How Much Does IRB Software Cost in 2026?
A custom IRB and human subjects protection system runs $80,000 to $500,000, and the single decision that moves that number most is whether you act as the reviewing IRB for multi site studies.
On this page
A custom IRB and human subjects protection system runs $80,000 to $500,000, and the single decision that moves that number most is whether you act as the reviewing IRB for multi site studies. A single institution program with no reliance sits at the bottom of the range, because every record belongs to people who already have accounts. The moment external institutions need scoped access to one study, with site level context forms, local investigator credentials and site specific consent versions, you have added a second identity model and a second permission model, and that is what pushes a program from the first release band into the full platform band.
The bands an IRB and research compliance build falls into
There are two honest bands, plus a narrower piece that is not really a system.
The first release band is $80,000 to $160,000 over 12 to 18 weeks. That covers the submission smart form modelled as a versioned decision graph, with completeness validation running before submission rather than after, review pathway determination that proposes a category with the matched criteria attached for an analyst to confirm, convened board meeting management with live quorum computation and recusal handling, and the expiration, continuing review and modification engine. That is the release an office actually reviews protocols in, not a demonstration.
The full platform band is $200,000 to $500,000 phased across 8 to 14 months. That adds reliance agreements with scoped external institution access and site level records, reportable new information triage with sponsor and federal reporting obligations generated as dated tasks, conflict of interest integration, and links out to grants, the animal care and use committee and clinical trial billing.
Below the first band sits one narrow build worth naming. An expiration and escalation engine that derives each study's review regime from its own determination and escalates on a schedule you define, running alongside your current system, is $20,000 to $35,000 over five to seven weeks in our delivery experience. It removes the failure that costs institutions most, which is a coordinator being the clock, and it touches nothing else.
What drives an IRB build up
Reliance is the step change, for the reason given above. Everything else is an increment.
An FDA regulated portfolio is the next largest driver. A study can be exempt under the Common Rule and still be FDA regulated, which means two frameworks running in parallel over one protocol record, plus significant risk device determinations, plus investigational new drug and investigational device exemption tracking. If your electronic signatures need to support records subject to 21 CFR Part 11, that posture is a design decision taken at the start and it is expensive to retrofit.
Integration with an electronic health record or a clinical trial management system is usually the largest single line in an academic medical centre build. It is rarely one interface. It is participant identification, study status feeding the research billing determination, and an agreed owner for every field that appears in both systems.
Then there is the driver nobody scopes for: local policy that exists as practice rather than as writing. The smart form is your policy expressed as branching logic, so every rule that lives only in a senior analyst's head has to be discovered, written down and agreed before it can be built. In our experience this is where IRB projects actually lose schedule, not in engineering.
What keeps the number down
Deferring reliance to phase two is the most effective lever available. Build the form, the determination model, the meeting engine and the clocks for your own institution, run two full board cycles on them, then add external institutions once the study record has settled. Programs that sequence this way spend less in total, because site level records benefit enormously from a proven parent study model.
Bring a written policy manual to kickoff. A program that can hand over documented determination criteria, escalation timing and minutes requirements moves several weeks faster than one relying on institutional memory, and those weeks are pure cost.
Consolidate the smart form. A single form driven by conditional branches costs less to build and far less to maintain than a separate form per study type, and it produces a cleaner record when policy changes.
Migrate open protocols only. Every open study is entered and verified by a second person, because a mis-anchored approval date is a missed expiration rather than a data error. Closed studies can be bulk loaded afterwards for retention, since nothing is computed from them.
Finally, appoint one decision owner with authority to settle policy questions without convening a committee. In this domain most open questions are regulatory and operational rather than technical, and a program that routes each one to a monthly meeting adds months that arrive as cost.
A worked example that adds up
A university with an academic medical centre, about 1,200 active protocols, roughly 15 percent FDA regulated, no reliance in phase one, 260 open protocols at cutover, and a written policy manual that is current.
- Discovery, writing down determination criteria and escalation policy: $12,000
- Versioned smart form as a decision graph, with pre submission completeness validation: $26,000
- Pathway determination with criteria matching, recorded reasoning and parallel FDA framework flags: $18,000
- Convened meeting management with live quorum, conflict recusal and minutes assembled from actions: $24,000
- Expiration, review regime and modification versioning engine with layered escalation: $22,000
- Reviewer workspace and investigator portal: $14,000
- Migration of 260 open protocols, entered and verified per file: $9,000
- Testing, deployment and two weeks of parallel running: $13,000
That totals $138,000, inside the first release band and toward its upper half because of the FDA framework work and the size of the open book. A social and behavioural program with no FDA studies, 90 open protocols and a simpler form lands nearer $92,000 on the same functional scope.
If that university later adds reliance with scoped external access, reportable new information workflows, conflict of interest integration and a grants link, expect a further $95,000 to $150,000, taking the platform to roughly $235,000 to $290,000 in total.
How the spend phases
Discovery runs two to three weeks and is typically 8 to 12 percent of the first release. It produces the determination criteria, the escalation schedule and the minutes requirements in writing. Programs that skip it pay for it later as rework in the form logic, which is the most expensive place in this system to change your mind.
Weeks three to ten carry the heaviest spend, around 40 percent, on the smart form and the determination model. This is where the domain risk lives, because the form is your policy and a wrong branch produces a wrong determination.
Weeks ten to fifteen are the meeting engine and the expiration and modification clocks, roughly 35 percent. The clocks come late deliberately, because they depend on the determination model being settled.
The last two to three weeks are migration, parallel running and cutover, around 15 percent. Keep your existing expiration calendar running until every protocol open at cutover has been through one review cycle in the new system. It is cheap insurance and we recommend it on every engagement in this category.
The ongoing costs nobody quotes
Infrastructure for a system of this shape runs $300 to $900 a month in our delivery experience, driven by document storage and backup retention rather than compute. Research records support determinations that may be inspected years later, so storage grows and never shrinks.
Regulatory and policy maintenance is a recurring line rather than a one off. Every time the institution amends a policy or a federal requirement changes, the form version, the determination criteria and the minutes template need updating and testing together. Two to four revision cycles a year is normal for an active program.
Support and enhancement typically runs 12 to 18 percent of build cost annually if you want a partner available during meeting weeks. Programs that hire a developer instead should budget for the fact that this domain takes months to learn, which is a real and often invisible handover cost.
Then add the institutional overheads a research system attracts: an annual security review from your IT office, accessibility conformance work if you are a public institution, and single sign on maintenance when your identity provider changes. None of these are large individually. Together they are a few weeks of somebody's year.
Comparing a build against your current renewal
Do this arithmetic before you commission anything. Take the annual figure on your current license. Add the consultant configuration retainer, which in this category is often the larger of the two. Then add the fully loaded staff cost of the work the software does not do: administrative pre review of incomplete submissions, minutes typed from handwritten notes days after the meeting, expiration chasing by email, and reliance materials handled entirely in inboxes.
In most programs of moderate size that third number is larger than the license. That is the honest reason build economics work here more often than in other compliance categories: you are frequently comparing a build against a configuration project that is itself a build, plus ongoing manual labour the product never removed.
Then set both against what you are insuring. An enrolment against a lapsed approval is a reportable event. A pattern of them, in a federally funded portfolio, is a finding against the human research protection program rather than against one study, and the consequence reaches research across the institution. We will not put a probability on that and neither should anyone selling you software. What we will say is that a control enforced by an administrative hold is a different risk profile from a control that depends on a coordinator noticing something during a busy month.
When buying beats building
If you review under about 200 protocols a year, almost all minimal risk social and behavioural research, with no FDA regulated studies and no reliance relationships, buy. IRBNet is inexpensive, adequate for that shape of program and the right answer. We tell institutions this regularly and it costs us work. Cayuse IRB is a reasonable step up for a mid sized program that wants more workflow without a configuration project.
Volume alone is not the trigger. A program running 700 straightforward expedited and exempt studies at a single institution is well served by a product. A program running 300 studies where forty are FDA regulated and fifteen carry reliance agreements is not, because the parts that hurt are the parts no product models as first class objects.
Build when two or more of these are true: your configuration project for a packaged system has already overrun, which is the most common trigger we see; you carry FDA regulated research alongside Common Rule research and your system forces one framework; you are the reviewing IRB for multi site studies and external sites currently reach you by email; your submission form asks everyone everything because the conditional logic could not be expressed; or expiration management depends on one person's reminders. If a consultant's configuration estimate is above roughly $250,000, get a build quote before you sign it.
If you want a second opinion before signing anything, Digital Heroes contracts through India LLP, US LLC and UK LTD entities, so the agreement and the intellectual property assignment sit under law your own advisers already read. Nothing about that commits you to the build.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- Companies in the top quartile of McKinsey's Developer Velocity Index had 2014-18 revenue growth four to five times faster than bottom-quartile peers, showing that software-building capability is a driver of business performance, not just a support function. Source: McKinsey & Company (2020) →
- Median SaaS spend reached $9,455 per employee, and organizations leave an average of 36% of their SaaS licenses unused. Source: Zylo (2026) →
- Gartner estimates RPA can eliminate up to 25,000 hours of avoidable rework caused by human errors in the finance function each year, equating to savings of roughly $878,000 for an organization with 40 full-time accounting staff (based on interviews with more than 150 corporate controllers and chief accounting officers). Source: Gartner (2019) →
- Only 22% of firms are 'future ready' having significantly transformed digitally; these companies show average revenue growth 17.3 percentage points and net margins 14.0 percentage points above their industry average. Source: MIT Center for Information Systems Research (MIT Sloan) (2022) →
Frequently asked questions
What is the total cost of custom IRB software?
A first release covering the versioned smart form with pre submission validation, pathway determination with recorded reasoning, convened meeting management with live quorum and the expiration and modification engine runs $80,000 to $160,000 and ships in 12 to 18 weeks in our delivery experience. A full platform adding reliance agreements with scoped external access, reportable new information workflows, conflict of interest integration and links to grants and clinical systems runs $200,000 to $500,000 over 8 to 14 months.
Structure drives the number more than protocol volume does. A single institution program with 900 studies costs less to serve than a 300 study program that reviews for external sites and carries FDA regulated research.
What does an IRB system cost to run each year after launch?
Infrastructure sits at $300 to $900 a month for a system of this shape, driven by document storage and backup retention rather than compute, and it grows because research records have to remain producible long after a study closes. Support and enhancement typically runs 12 to 18 percent of build cost annually if you want a partner available during convened meeting weeks.
Then budget two to four policy revision cycles a year, where the form version, determination criteria and minutes template are updated and tested together, plus your institution's annual security review and accessibility work.
How long does an IRB system take to build?
Twelve to 18 weeks for a first release covering the smart form, determinations, convened meetings and the clocks. Reliance with scoped external access, reportable new information and conflict of interest integration add a further four to nine months depending on how many external institutions you review for.
The most common cause of a slipped date is not engineering. It is local policy that exists as practice rather than as writing, since every unwritten rule has to be discovered and agreed before it can become a branch in the form.
Is configuring Huron IRB cheaper than building our own?
Often it is not, and this is one of the few categories where that is genuinely true. The packaged products in this space are largely configuration shells, so a configuration project for a complex human research protection program can match or exceed a build in both cost and elapsed time, and it ends with a system your own staff cannot change without raising a change request.
Our rule of thumb: if the configuration estimate is under roughly $250,000, configure. Above that, get a build quote and compare them properly, including who can change the smart form in year three.
Why does adding reliance agreements move us into the higher band?
Because external institutions are a second identity and permission model, not an extra screen. A site at another university needs an account that sees exactly one study and only its own documents, and the study itself gains site level records for local context, local investigator training verification and site specific consent versions.
The reliance agreement then becomes an object in its own right, with an execution date, a scope and an expiry, and reportable events have to resolve to the affected sites and each institution's own reporting obligations. That is a subsystem, which is why it sits in the full platform band rather than in the first release.
Can we build only an expiration engine to start with?
Yes, and for a program whose main pain is lapsing approvals it is a sensible first move. An engine that derives each study's review regime from its own determination, escalates from coordinator to principal investigator to department chair on your schedule, and places an automatic administrative hold on a lapsed study runs $20,000 to $35,000 over five to seven weeks.
Be clear about what it does not do. It does not touch submission, determination or minutes, so it removes one failure mode and leaves the administrative pre review workload exactly where it is.
What does migrating our open protocols add to the budget?
Budget per open protocol rather than per study you have ever reviewed. Each open study is entered and then verified by a second person against the existing approval record, because a mis-anchored approval date produces a missed expiration rather than a tidy data error. At 260 open protocols that work was $9,000 in the example above.
Closed studies can be bulk loaded afterwards for retention at low cost, since no clock is computed from them and they are only ever read.
How much of the budget goes on the submission smart form?
In the worked example the form was $26,000, around 19 percent of the first release, and the determination model on top of it another $18,000. The variable is not the number of questions but the number of conditional branches and how many of them are currently undocumented.
Programs that consolidate to one form driven by conditions spend materially less than programs carrying a separate form per study type, and they spend less again every year afterwards, because a policy change is one version rather than nine.
What is the cheapest credible version of this system?
Around $80,000 for a program with no FDA regulated studies, no reliance, a current written policy manual and fewer than 100 open protocols at cutover. That buys the versioned form with pre submission validation, determination with recorded reasoning, convened meeting management with quorum, and the expiration and modification engine.
Be sceptical of a quote below about $60,000 for that scope. The form as a versioned decision graph is real work on its own, and a system that cannot render an old submission under the form version it was submitted against is not a compliance record.
What does an internal tool cost for a small business with 20 to 50 employees?
Plan on $5,000 to $15,000 for a focused tool that replaces one painful spreadsheet workflow, such as job scheduling, quoting, or PTO tracking. In Digital Heroes projects at this size, the sweet spot is one core workflow, two or three user roles, and a single integration, usually QuickBooks or Google Workspace. Quotes far below $5,000 usually mean a template with your logo on it rather than software built around your process.
What tech stack should an internal tool be built with?
Boring and popular: a React or Next.js frontend, a Node.js or Python backend, and PostgreSQL covers the vast majority of internal tools and keeps future hiring easy. The stack matters far less than whether a different developer can pick the code up in two years, so require documentation as a deliverable and avoid anything exotic. Treat it as a red flag if an agency pushes a proprietary platform only they maintain, because that quietly converts your tool into a subscription to that agency.
We run everything on spreadsheets and Airtable. How do we know it's time for custom software?
The reliable signals are re-typing the same data into multiple tools, one employee acting as human middleware between systems, and errors appearing in handoffs between teams. Hard limits force the issue too: Airtable's Team plan caps at 50,000 records per base, and Business costs $45 per seat per month, so a 20-person team pays about $10,800 a year for a tool it has already outgrown. When workarounds consume more hours than the tools save, the spreadsheet era is over.
Is a freelancer or an agency better for building an internal tool?
A solid freelancer works for a single-workflow tool under roughly $10,000, if you accept that one person holds all the knowledge. An agency earns its premium once the tool spans departments or integrations, because you get a developer, a designer, and a project manager plus continuity when someone leaves or gets sick. The hidden freelancer cost appears 18 months later when you need changes and the original builder has moved on, a rescue situation Digital Heroes is hired for regularly.
What are the most common mistakes companies make when building internal tools?
The three failures Digital Heroes sees most: building for every department at once instead of nailing one workflow, designing without the end users so staff quietly go back to their spreadsheets, and leaving no named owner after launch so small bugs pile up until the tool dies. A subtler fourth is faithfully recreating the old spreadsheet, including its workarounds, instead of fixing the process first. Start with one team's most painful workflow and put the actual users in the room from week one.
How small can the first version of my software be and still be worth building?
One workflow, end to end, for one type of user: the single process that currently burns the most hours or loses the most money. In Digital Heroes delivery experience, first versions scoped to 6 to 10 weeks of build time ship, get used, and generate the feedback that makes version two obviously right, while 9-month first versions routinely launch with features nobody touches. Everything you cut from v1 gets cheaper to build later, because real usage reorders the roadmap for you.
When does a company outgrow Airtable?
The usual breaking points are record limits, permissions, and automation complexity. Airtable's Team plan caps each base at 50,000 records and Business at 125,000, so operations logging thousands of rows a month hit the ceiling within a year or two. The other trigger Digital Heroes sees constantly is permissions: restricting who can view specific fields or records is clumsy below Airtable's Enterprise tier, which becomes a genuine problem once salaries, pricing, or client contracts live in the base.
What does it cost to keep an internal tool running after launch, and do we need to hire a developer?
Budget 15 to 20 percent of the build cost per year, so a $25,000 tool runs roughly $300 to $400 a month covering hosting, security patches, dependency updates, and small tweaks, figures drawn from Digital Heroes maintenance contracts. You do not need an in-house developer; a monthly retainer with the agency that built it covers the typical internal tool comfortably. Hosting itself is cheap for internal audiences, often $20 to $100 a month, because you serve dozens of users rather than the open internet.
At what point does Retool cost more than building a custom tool?
The crossover usually lands between 25 and 50 daily users. At Retool's published Business rates of $50 per standard user and $15 per end user monthly, a 40-person deployment with a typical seat mix runs roughly $9,000 to $15,000 per year, every year, while a comparable custom tool built once for $20,000 to $30,000 carries no per-seat fees and costs about 15 to 20 percent of the build price annually to maintain. On a three-year horizon, custom comes out ahead for most growing teams in Digital Heroes engagements.
How do we migrate years of spreadsheet or Airtable data into a new internal tool?
Migration is a standard part of the build, not a separate project: the agency writes import scripts that clean, deduplicate, and map your existing rows into the new database. On typical spreadsheet and Airtable histories, Digital Heroes budgets 3 to 10 extra days, most of it spent resolving inconsistencies like the same customer spelled four different ways. The safe sequence is a trial migration first, a review of flagged conflicts with your team, then final cutover over a weekend so nobody loses a working day.
Who can build a custom internal tools system?
Digital Heroes builds custom internal tools systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other internal tools companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
More from Charlie.
Senior Copywriter · UK · London · 3 posts on the site
Published · Last updated .
