03 · What You Need to Know
Research Requirements Come From Different Sources of Authority
Begin by identifying every requirement and where it comes from
A single project can be governed simultaneously by several layers of requirements.
| Source |
What It May Govern |
How It May Be Changed |
| Law or regulation |
Privacy, clinical trials, safety, human tissue, medicines, employment, records, international transfer, or other legally regulated matters |
Generally cannot be waived by a researcher, institution, ethics committee, sponsor, or funder merely by agreement |
| Ethics approval or favorable opinion |
Approved protocol, recruitment, consent, participant protection, privacy, risk, and other ethically reviewed arrangements |
May require a formal amendment, further review, or another authorized ethics process |
| Institutional policy |
Research governance, integrity, data, security, records, staff conduct, facilities, and institutional resources |
Depends on the policy and institution's authority; exemptions or alternative arrangements may sometimes exist |
| Sponsor requirement |
Project setup, oversight, monitoring, risk, reporting, site readiness, data quality, and other sponsor responsibilities |
Depends on the governing framework and sponsor's authority |
| Funding condition |
Use of funds, reporting, milestones, open access, data sharing, acknowledgement, and other grant conditions |
May sometimes be renegotiated with the funder but should not simply be ignored |
| Contract or research agreement |
Data, confidentiality, intellectual property, finances, publication, responsibilities, services, and collaboration |
Usually requires agreement of the relevant contracting parties |
The categories can overlap. A requirement may appear in an institutional policy because the institution is implementing a legal obligation. A funding agreement may incorporate ethics or regulatory conditions. A sponsor requirement may exist because legislation imposes a sponsor duty.
Tracing the requirement to its underlying source is therefore more informative than simply asking who issued the document.
Law cannot ordinarily be overridden by an ethics committee, institution, or funder
Ethical approval does not legalize conduct that is otherwise unlawful.
The current UK Policy Framework makes legality an explicit principle of research governance and requires researchers and sponsors to familiarize themselves with relevant legislation and guidance. It also states that its own principles take account of legal requirements rather than replacing them.
An ethics committee might conclude that a proposed use of data is ethically acceptable, for example, while applicable law still requires a particular legal basis, authorization, safeguard, or restriction. The researcher must satisfy both.
Conversely, the fact that an activity is legally permissible does not necessarily establish that it is ethically acceptable research.
Legally permissible
The activity is not prohibited and satisfies applicable legal requirements.
Ethically acceptable
The activity satisfies the applicable ethical standards and review requirements for the research.
These judgments often align, but neither should automatically be substituted for the other.
An ethics condition cannot usually be ignored because another party prefers a different procedure
Research ethics committees exist to independently review ethical aspects of research. WHO's operational guidance describes ethics-review systems as mechanisms through which organizations rely on research ethics committees to review and oversee ethical aspects of health research involving human participants.
If a study has been approved on the basis that participants receive a particular consent process, recruitment procedure, confidentiality protection, or risk-management arrangement, the research team should not quietly abandon that arrangement because a site, funder, sponsor, or collaborator finds another approach more convenient.
The proposed change may need to be submitted through the applicable amendment or review process. Current HRA guidance, for example, warns that failure to follow conditions attached to a favorable ethics opinion can lead the committee to review its opinion.
A funder can impose conditions, but funding does not create unlimited governance authority
Funders can legitimately attach conditions to financial support. These may concern milestones, expenditure, reporting, dissemination, open access, data sharing, acknowledgement, or other matters within the funding arrangement.
But the funder does not thereby acquire authority to require unlawful or ethically impermissible research.
The UK Policy Framework makes this separation explicit. Funders have responsibilities for matters such as scientific quality, costs, feasibility, conditions of funding, and ensuring that ongoing funding is conditional on sponsorship and relevant approvals being in place before research begins. Sponsors, investigators, sites, and ethics bodies retain different responsibilities.
This is another reason to distinguish research sponsorship from research funding.
A sponsor cannot authorize what another authority prohibits
A formal research sponsor can have substantial project-level authority and responsibility. Under the UK framework, the sponsor must ensure that required ethics and other approvals exist and verify that regulatory and practical arrangements are in place before permitting research to begin.
That does not mean sponsor authorization supersedes every other requirement.
If an ethics committee has not approved a required modification, a regulator has not granted a required authorization, or applicable law prohibits an activity, the sponsor cannot simply declare the problem resolved.
Sponsor authority operates within the larger legal and governance framework.
Institutional policies can legitimately add requirements
A university, hospital, company, or other organization may impose requirements concerning its own premises, information systems, staff, data, resources, safety, or governance processes.
These requirements may be more restrictive than the minimum required by an external ethics body or funder. That does not automatically make them invalid. The institution may be managing responsibilities that the other body does not control.
At the same time, an institution should not assume that its internal policy can override law, regulatory requirements, or conditions imposed by another body acting within its legitimate authority.
When the disagreement is specifically between institutions, the appropriate first step is to resolve the conflicting institutional requirements by identifying the source and scope of each one.
Do not assume that the strictest requirement always resolves the problem
When requirements are cumulative, satisfying the most protective or demanding standard may sometimes satisfy all of them.
For example, if one institution requires encryption and another specifies a stronger encryption standard that is permitted by both, the stronger standard may solve the issue.
But genuine conflicts are not always solved by becoming more restrictive. A funder may require data sharing while consent, privacy requirements, law, or an ethics decision restrict what data may be shared. Retaining data longer may satisfy one policy while violating another valid requirement to destroy them.
What matters is compatibility and authority, not simply which requirement sounds stricter.
Participant safety and welfare can impose an immediate priority
Some conflicts cannot wait for an ordinary administrative process.
The UK Policy Framework places the safety and well-being of individuals above the interests of science and society. It also states that where an unmanageable conflict arises between research and a patient's interests, the duty to the participant as a patient prevails.
Research frameworks may therefore permit or require urgent action to protect participants even before ordinary amendment processes are completed, followed by prompt reporting through the required channels.
The exact procedure is jurisdiction- and study-specific. "Safety first" should not be interpreted as permission to bypass governance whenever researchers personally prefer another procedure.
A contract cannot necessarily make an impermissible activity permissible
Research agreements are important tools for allocating responsibility. They can govern data sharing, confidentiality, publication, finances, intellectual property, services, and many other matters.
But contractual agreement does not automatically override applicable law or ethics requirements.
If a research contract requires publication of identifiable participant information that the researchers are not lawfully or ethically permitted to disclose, the solution is not to breach participant protections because the contract was signed. The contractual term itself needs to be addressed.
Changing the research may be the correct resolution
Sometimes the conflict cannot be solved while preserving the original design.
The research team may need to change a data flow, modify recruitment, remove a site, renegotiate a funding condition, revise an agreement, alter the analysis plan, seek additional consent, or change another aspect of the protocol.
If the change affects the approved research, appropriate ethics, sponsor, institutional, regulatory, or other review may be required before implementation.
Good governance is not the art of finding a loophole through every requirement. Occasionally, the scientifically elegant plan simply cannot be conducted in its original form under the legitimate constraints that apply.
If no compliant resolution exists, the affected research activity may need to stop
Not every conflict has a compromise.
If a legally required restriction prevents a planned activity, an ethics committee will not approve the necessary modification, or institutions cannot establish a compliant arrangement for a critical research function, the project may need to suspend or abandon that activity.
This can mean delaying a site, changing the protocol, removing a collaborating organization, returning or declining funds, or in some cases stopping the project.
The fact that research has already consumed time and money does not make an impermissible activity permissible. Sunk costs remain remarkably unpersuasive to statutes and ethics committees alike.
Escalation should follow the source of the conflict
There is no single office that can resolve every research-governance disagreement.
| Conflict Involves |
Likely Bodies to Involve |
| Ethics conditions |
Research ethics committee or responsible ethics office, investigator, sponsor |
| Legal or regulatory requirement |
Responsible regulatory authority or appropriately qualified legal/compliance function |
| Institutional policy |
Research governance office, institutional authority responsible for the policy, PI |
| Funding condition |
Funder, institutional research or grants office, PI, sponsor where relevant |
| Sponsor requirement |
Sponsor, chief or principal investigator, affected sites |
| Contractual requirement |
Authorized contracting parties and relevant legal or contracts offices |
| Participant safety |
Investigator, clinical or professional authority where relevant, sponsor, ethics or regulatory bodies according to applicable urgent-reporting requirements |
The people resolving the issue should have authority over the requirements involved. A research assistant should not be expected to negotiate away a contractual obligation, and an ethics committee should not be asked to rewrite legislation.
Document both the conflict and its resolution
Significant governance conflicts should leave a clear record.
Document what the requirements were, why they appeared incompatible, who had authority over them, what decision was reached, and which protocols, agreements, approvals, or procedures changed as a result.
This is particularly important in collaborative projects because personnel change. Six months later, a new site coordinator should not have to reconstruct the resolution from fragments of email and institutional folklore.
Watch Out
No research stakeholder has unlimited authority. A funder cannot purchase an exemption from ethics, an ethics committee cannot make unlawful research lawful, a sponsor cannot override a regulator, and an institution cannot automatically disregard obligations another legitimate authority imposes. Resolve conflicts by tracing each requirement to its source and authority.
