28.1 Safety Reconciliation and Dataset Finalisation

Safety Reconciliation and Dataset Finalisation

Regulatory inspectors verify that the following five parameters demonstrate agreement on shared concepts or documented justified differences between the EDC adverse event panel and the safety database case record:

1. Subject Identification: Subject study ID, site number, age, sex, and randomized treatment cohort.
2. Adverse Event Terminology: Verbatim diagnostic phrase and matched MedDRA Preferred Term (PT).
3. Event Chronology: Exact date of event onset and exact date of event resolution (or notation of ongoing status).
4. Seriousness Criteria: Identical classification of why the event is serious (Death, Life-Threatening, Inpatient Hospitalization / Prolongation, Persistent Disability, Congenital Anomaly, or Medically Significant).
5. Causality & Outcome: Investigator-assessed relationship to investigational product (Related vs. Not Related), action taken with study drug, and final clinical outcome (Recovered, Recovered with Sequelae, Fatal, Unknown).

The CRA's Operational Role in Reconciliation

When reconciliation identifies a discrepancy (e.g., the safety database records an SAE onset date of October 12, but the EDC eCRF records October 14), the CRA is called upon to perform immediate source record auditing. The CRA reviews the hospital admission face-sheet, nursing notes, and discharge summary to determine the true clinical onset date, guides the site coordinator in amending the erroneous system, and ensures documented rationale accompanies the change.

Blinded review, populations and intercurrent events

Before planned unblinding and analysis, review data quality, deviations and analysis-set decisions under the prespecified statistical plan. Maintain appropriate blinding and document the decisions. A named Blinded Data Review Meeting is one organisational method, not a universal required meeting or attendee list.

The intention-to-treat principle concerns all randomised participants analysed according to assigned treatment. A full analysis set aims to be as close as possible to that ideal, with any justified exclusions limited and prespecified. It is not universally identical to a safety set of participants who received a dose. A per-protocol set uses prespecified criteria for sufficient adherence and relevant deviations. Its selection can introduce bias; it does not automatically reveal a pure biological effect.

E9(R1) links the clinical question to an estimand: treatment, population, variable, handling of intercurrent events and population-level summary. Stopping treatment, rescue medication or death may affect interpretation. Missing data and an intercurrent event are related but different concepts. A participant who stops medication may still contribute planned follow-up measurements if they agree and the protocol permits. Collect the information required by the estimand rather than deleting the person from the database.

Database Lock (DBL) Procedures & Unlocking Governance

Database Lock (DBL) is the definitive milestone in the data management lifecycle. It marks the formal cessation of data editing, rendering the trial database read-only and immutable.

Finalisation based on the analysis purpose

E6(R3) requires prespecified, documented activities that produce data of sufficient quality for planned interim or final analyses. These can include reconciliation, correction of meaningful errors and omissions where possible, medical coding, evaluation of noncompliance and determination of analysis sets. Investigator review/endorsement should occur at agreed important milestones.

A finalisation checklist should identify the intended data cut, required reviews, known missing information, unresolved issues and their assessed impact. Do not invent values to obtain 100% filled fields. Some data may remain genuinely missing or an issue may be documented rather than numerically corrected. The responsible functions assess whether the dataset is suitable for its planned purpose.

A final global lock differs from a planned interim cut or a site close-out. Not every participant must finish long-term follow-up before every interim analysis. Apply the protocol, analysis plan and data-management procedures, including who authorises release and how the version is identified.

Soft Lock vs. Hard Lock

• Soft Lock (Interim / Dry-Run Lock): All site editing privileges are temporarily removed, placing the database in read-only status. The biostatistics team runs exploratory statistical scripts, validates analysis datasets (SDTM / ADaM), or conducts planned interim analyses for Data Safety Monitoring Boards (DSMBs). If critical minor data errors are discovered, controlled, documented edits may still be performed under strict change control procedures.
• Hard Lock (Final Database Freeze): The final, definitive lock executed after all quality gates pass. Routine editing is restricted under the documented lock procedure. The final dataset is extracted and transferred to Biostatistics. Release of treatment codes follows the protocol and prespecified analysis process, including appropriate interim arrangements.

Controlled post-finalisation corrections

If an important error is found after lock or data release, preserve the prior dataset and assess its impact. Follow documented authorisation, justification, audit trail, change review and re-finalisation procedures. The required approvers are defined by the organisation/trial, not a universal five-executive ICH list. Document what changed, who changed it, why it was justified and which analyses need reassessment.

An audit trail must remain interpretable. Unblinded knowledge creates particular risk of biased changes, so maintain appropriate independent review and safeguards. A locked database is an operational control, not proof that no error can ever exist or that a legitimate correction is prohibited.

Official sources

Checked October 18, 2026: ICH E6(R3), Principles and Annex 1, ICH E9(R1).