My institution has separate ethical review boards for each department, and the college as a whole has a general ethics policy here. The Guide to Good Research Practices mentioned in that policy is here. It’s very broad, and like many other situations I can think of there’s a lot of discretion reserved to individual groups. Something that might raise an eyebrow in the Genetics department’s ethical review might not be picked up by the same experiment done in CS, simply because there are different people involved.
As it happens, we don’t do a lot of human research in my department, so there aren’t many things that require that level of ethical review. (For departments that work with animals, there are separate sets of guidelines.)
Interestingly, if I were to put together a study using publicly available human data sets, I wouldn’t need to submit my proposal to an IRB.