What defines the legitimacy of an IRB?

Question

As we know, researchers without university affiliations who need IRB approval for human subjects research can obtain approval from an independent IRB.

What defines the legitimacy of an independent IRB? Logically, a university IRB derives an aura of legitimacy from the accreditation that its university carries, but how does an independent IRB differentiate itself from a "fake" independent IRB?

In other words, if I wanted to start my own Independent IRB and start approving research projects for independent researchers, nonprofits, and industry groups, what exactly would I need to do to become "legit"? Alternatively, what stops random people from starting up a "predatory" IRB that exists to rubber-stamp any old unethical garbage research in exchange for large cash payments?

• Is the legitimacy of a self-claimed Independent IRB defined by the soundness of its ethical judgments? E.g. if you make good judgments, approve ethical research, don't approve anything unethical, etc., everything is golden. If you approve bad things (either intentionally or incompetently), you lose face and become seen as "fake".
• Is the legitimacy defined in terms of inputs? e.g. if you have enough advanced degree holders, persons who have passed certain research ethics exams, etc., you are legit, else you are not.
• Is there some formal accreditation process that wannabe independent IRB's must go through? In other words, if you have the formal accreditation certificate, you are legit, else you are not.
• Is there no "gold standard" in legitimacy, and funding sources, journals, etc. all make their own independent determinations as to which IRBs to recognize? E.g. perhaps someone's research results turn out to be groundbreaking, but they can only publish in a third-rate journal because they used a small, discount IRB not recognized by most high-impact journals.
• Is the real requirement simply that the research be vetted by someone other than the researcher(s), and using a formally constituted IRB is just a Best Practice that researchers typically choose to follow in order to reduce the likelihood that they will harm a research subject?

Alternatively, what stops the following from being heard more often?

I got all this research approved by Uncle Bill's Discount Cigar and Research Ethics Adviseorium on Maple Avenue, behind the bowling alley next to the pawn shop, what do you mean they are not legit?

Although one may argue the extent of the problem and where exactly the border line between legit and non-legit is, very few people would dispute that "diploma mills" and "predatory journals" actually do exist. There seems to be no evidence, however, that "fake IRBs" are even a thing in the overactive mind of some busybody, let alone a significant concern. Considering that I have not heard much (actually, nothing at all) regarding allegations of "fake" or "predatory" independent IRB's bilking naive independent researchers in exchange for worthless rubber stamps, I am led to believe that either there is little money in independent IRB activities (e.g. low profit margins, very high overhead costs) to attract predators, or that there is already an onerous approval process that "fake" or less-competent wannabe reviewers cannot pass.

I might also expect that if there really were "fake" IRB's, someone would have performed a sting operation or expose by now. E.g.

I submitted a copy of the Milgram Experiment to TomorrowIRB 21st Century Ethics, Inc., and they sent it back with a letter saying that they would approve it immediately if I paid them $20,000 by Western Union and signed a piece of paper promising not to use political prisoners. They are either on crack or predatory! Beware!

Answer 1

In the United States, this is governed by Title 45, Part 46.

• Paragraph 101 states that this applies to all research funded by or "subject to regulation" by the US Government
• The same paragraph also states that an Agency Head may determine that a foreign IRB system is equivalent and may be substituted

The key requirements for US IRBs are:

• Subpart A, Paragraph 107: IRBs must have at least 5 members with varying backgrounds (as enumerated)
• Subpart A, Paragraph 108: IRBs must have sufficient meeting space, staff, written procedures for its deliberations, decisions, and adverse incidents
• Subpart A, Paragraph 115: IRBs must keep detailed records for three years (as described)
• Subpart E: IRBs must be registered with HHS (Office for Human Research Protections and/or Federal Drug Agency).

Most of the other subsections detail the basic rules that IRBs must enforce (e.g., involving fetuses, prisoners).

From what I can tell (and I am no expert), the only barrier to people using Uncle Bill's Cigar Shop IRB is that if a subject is harmed by an IRB-approved protocol, Uncle Bill is going to get sued. Uncle Bill may also have legal problems with the Government if they fail to follow the federal regulations governing IRBs (i.e., if they approve something that is clearly not permitted under CFR).