Chapter 2

Chapter 2: Consent, Review and Vulnerable Populations: The Human-Subjects Research System

How WIA-BIO-018 turns three safeguards into working procedure: informed consent, independent ethics review, and additional protection for people who are less able to protect their own interests.

Chapter 1 traced the principles; this chapter covers the machinery that applies them. When a researcher wants to enrol a human being in a study, three things stand in the way, and all three are intentional. First, the person has to agree, knowing what they are agreeing to, and has to be able to agree. Second, a committee that does not answer to the researcher has to find the study acceptable. Third, if the person belongs to a group that is easy to pressure or exploit, extra conditions apply. WIA-BIO-018 covers these in §3 (informed consent), §4 (the Institutional Review Board) and §5 (vulnerable populations).

The chapter follows the order a participant meets them. Where the standard's numbers are its own design choices rather than legal or clinical rules, the text says so, and where its wording departs from the regulation it paraphrases, the chapter gives the regulatory reading. There is no code here; the same rules return as data structures and SDK functions from Chapter 4 on.

2.1 What Must Be Disclosed: The Ten Elements

Informed consent is often reduced to a signature, but a signature only records that a process took place. The process itself has three ingredients, and BIO-018 §3.1 names all three: information, comprehension and voluntariness, with competence (decision-making capacity) as the precondition that makes the other three meaningful. Section 3.1.1 lists ten items that every consent process has to cover.

#Element (§3.1.1)What the participant should be able to findCommon way it goes wrong
1Research purpose and proceduresWhy the study exists, what will be done to them, and which parts are experimental rather than routine careRandomisation or placebo use is mentioned only in technical language
2Duration of participationTotal time, number of visits, and any long-term follow-upFollow-up after the main study phase is left out
3Risks (physical, psychological, social, economic)Foreseeable risks and discomforts, including the possibility of risks not yet knownOnly physical side effects are listed; social risks such as stigma or loss of insurability are missing
4Benefits (direct and indirect)Whether the participant personally may benefit, as distinct from benefit to future patientsBenefits are overstated, which encourages "therapeutic misconception"
5Alternatives to participationOther treatments or options available outside the studyLeft out entirely, so taking part looks like the only option
6Confidentiality measuresWho will see identifiable data and how it is protectedA generic line such as "your information will be kept confidential"
7Compensation for injuryWhat care is available and who pays if the research causes harmNot mentioned, or buried in insurance wording
8Voluntary participation and right to withdrawThat refusing or withdrawing brings no penalty or loss of normal careStated once in small print instead of being repeated at key points
9Contact informationWhom to contact about the study, and separately, about their rights as a participantOnly the study team is listed, with no independent contact for complaints
10Future use of data/samplesWhether data and specimens will be kept, shared or used for other research, and in what formA blanket sentence that samples "may be used for future research"

The list follows the basic elements in the major regulations closely. The US Common Rule (45 CFR 46.116) and ICH E6 Good Clinical Practice each require most of these items in some form. Two features of the 2018 revision of the Common Rule are worth adding to an implementation, even though BIO-018 does not list them. The first is a key information summary at the start of the consent form: a short, focused presentation of the facts most likely to help a person decide, ahead of the full detail. The second is the requirement to state whether identifiable data or specimens, once identifiers are removed, might be used for future research or shared with other investigators. The second is the same concern as element 10.

Element 10 matters most for biobanks and genomic research. A blood sample taken for a diabetes trial can sit in a freezer for decades. It can be sequenced with technology that did not exist at enrolment and combined with datasets the participant never heard of. Chapter 3 explains why a genome is hard to anonymise. The ethical point is simpler: nobody can meaningfully agree to uses no one has described. Institutions respond with one of three consent models. Specific consent covers only the named study. Tiered consent lets the participant tick separate choices, for example "same disease area only" or "commercial partners allowed". Broad consent covers a described range of future research under governance safeguards; the US Common Rule provides a formal broad-consent route. Korea's Bioethics and Safety Act likewise requires written consent covering matters such as storage and provision to third parties when material is donated to a human biobank. Whatever the model, what was chosen has to be recorded in a form a system can check before each later use. That requirement drives the data model in Chapter 4.

Section 3.1.1 also gives a "risk disclosure adequacy" formula that sums each risk's probability times its severity and divides by the number of risks. The standard does not define the scales for probability or severity, and it sets no threshold, so the formula cannot be computed as written. Read it as a qualitative reminder that an adequate risk section tells people both how likely each harm is and how serious it would be.

2.2 Checking Understanding: Comprehension Assessment

Disclosure is not understanding. BIO-018 §3.1.2 therefore makes comprehension something to be checked, not assumed. It names two methods.

The standard turns the result into a percentage, correct responses divided by total questions, and requires at least 80% before enrolment continues. The 80% figure is a BIO-018 design choice. Regulations generally require that information be given in language the participant can understand, but they do not set a numerical pass mark. An institution adopting BIO-018 adopts that threshold as its own policy and should apply it consistently. The comparison is "greater than or equal to", so 8 out of 10 passes and 79% does not.

A worked case: participant P-67890

Appendix A.2 of the specification records a ten-question assessment for a participant in a diabetes drug trial. Mapping each question to the disclosure element it tests shows more than the total score does.

QQuestionResultDisclosure element tested
1What is the purpose of this study?Correct1 Purpose and procedures
2How long will you participate?Correct2 Duration
3What are the main risks?Correct3 Risks
4Can you stop at any time?Correct8 Voluntary participation and withdrawal
5What are the alternatives?Incorrect5 Alternatives
6Who will see your data?Correct6 Confidentiality
7Will you be compensated?CorrectPayment for participation (ambiguous; see below)
8How will privacy be protected?Correct6 Confidentiality
9What happens if you're injured?Incorrect7 Compensation for injury
10Who can you contact with questions?Correct9 Contact information

The score is 8/10, exactly 80%, so the result is a pass. The specification does not stop there. Its recorded action is "clarify questions 5 and 9, re-assess". That is the right instinct, and the mapping shows why. The two misses are not trivia: without knowing the alternatives, a participant cannot judge whether joining is a choice or the only option, and without knowing what happens after an injury, they lack information they may urgently need. A passing total can hide failures on exactly the items that matter most.

The mapping also shows gaps in the questionnaire. No question tests benefits (element 4) or future use of samples (element 10). Two questions test confidentiality. Question 7, "Will you be compensated?", mixes payment for taking part with compensation for injury, which is a different element. For implementers, this book recommends two refinements to the plain percentage. First, map every question to a disclosure element so that coverage can be checked automatically. Second, mark a small set of critical items, such as the right to withdraw, the main risks, and the fact that the study is research, that must be answered correctly whatever the total. Under that rule, P-67890 would still pass, but the record would show two flagged elements, the re-education given and the result of reassessment, and an auditor could see all of it.

2.3 Voluntariness: Coercion and Undue Inducement

A fully informed decision is still not valid if it was not free. BIO-018 §3.1.3 lists five coercion indicators, all of which must be absent:

  1. Explicit threats or pressure, for example suggesting that care will suffer if the person declines.
  2. Excessive incentives, meaning payments or benefits large enough to override the person's judgment about risk.
  3. Exploitation of authority relationships, such as a treating physician recruiting their own patient, a professor their student, or a manager their employee. The person may feel unable to refuse even when nobody applies pressure.
  4. Time pressure or urgency tactics, such as requiring a decision on the spot or implying that places are about to run out.
  5. Withholding of standard care, making usual treatment conditional on taking part.

The standard computes a voluntariness score, V = 1 − (indicators present ÷ maximum indicators), and requires V ≥ 0.95. With five indicators, one indicator gives V = 0.80, which fails. So in practice the rule means that no indicator may be present. It is a binary test written as a score. That is defensible, since voluntariness is closer to a gate than a gradient, but a "0.80" must never be read as "mostly voluntary".

Most indicators are prevented by how the process is organised: consent is obtained by someone other than the treating clinician or supervisor, participants may take the documents home and consult family (outside genuine emergencies, Section 2.5), and the form states plainly that refusal changes nothing about routine care.

Fair compensation versus undue inducement

Payment is where the most judgment is needed. Paying for time, travel and inconvenience is fair; refusing to pay can itself be unjust, because it limits participation to those who can afford the time. The concern is an offer attractive enough that a person accepts risks they would otherwise refuse. Institutions often use a few rules of thumb. Payment is treated as reimbursement or recognition of burden, not as a benefit of the research, so it does not count in the risk-benefit balance. Payment is prorated across visits rather than held back as one large completion bonus, which could make withdrawal feel costly. The amount is set with reference to the burden and the local economic context, which is why BIO-018 lists "reasonable compensation (not undue inducement)" among the protections for economically disadvantaged participants (Section 2.7).

2.4 Decision-Making Capacity

Information, comprehension and voluntariness all assume that the person is able to decide. BIO-018 §3.1.4 describes capacity through four abilities. They come from the model developed by Paul Appelbaum and Thomas Grisso, which also underlies structured instruments such as the MacArthur Competence Assessment Tool for Clinical Research (MacCAT-CR).

Two clinical points shape any implementation. Capacity is decision-specific: someone may be able to consent to a blood draw but not to a complex randomised trial. It can also fluctuate with illness, medication or time of day. That is why BIO-018 asks for periodic reassessment of capacity for cognitively impaired participants, not a single test at enrolment.

The standard scores each ability and averages them: Capacity = (Understanding + Appreciation + Reasoning + Choice) ÷ 4. A result of at least 0.75 counts as sufficient for autonomous consent. Section 5.4 then gives four bands, which the SDK's ParticipantCapacity type names.

Band (§5.4)Score rangeParticipantCapacityWho decidesPractical consequence
Full capacity1.0fullParticipant aloneStandard consent process
Borderline0.75–0.99borderlineParticipant, with supportExtra explanation time, simplified materials, and a witness is advisable
Diminished0.50–0.74diminishedLegally authorized representative (LAR), with participant assentLAR consents; the participant's agreement is sought and their refusal respected
Severely impairedbelow 0.50severely-impairedLAR decisionLAR decides; assent is still sought where any meaningful communication is possible

These thresholds are BIO-018's own. No clinical guideline or regulation defines capacity as a number on a 0–1 scale, and in practice capacity is a clinical judgment, supported by instruments such as MacCAT-CR, about whether a person can make this decision. The bands are still useful as a common language for routing a consent process. One arithmetic problem needs attention, though. An average lets strength in one ability make up for complete absence of another. A person who scores 1.0 on understanding, appreciation and reasoning but cannot communicate any choice scores (1 + 1 + 1 + 0) ÷ 4 = 0.75, which lands in the "borderline, independent with support" band. That result is plainly wrong. Each of the four abilities is a necessary condition, so this book recommends a floor per ability, with a very low score in any one of them sending the case to formal clinical assessment, alongside the average.

Who counts as an LAR is set by law, not by the standard. Depending on local law it may be a court-appointed guardian, a health-care proxy or a family member in a statutory order, so a BIO-018 system should record the legal basis on which the representative acts, not just their name.

Assent is the affirmative agreement of someone who cannot give legally valid consent: a child, or an adult with diminished capacity. It is more than the absence of objection. The standard's rule, in both the child and cognitive-impairment sections, is that dissent is respected: if the person clearly refuses, the refusal generally prevails. The exception is where the intervention offers a direct benefit that is important to the person's health and available only through the research.

2.5 Waiver of Consent and the Emergency Exception

Some legitimate research cannot be done if every participant must give prior consent. Examples are studies of old records from thousands of untraceable patients, and cardiac-arrest trials where the patient is unconscious and treatment must start within minutes. BIO-018 §3.3 provides two routes for such cases.

Waiver of consent (§3.3.1)

The standard permits a waiver only when all four of these conditions hold:

  1. the research involves no more than minimal risk;
  2. the waiver will not adversely affect participants' rights and welfare;
  3. the research would be impracticable without the waiver;
  4. participants will be given pertinent information afterwards, where appropriate.

These track the US Common Rule's waiver criteria. The 2018 revision added a fifth condition that BIO-018 should be read as including: if the research uses identifiable private information or identifiable biospecimens, it must also be impracticable to do the research without the identifiable form. In other words, a waiver is not a shortcut for convenience when de-identified data would do. Waiver of consent should also be kept apart from waiver of documentation. In the second case, consent is still obtained, for example verbally in a telephone survey, but no signed form is collected. The two have different criteria and have to be recorded differently.

Emergency research exception (§3.3.2)

The emergency exception is narrower and stricter. BIO-018 requires a life-threatening condition, an intervention that can only be tested in the emergency setting, inability to obtain consent from the participant or an LAR in the time available, community consultation, public disclosure, independent data monitoring, and consent from the participant or LAR at the earliest opportunity afterwards. These requirements match the structure of the US FDA's "exception from informed consent" rule for emergency research (21 CFR 50.24). The EU Clinical Trials Regulation (Regulation (EU) No 536/2014) also contains specific provisions for trials in emergency situations.

Community consultation is the unusual element. Because individuals cannot be asked, the research team consults the community from which participants are likely to come, and tells the public about the study before it starts and about the results afterwards. This does not substitute for individual consent; it respects the population that bears the risk. For a BIO-018 system, the practical consequence is that a waiver or emergency enrolment has to be recorded as a positive decision with its legal basis, the IRB approval that authorised it, and later deferred-consent events. It must never appear as a consent record with blank fields.

2.6 The Institutional Review Board

Consent protects participants one at a time; the IRB protects them as a group, judging a study before anyone is enrolled and overseeing it afterwards. Its authority rests on independence from those who stand to gain.

Composition

BIO-018 §4.1 requires at least five members, diversity of race, gender and cultural background, both scientific and non-scientific members, a community representative not affiliated with the institution, and expertise relevant to the research under review. It prohibits conflicts of interest, members reviewing their own research, and institutional pressure to approve. These closely follow the US Common Rule's membership requirements. Korea's Bioethics and Safety Act sets a comparable baseline for institutional review boards, including a minimum membership of five and members from outside the institution. The non-scientist and the unaffiliated member check whether the study makes sense to someone outside the specialty and the institution.

The seven approval criteria

Section 4.2 lists what the board must determine before approving. Each criterion traces back to a Belmont principle from Chapter 1, and the list corresponds closely to the approval criteria of the Common Rule (45 CFR 46.111).

#The IRB must determine that…PrincipleWhat reviewers actually look at
1Risks are minimised through sound designBeneficenceWhether procedures already done for care can be reused and unnecessary tests dropped; whether the design can answer its question
2Risks are reasonable relative to benefitsBeneficenceDirect benefit to participants and the importance of the knowledge, weighed against the risks
3Selection of participants is equitableJusticeWhether inclusion and exclusion criteria are scientifically justified and not chosen for convenience
4Informed consent is obtained and documentedRespect for personsThe consent form, the process, who obtains consent, and comprehension checks
5The data monitoring plan is adequateBeneficenceSafety monitoring, stopping rules, and a DSMB for higher-risk trials
6Privacy and confidentiality are protectedRespect for personsData security, access control, and de-identification plans
7Vulnerable populations are appropriately protectedRespect for persons and justiceAdditional safeguards (Section 2.7)

Three levels of review

Review effort is matched to risk, and the key concept is minimal risk: the probability and magnitude of harm are no greater than those ordinarily encountered in daily life or during routine physical or psychological examinations. BIO-018 §4.3 defines three levels, which the SDK represents as exempt, expedited and full-board.

LevelBIO-018 criteria (§4.3)Who reviewsTypical examplesRegulatory note
exemptMinimal risk; educational research; anonymous surveys; observation of public behaviour; analysis of existing de-identified dataIRB chair or designee (administrative review)An anonymous survey of adult staff about training preferences; analysis of a published, de-identified dataset"Exempt" does not mean unreviewed. Under US rules the exemption categories are specific and narrow, and the institution, not the investigator, decides whether a study qualifies.
expeditedMinimal risk; minor changes to approved protocols; collection of blood samples, voice recordings, or data by non-invasive proceduresIRB chair or one or more experienced reviewersBlood draws from healthy adults within set volume limits; adding a study site or correcting a typo in an approved protocolIn the US, expedited categories are defined in a published federal list. An expedited reviewer may approve or require changes but cannot disapprove; disapproval requires the convened board.
full-boardGreater than minimal risk; vulnerable populations; novel interventions; controversial researchThe convened board with a quorumFirst-in-human drug studies; gene therapy; paediatric trials above minimal riskBIO-018 is stricter than some regulations here. US rules, for instance, allow certain minimal-risk research with children to be reviewed by expedited procedure, but BIO-018 sends any vulnerable-population study to the full board.

For full-board review, the standard requires a quorum of a majority of members, a non-scientist and a community member present, and majority approval. It also says the board should meet at least monthly. The quorum and non-scientist rules reflect common regulatory practice. The monthly schedule is an operational choice, not a universal rule; real boards set their frequency according to workload. Chapter 6 returns to meeting mechanics, including recusal of members with conflicts of interest, as part of the review protocol.

Continuing review

Section 4.4 requires continuing review at least annually, more often for high-risk studies or after adverse events and deviations, covering progress reports, adverse event summaries, updated consent forms, amendments and re-approval. The annual rule needs a qualification. The 2018 revision of the US Common Rule removed routine continuing review for most minimal-risk research eligible for expedited review, and for studies that have reached the stage of data analysis only, unless the IRB decides otherwise. FDA-regulated clinical investigations, by contrast, still require review at least once a year. A BIO-018 implementation should therefore treat the review interval as a per-protocol setting fixed by the IRB at approval, with annual review as the conservative default, not as a constant. Safety reporting between reviews is covered in Chapter 6.

2.7 Vulnerable Populations

Some people are less able to protect their own interests: they cannot legally consent, their circumstances make refusal difficult, or they have historically been used as convenient subjects. The 2016 CIOMS International Ethical Guidelines treat vulnerability as depending on context rather than as a fixed label: the question is what in a particular study makes a particular person more likely to be wronged. The 2018 Common Rule names children, prisoners, individuals with impaired decision-making capacity, and economically or educationally disadvantaged persons as groups vulnerable to coercion or undue influence. BIO-018 §5 addresses five groups, and the SDK's VulnerablePopulation type adds three more.

PopulationMain concernRequired protections (BIO-018 §5 and SDK)Regulatory anchor and corrections
Children (children)Cannot give legal consent; developing capacityParental permission; child assent; limits by risk category; full-board review; paediatric expertise on the board45 CFR 46 Subpart D (§§46.404–407). One parent's permission can suffice for the lower categories (see below); an assent age of 7 is a convention.
Pregnant women and fetuses (pregnant-women)Risk to a fetus that cannot consentPreclinical reproductive toxicity data; fetal risk minimised and disclosed; no inducements related to the pregnancy45 CFR 46 Subpart B. The father's consent is needed only when the prospect of benefit is solely to the fetus.
Prisoners (prisoners)Confinement limits free choicePrisoner or prisoner representative on the IRB; no effect on parole; enhanced coercion screening45 CFR 46 Subpart C. Research on practices intended to improve participants' health or well-being is permitted, not prohibited.
Cognitively impaired (cognitively-impaired)Impaired or fluctuating capacityFormal capacity evaluation; LAR consent; assent and respect for dissent; periodic reassessmentNo dedicated US subpart; LAR rules come from local law.
Economically disadvantaged (economically-disadvantaged)Susceptibility to undue inducementReasonable compensation; access to results and benefits; community engagement; native-language materialsNamed in the Common Rule as vulnerable to coercion or undue influence.
Educationally disadvantaged (educationally-disadvantaged)Difficulty with written or technical informationSimplified materials; visual aids; teach-back; extra teaching sessions; witness signature; readability reviewAs above.
Terminally ill (terminally-ill, SDK only)Hope can distort judgment; therapeutic misconceptionRealistic benefit communication; palliative care access maintained; right to withdraw emphasisedBIO-018 design choice, not a regulatory category.
Ethnic minorities (ethnic-minorities, SDK only)History of exploitation; language and cultural barriersCulturally appropriate materials; translation; community engagement; equitable benefit sharingBIO-018 design choice (see caution below).
Refugees (refugees, SDK only)Legal insecurity; trauma; dependence on authoritiesTrauma-informed approach; interpreters and cultural mediators; assurance of no immigration consequencesBIO-018 design choice.

Children

US regulations sort research involving children into four categories. The SDK names them category-1 to category-4 in its ChildResearchCategory type. The specification's summary of category 2 is narrower than the regulation it cites, so the table below follows the regulation.

SDK valueRegulationRisk levelCondition for approvalParental permission
category-145 CFR 46.404No greater than minimal riskAdequate provisions for permission and assentOne parent may suffice
category-245 CFR 46.405Greater than minimal riskProspect of direct benefit to the child; risk justified by that benefit and at least as favourable as the alternativesOne parent may suffice
category-345 CFR 46.406A minor increase over minimal riskNo direct benefit, but likely to yield vital knowledge about the child's disorder or condition; experiences comparable to their usual situationBoth parents, unless one is deceased, unknown, incompetent, not reasonably available, or the only parent with legal responsibility
category-445 CFR 46.407Not otherwise approvableA reasonable opportunity to understand, prevent or relieve a serious problem affecting children; requires review beyond the local IRB (in the US, by the Secretary of HHS after expert consultation and public comment)Both parents, with the same exceptions

The specification describes category 2 as a "minor increase over minimal risk with prospect of direct benefit". The regulation in fact allows greater than minimal risk in that category, provided the prospect of direct benefit justifies it. The SDK's protection text "both parents when feasible" should be read as applying to categories 3 and 4. Assent is determined by the IRB according to the child's age, maturity and psychological state. The standard's "7 years and older" is a widely used convention that the SDK's ChildAssent record carries in its age and assentRequired fields. It is not a legal rule. The same record keeps dissentRespected and a parentalPermission object that distinguishes one parent from both, so the category decision and the permission actually obtained can be checked against each other.

Pregnant women and fetuses

BIO-018 §5.2 requires preclinical studies of reproductive toxicity where appropriate, minimisation and disclosure of fetal risk, a purpose linked to the health of the woman or fetus or to knowledge that cannot be obtained any other way, and no inducements to end or continue a pregnancy. Its consent rule, "father's consent when feasible", needs correcting. Under the US regulation the pregnant woman's consent is sufficient in most cases, including where the research may benefit her, or both her and the fetus, or where the fetal risk is minimal. The father's consent is additionally required only when the prospect of direct benefit is solely to the fetus, and even then not if he is unavailable or incompetent or if the pregnancy resulted from rape or incest.

Prisoners

BIO-018 §5.3 requires a prisoner or prisoner representative on the IRB, limits risk (minimal risk, with exceptions for beneficial interventions), requires enhanced monitoring of voluntariness, and forbids any link between participation and parole. The specification's list of prohibited research, however, includes "research on practices aimed at rehabilitation", and that is incorrect. The US regulation expressly permits research on practices, both innovative and accepted, that have the intent and reasonable probability of improving the participants' health or well-being, alongside studies of incarceration, of prisons as institutions, and of conditions that particularly affect prisoners as a class. Some of these categories require consultation at the national level, which the SDK reflects in its "Secretary HHS review (US)" note. Implementations should not block rehabilitation or health-improvement research on the strength of the specification's list.

Cognitively impaired persons

For adults with conditions such as dementia, serious mental illness, brain injury or intellectual disability, BIO-018 §5.4 combines the tools from Section 2.4: formal capacity evaluation, LAR consent where capacity is insufficient, assent and respect for dissent, and periodic reassessment. The SDK adds simplified forms and extended education time, and it routes these studies to full-board review with an enhanced protection plan. Good practice adds one more safeguard: the research question should genuinely need this population, since studies that could be done with adults who can consent should not enrol those who cannot.

Economically and educationally disadvantaged persons

The concern here is circumstances that make exploitation easier. BIO-018 §5.5 lists equitable selection (not chosen for convenience), reasonable compensation, benefit sharing, cultural sensitivity and community engagement. The SDK makes these concrete. For economically disadvantaged participants it asks for an exploitation-risk assessment and community consultation. For educationally disadvantaged participants it asks for a readability review of the consent form, visual aids, teach-back, repeated teaching sessions and a witness signature.

The SDK's additional groups, and a caution

The three groups the SDK adds beyond the specification, the terminally ill, ethnic minorities and refugees, reflect real ethical concerns. Terminally ill patients may enrol in early-phase trials hoping for a cure such trials rarely aim to provide; refugees may fear that refusing will affect their legal status. Labelling a whole ethnic group as vulnerable, though, carries a risk of its own. If "vulnerable" triggers heavier requirements, investigators may simply leave the group out, and under-representation in research is itself a justice problem that Chapter 1 identified. This book therefore recommends treating these three categories as context triggers that prompt the IRB to consider specific safeguards, not as automatic labels on every member of a group. Protections should also add up: a refugee child with a serious illness is covered by the protections of all three categories at once, and the review record should show each.

2.8 Summary and Bridge to the Data Model

Consent protects the individual through ten disclosure elements, a comprehension check (80% in BIO-018, with critical items best checked separately), a voluntariness test that in effect requires zero coercion indicators, and a capacity assessment that decides who must agree. The IRB protects participants as a group through independent membership, seven approval criteria, risk-matched review levels and continuing oversight. Vulnerable-population rules add targeted safeguards, and several of the specification's summaries of them (child category 2, the father's consent, prisoner research) must be read against the regulations they paraphrase.

Each of these decisions has to leave a trace: which elements were disclosed, which questions were re-explained, which capacity band applied, who signed in what role, and which review level was assigned by whom. Chapter 3 applies the same reasoning to genomic data and gene editing, and Chapter 4 turns this vocabulary into WIA-BIO-018 records.