What defines the legitimacy of an IRB?

Question

As we know, researchers without university affiliations who need IRB approval for human subjects research can obtain approval from an independent IRB.

What defines the legitimacy of an independent IRB? Logically, a university IRB derives an aura of legitimacy from the accreditation that its university carries, but how does an legitimate independent IRB differentiate itself from a "fake" independent IRB?

In other words, if I wanted to start my own Independent IRB and start approving research projects for independent researchers, nonprofits, and industry groups, what exactly would I need to do to become "legit"? Alternatively, what stops random people from starting up a "predatory" IRB that exists to rubber-stamp any old unethical garbage research in exchange for large cash payments?

• Is the legitimacy of a self-claimed Independent IRB defined by the soundness of its ethical judgments? E.g. if you make good judgments, approve ethical research, don't approve anything unethical, etc., everything is golden. If you approve bad things (either intentionally or incompetently), you lose face and become seen as "fake".
• Is the legitimacy defined in terms of inputs? e.g. if you have enough advanced degree holders, persons who have passed certain research ethics exams, etc., you are legit, else you are not.
• Is there some formal accreditation process that wannabe independent IRB's must go through? In other words, if you have the formal accreditation certificate, you are legit, else you are not.
• Is there no "gold standard" in legitimacy, and funding sources, journals, etc. all make their own independent determinations as to which IRBs to recognize? E.g. perhaps someone's research results turn out to be groundbreaking, but they can only publish in a third-rate journal because they used a small, discount IRB not recognized by most high-impact journals.
• Is the real requirement simply that the research be vetted by someone other than the researcher(s), and using a formally constituted IRB is just a Best Practice that researchers typically choose to follow in order to reduce the likelihood that they will harm a research subject?

Alternatively, what stops the following from being heard more often?

I got all this research approved by Uncle Bill's Discount Cigar and Research Ethics Adviseorium on Maple Avenue, behind the bowling alley next to the pawn shop, what do you mean they are not legit?

To be clear, I'm considering an analogy with "diploma mills" and "predatory journals", entities that technically provide a service but are generally considered problematic in Academia. A hypothetical "IRB mill" or "predatory IRB" would presumably exist primarily as a profit-making venture and not as a strongly ethical body. It might give out rubber stamp approvals to questionable research in exchange for large cash payments while providing little in the way of actual ethical oversight or guidance, or it might actually provide ethical guidance but not on the level generally considered a best practice and/or charge more than reasonable rates for its services.

I might expect that if there really were "fake" IRB's, someone would have performed a sting operation or expose by now, the way that there have been several "stings" of predatory journals (trying to get obvious crap or nonsense approved for publication) in the past few years. For example,

I submitted a copy of the Milgram Experiment to TomorrowIRB 21st Century Ethics, Inc., and they sent it back with a letter saying that they would approve it immediately if I paid them $20,000 by Western Union and signed a piece of paper promising not to use political prisoners. They are either on crack or predatory! Beware!

Answer 1

In the United States, this is governed by Title 45, Part 46.

• Paragraph 101 states that this applies to all research funded by or "subject to regulation" by the US Government
• The same paragraph also states that an Agency Head may determine that a foreign IRB system is equivalent and may be substituted

The key requirements for US IRBs are:

• Subpart A, Paragraph 107: IRBs must have at least 5 members with varying backgrounds (as enumerated)
• Subpart A, Paragraph 108: IRBs must have sufficient meeting space, staff, written procedures for its deliberations, decisions, and adverse incidents
• Subpart A, Paragraph 115: IRBs must keep detailed records for three years (as described)
• Subpart E: IRBs must be registered with HHS (Office for Human Research Protections and/or Federal Drug Agency).

Most of the other subsections detail the basic rules that IRBs must enforce (e.g., involving fetuses, prisoners).

From what I can tell (and I am no expert), the only barrier to people using Uncle Bill's Cigar Shop IRB is that if a subject is harmed by an IRB-approved protocol, Uncle Bill is going to get sued. Uncle Bill may also have legal problems with the Government if they fail to follow the federal regulations governing IRBs (i.e., if they approve something that is clearly not permitted under CFR).