Risk management looks different depending on who you ask. For a hospital, it might mean clinical audits. For a nonprofit, it might mean financial controls. But for organizations doing community-based research or evaluation — whether that’s a needs assessment, a program evaluation with focus groups, or a survey of service recipients — one of the most important risk management tools available is one most organizations haven’t fully considered: an independent Institutional Review Board (IRB).
And if you’re reading this thinking “That’s for universities, not us”, that’s exactly the gap we want to close.
What An IRB Actually Does & Why It Matters Beyond Academia
Institutional Review Boards were established in the United States through the National Research Act of 1974, a direct response to decades of research scandals and ethical violations involving human subjects. Their job is to review research protocols before work begins, ensure that participants are protected, and provide ongoing oversight as studies unfold.
For a long time, IRBs were almost exclusively housed in universities and large research hospitals, and for a long time, that made sense. That’s where most of the research was happening, but the landscape has shifted.
Today, nonprofits, community-based organizations, independent evaluators, and social science research firms are conducting meaningful, rigorous, community-engaged research every day. Program evaluations, community health surveys, needs assessments, participatory action research — this work involves human subjects, and it carries real ethical obligations. As the FDA has clarified, organizations without an internal IRB can arrange for an independent or “outside” IRB to take responsibility for review.
4 Different Risks You’re Managing
Not to put too fine a point on it, but there’s a lot at stake when organizations skip IRB oversight or assume it doesn’t apply to them.
Reputational risk
If your research methods are later found to be ethically unsound — consent forms that participants couldn’t read, data shared with partners in ways that weren’t disclosed, vulnerable populations who weren’t adequately protected — the damage to your organization’s credibility and community trust can be significant and lasting.
Research published in the American Journal of Public Health found that poorly designed consent processes in community-engaged research erode the trust that the research relationship depends on, with participants eventually disengaging from organizations that were meant to serve them. Which means that when one organization alienates a population, all the other organizations that serve that group are impacted.
Funding risk
IRB oversight is often required to secure federal research grants. Many private foundations and institutional funders are increasingly asking applicants to demonstrate ethical oversight practices as part of their due diligence. Organizations that can’t show a documented, credible IRB process may find themselves locked out of funding opportunities they’d otherwise qualify for.
Legal and regulatory risk
The Office for Human Research Protections (OHRP), which operates under the Department of Health and Human Services, regulates IRBs and has authority to investigate complaints and impose sanctions. A 2023 GAO report confirmed that federal oversight of IRBs is active, even if inspections are relatively infrequent. This means organizations conducting human-subjects research without appropriate oversight are taking a real regulatory risk, not just a theoretical one.
Data integrity risk
Perhaps less obvious but equally important: research conducted without proper ethical oversight is harder to publish, harder to defend, and harder to use. If your evaluation findings can’t stand up to scrutiny — because consent was incomplete, data handling wasn’t documented, or protocols weren’t followed — the work itself loses value. All the effort that went into the research becomes much harder to leverage.
Why Independent IRBs Specifically
So why choose an independent IRB rather than trying to build something internal, or relying on an informal review process?
The core answer is objectivity. An independent IRB brings an outside perspective to your research protocols; reviewers who aren’t invested in the project’s success, the funder relationship, or the organizational dynamics at play. That independence is the whole point. As recent scholarship on community-engaged research has emphasized, conflicts of interest — even subtle, unintentional ones — can compromise how risks are assessed and how participant welfare is weighed against organizational goals.
Independent IRBs also offer structural safeguards. Their review boards are required to include diverse membership: scientists, non-scientists, and members unaffiliated with the institution. That diversity is a feature. It means your research protocol gets evaluated from multiple perspectives before it touches a single participant.
For organizations without a university affiliation, an independent IRB also solves a practical problem: access. Without an internal IRB infrastructure, organizations that need ethical oversight have historically had limited options. Independent IRBs (yes, including us) exist specifically to fill that gap, at price points and with processes designed for the realities of nonprofit and community research.
What Good IRB Risk Management Looks Like
Done well, IRB review is an ongoing part of your research infrastructure.
That means engaging your IRB before you design your data collection tools, not after. It means making sure everyone with a significant role in your research — including community partners and contracted evaluators — has completed appropriate human subjects research training. It means building your consent processes around what participants actually need to understand, not what’s easiest to produce. And it means planning in advance for how data will be shared, stored, and eventually destroyed.
If this sounds like a lot of moving pieces, it is and that’s exactly why having an IRB partner matters. IRB review, human subjects training, data sharing agreements, and data communication plans form a coherent system. When one piece is missing or misaligned, it creates problems that ripple through everything else.
An independent IRB helps hold that system together. It creates accountability, documentation, and a defensible record that your organization took participant welfare seriously, from the first question asked to the last data point analyzed.
The Bigger Picture: Ethics As Organizational Strategy
There’s a temptation to think of IRB review as a compliance burden, something you do because you have to, not because it adds value. We’d push back on that framing.
Organizations that build ethical research infrastructure are building something durable: community trust, funder confidence, and the kind of data quality that truly moves the needle on the issues they care about. In a funding landscape where evidence increasingly has to be defensible as well as compelling, that infrastructure is a strategic asset.
The organizations we’ve seen treat IRB review seriously are also the ones whose community research holds up — whose findings get used, participants stay engaged, and reputations for doing right by the people they serve become part of how they’re known.
Ready To Talk About What Ethical Research Oversight Looks Like for Your Organization?
VIRB — Viable Insights’ independent IRB — was built specifically for nonprofits, community-based organizations, and independent researchers who need credible, accessible IRB review. We offer a free initial consultation to help you understand what your project actually requires and whether VIRB is the right fit.