40 C.F.R. § 26.1109 – IRB review of research.

(a) An IRB shall review and have authority to approve, require modifications in (to secure approval), or disapprove all research activities covered by this subpart.
(b) An IRB shall require that information given to subjects as part of informed consent is in accordance with § 26.1116. The IRB may require that information, in addition to that specifically mentioned in § 26.1116, be given to the subjects when, in the IRB's judgment, the information would meaningfully add to the protection of the rights and welfare of subjects.
(c) An IRB shall require documentation of informed consent in accordance with § 26.1117.
(d) An IRB shall notify investigators and the institution in writing of its decision to approve or disapprove the proposed research activity, or of modifications required to secure IRB approval of the research activity. If the IRB decides to disapprove a research activity, it shall include in its written notification a statement of the reasons for its decision and give the investigator an opportunity to respond in person or in writing.
(e) An IRB shall conduct continuing review of research requiring review by the convened IRB at intervals appropriate to the degree of risk, not less than once per year, except as described in paragraph (f) of this section.
(f)
1. (1) Unless an IRB determines otherwise, continuing review of research is not required in the following circumstances:
  1. (i) Research eligible for expedited review in accordance with § 26.1110;
  2. (ii) Research that has progressed to the point that it involves only one or both of the following, which are part of the IRB-approved study:
    1. (A) Data analysis, including analysis of identifiable private information or identifiable biospecimens, or
    2. (B) Accessing follow-up clinical data from procedures that subjects would undergo as part of clinical care.
2. (2) [Reserved]
(g) An IRB shall have authority to observe or have a third party observe the consent process and the research.