How do I determine the level of risk of my project?

Types of Review

Delegated Review

Applications receive an administrative review followed by a review by two members of the REB. These reviews form the basis of the final feedback to the investigator. The Chair of the REB is sent the proposed feedback plus the submitted reviews and approves or amends the final feedback. The process takes approximately 2 weeks from the date of submission, but on occasion can take longer. In the case of annual renewals and amendments, delegated review may be carried out administratively 

Full Board Review

Applications receive an administrative review and are then slated for review by all members of the REB at the next meeting (meetings take place monthly). At the meeting, members propose amendments to the administrative review. After the meeting, the Chair is sent the proposed feedback and approves or amends the final feedback. Investigators are usually advised of the results of full board review within a few days of the meeting. 

Types of Risk

Minimal Risk

Studies which fall under the threshold of minimal risk may be reviewed under the delegated review process. The definition of minimal risk in the TCPS2 (Chapter 2) is as follows:

For the purposes of this Policy, “minimal risk” research is defined as research in which the probability and magnitude of possible harms implied by participation in the research is no greater than those encountered by participants in those aspects of their everyday life that relate to the research. 

There are several types of risk to consider and must be considered within the context of the given research project, including the methodology, participant population, nature of the data collection, and security of data. 

Physical Risk

 Risk of harm through bodily contact or administration of any substance. 

Psychological/emotional Risk

Risk of feeling uncomfortable, embarrassed, anxious or upset. 


Risk of loss of status, privacy, and/or reputation, including legal risk.

Economic Risk 

Risk to livelihood or income.


The delegated review process may not be used where any of these risks prove to be greater than minimal i.e. could potentially cause harm beyond that which would normally be encountered by the participant in everyday life. Studies where identification of the participants and/or their responses would reasonably place them at risk of criminal or civil liability or be damaging to the participant’s financial standing, employability, insurability, reputation, or may be stigmatizing cannot undergo delegated review. 


To evaluate risk for an application, consider: 

  • Group vulnerability – any pre-existing vulnerabilities associated with proposed participant groups. For example
    • relating to pre-existing physiological or health conditions, 
    • cognitive or emotional factors,
    • socio-economic or legal status,
    • conflict of interest, such as dual roles.
  • Research risk – the probability and magnitude of harms participants may experience as a result of the proposed methods to be used and types of data to be collected. For example, 
    • relating to physiological or health issues such as clinical diagnoses or side effects,
    •  cognitive or emotional factors such as stress or anxiety during data collection, 
    • socio-economic or legal ramifications such as stigma, loss of employment, deportation, or criminal investigation (e.g. in the event of duty to report intent to cause serious harm, subpoena, or breach of confidentiality). 

The risk matrix below can aid in considering the over-all assessment of group vulnerability and research risk: 



Low Research Risk

Medium Research Risk

High Research Risk

Low Group Vulnerability




Medium Group Vulnerability




High Group Vulnerability







Research risk can be further broken down into low, medium and high based on the nature of the risk and the likelihood of the risk of harm. The magnitude of some harms may be very high while at the same time the probability of them occurring is low. Alternatively, risks of harm could be low, but quite a bit more likely to occur. The following matrix can aid in assessing research risk: 



Low Magnitude of Research Risk

Medium Magnitude of Research Risk

High Magnitude of Research Risk

Low Probability of Research Risk




Medium Probability of Research Risk




High Probability of Research Risk







Types of research that MAY be delegated (examples only):

  • Annual renewals of research studies that originally qualified for delegated review and/or for which no adverse events or ethical problems have arisen. 
  • Studies that have received previous approval by another institutional REB. 
  • Minor amendments to previously approved research where the changes to the study protocol or consent documents do not result in increased risk to participants. 
  • Studies which pose minimal risks to participants
  • Prospective collection of biological samples for research purposes by non-invasive means, in adults.
  • Research involving materials that have been collected, or will be collected solely for non-research purposes.

The default process is full review, and justification for delegated review cannot be based on the method of collection. Attention must be paid to how these methods will be used to maintain minimal risk of harm to participants. 


Types of Research that MAY NOT be Delegated (examples only)

  • Research which poses more than minimal risk to the participants.
  • Research involving vulnerable populations.
  • Research involving genetic testing that may cause psychological or social risk to individuals, the participant population, or to their community in the present or future. 
  • Research involving testing for additional diseases or markers not yet determined that may cause psychological or social risk to individuals, the participant population or to their community in the present or future. 
  • Research involving the generation of databanks (of specimens) or databases (of populations)

Special Considerations for Research Populations 

Any research involving physical intervention or collection of biological samples, whether by invasive or non-invasive means, in children cannot be delegated, unless it is part of a required medical procedure and carries no additional risk. 

Research involving a specific community, including Indigenous people, HIV/AIDS community, etc., needs additional care to evaluate potential risks to the community that may occur from dissemination of results. 


Thanks to the University of Toronto, Office of Research Ethics for permission to use guidelines posted on their website to inform this document.

Support info
Human Ethics
Recruitment and Consent