When an outside board also reviews: which one reads first, and what each is deciding
A candidate collecting data inside a hospital, a school district or an employer will often meet a second review body with its own forms, its own criteria and its own opinion about sequence. Grand Canyon University's board and that body are not duplicates of one another. They are deciding different questions, and the file only moves when you can say which question belongs to whom.
The short answer
A site letter is permission to be there; an external board review is an ethics decision. GCU wants the letter with the submission, so where a site insists on university approval first, a conditional letter breaks the deadlock.
Does a site letter mean the site has reviewed the study?
No, and conflating the two is the mistake that costs candidates most. GCU's board requires site authorization for protocols involving human subjects, and expects an authorization or cooperation letter from each site agreeing to host the work — part of the submission, in hand before any activity happens there. That letter answers a question of access: may this person be here, approach these people, use this space, receive these records.
An external board review answers something else: is this study ethically acceptable for the people this institution is responsible for. A hospital's research office can grant the first and refuse the second, or grant both, or neither. A district superintendent may sign with genuine authority and still have no review body at all. The two are not substitutes, and a file offering one where the board wanted the other comes straight back.
So the first question is not who goes first, but which of these the site actually has. Ask directly: is there a review body, what does it require, and who signs the access letter. One email prevents most of what follows.
Which board goes first?
There is no universal answer, and anyone who offers one has not met enough sites. What exists is a common deadlock and a standard way out.
The deadlock forms like this. GCU wants the site authorization letter with the submission. The site, quite reasonably, will not authorize a study its own committee has not seen, or cannot issue a letter until the university has approved. Each waits for the other, and the file stops.
It breaks with a conditional letter. The site writes what it is genuinely willing to write now — that it has reviewed the proposed procedures, agrees to host the study as described, and makes its authorization contingent on the university's approval and its own committee's later review. That letter is honest, signed by someone with authority to sign it, and describes exactly the procedures the application describes. It promises nothing about a decision nobody has made.
Two rules govern that letter, and both matter more than the sequence. It must not authorize less than the application describes — a letter permitting interviews while the application also plans a records extract is a return waiting to happen. And the condition must be written rather than implied, because a letter that looks unconditional and later proves otherwise is a far worse problem than a conditional one filed openly.
What does the external board decide that GCU's does not?
Usually something only it can decide, because only it answers for the people or records concerned.
- A hospital or health system holds protected health information. Under 45 CFR 164.512(i) the disclosure of that information for research without individual authorization requires documented approval of a waiver or alteration by an IRB or a privacy board, resting on findings that the privacy risk is no more than minimal, that identifiers will be protected and then destroyed, and that the work could not realistically go ahead without the waiver, or without reaching the information at all. GCU's board cannot make that finding on another entity's records.
- A school or district holds education records. 34 CFR 99.31 sets when identifiable information may be disclosed without consent, including the written-agreement route for studies conducted for or on behalf of the agency, with the purpose, scope and duration fixed and the identifiable information destroyed when it is no longer needed. That agreement is the district's instrument, not the university's.
- An employer decides about its own people and operations: whether staff may be approached, on whose attention, and what it is exposed to if answers about a manager or a policy travel. No ethics jurisdiction over your protocol; complete authority over its own doors.
GCU's board meanwhile decides what it always decides: the level of review, whether the criteria in 45 CFR 46.111 are met, and whether the file aligns with the proposal academic quality review approved. It defers none of that to a site, and no site's approval substitutes for it.
What is reliance, and does it apply to a doctoral file?
Reliance is a real mechanism with a narrow doorway, and most candidates who ask about it turn out to need a letter instead.
45 CFR 46.114 requires a United States institution engaged in cooperative research to rely on a single IRB for the portion conducted in the United States, excepting work where more than one review is required by law, including tribal law, or where a supporting federal department or agency documents that single review is not appropriate. Outside that requirement, institutions may review jointly, rely on another board, or set up comparable arrangements so one file is not read twice over.
Reliance is documented rather than assumed. National infrastructure such as SMART IRB exists to remove the per-study negotiation: institutions join a master agreement, and each study's arrangement is requested, tracked and documented through a shared system, with one body named reviewing IRB and the others relying institutions.
For a single-site doctoral study — one hospital, one district, one employer — reliance is usually not the shape of the problem. You have one board reviewing and one organization granting access. Reliance becomes worth raising when a site insists its own committee must be the reviewing body, or where the study spans institutions. Whether GCU enters such an arrangement, and by what instrument, is set by GCU's current doctoral handbook or IRB portal — a question to put to the board rather than assume either way.
The two-board matrix
| The other body | What it is deciding | What GCU's board still decides | What the file carries |
|---|---|---|---|
| Hospital or health system board | Ethics for its patients; access to protected health information | Level of review; the criteria; alignment with the approved proposal | Its determination letter, plus any waiver or data use agreement |
| Health system with no board | Access only | Everything ethical | Site authorization signed with real authority |
| School district research office | Whether the work may proceed in its schools; disclosure of education records | Level of review; the criteria; alignment | Its approval and any written agreement over records |
| Employer with no review body | Access to staff, space and time | Everything ethical, including coercion in the workplace | Site authorization naming exactly the approved procedures |
| A second university | Its own review, or reliance | Whichever role it holds under the arrangement | The documented reliance, or both determinations |
A reading of how these bodies divide the work, not a determination. What any particular site requires is that site's to state.
How does a two-board file go wrong?
The five recurring failures
- Two applications describing two slightly different studies, because each was written for its own audience.
- A letter signed by someone senior but without authority to grant access to those people or those records.
- An external approval obtained for procedures the university has since required to change, with nobody told.
- Recruitment begun on the strength of one approval while the other is still outstanding.
- A second site discovered late, after the file was built as a single-site study.
What a clean two-board file does
- Uses one master description of the procedures, and lets each form quote it rather than paraphrase it.
- Names the signing authority and their title, and asks the site who that is rather than guessing.
- Routes any change required by one body back through the other before it is used anywhere.
- Waits for both, in writing, before a single participant is approached.
- States plainly, in the application, that a second review exists and where it currently stands.
Neither approval releases you from the other. Two letters, then a first participant.
What if the site's requirements contradict GCU's?
Then you have a method question wearing a paperwork costume, and it goes back to your chair and committee rather than being settled by quiet editing. If a hospital insists consent be taken by its own staff, or a district requires an opt-out route where your protocol promised opt-in, that is a change to approved procedures — and it reaches GCU's board as an amendment before it is used, never as a footnote afterwards. Nothing changes in one document without changing everywhere it appears: the rule the third move is built on.
What to do next
Before approaching anybody at the site, write down three things: which body there has a review function, who holds authority to sign an access letter, and exactly what you will ask for — people, space, records. Carry those answers into the first conversation and the sequence usually reveals itself rather than needing to be negotiated. Send us the AQR-approved proposal and the site's name, and the free application review will map the two-board path. The surrounding gates are counted in gates and passes; the letter itself is dissected in the site authorization piece; anything left over is likely on the record.
Sources
- GCU Research — Institutional Review Board
- GCU Research — Steps to Prepare IRB Application
- GCU Research — Site Authorization Checklist
- GCU IRB Resource Center — Procedure for Approval to Conduct Research at GCU
- 45 CFR 46.111 — approval criteria, and the safeguards clause
- 45 CFR 46.114 — Cooperative research
- 45 CFR 164.512(i) — Uses and disclosures for research
- 45 CFR 164.514 — de-identified health data, and the limited data set
- 34 CFR 99.31 — FERPA: disclosure without consent
- SMART IRB — reliance agreement and reliance system
Where this article and GCU's own materials differ, GCU's current doctoral handbook or IRB portal governs. gcuirb is an independent practice and is not affiliated with, endorsed by or connected to Grand Canyon University.