An institutional biosafety review simulator — walking a research proposal through triage, risk-benefit scoring, IBC/DURC board deliberation, publication review, and post-approval oversight
Before a single experiment begins, every federally funded life-sciences proposal at a covered institution passes through an intake questionnaire administered by the institutional biosafety office. The questionnaire operationalizes the 2012 United States Government Policy for Institutional Oversight of Life Sciences Dual Use Research of Concern: does the proposed work involve one of 15 listed agents or toxins, and does it fall into one of 7 defined categories of experiments of concern? This is a triage step, not a scientific review — its purpose is simply to sort proposals into "standard pathway" versus "requires DURC/IBC escalation."
The 2012 USG DURC Policy and its 2014 institutional counterpart apply to a defined list of 15 agents and toxins historically associated with dual-use concern — organisms such as Bacillus anthracis, Ebola virus, highly pathogenic avian influenza, botulinum neurotoxin, Francisella tularensis, and variola virus, among others. This list functions purely as an administrative screening filter, not a technical reference: intake staff check whether a proposal names one of these organisms as a research subject, exactly the way a customs form checks a box rather than describing cargo contents.
Intake questionnaire structure: • Section A — does the proposal involve an agent or toxin on the checklist? (yes/no, with citation to strain/isolate) • Section B — does the anticipated experimental approach fall into one of the 7 categories of experiments of concern (described below)? • Section C — self-attestation by the Principal Investigator, countersigned by the department chair • Section D — biosafety officer initial read: routine review, or escalate to the institutional DURC entity/IBC
Routing outcomes: • Neither box checked → standard IBC biosafety review only (majority of proposals) • Agent match but no category-of-concern match → standard review with a documentation note • Both boxes checked → mandatory referral to the institutional DURC review pathway, described in Stage 3
This triage step exists precisely so that the small fraction of genuinely dual-use-relevant proposals receive proportionate scrutiny, while the vast majority of ordinary life-sciences research is not slowed down by a governance process designed for a narrow category of higher-consequence work.
The USG DURC Policy defines dual-use research of concern not by what organism is studied but by what an experiment could plausibly do to that organism's risk profile. The seven categories, stated at the policy level only, ask whether an experiment is reasonably anticipated to:
1. Enhance the harmful consequences of the agent or toxin 2. Disrupt immunity or the effectiveness of an immunization against the agent or toxin without clinical/agricultural justification 3. Confer resistance to clinically or agriculturally useful prophylactic or therapeutic interventions, or facilitate their evasion 4. Increase the transmissibility of the agent or toxin 5. Alter the host range or tropism of the agent or toxin 6. Enhance the susceptibility of a host population to the agent or toxin 7. Generate or reconstitute an eradicated or extinct agent or toxin
These categories are deliberately outcome-based rather than method-based: reviewers are asked to assess the anticipated result of a line of research, not to catalog the laboratory steps that would produce it. A proposal is flagged if a reasonable biosafety professional would expect the described research aims — as written in the specific-aims page of a grant application — to plausibly produce one of these seven outcomes, regardless of the investigator's intent.
Once a proposal is flagged, intake staff open a formal DURC case file rather than issuing an immediate verdict. The file compiles: the original specific-aims page, the completed intake questionnaire, any prior institutional review history for the PI's lab, and a preliminary containment-level recommendation drawn from the institution's biosafety manual.
Turnaround expectations vary by institution but commonly target an initial triage decision within 10 business days of submission, so that flagged proposals can move promptly into the structured risk-benefit assessment covered in the next stage rather than stalling in an administrative queue.
A proposal that clears intake with a flag does not receive a yes/no answer — it receives a structured score. Institutional review frameworks modeled on the P3CO Framework and NIH Guidelines pair a likelihood-and-consequence risk matrix with an explicit accounting of anticipated benefit, so that the review board's eventual decision rests on a documented, reproducible methodology rather than an individual reviewer's intuition.
The core scoring instrument is a 5×5 matrix familiar from institutional risk-management practice generally, adapted here to biosafety governance:
Likelihood axis (1–5): how plausible is it that the described research outcome could be misapplied or could itself constitute a biosafety incident, given the containment context, personnel access controls, and the technical maturity of the field?
Consequence axis (1–5): if realized, how severe would the outcome be — scored against established biosafety consequence tiers ranging from a contained laboratory-acquired infection at the low end to an outcome with population-level public health significance at the high end.
The product of the two axes places each proposal into one of four risk bands — low, moderate, high, or extreme — which in turn determines the review pathway: low-band proposals may be closed out at the biosafety-officer level with documentation; moderate and high-band proposals proceed to full IBC/DURC board deliberation; extreme-band proposals are automatically escalated with a recommendation that the board consider restriction or referral to a national-level body, mirroring the escalation logic built into the P3CO Framework for federally funded gain-of-function-adjacent research.
A risk score alone cannot drive a governance decision — the policy explicitly requires weighing risk against anticipated benefit, since research that would otherwise be flagged as high-risk may still be approvable if its public health, scientific, or biodefense value is substantial and cannot be obtained through a lower-risk alternative approach.
Benefit is scored across three domains: • Public health value — does the work inform surveillance, vaccine strain selection, diagnostic development, or outbreak preparedness? • Scientific value — does the work fill a genuine knowledge gap not addressed by existing, lower-risk study designs? • Biodefense/preparedness value — does the work support recognized national or international biodefense planning functions?
Reviewers are specifically asked whether the same scientific question could be answered through a less risky experimental design — a "necessity" test borrowed from the P3CO Framework's requirement that funded gain-of-function-adjacent studies represent the only feasible means of answering an important question.
The final composite score — risk band offset by scored benefit — produces a referral recommendation rather than a final decision: proceed to standard IBC approval, proceed to full DURC board deliberation with a mandatory mitigation plan, or proceed to full board deliberation with a preliminary recommendation toward restriction. This recommendation, along with the full scoring worksheet, is what the review board receives at the start of the deliberation stage described next — ensuring the board's discussion begins from a documented analytical baseline rather than an unstructured debate.
The Institutional Biosafety Committee — or, where an institution has established one, a dedicated DURC entity operating alongside it — is where risk-scored proposals receive a binding institutional decision. Composition requirements, containment-level determination, and a documented mitigation plan together form the backbone of the deliberation, which the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules require to be reproducible and minuted.
NIH Guidelines require an Institutional Biosafety Committee to have at least five members with expertise sufficient to assess the safety of the institution's research portfolio, and — critically — at least two members who are not affiliated with the institution beyond their committee membership, representing the surrounding community's interest in institutional biosafety decisions. For DURC-specific deliberations, institutions commonly add members with biosecurity, public health, and law-enforcement liaison expertise, and many designate an Institutional Contact for Dual Use Research (ICDUR) as a standing point of coordination with funding agencies.
This composition requirement is deliberate: a board making a binding decision about whether research proceeds, is modified, or is restricted must represent perspectives broader than the investigator's own department, both for scientific rigor and for public accountability.
For proposals reaching this stage, the board's first substantive task is confirming or revising the containment level assignment — BSL-2, BSL-3, or in rare federally coordinated cases BSL-4, with parallel ABSL designations where animal work is involved. Containment level is treated as a distinct decision from the DURC risk-benefit score: an experiment can be low-DURC-risk but require BSL-3 containment for routine biosafety reasons, or vice versa.
Where a proposal is approved conditionally, the board mandates a written mitigation plan before work may begin. Common elements of an approved mitigation plan include: restricting access to the specific experimental data and materials to a named, IBC-approved personnel list; requiring dual-authorization ("two-person rule") for particularly sensitive procedural steps; specifying enhanced material-transfer and inventory-tracking controls; and setting explicit criteria under which the board must be notified of a deviation from the approved protocol before it proceeds.
Deliberation concludes with a quorum vote recorded in institutional minutes, typically requiring a majority of voting members present, with any member who has a conflict of interest recused. Three outcomes are possible:
• Approve — the proposal proceeds under standard institutional biosafety oversight, with no DURC-specific conditions attached. • Approve with mitigation — the proposal proceeds, but only under the access-control, containment, and reporting conditions specified in the mitigation plan; the board typically sets a re-review date. • Restrict — the board declines to approve the proposal as submitted, and either requests a substantially revised design, refers the matter to a higher institutional authority or funding-agency review body, or declines the work outright.
Every vote, along with its supporting risk-benefit worksheet and mitigation plan, becomes part of the permanent institutional DURC record — the same record that a funding agency or, later, a journal's biosecurity reviewer may request to see.
Institutional approval to conduct research is not institutional approval to publish it without further scrutiny. A second, largely independent review layer sits at the point of publication: journal biosecurity screening processes, and — for the small number of studies with the highest anticipated consequence — advisory review in the tradition of the National Science Advisory Board for Biosecurity (NSABB), established in 2004 following the 2004 Fink Report's recommendation for a standing federal advisory body on dual-use life-sciences research.
Major life-sciences journals — Nature, Science, PNAS, and others that are signatories to shared biosecurity principles — apply an editorial-stage dual-use screen distinct from ordinary peer review. Submissions touching agents or methodologies with elevated dual-use sensitivity are routed to a biosecurity-aware editor or an external biosecurity advisory panel before or alongside standard scientific review.
The screening asks a narrower question than the IBC's risk-benefit assessment: not "should this research have been done," which the home institution has already decided, but "does this manuscript, as written, need modification before it enters the public scientific record" — for example, by moving a sensitive experimental detail to a restricted-access supplement available to qualified requesters rather than the open-access main text.
The formative case for publication-stage DURC review remains the 2011–2012 controversy over two manuscripts describing avian influenza H5N1 transmissibility studies, one from Ron Fouchier's group (Erasmus MC) and one from Yoshihiro Kawaoka's group (University of Wisconsin), submitted to Science and Nature respectively. The NSABB initially recommended in December 2011 that the papers be published only in redacted form, withholding specific methodological detail, citing biosecurity concern. After extended international deliberation — including a WHO-convened technical consultation in February 2012 — the NSABB reversed its position in March 2012 and recommended full publication of revised manuscripts, both of which were ultimately published in full in mid-2012.
The episode is treated today as the founding case study for institutional DURC policy: it directly motivated the 2012 USG DURC Policy and later the 2017 P3CO Framework, and it established the now-standard practice of a documented, multi-stakeholder review process — rather than an individual editor's judgment — for publication decisions on the highest-consequence dual-use manuscripts.
In October 2014, the US government announced a deliberative pause on federal funding for a defined set of gain-of-function studies involving influenza, SARS, and MERS viruses anticipated to increase transmissibility or pathogenicity, while the government developed a formal risk-benefit review framework. That process concluded with the December 2017 release of the P3CO (Potential Pandemic Pathogen Care and Oversight) Framework, which established a standing interagency review mechanism for proposed federally funded research reasonably anticipated to create, transfer, or use enhanced potential pandemic pathogens.
For publication reviewers, the pause-and-framework sequence is instructive precedent: it demonstrates that funding agencies, not only journals, can act as a publication-adjacent gate by determining upstream whether a study proceeds at all, and it is the origin of the "reasonably anticipated to" risk-scoping language used throughout modern institutional DURC screening, including the intake questionnaire in Stage 1.
A DURC approval, with or without a mitigation plan, is not a one-time event — it opens a period of continuous institutional accountability that lasts for the life of the project. Personnel reliability review, scheduled re-review, and mandatory incident reporting together ensure that the conditions under which a board approved a proposal continue to hold as the work, the personnel, and the surrounding scientific landscape all change over time.
Mitigation plans from Stage 3 typically name a fixed list of personnel authorized to access DURC-designated materials, protocols, or data. Ongoing oversight requires that list be actively maintained rather than treated as a one-time approval: new lab members must be added and cleared before gaining access, departing personnel must be promptly removed, and many institutions require periodic reaffirmation — commonly annual — that each listed individual's access remains necessary and appropriate.
Some institutions layer a formal personnel reliability program onto this list for the highest-risk projects, modeled on federal select-agent personnel suitability review, including a documented process for reporting and evaluating any change in an individual's circumstances relevant to trustworthy access.
Approved DURC projects are placed on a recurring re-review calendar — annual renewal is standard practice for IBC-registered protocols generally, and DURC-designated projects typically receive at least that frequency, sometimes more often when the board set a shorter interval as a mitigation condition. Re-review confirms that the original risk-benefit scoring still holds: has the scientific landscape changed in a way that alters the benefit case? Has the containment or access-control infrastructure remained intact? Has the project's actual experimental direction drifted from what was originally approved, requiring a protocol amendment and a fresh board review before work continues?
Any proposed change to an approved protocol — a new agent strain, an expanded experimental aim, a new collaborating site — is treated as an amendment requiring its own abbreviated risk-benefit review rather than being absorbed silently into the ongoing project.
Approved projects operate under a mandatory incident-reporting obligation: any biosafety breach, containment failure, loss of material, or unauthorized access attempt connected to DURC-designated work must be reported to the institutional biosafety officer, commonly within a 24-hour window, with escalation to the full board and, where required by the project's funding terms, to the relevant federal program office.
Institutions themselves are subject to periodic accountability review — some accept participation in a compliance audit process to confirm their DURC program continues to meet USG DURC Policy and P3CO Framework expectations. This closes the governance loop: the same institutional structures that triaged, scored, and approved a proposal in Stages 1 through 4 remain answerable for how that approval is actually carried out for as long as the work continues.
Institutional oversight does not end at approval. The 2012 USG DURC Policy and 2017 P3CO Framework both frame governance as a continuous cycle — intake, assessment, deliberation, publication review, and monitoring — rather than a single gate passed once. A proposal that changes materially during its lifetime re-enters that cycle rather than continuing on its original approval indefinitely.