Institutional Review Boards and their federal overseers protect human subjects, but this vital work is often dysfunctional despite their conscientious efforts. A cardinal, but unrecognized, explanation is that IRBs are performing a specific function – the management of risk – using a flawed theoretical and practical approach. At the time of the IRB system’s creation, risk management theory emphasized the suppression of risk. Since then, scholars of governance, studying the experience of business and government, have learned that we must distinguish (...) pure from opportunity risks. Pure risks should be suppressed. Some opportunity risks, in contrast, must be accepted if the institution is to meet its goals. Contemporary theory shows how institutions may make these decisions wisely. It also shows how a sound organizational understanding of risk, a proper locus of responsibility, and appropriate institutional oversight all contribute to effective risk management. We can apply this general theory, developed in other contexts, to the problems of the IRB system. Doing so provides a unifying explanation for IRBs’ disparate dysfunctions by spotlighting five related deficiencies in IRB theory and structure. These deficiencies are inability to focus on greater risks, loss of balanced theory, inaccessibility to guidance from senior leadership, unbalanced federal oversight, and inflexibility. These flaws are deeply rooted in the system, and superficial reform cannot resolve them. Congress should overhaul the system to meet contemporary standards of risk management; this would benefit subjects, scientists, and the public that needs the fruits of research. (shrink)