two boards

Two boards, one project — and which one goes first.

When the site is a hospital, a health system or an employer with its own review body, you are not choosing between boards. You are managing two, each deciding only for its own institution, neither able to decide for the other. The sequencing question has a defensible default — Herzing's own submission checklists ask you to attach the external application and its approval letter — and a small set of honest exceptions. This piece sets out who owns what, the order that usually holds, and what to do when each board expects to be second.

Olivia Tremblay, MSN, RN · filed 23 August 2026

Both boards decide for their own institution and neither can decide for the other. Herzing's checklist asks you to attach the external application and its approval letter, so start the outside board first — and ask each, in writing, what order it expects.

Does a second board even apply to your project?

Ask the site rather than assuming from its size. A community clinic may have no review body and rely entirely on an administrator's permission; a large system may have several bodies with overlapping claims, and the one called "the IRB" may not be the one that has to see your project first.

The bodies you may meet at a site, singly or together:

The site's IRB or research committee, which reviews human-subjects research conducted on its premises or with its people.
A nursing research or evidence-based practice council, which in many hospitals screens practice-facing projects before anything reaches a board.
A quality or performance improvement committee, which may claim work that the site classifies as improvement rather than research — a classification that need not match the one your project carries.
A privacy office or privacy board. Where records are in play, this is the body that waives individual authorization on the criteria at 164.512(i), or releases a limited data set once an agreement under 164.514(e) is signed. It is a decision separate from research approval, and frequently the hardest one to reach.
Legal or contracting, wherever an agreement names an institution as a party.
The person who signs the site permission letter, who is not a board at all and whose signature does not substitute for one. That letter is its own piece of work — see the site permission letter piece.

Federal regulation contemplates the multi-institution case directly. Under 46.114(a), every institution taking part in a cooperative project carries its own responsibility for safeguarding participants and for complying with the policy. The single-IRB requirement at paragraph (b) reaches cooperative research that the policy covers, with exceptions for research where law requires more than one review or where the supporting federal agency documents that a single board is inappropriate. Paragraph (c) then lets institutions outside that requirement set up joint review, rely on somebody else's board, or arrange things similarly so effort is not duplicated. Reliance is a genuine option — but only where both institutions agree to it in writing, and neither can be talked into it by an applicant.

What does each board actually own?

Which question belongs to which board
The question	Herzing's board	The site's board or committee
Is this human-subjects research?	Decides for the university. The Chair triages every incoming application into exempt, expedited or full board	Decides for the site, and may reach a different classification of the same project
Are the participants adequately protected?	Applies 45 CFR 46.111 to the protocol as filed	Applies the same criteria plus its own institutional policy, which can be stricter
May its own records leave the building?	Asks that your account of the lawful basis is coherent	Owns this outright. Authorization, a waiver, a limited data set or de-identification is the site's decision to make
May you approach its people?	Reviews the recruitment plan	Owns access to the workforce, the patients and the premises
Who signs an agreement?	Any agreement naming the university is an institutional matter, not one for an individual to sign	Its own contracting or legal office signs for the site
Can it override the other?	No	No. Each decides only for itself

The row that causes the most trouble is the first. It is entirely possible for a site to call your project quality improvement, exempt it from its own board, and hand you a permission letter — while Herzing's board reads the same design as research because it is intended to generalise beyond that site. The site's classification is not a determination for the university, and vice versa. Where the two diverge, the file has to be honest about both readings rather than quoting whichever is more convenient. The review levels piece works through how the university's own assignment is made.

Which one goes first?

The default that fits Herzing's published material: start the external board first. Both Herzing applications list, among the items that accompany a submission, an external IRB's own application together with its approval letter, where one applies — the external material is contemplated as an attachment to the Herzing file, in other words, rather than as something that follows it. The Statement of Principles carries the same expectation for collaborations with an outside institution: where approval has been obtained elsewhere, a copy of that application and approval goes to the IRB Chair along with the request.

Start first does not mean finish first. In practice the sequence that wastes the least effort is:

Ask both boards, in writing, what order each expects. One email to the site's research office and one to Herzing's IRB office. Keep the replies; they are the record you will quote if the two expectations conflict.
Open the site's process immediately, along with the site permission letter and any privacy-office request, because these depend on people who do not work for you and whose calendars you cannot see.
Build one protocol, not two. The same design, the same instruments, the same data-security answers, formatted onto each board's own forms. Two boards reading two different descriptions of one project is the failure mode this whole exercise exists to prevent.
File with Herzing against the announced cut-off, attaching whatever external material exists — the submitted application at minimum, the approval letter when it arrives. What the calendar costs a late file is set out in the gates and passes piece.
Carry each board's conditions back to the other as an amendment where they change the protocol, rather than quietly running two versions.

What if the two boards each want to be second?

It happens, and it is a real deadlock rather than a misunderstanding: a site board that will not read anything without academic approval, facing a university checklist that asks for the site's approval letter. Four ways out, in the order worth trying.

File in parallel and say so. Submit to both, and state in each application that the other review is under way, naming the board and the date of submission. The older edition of Herzing's Statement of Principles phrased the attachment requirement to cover approval that "has been or will be" obtained elsewhere, which is the situation this describes. Confirm the current wording against Herzing's current IRB handbook or portal.
Ask for conditional or contingent approval. Many boards will approve subject to receipt of the other institution's letter, releasing you to begin only once both are in hand. This resolves most deadlocks and costs nothing to request.
Propose reliance. Where both institutions are willing, 45 CFR 46.114(c) allows one to rely on the other's review under a written arrangement. This is an institution-to-institution agreement; it is arranged between the two offices, not by the applicant, and neither is obliged to enter it.
Split the decision. Sometimes what the site actually needs first is not research approval but a privacy determination or a signed data-use agreement, which can proceed independently of either board's protocol review.

What is never a way out is beginning. Herzing's bylaws are unambiguous that research may not start before written approval, and a site's permission does not stand in for the university's decision any more than the university's decision opens a door at the site. Nor does approval end the sequence: 45 CFR 46.112, restated in Herzing's bylaws, allows institutional officials to add restrictions after board approval, though they may never approve what a board declined.

What the two-boards pocket carries

The external application, as submitted, in the version the site's board actually received.
The external approval letter when it exists, and evidence of submission until then.
A single protocol narrative reproduced faithfully on both boards' forms, with the same numbers in both.
The site permission letter, on the site's letterhead, signed by someone with authority over the access it grants.
Any program chair letter from an affiliated institution, which Herzing's checklists list separately where applicable.
The privacy paperwork — waiver documentation or the data-use agreement — where records leave a covered entity. What each of those requires is set out in the existing records piece.
A conditions log. Every requirement either board attaches, and where it now appears in the protocol, so an amendment to one is never missed at the other.
CITI certification for every named person — something both boards usually want, and which Herzing supplies to its own affiliates without charge through Canvas.

What to do next

Send the two emails today — one to the site's research office, one to Herzing's IRB office — asking each what order it expects and what it needs from the other. Everything else in this article is downstream of those two replies, and they cost nothing but the asking.

Rather have it handled? The free application review reads your folder alongside the site's requirements and marks the places where the two are going to collide. We then draft both submissions off a single protocol, hold their versions in step, and answer whatever either board sends back until both approvals exist. Nothing about the research changes hands: it stays yours, while each board keeps its own verdict entirely to itself. Read how it works for the tabs in order, or the FAQ for the compressed version.

Sources

Herzing University Institutional Review Board — the board's page, its forms and its contact address.
Herzing University IRB Research Protocol Application (PDF) — the checklist line asking for an external board's application and approval letter.
Herzing University IRB Healthcare Improvement or Innovation Project Application (PDF) — the same checklist, plus the program chair signature line.
Herzing University IRB Statement of Principles (PDF) — internal and external requests, and the submission cut-off.
Herzing University IRB Bylaws (PDF) — written approval before research begins, and institutional review after board approval.
45 CFR 46.114 — cooperative research, the single-IRB requirement and its exceptions, and joint review or reliance arrangements.
45 CFR 46.112 — institutional review after a board has approved.
45 CFR 164.512(i) and 45 CFR 164.514(e) — privacy-board waivers and limited data sets with data-use agreements.

Named forms, routes and prerequisites move between editions; verify every Herzing-specific item against Herzing's current IRB handbook or portal, and every site-specific item against the site's own research office. This practice is independent and not affiliated with Herzing University or its Institutional Review Board.

the other tabs in this file

Gates and passes Existing records Interviews and focus groups How it works FAQ Contact