29 C.F.R. § 21.109 – IRB review of research.

(a) An IRB shall review and have authority to approve, require modifications in (to secure approval), or disapprove all research activities covered by this policy, including exempt research activities under § 21.104 for which limited IRB review is a condition of exemption (under § 21.104(d)(2)(iii), (d)(3)(i)(C), and (d)(7), and (8)).
(b) An IRB shall require that information given to subjects (or legally authorized representatives, when appropriate) as part of informed consent is in accordance with § 21.116. The IRB may require that information, in addition to that specifically mentioned in § 21.116, be given to the subjects when in the IRB's judgment the information would meaningfully add to the protection of the rights and welfare of subjects.
(c) An IRB shall require documentation of informed consent or may waive documentation in accordance with § 21.117.
(d) An IRB shall notify investigators and the institution in writing of its decision to approve or disapprove the proposed research activity, or of modifications required to secure IRB approval of the research activity. If the IRB decides to disapprove a research activity, it shall include in its written notification a statement of the reasons for its decision and give the investigator an opportunity to respond in person or in writing.
(e) An IRB shall conduct continuing review of research requiring review by the convened IRB at intervals appropriate to the degree of risk, not less than once per year, except as described in § 21.109(f).
(f)
1. (1) Unless an IRB determines otherwise, continuing review of research is not required in the following circumstances:
  1. (i) Research eligible for expedited review in accordance with § 21.110;
  2. (ii) Research reviewed by the IRB in accordance with the limited IRB review described in § 21.104(d)(2)(iii), (d)(3)(i)(C), or (d)(7) or (8);
  3. (iii) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study:
    1. (A) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or
    2. (B) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care.
2. (2) [Reserved]
(g) An IRB shall have authority to observe or have a third party observe the consent process and the research.
(Approved by the Office of Management and Budget under Control Number 0990-0260)