Low Risk Doesn't Mean No Risk

“It’s only a few interviews.”

“We’re not collecting anything particularly sensitive.”

“It’s just an anonymous survey.”

“We’re only using existing data.”

These are all perfectly reasonable and common things to highlight when preparing an ethics application. They can also be good indicators that a project presents relatively little risk to participants.

But low risk does not mean no risk.

And perhaps more importantly, describing research as low risk shouldn't be the end of the ethical conversation. It should be the beginning of a more useful one: what are the risks in this particular research, and have they been appropriately addressed?

What do we actually mean by low risk?

“Low risk” can sometimes become shorthand for research that appears relatively straightforward: a small number of interviews, an anonymous survey, an evaluation, or research using existing information. But risk has a more specific meaning in research ethics.

New Zealand's National Ethical Standards take a risk-based approach to ethical oversight and distinguish between negligible risk, minimal risk and more-than-minimal risk

Negligible-risk research is research where the only foreseeable risk is inconvenience or discomfort. Minimal-risk research is research where the probability and magnitude of harm are no greater than those ordinarily encountered in daily life or routine physical or psychological examinations. Research involving greater probability or magnitude of harm moves beyond those categories.

These distinctions matter because the level of ethical oversight should be proportionate to the level of risk. But there is an important principle sitting alongside them: less ethical scrutiny does not mean fewer ethical responsibilities.

The National Ethical Standards explicitly recognise this. A low level of scrutiny for research assessed as low or minimal risk does not imply a lower level of adherence to the ethical principles in the Standards. That is an important distinction.

A project may quite properly be assessed as low risk. But getting to that conclusion still requires us to identify what could reasonably happen, who could be affected, how significant the consequences might be, and whether those risks have been appropriately managed.

Risk isn't always where we expect it

Some research risks are relatively easy to recognise. Others emerge from the context in which research takes place.

An apparently innocuous survey might collect combinations of demographic information that make individual respondents identifiable (particularly in a country the size of New Zealand, where some professional and population groups are very small.)

An interview about a seemingly uncontroversial topic might lead a participant to disclose something unexpected or sensitive.

Research involving existing data may involve no direct interaction with participants at all, while still raising important questions about secondary use, privacy, governance, cultural considerations or the potential for findings to cause harm to a particular community.

And research involving professional participants may involve capable adults who are perfectly able to decide whether to participate, whilst still raising questions about employment relationships, organisational hierarchy or whether declining really feels consequence-free.

None of these examples necessarily makes the research high risk. They simply demonstrate why risk needs to be considered rather than assumed.

Risk and ethical complexity aren't quite the same thing

There is another distinction worth making. A project can genuinely be low risk and still involve ethical questions that deserve thought.

Consent is one example.

Obtaining consent may be straightforward, but researchers still need to decide what participants need to know, whether participation can genuinely be voluntary, whether withdrawal is possible once information has been combined or aggregated, and what will happen to participants' information after the project is complete.

The same is true of confidentiality, data management, recruitment, cultural considerations and dissemination. These questions don't necessarily signal danger. They are simply part of doing research responsibly.

That distinction matters because otherwise we risk treating ethics as a binary exercise: research is either risky and therefore requires ethical consideration, or low risk and therefore ethics has little to contribute.

Alas, research rarely divides quite so neatly.

Proportionate review should actually be proportionate

None of this means that every research project should receive the same level of scrutiny. Quite the opposite.

A good ethics system should be capable of distinguishing between different kinds and levels of risk. Researchers shouldn't have to navigate processes designed for complex clinical research simply because their project involves humans.

But proportionate review shouldn't mean cursory review. It means directing attention to the ethical issues that actually matter in the research.

For a large anonymous survey, there may be relatively little concern about the burden placed on individual participants and the questions asked in the content of the survey – but BOOM, respondents are asked for their postcode, age, birthday, ethnicity, and occupation. Individually innocuous questions can become identifying when combined.

For a handful of interviews, data security may be straightforward – but BOOM, the researcher is asking their own employees to participate. Suddenly, voluntariness, power and existing relationships require more thought.

Proportionate review isn't necessarily about doing less. It's about looking closely at the things that matter, and spending less time on the things that don't.

The point isn't to make low-risk research harder

Ethics review should not be an exercise in finding hypothetical problems with otherwise straightforward research. Nor should researchers be expected to eliminate every conceivable risk. That would be neither possible nor proportionate.

The objective is much more practical:

identify reasonably foreseeable ethical issues

think about their consequences

and put sensible measures in place to manage them.

Sometimes, that will require substantial changes to a project. But often, it won't.

Sometimes the conclusion will simply be that a potential harm is very unlikely, its consequences are limited, and the measures already proposed are sufficient.

That is still an ethical judgement. That is what proportionate ethics review should look like.

A better question

“Is this low risk?” is a useful question. But on its own, it doesn't tell us very much.

Perhaps the better question is:

What are the risks and ethical issues in this particular research, and have we dealt with them well?

If the answer is yes, then the research may quite properly be described as low risk. But we get there by considering the risks; not by assuming their absence.