IACUC, Animal Research & Biosafety Compliance with Kissflow

Key takeaways

• IACUC and IBC review are separate committees with separate regulations, and a single animal study involving recombinant material needs approval from both before work can start.
• Federal rules set specific timing: full committee or designated member review at protocol submission, a complete "de novo" review at least once every three years, and a semiannual program review and facility inspection every six months.
• Most research offices still track protocol status, training records, and containment approvals across email, shared drives, and separate portals, which is exactly where audit findings originate.

Why IACUC and biosafety compliance carry funding risk, not just paperwork risk

Animal research and biosafety oversight are federally mandated conditions of research funding, not internal best practices. When a research institution accepts Public Health Service funding for work involving vertebrate animals, it commits to an approved Animal Welfare Assurance on file with the NIH Office of Laboratory Animal Welfare. When it conducts recombinant or synthetic nucleic acid research, it commits to registering that work with an Institutional Biosafety Committee under the NIH Guidelines for research involving recombinant or synthetic nucleic acid molecules.

Neither commitment is symbolic. If OLAW or USDA APHIS determines that an institution's animal care and use program is out of compliance, PHS support for animal activities can be restricted, suspended, or terminated until the program is corrected. If an Institutional Biosafety Committee has not approved recombinant or synthetic nucleic acid research before it begins, the work is not compliant with the terms of the funding, regardless of the scientific merit of the protocol.

For a research-intensive university running dozens of active animal protocols and biosafety registrations at once, a coordination gap between the two committees, or between either committee and the training and grants offices, is what an auditor finds first.

What IACUC review actually covers

The Institutional Animal Care and Use Committee reviews and approves any research, teaching, or testing activity involving live vertebrate animals before the activity begins. Its authority comes from two overlapping frameworks:

• The Animal Welfare Act (7 U.S.C. 2131-2159) and its implementing regulations at 9 CFR Parts 1 through 3, enforced by USDA APHIS, which covers most warmblooded species used in research.
• The PHS Policy on Humane Care and Use of Laboratory Animals, administered by OLAW, which covers all live vertebrate animals in research funded by NIH, CDC, FDA, or any other PHS agency, regardless of species.

A regulatory detail that trips up new compliance staff: under 9 CFR 1.1, the Animal Welfare Act's definition of "animal" excludes birds, and rats of the genus Rattus and mice of the genus Mus bred for research. An institution running only purpose-bred rodent studies with no PHS funding may fall outside USDA jurisdiction entirely. The same institution accepting a single NIH grant using those same rodents falls squarely under PHS Policy, which draws no such exclusion. Most institutions end up governed by both frameworks at once, and the IACUC has to know which rule applies to which protocol.

What the Institutional Biosafety Committee reviews

The Institutional Biosafety Committee reviews research involving recombinant or synthetic nucleic acid molecules, infectious agents, and biological toxins before the work begins. Its authority comes from the NIH Guidelines, which apply to any institution receiving NIH funding for this type of research, and from the biosafety level framework published in Biosafety in Microbiological and Biomedical Laboratories (BMBL), maintained jointly by CDC and NIH.

A principal investigator must register the proposed work with the IBC, describing the organism or vector, the containment level, and the personnel involved. The committee, or a subcommittee acting under its delegated authority, must approve the registration before the work starts, per NIH Office of Science Policy guidance. If the work involves an agent or toxin listed under the Federal Select Agent Program (42 CFR 73 for HHS agents, with parallel USDA regulations), the institution must also hold a current registration with CDC or APHIS before possessing, using, or transferring the material.

Where the two committees intersect: transgenic animals, animals administered recombinant material, and animals exposed to infectious agents all require IACUC and IBC sign-off together, sequenced so that neither committee approves in isolation.

IACUC vs. IBC: scope, membership, and review cycle

Biosafety levels and what they require

The full containment specifications for each level are published in the BMBL, maintained jointly by CDC and NIH. The IBC assigns the containment level for each registration before work begins, and any change in agent, procedure, or scale requires re-review.

The bottleneck: why protocol tracking still runs on email and shared drives

Most research compliance offices still run their biosafety compliance workflow through university email threads, shared drives, and a spreadsheet that tracks protocol expiration dates by hand. A typical cycle looks like this:

• A principal investigator emails a protocol amendment to the IACUC coordinator, who forwards it to the veterinarian and the assigned reviewer.
• Training records live in a separate learning management system that the compliance office cannot query directly, so verifying a technician's current status means a manual cross-check.
• IBC registrations for the same study sit in a different office, tracked in a different spreadsheet, with no shared record of which protocols require both committees' sign-off.
• When a semiannual inspection or a triennial de novo review comes due, staff reconstruct the status of every active protocol from scattered files rather than pulling a single report.

This works at small scale. It breaks down once an institution is running more than a few dozen active protocols across multiple departments, because the coordination failure compounds. Nobody owns the moment when an animal study requiring recombinant material clears IACUC review but is still waiting on IBC registration, and the study proceeds on the assumption that someone else checked.

A governed protocol-to-approval workflow

Intake and triage

The principal investigator submits a protocol describing the species, procedures, and any biohazardous agents or recombinant material involved. Compliance staff triage the submission to determine whether it requires IACUC review, IBC review, or both.

Committee assignment and review method

IACUC protocols route to full committee review at a convened meeting, or to designated member review, which can approve the protocol or refer it to the full committee but cannot disapprove it alone. IBC registrations route to full committee or delegated subcommittee review depending on the containment level and institutional policy.

Determination and containment assignment

The IACUC records species-specific procedure and pain-category determinations. The IBC assigns a biosafety containment level from BSL-1 to BSL-4 before the work can start.

Training verification

Personnel must complete species-specific and agent-specific training, along with occupational health clearance where required, before first contact with animals or biohazardous material. The workflow checks training status against the protocol before granting access.

Select agent and sub-recipient checks

If the protocol involves a listed select agent or toxin, the institution's Federal Select Agent Program registration (42 CFR 73) must be current, a certificate that requires reauthorization at least every three years. If the funded work flows to a sub-recipient institution, the prime institution confirms the sub-recipient holds its own current Assurance, IACUC approval, or IBC registration before subaward funds release, consistent with pass-through entity monitoring obligations under the Uniform Guidance.

Semiannual program review and facility inspection

Under 9 CFR 2.31(c), at least once every six months, the IACUC reviews the animal care and use program and inspects every animal facility, including satellite housing and survival surgery areas, and prepares a written report signed by a majority of the committee.

Continuing and triennial review

IACUC protocols require a complete "de novo" review at least once every three years, replacing the older annual continuation requirement, per OLAW guidance. IBC registrations are reviewed on the institution's own recurring schedule, with immediate re-review triggered by any change in agent, containment, or procedure.

Incident reporting and retention

Significant problems, protocol violations, or research-related incidents involving recombinant material are reported to the NIH Office of Science Policy within 30 days, with immediate reporting required for overt exposures at BSL-2 and above. Protocol, training, and inspection records are retained for at least three years after the protocol closes.

Regulatory requirements compliance offices must operationalize

Membership

Under PHS Policy, which governs institutions receiving Public Health Service funding, the IACUC must include at least five members, while the Animal Welfare Act sets a lower floor of three: a veterinarian with training in laboratory animal medicine and delegated program authority, a practicing scientist experienced in animal research, a nonscientist member, and a member with no institutional affiliation beyond the committee. The IBC must include at least five members with collective biosafety expertise, plus two members unaffiliated with the institution who represent the surrounding community's health and environmental interests.

Timing

Full committee or designated member review happens at initial submission. A complete de novo review of the protocol is required at least once every three years. Program review and facility inspection happen at least every six months.

Training

Personnel must complete required training before their first contact with animals or biohazardous material, and institutions must be able to verify current training status at the time a protocol is approved, not reconstruct it afterward.

Retention

Protocol records, committee minutes, training documentation, and inspection reports must be retained for at least three years after the protocol or activity closes.

Reporting

Noncompliance and adverse events involving animal subjects are reported to OLAW and, where applicable, USDA APHIS. Significant problems involving recombinant material are reported to NIH OSP within 30 days, with immediate reporting for overt exposures at BSL-2 and above.

Sub-recipient flow-down

When a grant funds animal or biosafety-regulated work at a sub-recipient institution, the prime institution must confirm the sub-recipient's own Assurance, IACUC approval, and IBC registration are current before releasing subaward funds for that portion of the work.

How IACUC and biosafety compliance protect grant revenue and research continuity

A compliance gap in either committee does not stay contained to paperwork. If a funding agency determines that an institution's animal care and use program is out of compliance, PHS support for animal activities can be restricted until the program is corrected, which halts active protocols and the grant spending tied to them. If recombinant or select agent work proceeds without current IBC registration or Federal Select Agent Program authorization, the institution is operating outside the terms of its own funding and its own biosafety program simultaneously.

The mission case is straightforward for a research administrator: every week a protocol sits in an unmonitored review queue is a week of grant-funded research the institution cannot start or continue. Compliance is not the obstacle to research velocity. Coordination between two committees, a training system, and a grants office is the actual obstacle, and it is the part institutions can fix.

Voluntary accreditation through AAALAC International signals a program operating above the regulatory floor, but accreditation reviews the same underlying records: protocol files, training documentation, committee minutes, and inspection reports. A program that can produce these on demand is positioned for accreditation as a byproduct of normal operation, not a scramble before the site visit.

Kissflow and the animal research and biosafety compliance stack

Kissflow is the governed execution layer at the edges of the research compliance stack. It does not replace the IACUC, the IBC, or the judgment of either committee. It replaces the email threads, shared drives, and disconnected spreadsheets that currently carry protocol status, training verification, and containment approvals between offices.

If your institution runs Cayuse for IACUC and biosafety protocol tracking, Huron for research administration, or ServiceNow for IT ticketing and general workflow requests, Kissflow does not compete with those systems. It sits alongside them as the layer that sequences intake, routes each protocol to the correct committee and review method, checks training status before granting access, and produces a continuous, audit-ready evidence trail rather than one assembled under deadline pressure before a site visit.

The differentiation that matters to a compliance office: when institutional policy changes, when a new select agent is added to the federal list, or when the training cycle shifts, the office adjusts the workflow directly in Kissflow. No vendor ticket, and no waiting for a quarterly release from a point solution that was not built to be reconfigured by the compliance team that owns the process.

FAQ: IACUC, animal research, and biosafety compliance

1. What is the difference between IACUC and IBC review?

The IACUC reviews the humane use of live vertebrate animals under the Animal Welfare Act and PHS Policy. The IBC reviews recombinant or synthetic nucleic acid research, infectious agents, and select agents under the NIH Guidelines. A study can require one, the other, or both, depending on whether it involves animals, biohazardous material, or both together.

2. Does every animal study need both IACUC and IBC approval?

No. A study using only conventional procedures on vertebrate animals, with no recombinant material or infectious agent involved, needs IACUC approval alone. A study that administers a recombinant vector to an animal, or exposes an animal to an infectious agent, needs sign-off from both committees before work begins.

3. How often must IACUC protocols be reviewed?

A complete de novo review is required at least once every three years. In addition, the IACUC reviews the overall animal care and use program and inspects every animal facility at least once every six months, and any protocol amendment triggers its own review before the change takes effect.

4. What triggers Federal Select Agent Program registration?

Possessing, using, or transferring an agent or toxin on the HHS or USDA select agent list triggers registration under 42 CFR 73 or its parallel USDA regulations. Registration must be reauthorized at least every three years, and any change to the agents, activities, or locations covered requires an amendment before the change takes effect.

5. Do purpose-bred rats and mice require IACUC review under the Animal Welfare Act?

The Animal Welfare Act's own definition of "animal" excludes birds, and rats of the genus Rattus and mice of the genus Mus bred for research. Institutions using only these species with no PHS funding may fall outside USDA jurisdiction. The same species used under PHS-funded research fall under PHS Policy, which applies to all live vertebrates regardless of species, so most institutions end up governed by both frameworks depending on the funding source.

6. What happens if a facility misses a semiannual inspection deadline?

A missed inspection is a program-level compliance gap, not just a missed protocol deadline. It calls into question whether the institution can demonstrate continuous oversight of every animal facility, which is exactly what OLAW and USDA APHIS review during a site visit or a for-cause investigation.

Request a 30-minute walkthrough to see how Kissflow routes IACUC protocols, biosafety registrations, and select agent compliance through one auditable workflow.