Academy — How Regulatory Affairs Works With Clinical regulatoryacademy.com
This essay is provided for general educational purposes and reflects the regulatory landscape as of its publication date. It is not legal, regulatory, or career advice.
