There is a particular conversation that comes up regularly at Iris Ethics. An evaluator or researcher gets in touch, often partway through a project, to ask whether they need ethics approval. When we probe a little, it becomes clear they have already decided the answer is no. The reasoning usually draws on one of two sources: the people involved are "only internal stakeholders," or someone has invoked the NHMRC's Ethical Considerations in Quality Assurance and Evaluation Activities (the QA document) as a kind of get-out clause.

This article is about explaining what exemption from ethical review actually means under the National Statement on Ethical Conduct in Human Research (2025) (the National Statement), and why the exemption category is considerably narrower than many evaluators and researchers assume. Our resource on navigating the National Statement including a flow chart also helps to understand the exemption criteria.

The National Statement's Starting Point

The National Statement is clear that some activities are not human research and therefore do not require ethics review as a matter of course. The relevant passage (in "Purpose Scope and Limits of this Document") lists three categories: 

1. Literature reviews that support the development or design of a research project; 
2. Research using public data (information that has been published, or has entered the public domain with the consent of the relevant persons); and, 
3. Research using aggregate data.

It also notes that: 

...consultation and engagement with potential participants, co-researchers, or community representatives that precedes the design or development of research is not itself human research and typically does not require ethics review.

These are genuinely excluded categories, and they are fairly specific. But they are not a template for creative interpretation.

The Exemption Criteria Are Stricter Than People Think

When an activity does constitute human research, paragraph 5.1.17 of the National Statement sets out when it may be eligible for a grant of exemption from ethics review. Research and evaluation must carry a lower risk to participants or the community, and satisfy one or more of four conditions:

• the research uses collections of information or data from which all personal identifiers have been removed before being received by the evaluators/researchers, and the evaluators/researchers explicitly commit to not attempting re-identification, preventing unauthorised re-identification, and ensuring that any data sharing does not create additional re-identification risks;

• the research is restricted to: 

  • surveys or observation of public behaviour; 
  • uses information collected without personal identifiers; and 
  • is highly unlikely to cause distress;
• the research is conducted as part of an educational training programme where the activity is for training purposes only and outcomes are for programme use only; or

• the research uses only information that is publicly available through a mechanism set out by legislation or regulation, such as: 

  • mandatory reporting information; 
  • births and deaths registries; or 
  • ABS data.

Paragraph 5.1.16 adds a firm constraint that often goes unnoticed: 

Research that involves the use of personal information without consent cannot be granted an exemption from ethics review, because, to conduct such research, a waiver of the requirement for consent would need to be granted by an appropriate ethics review body. 

If you need to collect or use personal information and have not obtained consent, exemption is not available. A waiver of the consent requirement would need to be granted by an appropriate ethics review body before the project proceeds. Exemption and waiver are different things, and neither is a rubber stamp.

Why "Internal Stakeholders" Is Not a Magic Phrase

One of the most common misconceptions we encounter is the idea that conducting interviews with program managers, service leads, or senior staff removes the need for ethics review. The reasoning tends to fall into these categories: 

• these are professional adults in positions of authority; 
• they are not "participants" in the "vulnerable" sense; 
• they know what they are involved in; and 
• anyway, this is evaluation, not research.

None of this reasoning holds up against the National Statement.

First, the National Statement defines human research broadly. It includes taking part in surveys, interviews, or focus groups, being observed by researchers, and researchers accessing personal documents or other materials. A semi-structured interview with a program director is human research under this definition. The seniority or role of the person being interviewed does not change that.

Second, consider what a typical interview instrument involves. It is bespoke, developed for the specific context of the evaluation, and not a standardised or validated tool by any definition. It collects information about the participant's views, experiences, decisions, and sometimes information about third parties. It is conducted in person or by video call, creating a recorded or noted account of identifiable statements. NHMRC guidance identifies the use of non-standard protocols in quality assurance and evaluation as an automatic trigger for consideration of ethical review.

Third, identifiability is not just about whether someone's name appears on a form. The National Statement is explicit that the identifiability of information exists on a continuum and is affected by contextual factors, including who has access to the information and what other potentially related information they hold. A program director who is one of three senior leaders at a small government agency is identifiable to anyone who reads the evaluation report, whether or not their name is attached to a specific quote.

Consider a concrete example. An evaluator is engaged to assess a community services programme. The evaluation design involves interviews with the programme director, two team leaders, and four frontline workers. The evaluator prepares a set of interview questions, conducts the interviews over two weeks, and writes up findings that reference "senior staff" and "frontline perspectives" throughout. No names are used. The evaluator concludes no ethics review is needed because the participants are professional stakeholders, not clients or service users.

This conclusion is difficult to defend. The interviews collect personal information through a non-standard, bespoke protocol. The participants are identifiable given the small pool and their professional roles. The data will be used to make judgements about the programme, which may in turn affect the people who work in it. This is human research, and it is not eligible for exemption under paragraph 5.1.17, nor is it exempt under the "QA Document".

The QA Document: Context Matters

The NHMRC's 2014 publication "Ethical Considerations in Quality Assurance and Evaluation Activities" is regularly cited by evaluators as justifying an exemption from ethics review. It does describe a limited set of circumstances where QA and evaluation activities can be conducted with oversight but without formal ethics review. However, its framing is important, and worth reading carefully.

The document applies two tests (that are applied in addition to, and not as a substitute for, the tests in the National Statement for exemption outlined above). The first test identifies three conditions which all must be satisfied before the second test is applied. These conditions are: 

• where data is collected and analysed in a way that is coincidental to standard operating procedures;
• where data is collected expressly for the purpose of maintaining standards or identifying areas for improvement within the environment from which the data was obtained; and 
• where data is not linked to individuals.

Should these conditions be satisfied, then the second test applies, in which none of the following triggers for ethical review are present: 

• activities that potentially infringe the privacy or professional reputation of participants, providers, or organisations; 
• using data or analysis from QA or evaluation activities for another purpose;
• gathering information about participants beyond what is routinely collected; 
• using non-standard/innovative protocols or equipment; 
• comparison of cohorts;
• using randomisation, control groups, or placebos; or
• involving targeted analysis of minority or vulnerable* groups separate to the overall analysis.

*This document was published in 2014 and never updated since. As a result this language is outdated and no longer used in the 2025 National Statement. We treat this as referring to groups identified as being at higher risk of harm or discomfort as outlined in Chapter 4.1 of the National Statement 2025 edition.

Note that the QA document identifies the use of non-standard (innovative) protocols or equipment as a trigger. This matters because the evaluators who invoke the document most often are precisely those who are using methods (interviews, focus groups, surveys) that are not standard operating procedures within the service environment being evaluated.

A useful test is to ask whether the activity is genuinely internal improvement work, conducted within and for the organisation delivering the service, or whether it is an externally commissioned evaluation designed to produce findings for an external audience. The former has a reasonable claim to the QA framing. The latter does not, regardless of the methods used.

As noted above, the QA document was published in 2014, while the National Statement is the 2025 edition. The National Statement explicitly directs readers to the QA document for guidance on when evaluation and quality assurance activities require ethics review. That relationship is one of supplementary guidance, not override. When in doubt, the 2025 document takes precedence.

What Does Need Ethics Review?

To make this concrete, here are some evaluation and research activities that typically do require ethics review, even where they involve professional stakeholders, and even where they use relatively familiar methods:

• Interviews with programme staff, managers, or leaders where the information collected goes beyond routine operational data. 
• Policy research that involves interviews or surveys with public servants, elected officials, or sector representatives about their decisions, experiences, or views. 
• Market research studies that use surveys or qualitative methods to collect attitudinal or behavioural data linked to individuals, even where individual results are not reported. 
• Social research involving observation of public behaviour in contexts where participants could be distressed if they knew they were being observed. 
• Programme evaluations that involve secondary analysis of administrative data originally collected for a different purpose.

The level of review required is proportionate to the level of risk. Many of these activities will be low risk and eligible for a streamlined review pathway rather than full HREC review. But "eligible for lower risk review" is not the same as "exempt."

Getting It Right

The National Statement sets out a clear process for exemption. The institution responsible for the research may grant an exemption where the criteria in paragraph 5.1.17 are met. Where there is no institution providing oversight (which applies to many independent evaluators and social researchers), the evaluator/researcher should request a grant of exemption from an ethics review body. Either way, exemption is a formal decision that should be documented (paragraph 5.1.18), not an informal conclusion reached by the person doing the work.

If you are unsure whether your activity meets the criteria for exemption, the more reliable approach is to make a brief inquiry with an ethics review body rather than to assume. In our experience, activities that clearly meet the exemption criteria are usually recognisable as such very quickly. Activities where there is genuine uncertainty almost always turn out, on closer inspection, to involve identifiable personal information, non-standard protocols, or other features that take them outside the exemption category.

The cost of getting this wrong is not merely procedural. It affects the rights and interests of participants, including professional stakeholders who deserve to know what they are involved in and to have made an informed decision about whether to participate.

This article draws on the National Statement on Ethical Conduct in Human Research (2025) and the NHMRC's Ethical Considerations in Quality Assurance and Evaluation Activities (2014). It is intended as practical guidance and does not constitute legal advice. If you have questions about whether your project requires ethics review, get in touch.

AI Disclosure: Initial drafts of the content for this article were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.

​