Orchestrate Research Compliance: IRB, Ethics, COI, Safety & Agreements

Key takeaways

• Research compliance is not one regulation. It is at least four overlapping regimes, human subjects protection, financial conflicts of interest, export control, and training verification, each with its own trigger, timeline, and owning office, and a gap between any two of them is what an audit or a federal program review actually finds.
• IRB review is not a single process. Whether a protocol needs exempt, expedited, or full board review changes the timeline and the reviewer entirely, and getting the classification wrong at intake creates delay that compounds every time the protocol is amended.
• The training requirement most institutions under-scope is not IRB training. It is the responsible conduct of research training NSF requires for every undergraduate, graduate student, postdoc, and senior personnel supported by an NSF award, a requirement that expanded again under the 2022 CHIPS and Science Act.

Why "research compliance" isn't one office's job

A single funded study can touch four separate compliance regimes at once: the IRB reviews the human subjects protocol, the COI office reviews the PI's financial disclosures, export control screens whether the collaboration or the equipment involved needs a license, and the training office confirms every person on the award has completed the required responsible conduct training. Each of these offices operates independently, with its own system and its own definition of when a case is "done," and none of them is positioned to see the whole picture for a given study unless something specifically connects their records.

A PI cleared by COI but not yet current on RCR training, or an IRB-approved protocol involving a foreign national researcher nobody flagged for export control review, is not a hypothetical. It is what happens by default when four offices each manage their own slice of the same funded project.

What IRB review actually requires, and which type applies

Not every human subjects study gets the same review. Under the Common Rule at 45 CFR 46, research falls into one of three review categories: exempt research meeting specific low-risk criteria, expedited review for research presenting no more than minimal risk within defined categories, and full board review for everything else, conducted at a convened meeting of the IRB.

Getting the classification right at intake matters because it determines who reviews the protocol and how long that review takes, and misclassifying a study, treating something that actually needs full board review as expedited, is a finding waiting to surface at the next compliance review, not just a processing delay.

Financial conflicts of interest: the disclosure and management cycle

Under the FCOI Final Rule, 42 CFR 50 Subpart F, institutions receiving PHS funding must collect financial disclosures from investigators, determine whether a disclosed interest constitutes a conflict, and if so, develop and implement a management plan before the research proceeds. This is not a one-time disclosure. Investigators disclose at proposal submission, at least annually, and within the institution's policy window whenever a new interest arises, and each disclosure has to be reviewed and, where necessary, managed before the associated research activity continues.

A COI office tracking disclosures without connecting them to the specific awards and protocols they affect cannot answer the question that actually matters: is this researcher clear to work on this specific project right now.

Export control: when a collaboration or a shipment needs a license

Export control questions do not only arise when equipment physically leaves the country. Under the Export Administration Regulations at 15 CFR 734.13, releasing controlled technical data to a foreign national within the United States can itself constitute an export, a deemed export, requiring the same license analysis as a physical shipment. The parallel rule under 22 CFR 120.50, the International Traffic in Arms Regulations, applies to defense-related technical data specifically.

A research compliance program that only screens outbound shipments, and never screens which researchers on a project are foreign nationals with access to controlled technical data, has covered half the actual export control exposure a project can carry.

Training: the requirement institutions routinely under-scope

NSF's responsible conduct of research requirement covers every undergraduate, graduate student, postdoctoral researcher, and, since the 2022 CHIPS and Science Act, all senior personnel supported by an NSF award, whether paid or unpaid, with the institution's authorized representative certifying at proposal submission that a training plan is in place. The 2022 expansion specifically added federal export control, disclosure, and reporting requirements to the required RCR curriculum, tying the training requirement directly back to the export control and COI obligations described above.

An institution tracking RCR training as a generic onboarding checkbox, disconnected from which specific award a researcher is currently supported by, cannot confirm the certification it already made to NSF is actually still true.

Safety and agreements: the two areas this pillar connects but doesn't duplicate

Animal research and biosafety carry their own dedicated review structures, the IACUC and the Institutional Biosafety Committee, governed by the Animal Welfare Act, PHS Policy, and the NIH Guidelines, sequenced so that neither committee approves a protocol in isolation from the other. Material transfer and data use agreements carry a separate obligation again: a material or the technical data describing it can trigger the same export control screening described above, while a data use agreement governing human data has to satisfy FERPA or HIPAA's limited data set requirements depending on what the data actually is.

Where a research relationship flows down through a subaward, the same pass-through entity monitoring duties apply to a sub-recipient's own COI, IRB, and export control compliance. Neither safety review nor agreement processing duplicates the compliance areas this pillar focuses on. Both connect to the same underlying project record, the same PI, the same award, that IRB, COI, export control, and training all already track.

Compliance area, governing framework, and what has to be tracked

A governed research compliance workflow

1. Every protocol is classified at intake, not assumed.

An IRB submission is routed to exempt, expedited, or full board review based on the actual criteria the study meets, not a default assumption that adds unnecessary review or skips required review.

2. COI disclosures are checked against every active award, not just reviewed once.

Before a researcher's involvement in a project proceeds, the workflow confirms their financial disclosures are current and any management plan is active.

3. Personnel are screened for export control exposure before access is granted

A researcher's nationality and role on a project involving controlled technical data triggers an export control review before that access is granted, not after.

4. RCR training status is tied to the specific award, not tracked generically

Training completion is checked against the specific NSF award a researcher is supported by, matching the certification the institution actually made at proposal submission.

5. Every compliance area's status feeds one project-level view

A research administrator can see IRB status, COI clearance, export control screening, and training completion for a given project together, rather than checking four separate systems to answer one question.

6. Amendments and changes route back through the same checks

A protocol amendment, a new team member, or a new subaward triggers a fresh check against all four compliance areas, not just the one that prompted the change.

Kissflow and the research compliance stack

Kissflow is the governed execution layer at the edges of the research compliance stack. It does not replace the IRB's judgment, the COI committee's determination, or export control counsel's licensing analysis. It replaces the disconnected systems that currently make it possible for a project to be compliant in one area while quietly behind in another, because none of the four offices involved sees the whole picture.

If your institution runs Cayuse, Huron, or a dedicated IRB and COI system, Kissflow does not compete with any of them for their specific compliance function. It sits alongside them as the layer that connects a project's IRB status, COI clearance, export control screening, and training completion into one view, so a research administrator or a compliance office can answer a cross-cutting question without reconstructing it from four systems.

The differentiation that matters to a research compliance office: when NSF expands its training requirements, a new export control determination applies to a specific technology, or the institution adjusts its COI management plan process, that office updates the workflow directly, instead of coordinating a manual handoff across four offices every time a policy changes.

Frequently asked questions

1. What determines whether a study needs full board IRB review instead of expedited?

Whether the research presents more than minimal risk to participants, or falls outside the specific categories defined for exempt or expedited review. Full board review requires a vote at a convened meeting of the IRB, while expedited review can be conducted by the chair or a designated reviewer.

2. How often does a researcher need to disclose financial conflicts of interest?

At proposal submission, at least annually, and within the institution's policy window whenever a new financial interest arises, not as a one-time disclosure at the start of employment.

3. Does export control only apply to physically shipping equipment overseas?

No. Releasing controlled technical data to a foreign national within the United States can itself require an export license, a deemed export, under both the Export Administration Regulations and the International Traffic in Arms Regulations.

4. Who has to complete NSF's responsible conduct of research training?

Every undergraduate, graduate student, postdoctoral researcher, and, since the 2022 CHIPS and Science Act, all senior personnel supported by an NSF award, whether paid or unpaid.

5. What changed in the RCR training requirement under the CHIPS and Science Act?

The required curriculum expanded to include federal export control, disclosure, and reporting requirements, tying the training obligation directly to the same compliance areas COI and export control offices already manage separately.

Does Kissflow replace our IRB or COI system?

No. Kissflow is the workflow layer that connects IRB status, COI clearance, export control screening, and training completion across a project. The IRB and COI systems remain the systems of record for their specific determinations.

Request a 30-minute walkthrough to see how Kissflow connects IRB review, COI disclosure, export control screening, and training verification into one governed research compliance workflow.