01 · The Question
What Does It Mean When a Research Site Must “Authorize” Your Study?
You have identified a hospital, school, company, community organization, university, or other institution where you want to conduct research. Someone then tells you that you need "site authorization," "institutional permission," "local approval," or perhaps "management approval" before you can begin.
What exactly are they giving you permission to do?
The terminology varies considerably across institutions and jurisdictions, but the underlying idea is straightforward. An organization may have responsibilities and legitimate authority over its premises, resources, systems, records, staff activities, or services. If your research involves those areas, the organization may need to decide whether it is willing and able to host or support the study.
03 · What You Need to Know
What an Institution Is Actually Authorizing
Site authorization concerns the institution's own responsibilities
Consider a simple question: what gives a researcher the right to walk into a hospital, use a consultation room, ask staff to distribute recruitment materials, or access an internal database?
Ethics approval alone does not necessarily provide that authority. The organization responsible for those premises, systems, resources, or activities may have to authorize their use for research.
Research governance frameworks make this distinction explicit. Australian National Health and Medical Research Council guidance, for example, distinguishes ethical review from institutional site assessment and project authorization. Under its research-governance framework, an institution considers the results of ethical review alongside local matters before authorizing research to commence at that institution.
The scope of authorization therefore depends on what the institution controls and what role it will play in the study.
What might a site assess before giving permission?
The answer varies with the research. In a substantial clinical study, site assessment can be extensive. In a low-risk interview project, it may be much simpler.
Depending on the institution and project, the assessment may consider whether the research is feasible locally, whether suitable participants and resources are available, whether staff can support the project, whether financial and contractual arrangements are acceptable, whether institutional risks have been addressed, and whether relevant legal, regulatory, privacy, safety, or administrative requirements have been satisfied.
NHMRC's current Good Practice Process for clinical trials, for example, describes site assessment as including feasibility, resources, capacity, participant population, budget, contractual arrangements, documentation, ethics review, and ultimately site authorization. These requirements are specific to that framework and should not be treated as a universal checklist for every type of research.
Site authorization is different from ethics approval
Ethics approval
Addresses whether the research is ethically acceptable under the reviewing body's remit.
Site authorization
Addresses whether a particular organization authorizes the research activities for which it has responsibility.
The distinction matters because a study can be ethically acceptable yet unsuitable for a particular site. A hospital might lack the staff required to support it. A school might be unable to accommodate data collection during examination periods. An organization might identify unresolved contractual, privacy, financial, or operational issues.
Australian governance guidance explicitly recognizes this possibility: ethical approval can be a prerequisite for commencement while an institution may nevertheless decide not to authorize ethically approved research because of other considerations within its responsibility.
This is why ethics approval and institutional approval answer different questions .
Site authorization does not replace participant consent
An institution can ordinarily authorize only matters within its legitimate authority. A school may permit researchers to conduct a study on campus. A hospital may authorize use of its facilities. A company may permit recruitment through an internal communication channel.
That does not ordinarily mean the organization can volunteer competent individuals as research participants.
Authorization from the organization and consent from the individual therefore operate at different levels. Even when a gatekeeper has legitimate authority to permit organizational involvement, research-ethics scholarship on cluster research emphasizes that such permission does not substitute for individual informed consent when individual consent is required.
Who can grant institutional permission?
Not simply anyone who works there.
The appropriate decision-maker depends on the organization's governance structure and the nature of the permission being requested. It could be a research office, chief executive or delegate, school administrator, department head, data custodian, facility manager, research governance officer, or another formally authorized person or body.
In the NHMRC research-governance framework, institutional authorization may ultimately rest with a senior officer or appropriately delegated decision-maker who considers information from ethical review, site assessment, and relevant institutional advisers.
In less formal settings, the process may look quite different. The important question is not whether someone appears senior enough. It is whether that person or body has legitimate authority over the research activity you are asking them to permit.
Authorization can be specific rather than all-or-nothing
Institutional permission should not be interpreted more broadly than its actual scope.
An organization might allow researchers to distribute invitations but not release employee contact details. It might authorize interviews off-site but not permit researchers to access internal records. It might permit recruitment but prohibit data collection during working hours.
Read the authorization itself and any attached conditions. "The institution approved my study" can conceal quite a lot of detail.
One site's authorization does not necessarily authorize another site
This becomes especially important in multisite research. Centralized or single ethical review can reduce repeated ethics review, but it does not necessarily remove each institution's responsibility for deciding whether research may occur at its site.
NHMRC guidance on single ethical review, for example, explicitly preserves institutional responsibility for site assessment and project authorization, with participating institutions individually authorizing commencement at their sites.
Researchers planning studies across several organizations should therefore establish what each participating institution must approve or accept .
Watch Out
Do not assume that an informal "Sure, that's fine" from a convenient contact constitutes institutional authorization. Confirm who has authority, what form the authorization must take, which activities it covers, and whether any conditions must be satisfied before the research begins.
04 · A Practical Example
What Site Authorization Looks Like in Practice
Hypothetical Example
Conducting interviews in a hospital
A university researcher has ethics approval to interview nurses about digital documentation practices. The researcher wants to recruit nurses through the hospital's internal email system and conduct interviews in a meeting room on hospital premises.
The ethics committee has approved the recruitment and interview procedures from an ethical perspective. The hospital must still decide whether it will permit its systems, staff environment, and facilities to be used for the project.
Researcher approaches the site
The researcher provides the hospital with the required protocol, ethics documentation, recruitment materials, and local information.
Hospital assesses its role
The responsible office determines whether local resources, operational arrangements, privacy requirements, responsibilities, and other applicable conditions are acceptable.
Institution authorizes specified activities
The hospital confirms that the approved recruitment and interview activities may proceed under stated conditions.
Individual nurses decide
Eligible nurses receive invitations and independently decide whether they want to participate.
The authorization therefore does not say, "These nurses have consented." It says, in effect, "The organization permits these specified research activities within the scope of its authority."
07 · A Quick Checklist
Before You Treat a Site as Authorized
For each research site, check:
What research activities require permission from this organization?
Who has formal or legitimately delegated authority to authorize those activities?
Does the organization require a site assessment, governance review, application, agreement, or another defined process?
Have all required ethics documents or other supporting materials been provided?
Are local resource, privacy, legal, contractual, financial, safety, or operational requirements relevant to the project?
What exactly does the authorization permit, and are there restrictions or conditions?
Is the authorization documented in the form required by the institution?
If several sites are involved, has each site's authorization status been established separately where required?
11 · Cite this Guide
How to Cite This Guide
This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.
Recommended (Field Guide)
APA
MLA
Chicago
Copy Citation
