03 · What You Need to Know
Waiver authority comes from the framework governing the research
"Who can waive consent?" sounds like a question with one institutional answer. It is actually a question about regulatory authority.
Different systems use different names for reviewing bodies, including institutional review board, research ethics committee, independent ethics committee, human research ethics committee, and similar terms.
The name matters less than whether the body has authority under the framework governing the research.
Under the revised U.S. Common Rule, the IRB makes the waiver findings
For research governed by the revised Common Rule, 45 CFR 46.116(f) gives the IRB authority to waive informed consent or approve an alteration when the applicable requirements are satisfied.
The IRB must find and document the relevant criteria. Under the general waiver provision, these include no more than minimal risk, impracticability without the waiver or alteration, an additional practicability requirement when identifiable private information or identifiable biospecimens are involved, protection of participants' rights and welfare, and provision of additional pertinent information afterward whenever appropriate.
The investigator can explain why those criteria are satisfied. The investigator does not replace the IRB's required findings with their own conclusion.
The research team proposes; the reviewing body evaluates
A useful division of responsibility is:
Researcher
Designs the study, identifies why ordinary consent presents a problem, proposes the waiver or alteration, describes safeguards, and supplies evidence supporting each applicable criterion.
Authorized review body
Independently evaluates the proposal, determines whether the applicable criteria are satisfied, documents required findings, and approves, modifies, or rejects the request.
This division matters because researchers have an understandable interest in being able to conduct the study they designed. Independent review provides a separate assessment of whether reducing participant choice is ethically and regulatorily justified.
Research ethics committees play the same broad role internationally
CIOMS states that researchers should not initiate research without individual informed consent or consent from a legally authorized representative unless they have received explicit approval from a research ethics committee.
Its Guideline 10 permits a research ethics committee to approve a modification or waiver when the research would not be feasible or practicable without it, has important social value, and poses no more than minimal risk.
The precise composition, legal authority, procedures, and terminology of ethics committees vary internationally. Researchers should therefore follow national law and institutional requirements rather than assuming that the U.S. IRB model applies everywhere.
FDA-regulated research has its own waiver authority
FDA historically had more limited consent-waiver provisions than the Common Rule. That changed for certain minimal-risk clinical investigations through a final rule published in December 2023.
FDA's rule allows the IRB responsible for review, approval, and continuing review of a qualifying clinical investigation to approve a consent procedure that omits or alters certain elements or to waive informed consent when the IRB finds and documents the specified criteria.
This is important for studies subject to FDA regulations because researchers should not rely solely on Common Rule provisions when FDA requirements also apply.
Emergency research uses a specialized authorization pathway
FDA emergency research under 21 CFR 50.24 provides a useful example of why waiver authority cannot be reduced to "the investigator decides."
The IRB responsible for the clinical investigation may approve research without prospective consent only after making and documenting extensive required findings. FDA also requires concurrence from a licensed physician who is an IRB member or consultant and is not otherwise participating in the investigation, along with community consultation, public disclosure, and other safeguards.
Emergency exceptions are specialized pathways. They should not be borrowed as justification for ordinary studies in which consent is merely difficult to obtain.
Institutional officials do not automatically substitute for the IRB
A department chair, hospital administrator, dean, research director, data custodian, or principal investigator may have authority over access to facilities, records, funding, or institutional resources.
That does not necessarily give them authority to waive informed consent under human-subject protection regulations.
Institutional permission and research-ethics authorization answer different questions.
A hospital might authorize researchers to access a database only after IRB approval, for example. The hospital's data-access approval does not itself constitute the IRB's consent-waiver determination.
A sponsor cannot simply declare the waiver either
Sponsors can propose study procedures and provide arguments supporting a waiver. They may also have regulatory responsibilities concerning the protocol.
But where regulations assign waiver authority to an IRB or ethics committee, sponsor preference does not replace that independent review.
This is especially important in multicenter research, where the sponsor may develop one protocol but the ethics-review arrangements determine which reviewing body has authority for participating sites.
Single-IRB arrangements can centralize the decision
Some multicenter research uses a single IRB or reviewing IRB rather than separate full review by every participating institution.
In those arrangements, the reviewing IRB may make the regulatory waiver determination for relying institutions according to the applicable reliance arrangements and regulations.
Local institutions may still retain responsibilities concerning local context, privacy, ancillary review, data access, or other institutional requirements.
Researchers should therefore identify the IRB of record rather than assuming every site independently grants its own consent waiver.
Exempt research complicates the simple "IRB waiver" answer
Some research activities may qualify for exemption from particular Common Rule requirements.
If an activity is exempt, the question may not technically be whether an IRB should waive informed consent under 45 CFR 46.116(f). The applicable exemption itself may mean those consent requirements do not apply in the ordinary way.
However, institutions differ in who is authorized to determine that research is exempt. Some require an IRB office or designated reviewer to make the determination rather than permitting investigators to self-declare exemption.
Researchers should follow institutional policy. "I think my study is exempt" and "my study has been determined to be exempt under the applicable process" are not necessarily equivalent statements.
Exemption and waiver should not be used interchangeably
These are different regulatory concepts.
Exemption
The research falls within a regulatory category that is exempt from specified requirements, subject to the conditions of that exemption.
Waiver
A requirement that would otherwise apply is specifically waived after the authorized body makes the required findings.
Confusing the two can lead researchers to submit the wrong justification or misunderstand which protections still apply.
Waiver of documentation may also require IRB authorization
Even when researchers intend to obtain informed consent, they may want to omit the participant's signature.
Under the Common Rule, the IRB can waive signed documentation under the criteria in 45 CFR 46.117(c). This is a different decision from waiving informed consent under 45 CFR 46.116.
So proceeding without a signed consent form may itself require authorization even though participants will still be asked for informed consent.
Researchers should not retroactively authorize themselves
Suppose recruitment begins with ordinary consent. After several weeks, the research team discovers that participants are difficult to contact and decides that consent is impracticable.
The team cannot ordinarily solve the problem by announcing that the remaining participants will be included under a waiver.
If a waiver or protocol change requires review, the researcher should submit the proposed change and obtain authorization before implementing it, except where a specific framework permits otherwise.
OHRP has long emphasized that waiving informed consent by a method other than the required IRB findings and documentation does not satisfy the HHS regulatory process.
The reviewing body must document the basis for its decision
Under the Common Rule's general waiver pathway, it is not enough for an IRB simply to mark "approved."
The IRB must find and document that the required waiver criteria are satisfied. FDA's minimal-risk waiver rule similarly requires the IRB to find and document the applicable criteria.
This creates an important practical implication for researchers: waiver requests should be written so reviewers can make those findings from the information provided.
"Minimal risk retrospective study, waiver requested" is rarely a persuasive waiver analysis.
Authorization does not make every research activity permissible
A consent waiver addresses the requirement for informed consent. It does not independently approve inadequate privacy protections, excessive risk, poor scientific design, unfair participant selection, or other ethical deficiencies.
The study still needs to satisfy the broader criteria for ethical and regulatory approval.
This is why the substantive criteria for waiving informed consent matter separately from identifying who has authority to approve the exception.
Watch Out
Permission to access records, approval from a supervisor, agreement from a sponsor, or the researcher's own determination that a study is minimal risk does not automatically constitute authorization to waive informed consent. Identify the body legally or institutionally empowered to make that decision for the research.
