> IRB & Research Ethics
Writing a Protocol
The anatomy of an IRB protocol, step by step. · 10 min
A protocol is the document the IRB reviews. Most of the work is describing exactly what you’ll do to participants and how you’ll protect them.
- Specific aims. State your research question and why it needs human subjects — what you couldn’t answer from existing data or logs alone. Keep it to a short paragraph the reviewer can grasp quickly.
- Recruitment. Who, how many, how you’ll reach them, and your inclusion/exclusion criteria. Attach the actual recruitment materials (emails, flyers, scripts) — reviewers read the wording you’ll really use.
- Procedures. A step-by-step account of what each participant experiences, in order, with realistic time estimates. The reviewer is checking that the burden matches what you promise in consent.
- Consent. How you’ll obtain informed consent, in plain language at the participant’s reading level, plus any waiver of documentation (e.g., online studies) you’re requesting and why.
- Data handling. Where data lives, who can access it, how and when it’s de-identified, and how long you retain it. Name approved storage — not a personal laptop or a random cloud drive.
- Risks & benefits. List risks honestly and concretely (including privacy and dignity, not just physical harm), say how each is minimized, and state the benefits without overselling.
Common reasons protocols get sent back
Reveal the usual culprits
- Consent language that’s too technical for the target population.
- Data storage that names a personal laptop or an unapproved cloud drive.
- Recruitment materials not included with the submission.
- Procedures that don’t match the time/effort described in consent.