A single funded study can touch four separate compliance regimes at once: the IRB reviews the human subjects protocol, the COI office reviews the PI's financial disclosures, export control screens whether the collaboration or the equipment involved needs a license, and the training office confirms every person on the award has completed the required responsible conduct training. Each of these offices operates independently, with its own system and its own definition of when a case is "done," and none of them is positioned to see the whole picture for a given study unless something specifically connects their records.
A PI cleared by COI but not yet current on RCR training, or an IRB-approved protocol involving a foreign national researcher nobody flagged for export control review, is not a hypothetical. It is what happens by default when four offices each manage their own slice of the same funded project.
Not every human subjects study gets the same review. Under the Common Rule at 45 CFR 46, research falls into one of three review categories: exempt research meeting specific low-risk criteria, expedited review for research presenting no more than minimal risk within defined categories, and full board review for everything else, conducted at a convened meeting of the IRB.
Getting the classification right at intake matters because it determines who reviews the protocol and how long that review takes, and misclassifying a study, treating something that actually needs full board review as expedited, is a finding waiting to surface at the next compliance review, not just a processing delay.
Under the FCOI Final Rule, 42 CFR 50 Subpart F, institutions receiving PHS funding must collect financial disclosures from investigators, determine whether a disclosed interest constitutes a conflict, and if so, develop and implement a management plan before the research proceeds. This is not a one-time disclosure. Investigators disclose at proposal submission, at least annually, and within the institution's policy window whenever a new interest arises, and each disclosure has to be reviewed and, where necessary, managed before the associated research activity continues.
A COI office tracking disclosures without connecting them to the specific awards and protocols they affect cannot answer the question that actually matters: is this researcher clear to work on this specific project right now.
Export control questions do not only arise when equipment physically leaves the country. Under the Export Administration Regulations at 15 CFR 734.13, releasing controlled technical data to a foreign national within the United States can itself constitute an export, a deemed export, requiring the same license analysis as a physical shipment. The parallel rule under 22 CFR 120.50, the International Traffic in Arms Regulations, applies to defense-related technical data specifically.
A research compliance program that only screens outbound shipments, and never screens which researchers on a project are foreign nationals with access to controlled technical data, has covered half the actual export control exposure a project can carry.
NSF's responsible conduct of research requirement covers every undergraduate, graduate student, postdoctoral researcher, and, since the 2022 CHIPS and Science Act, all senior personnel supported by an NSF award, whether paid or unpaid, with the institution's authorized representative certifying at proposal submission that a training plan is in place. The 2022 expansion specifically added federal export control, disclosure, and reporting requirements to the required RCR curriculum, tying the training requirement directly back to the export control and COI obligations described above.
An institution tracking RCR training as a generic onboarding checkbox, disconnected from which specific award a researcher is currently supported by, cannot confirm the certification it already made to NSF is actually still true.
Animal research and biosafety carry their own dedicated review structures, the IACUC and the Institutional Biosafety Committee, governed by the Animal Welfare Act, PHS Policy, and the NIH Guidelines, sequenced so that neither committee approves a protocol in isolation from the other. Material transfer and data use agreements carry a separate obligation again: a material or the technical data describing it can trigger the same export control screening described above, while a data use agreement governing human data has to satisfy FERPA or HIPAA's limited data set requirements depending on what the data actually is.
Where a research relationship flows down through a subaward, the same pass-through entity monitoring duties apply to a sub-recipient's own COI, IRB, and export control compliance. Neither safety review nor agreement processing duplicates the compliance areas this pillar focuses on. Both connect to the same underlying project record, the same PI, the same award, that IRB, COI, export control, and training all already track.
|
Compliance area |
Governing framework |
What has to be tracked |
|
Human subjects research |
Common Rule, 45 CFR 46 |
Review classification, approval status, continuing review |
|
Financial conflicts of interest |
FCOI Final Rule, 42 CFR 50 Subpart F |
Disclosures, determinations, active management plans |
|
Export control |
EAR (15 CFR 734.13) and ITAR (22 CFR 120.50) |
Personnel nationality, technical data access, license status |
|
Responsible conduct training |
NSF RCR requirement (America COMPETES / CHIPS and Science Act) |
Training completion tied to the specific award a person is supported by |
An IRB submission is routed to exempt, expedited, or full board review based on the actual criteria the study meets, not a default assumption that adds unnecessary review or skips required review.
Before a researcher's involvement in a project proceeds, the workflow confirms their financial disclosures are current and any management plan is active.
A researcher's nationality and role on a project involving controlled technical data triggers an export control review before that access is granted, not after.
Training completion is checked against the specific NSF award a researcher is supported by, matching the certification the institution actually made at proposal submission.
A research administrator can see IRB status, COI clearance, export control screening, and training completion for a given project together, rather than checking four separate systems to answer one question.
A protocol amendment, a new team member, or a new subaward triggers a fresh check against all four compliance areas, not just the one that prompted the change.
Kissflow is the governed execution layer at the edges of the research compliance stack. It does not replace the IRB's judgment, the COI committee's determination, or export control counsel's licensing analysis. It replaces the disconnected systems that currently make it possible for a project to be compliant in one area while quietly behind in another, because none of the four offices involved sees the whole picture.
If your institution runs Cayuse, Huron, or a dedicated IRB and COI system, Kissflow does not compete with any of them for their specific compliance function. It sits alongside them as the layer that connects a project's IRB status, COI clearance, export control screening, and training completion into one view, so a research administrator or a compliance office can answer a cross-cutting question without reconstructing it from four systems.
The differentiation that matters to a research compliance office: when NSF expands its training requirements, a new export control determination applies to a specific technology, or the institution adjusts its COI management plan process, that office updates the workflow directly, instead of coordinating a manual handoff across four offices every time a policy changes.
Whether the research presents more than minimal risk to participants, or falls outside the specific categories defined for exempt or expedited review. Full board review requires a vote at a convened meeting of the IRB, while expedited review can be conducted by the chair or a designated reviewer.
At proposal submission, at least annually, and within the institution's policy window whenever a new financial interest arises, not as a one-time disclosure at the start of employment.
No. Releasing controlled technical data to a foreign national within the United States can itself require an export license, a deemed export, under both the Export Administration Regulations and the International Traffic in Arms Regulations.
Every undergraduate, graduate student, postdoctoral researcher, and, since the 2022 CHIPS and Science Act, all senior personnel supported by an NSF award, whether paid or unpaid.
The required curriculum expanded to include federal export control, disclosure, and reporting requirements, tying the training obligation directly to the same compliance areas COI and export control offices already manage separately.
No. Kissflow is the workflow layer that connects IRB status, COI clearance, export control screening, and training completion across a project. The IRB and COI systems remain the systems of record for their specific determinations.
Request a 30-minute walkthrough to see how Kissflow connects IRB review, COI disclosure, export control screening, and training verification into one governed research compliance workflow.