Clinical Operations SOPs, Forms & Trackers

The Clinical Operations lead obtains relevant medical and statistical input on critical operational assumptions, resolves unassigned controls with the study owner, and submits the study plan and responsibility matrix for study-owner approval before implementation.

Check: The approved plan identifies owners, review triggers and unresolved readiness blockers.

Retain: Approved study plan, scoped review and disposition.

Open the approved protocol and mark each operational activity that can affect participant protection or endpoint reliability. Enter the risk, existing control, accountable function and review trigger in the study plan.

Check: Each critical activity has an owner and an observable control; high-impact gaps have an action before readiness.

Retain: Protocol review and critical-process register.

Build the study responsibility table by deliverable and decision. Compare it with signed provider agreements; resolve overlaps or unassigned work with the sponsor owner.

Check: One decision owner is named per gate, and outsourced tasks have a sponsor oversight owner.

Retain: Approved delegation/RACI and interface decisions.

At the planned governance review, compare actual results with the approved thresholds. Record data period, source, breach assessment, decision and action due date.

Check: The decision can be traced to dated evidence; a closed action has closure evidence.

Retain: Quality review minutes and action register.

For an amendment or material change, list affected plans, systems, vendors and training. Obtain scoped review, issue the new version and record acknowledgment.

Check: No team is instructed to operate from an unapproved or superseded baseline.

Retain: Change assessment and effective distribution record.

The startup lead separates country-level approvals from site-specific requirements in the readiness checklist. Obtain regulatory confirmation for the country and verify current site approvals, contract status, training and system readiness. Submit the completed evidence to the Clinical Operations activation approver; retain the dated decision before authorizing enrollment.

Check: Country and site readiness are both established; activation exceptions cannot bypass required approvals.

Retain: Country/site readiness checklist and activation decision.

Score each candidate site against protocol-specific recruitment, staffing, facilities and equipment criteria. Cite evidence and record why the chosen site is suitable.

Check: Unverified capacity is identified as a risk, not scored as established capability.

Retain: Feasibility scorecard and qualification evidence.

Assemble the activation checklist by country and site. Verify ethics/regulatory approvals, approved consent versions, contracts and essential documents against the planned start date.

Check: Approvals cover the correct site, protocol and materials; no critical item is expired or missing.

Retain: Dated activation checklist and approval links.

Conduct the initiation review with delegated site staff. Demonstrate consent, eligibility, safety notification, product and data-entry workflows; record training and open actions.

Check: Staff can locate contacts and current instructions; unresolved critical actions block activation.

Retain: Initiation report, training evidence and action closure.

Submit the exact activation package to the sponsor's authorized greenlight approver. Record the decision and communicate the allowed start date and scope.

Check: Greenlight is signed/approved before enrollment, and recipients acknowledge it.

Retain: Site greenlight and distribution record.

The vendor manager defines the service risk and acceptance criteria, obtains QA input on qualification appropriate to that risk, and records the qualification decision by the delegated sponsor owner. Assign an acceptance owner for each deliverable and interface, including any subcontracted work; resolve gaps before service initiation.

Check: Qualification and deliverable acceptance authority are documented; unresolved critical gaps block startup.

Retain: Qualification assessment and approved acceptance responsibilities.

Define each vendor's services, data access, subcontractors and failure risks. Request qualification evidence proportionate to those risks and document gaps.

Check: Evidence supports intended services and significant subcontracting is visible to the sponsor.

Retain: Due-diligence assessment.

Reconcile the contract, specifications and oversight plan. Assign deliverables, acceptance criteria, notification timelines, audit/record access and exit obligations.

Check: No critical responsibility is left between two organizations without an owner.

Retain: Approved service/RACI and oversight plan.

Use test cases or readiness evidence to verify interfaces, transfers, contact routes and contingency arrangements before first live use.

Check: Results meet approved acceptance criteria; failures have approved disposition.

Retain: Kickoff/readiness record.

Compare performance and significant changes at each scheduled review. Escalate unresolved risk; at exit obtain records, access transfer and outstanding-action ownership.

Check: Vendor closure does not strand essential records, data or unresolved obligations.

Retain: Performance review and closeout handoff.

The monitoring lead prepares the monitoring plan from the current protocol and risk assessment. Specify critical data/processes, monitoring methods, review frequency, escalation triggers and report review authority. Obtain Clinical Operations approval and distribute the controlled plan before routine monitoring starts; reassess it after material risk changes.

Check: The plan is approved and the report reviewer and issue-closure owner are assigned.

Retain: Monitoring plan approval, distribution and revision evidence.

Select sites and activities from the approved monitoring plan using dated risk signals. Record the sample and reason for any change in coverage.

Check: Coverage addresses critical data and participant risks rather than only visit frequency.

Retain: Monitoring scope and risk rationale.

Perform authorized source review or verification against protocol and plan. Record discrepancy location and impact without copying unnecessary identifiers.

Check: Each finding is specific, supported and assigned to the responsible site/function.

Retain: Visit/central-review record and findings.

Draft the report with findings, severity rationale and immediate actions. Send the same report version to the qualified reviewer; resolve comments visibly.

Check: Report review covers accuracy, evidence and escalation, not just formatting.

Retain: Reviewed report and comment disposition.

Assign follow-up owners and dates. Inspect correction evidence; escalate repeated or overdue significant findings and reassess monitoring strategy.

Check: Actions are closed on evidence and effectiveness, not on a promised completion date.

Retain: Follow-up closure and risk-plan update.

Check the site's current approved consent version and staff delegation. Verify the documented process covers understandable discussion, questions and required consent before trial-specific procedures.

Check: Consent timing, version and authorization are supported; concerns go promptly to the investigator.

Retain: Consent oversight review.

Compare eligibility evidence with each protocol criterion through the approved review channel. Send ambiguities to the investigator and medical monitor; do not make undocumented exceptions.

Check: The responsible clinician records the eligibility decision; unresolved criteria are not assumed satisfied.

Retain: Eligibility checklist and clinical decision link.

Compare screening, enrollment and retention trends by site with planned assumptions. Review approved recruitment materials and reasons for avoidable barriers.

Check: Remediation respects participant choice, privacy and protocol requirements.

Retain: Enrollment review and approved remediation plan.

Before implementing a revised recruitment or retention approach, assess ethics review, training, vendor and consent implications. Track results and adverse consequences.

Check: Any required approval is obtained before changed materials or procedures are used.

Retain: Change approval, implementation and effectiveness review.

When enrollment or site performance threatens study delivery, the Clinical Operations lead reviews the cause and feasibility of recovery with relevant site and medical personnel. Record the proposed recovery actions, resources, risks to participants and data, owner and reassessment date. Obtain sponsor study-owner approval for material changes and investigator agreement for site actions; verify required amended approvals before use.

Check: The recovery decision is supported and does not bypass consent or eligibility requirements.

Retain: Recovery assessment and authorized action plan.

Match the shipment request to authorized site, product, lot, quantity and storage capability. Confirm release documentation before authorizing dispatch.

Check: Shipment is authorized and destination can maintain required conditions.

Retain: Shipment release checklist.

Reconcile shipped, received, dispensed, returned and destroyed quantities using controlled accountability records. Investigate unexplained differences.

Check: The inventory equation balances or each discrepancy has documented investigation.

Retain: Accountability reconciliation.

When monitoring shows an excursion or an unexplained balance, the supply coordinator records the affected product, lots, locations, quantities, times and measured conditions. Segregate affected stock and block further use in the applicable inventory workflow. Preserve logger data and shipment records, notify the supply owner, and identify any participant exposure for medical assessment.

Check: Quarantine remains until permitted disposition; clinical impact is escalated when needed.

Retain: Excursion assessment and disposition.

For a product excursion or unexplained discrepancy, identify and segregate affected stock, preserve shipment/storage records and notify the supply owner. Obtain documented disposition from the designated product-quality authority and medical assessment if participant exposure may be affected. Reconcile return, destruction or release records before closing the item.

Check: Affected stock is not used pending authorized disposition; balances and participant-impact actions are reconciled.

Retain: Excursion/discrepancy assessment and disposition.

At closeout, verify authorized return/destruction evidence and reconcile final balances. File the signed reconciliation with custody records.

Check: No unexplained stock or outstanding disposition remains at closure.

Retain: Final product accountability and closure.

On receipt of safety information, identify the event and awareness time and use the approved urgent notification route. If acknowledgment fails, use the escalation contact immediately.

Check: Required notification is not delayed by incomplete administrative fields.

Retain: Timestamped notification and acknowledgment.

Enter the case reference in the oversight log using only necessary identifiers. Link to the safety system and record the follow-up owner.

Check: The log supports oversight and does not become an uncontrolled substitute safety database.

Retain: Case-reference communication log.

Track requested follow-up to the investigator/site owner. Escalate approaching or missed deadlines using the safety plan and applicable reporting requirements.

Check: Outstanding safety information remains visible with a named owner and escalation history.

Retain: Follow-up tracker and communications.

At reconciliation, compare communication status with safety team receipt. Resolve missed or duplicate handoffs and obtain safety-owner confirmation.

Check: Closure means receipt and disposition are documented, not merely that an email was sent.

Retain: Safety handoff reconciliation.

The Clinical Operations lead records the event or proposed change, affected baseline, discovery/request date and immediate impact. Classify it as a deviation/noncompliance, a planned change, or both. For deviations, contain impact and assess whether investigation and CAPA are warranted by significance and recurrence. For planned changes, assess prospective risks, approvals and implementation checks; do not require CAPA solely because a change is requested.

Check: Participant and data impact are assessed before routine root-cause review.

Retain: Issue assessment and containment evidence.

For a deviation requiring investigation, establish the cause from evidence and select corrective/preventive actions proportionate to the risk. For a planned change, document the reason, affected documents/systems, required testing, approvals and transition arrangements. The quality process owner confirms the applicable route and decision authority; link both records when a change implements CAPA.

Check: The cause explains the failure; 'retrain staff' alone is not a root-cause conclusion.

Retain: Investigation and root-cause analysis.

Define each action, owner, due date, affected documents/systems and verification method. Obtain required change, ethics or regulatory approvals before implementation.

Check: The approved action addresses the cause and does not introduce uncontrolled changes.

Retain: CAPA/change plan and implementation evidence.

At the planned effectiveness check, compare actual evidence with prespecified success criteria. Reopen or escalate unsuccessful actions.

Check: Closure includes effectiveness evidence and accountable approval.

Retain: Effectiveness review and closure decision.

Check the DMC charter and firewall plan against the requested material and recipients. Confirm every recipient's role and authorization in the restricted access list.

Check: Recipients are authorized for the information level and blinded personnel are excluded.

Retain: Restricted request and access review.

Reconcile requested outputs to exact cut, specification and output versions. Mark treatment-revealing materials and store them only in the approved restricted location.

Check: Package content and classification match the authorized scope.

Retain: Restricted package manifest.

Have an authorized independent reviewer inspect masking, file metadata, filenames, attachments and the final recipient list.

Check: Review includes indirect disclosure channels, not just visible tables.

Retain: Restricted QC and transfer authorization.

Transfer through the approved secure route and obtain acknowledgment. For misdelivery, contain access and trigger disclosure-impact review immediately.

Check: Receipt is documented; incidents preserve chronology and containment evidence.

Retain: Transfer receipt or incident assessment.

The inspection coordinator selects a risk-based sample of important study decisions and asks the responsible functions to retrieve supporting versions, approvals and follow-up records. Record missing or inconsistent evidence and assign correction owners. Before an authority response is sent, obtain scoped functional and QA review and authorization from the designated inspection response owner.

Check: Readiness gaps have owners and responses are supported by existing evidence; records are not retrospectively fabricated.

Retain: Readiness sample results and authorized response evidence.

Record the authority request verbatim with scope, deadline, assigned owner and response approver. Confirm ambiguities through the authorized inspection coordinator.

Check: The response owner understands the exact request and due date.

Retain: Request intake log.

Retrieve the requested records and establish their version, origin and context. Identify missing records openly and investigate rather than recreating history.

Check: Evidence is attributable and traceable, including superseded versions when requested.

Retain: Evidence inventory and gap explanation.

Ask functional and quality reviewers to check factual accuracy, completeness, consistency and permitted redactions. Resolve conflicts before submission.

Check: The final response matches evidence and does not overstate compliance.

Retain: Approved response and review record.

Submit only through the authorized channel. Preserve exactly what was sent, its recipient and time, and track follow-up commitments.

Check: Submitted version is retrievable and commitments have owners.

Retain: Submission record and commitment log.

Protect participants and contain the affected activity without waiting for a routine meeting. Record the known facts and time the organization became aware.

Check: Immediate response follows medical judgment and the emergency pathway.

Retain: Initial event chronology and containment.

Notify the designated medical, safety, quality and regulatory contacts using the escalation matrix. Confirm receipt and alternate contact if needed.

Check: Critical escalation is acknowledged and not left in an unattended inbox.

Retain: Notification history.

Have the authorized functions assess reportability, jurisdiction, applicable clock and recipients. Record the legal/regulatory basis and decision, including a decision not to report.

Check: Deadlines are explicit for this event; routine CAPA timing cannot reset them.

Retain: Reportability assessment and notifications.

The assigned action owners implement containment and corrective work. Record completion evidence against each acceptance criterion and identify any remaining participant, data or operational risk. The medical, quality and regulatory owners review the relevant evidence and determine what additional external approval or notification is needed before the proposed restart.

Check: Restart decision is supported by participant/data risk assessment.

Retain: Corrective evidence and restart/closure decision.

Before restarting an affected activity, the Clinical Operations lead compiles containment, medical assessment, quality disposition and required external approvals. The sponsor study owner records the restart scope, conditions and rationale after the medical and quality owners confirm acceptance. Communicate only the authorized instructions and verify readiness before resumption.

Check: Restart is authorized and no unresolved safety or mandatory approval requirement is bypassed.

Retain: Restart decision and readiness evidence.

Maintain the essential-record inventory during the study. For missing or late records, identify the custodian, reason, due date and escalation; preserve metadata and version history.

Check: The inventory points to retrievable records and distinguishes missing from not applicable.

Retain: Essential-record inventory.

Before site/vendor closure, reconcile open data queries, safety follow-up, product, records and contractual obligations with the responsible functions.

Check: Closure does not conceal unresolved obligations; approved follow-up has a continuing owner.

Retain: Closeout checklist and handoff.

Transfer the archive with a manifest and custody record. Test a risk-based sample for readability, access, metadata and retrieval in the receiving repository.

Check: The records owner accepts the archive and can retrieve the tested records.

Retain: Archive acceptance and retrieval test.

Verify retention, legal holds, access needs and backup/restore arrangements before decommissioning. Obtain authorization and retain the shutdown evidence.

Check: No required record becomes inaccessible after the system is retired.

Retain: Retention decision and decommission authorization.

The CDM lead drafts the data-management plan using protocol requirements and agreed interfaces. Obtain review from functions responsible for critical data, analysis and safety interfaces, resolve comments, and obtain designated data-owner approval before implementation. Repeat scoped review and approval for material revisions; distribute the effective version.

Check: The DMP and critical interfaces are approved before use.

Retain: DMP review, approval and version distribution.

Read the protocol with clinical operations and biostatistics. Inventory collected and external data, critical variables, intended analyses, owners and transfer dependencies.

Check: Each critical variable has a source, review method and accountable decision owner.

Retain: Data-flow and critical-data inventory.

Draft the DMP against the inventory. Assign build, cleaning, coding, reconciliation, lock and handoff responsibilities; compare vendor obligations with the sponsor RACI.

Check: No data stream or release gate is unassigned or owned only by an unnamed vendor.

Retain: Approved DMP and responsibility matrix.

Set risk-based review frequencies and measures with denominators, source periods and escalation triggers. Document who reviews each signal and how actions close.

Check: A threshold has a defined action and owner, not only a dashboard color.

Retain: Metrics definitions and escalation plan.

At each review, reconcile vendor evidence, overdue issues and changes with the current plan. Record decisions and update affected plans through approval.

Check: Status statements link to evidence; unresolved significant risks are escalated.

Retain: Governance review and controlled plan revision.

The build lead lists protocol-driven data requirements and assigns stable IDs, intended behavior, risk and acceptance criteria. The CDM lead confirms study-specific requirements and the system owner identifies platform controls supported by existing validation evidence. Evaluate that evidence for the actual version, configuration and intended use; identify gaps requiring study-specific testing. Record the boundary between platform qualification, study configuration, interfaces and user acceptance testing. IT approval alone does not authorize the study data workflow.

Check: Required functions are covered by justified testing and release-blocking defects are resolved.

Retain: Approved requirements, traceability, test results and release decision.

Map protocol requirements to CRF fields and downstream data standards. Specify field type, units, allowed values, missing-data behavior and completion guidance.

Check: Every critical requirement is represented without unnecessary collection; ambiguous fields are resolved.

Retain: CRF/metadata specifications and traceability.

Specify edit checks and derivations with input conditions and expected outputs. Build in the controlled test environment and identify the exact configuration version.

Check: Specifications are testable and distinguish warnings from blocking conditions.

Retain: Build specification and configuration baseline.

The tester executes approved normal, invalid, boundary and role/access cases in the identified test configuration. Record each test ID, requirement ID, input, expected result, actual result, evidence, executor and date. Cover applicable edit checks, derivations, transfers, audit trails and workflow permissions. Preserve failures, assign defects, assess clinical-data impact and retest corrections with affected regression cases. The reviewer reconciles untested requirements and deviations before recommending release.

Check: Critical failures are resolved and traceability shows what was tested against each requirement.

Retain: UAT scripts, results, defects and regression evidence.

The CDM lead checks the validation summary against requirements and test evidence, including unresolved deviations and residual risk. The system owner verifies technical readiness and configuration equivalence between the tested and production versions. The release approver confirms training, authorized access, backup/contingency arrangements and required clinical-data acceptance, then records the exact version and release time. Perform and retain the planned production verification; use the approved contingency route if it fails.

Check: No untested material change enters production; the release has an approved scope and rollback/contingency plan.

Retain: Validation summary and go-live authorization.

Compare the access request with the approved permission matrix, person's role and training. Obtain the authorized owner's approval before granting access.

Check: Least privilege and blind restrictions are met; shared accounts are not used.

Retain: Access request and approval.

Record granted permissions and activation time. On role change or exit, remove unnecessary access and document when it was removed.

Check: Actual permissions match authorization and departed users cannot continue access.

Retain: Access history and periodic review.

At the approved review interval and after relevant role changes, the system owner compares current accounts and privileges with authorized duties, training status and the access matrix. Record retain/change/remove decisions; the administrator implements approved changes and returns completion evidence. The owner verifies overdue removals and inappropriate privileges are resolved and assesses exposure when needed.

Check: Every active account is dispositioned; removal actions have verified completion.

Retain: Periodic access review and implemented-change evidence.

Apply the audit-trail review plan to critical data and suspicious patterns. Examine who changed what, when and why, and compare with source-authorized corrections.

Check: Unexplained changes and missing rationale receive investigation rather than blanket acceptance.

Retain: Audit-trail review scope and findings.

Route anomalies to the system/data owner, preserve evidence and assess affected records. Verify corrective access or data changes and obtain closure review.

Check: Anomaly disposition is attributable and does not erase the original audit trail.

Retain: Investigation and closure evidence.

Before transfer testing, the external data manager specifies expected files/records and relevant identifiers, formats, units, reference ranges, specimen and collection timing attributes for the data type. Confirm these rules with the source owner and receiving function. Include missing, duplicate, replacement and out-of-range examples in applicable checks; route scientific ambiguities to the qualified data owner.

Check: The transfer specification supports interpretation and reconciliation for the particular data type.

Retain: Approved transfer rules and test examples.

Agree the transfer specification with the provider: fields, formats, units, identifiers, cadence, cut rules, corrections, encryption and acknowledgment. Test representative files before live transfer.

Check: Both parties approve the same specification and successful test results.

Retain: Transfer specification and test approval.

On receipt, log sender, transfer time, file identity and expected scope. Verify integrity, schema, counts and key uniqueness before loading.

Check: Unexpected, incomplete or duplicate files are quarantined until resolved.

Retain: Intake record and validation results.

Reconcile received records against expected visits/samples and relevant clinical data. Distinguish missing, duplicate, unmatched and clinically inconsistent records; assign each discrepancy.

Check: Reconciliation accounts for all expected scope and documents approved exceptions.

Retain: Reconciliation record and issue disposition.

Accept the corrected/verified version and acknowledge it to the provider and downstream users. Preserve prior versions and assess whether analyses or prior reviews must be repeated.

Check: Accepted version and replacement impact are explicit; no silent overwrites occur.

Retain: Acceptance, supersession and downstream notification.

The CDM lead prepares a risk-based review plan defining critical variables, checks, review frequency, query ownership and medical/statistical review triggers. Obtain scoped review and designated data-owner approval before running routine checks. Confirm source clarification remains with the investigator/source owner and define what evidence permits query closure.

Check: Checks, qualified reviewers and closure criteria are approved and traceable to study needs.

Retain: Approved data-review plan and review responsibilities.

Run the approved listings and checks against a recorded data version. Review critical variables first and record scope, rules and exclusions.

Check: The reviewer can reproduce the review population and check versions.

Retain: Data-review execution record.

For each discrepancy, write a precise, non-leading query identifying the inconsistency and requesting clarification. Route it through the authorized site workflow.

Check: The query does not suggest an unsupported clinical answer or request unnecessary personal data.

Retain: Query record and routing.

Read the site response and verify the resulting correction or explanation. Keep the query open when it does not resolve the issue; escalate persistent ambiguity to the appropriate clinical owner.

Check: Closure is supported by an adequate answer and retained audit trail.

Retain: Query disposition and reviewer evidence.

Reconcile eligibility, deviations and endpoint issues with clinical operations and biostatistics. Capture the agreed decision, affected data and follow-up before the release gate.

Check: Critical cross-functional disagreements are resolved or explicitly block release.

Retain: Critical-variable reconciliation and decisions.

Load the approved dictionary and coding conventions. Record dictionary version and apply coding to the current verbatim terms without altering the verbatim source.

Check: Dictionary/version matches the plan and source terms remain traceable.

Retain: Coding run and dictionary baseline.

Review uncoded, ambiguous and inconsistent terms. Request clarification from the authorized source owner rather than inventing a diagnosis or drug detail.

Check: Ambiguity has a documented query or qualified medical disposition.

Retain: Coding query and decision log.

Have the designated qualified reviewer examine the required coding scope and changed terms. Record review results and resolve disagreements before finalization.

Check: Reviewer conclusion is tied to the exact coded-data version.

Retain: Coding review and approval.

For a dictionary upgrade, compare old and new assignments, assess analysis/safety impact and approve recoding scope. Recheck changed terms and communicate the version change.

Check: No uncontrolled recoding affects delivered data; downstream impact is addressed.

Retain: Upgrade impact assessment and release record.

Agree matching keys, critical fields, data-cut dates and review frequency with safety. Obtain dated clinical and safety extracts through restricted channels.

Check: Both extracts cover the intended scope and preserve source versions.

Retain: Reconciliation plan and extract manifest.

Compare cases/events and the agreed critical fields. Classify missing, unmatched and conflicting records and identify the source-system owner.

Check: Each discrepancy can be traced to both system records without broad disclosure.

Retain: Discrepancy listing.

Request correction or explanation from the accountable source owner. Recheck both systems after resolution and preserve the original discrepancy history.

Check: Resolution is verified in the authoritative systems; reporting continues independently.

Retain: Correction verification and case disposition.

Summarize completed scope and remaining discrepancies for CDM and safety review before the relevant data release.

Check: Critical unresolved mismatches block the affected release; approved interim limitations are explicit.

Retain: Reconciliation signoff and release-status handoff.

Document the requested database change and reason. Compare it with the validated baseline and identify affected data, checks, integrations, access and study instructions.

Check: Impact assessment includes previously collected data and downstream extracts.

Retain: Approved change request.

Preserve a recoverable baseline and define rollback criteria. Test the migration or configuration change using representative data in a controlled environment.

Check: The baseline can be restored and the migration scope is reproducible.

Retain: Migration plan and backup/restore evidence.

Compare pre- and post-change counts, values, derivations, metadata and access. Run affected regression tests and investigate every unexpected difference.

Check: No unexplained loss, altered meaning or broken auditability remains.

Retain: Migration reconciliation and regression results.

Obtain release authorization, schedule implementation and notify affected users. Verify the production version and update instructions/training as needed.

Check: Production matches the approved tested version and the change history remains intact.

Retain: Release notes, implementation verification and training.

The release coordinator records whether the requested state is a data cut, freeze or lock and specifies exactly which data and users may still change data. Obtain the designated data-owner authorization. For unlock, record reason, affected records, authorized changes and downstream impact; repeat affected checks, authorize relock and issue a new version with supersession links.

Check: The state and permitted changes are explicit; released extracts remain preserved.

Retain: State authorization, unlock/relock decisions and version links.

Create the cut/lock request with scope, cutoff, intended use and acceptance criteria. Reconcile all expected data sources, queries, coding and safety review against it.

Check: Every required source and review has a documented status and owner.

Retain: Readiness checklist and cut definition.

Collect functional signoffs for the named data version and scope. Investigate exceptions; distinguish permitted interim limitations from critical unresolved final-lock defects.

Check: Signoffs are not blanket approvals and do not hide known critical issues.

Retain: Functional approvals and exception disposition.

Apply the approved freeze/lock controls and generate the immutable snapshot. Verify file counts, identifiers, schema and integrity against the transfer manifest.

Check: Snapshot is the approved version and unauthorized changes are prevented.

Retain: Lock evidence and transfer manifest.

Transfer securely to programming/biostatistics and obtain acceptance. For a needed correction, obtain unlock authorization, document changes, repeat affected checks and relock with a new version.

Check: The original snapshot is retained and all affected recipients know the replacement status.

Retain: Receipt, unlock/relock history and supersession record.

Maintain the CDM record inventory throughout the study, linking plans, specifications, tests, decisions and approvals to controlled repositories.

Check: Required records are readable, attributable and retrievable, including prior versions.

Retain: Essential-record index.

At closeout, reconcile the archive manifest to the inventory and test retrieval of data, metadata, audit trails and approvals with the records owner.

Check: Archive acceptance is documented before the system is retired.

Retain: Archive verification and acceptance.

For an external data request, document purpose, recipient, permissions and minimum necessary content. Obtain privacy/legal review and apply approved de-identification.

Check: Access is lawful and authorized for this use; removal of direct identifiers alone is not assumed sufficient.

Retain: Data-use authorization and privacy assessment.

Independently check the outgoing package and restrictions, then record secure transfer and receipt. Preserve source custody, retention requirements and inspection access.

Check: Only the approved package reaches authorized recipients and retained records remain available.

Retain: Transfer authorization and custody record.

The programming lead prepares the study programming plan with deliverables, approved scientific inputs, validation methods, roles, repositories and release criteria. Obtain statistical resolution of scientific ambiguities and sponsor programming-owner approval before implementation. Route significant quality concerns or proposed departures from governing procedures to the designated quality owner; an operational lead cannot waive an applicable requirement alone. For a proposed departure from vendor procedures, the programming lead records the exact requirement, reason, affected work, risk, alternative controls, duration and return-to-standard plan. Obtain vendor process-owner agreement and authorized sponsor quality/functional approval before planned use. A sponsor instruction cannot waive applicable law, participant protection or data-integrity requirements. Record urgent actions promptly under the applicable exception route and assess impact; do not retrospectively fabricate approval.

Check: The plan is approved and material exceptions have authorized disposition.

Retain: Programming plan approval and linked exception decisions; vendor procedure exception assessment where applicable.

Read the approved protocol, SAP, analysis-data specifications and output specifications together. The protocol governs objectives and endpoint definitions; the SAP defines prespecified analysis consistent with the protocol. Data specifications implement derivations and output specifications implement presentation. Record a conflict with document/version, affected requirement and work held. Obtain the responsible statistical or clinical decision, update the controlling document or approved decision record, and link the resolution in the programming decision log before affected programming proceeds.

Check: The approved interpretation is recorded before affected programming begins.

Retain: Protocol/SAP review and decision log.

Assign the production author, independent reviewer and release approver for each deliverable. Compare vendor and sponsor responsibilities and identify the governing procedures.

Check: Each gate has an authorized owner; independent QC is not assigned to the author.

Retain: Programming plan and responsibility matrix.

Review milestones, defect trends and scope changes using dated evidence. For a vendor procedure difference, record exactly what differs, impact, authority and compensating controls.

Check: A sponsor request alone is not treated as an undocumented waiver of required controls.

Retain: Quality review and approved procedure-difference record.

For a material change, record affected programs, datasets, outputs and prior releases. Approve scope, revise the baseline, retest affected work and close on evidence.

Check: Recipients can identify the current approved baseline and superseded work.

Retain: Change assessment, retest and closure.

The standards/tool lead records applicable standard versions and differences from the study baseline. For reusable code, document intended use, inputs, expected outputs, tests and release limitations. For the computing environment, confirm dependencies, access restrictions, backup/recovery arrangements and technical-owner acceptance. Release identified versions only after relevant evidence is reviewed; reassess impacted tests after changes.

Check: Standards, reusable code and environment each have evidence appropriate to their intended use.

Retain: Standards decisions, qualification evidence and environment acceptance.

List intended uses and select standards, terminology and software versions against the applicable submission/study strategy. Record rationale for exceptions.

Check: The chosen versions are supported for the intended use and deviations are reviewed.

Retain: Standards/version decision register.

For a reusable component, write its input contract, output behavior, dependencies and failure behavior. Identify risk from incorrect results or incompatible versions.

Check: Requirements are testable and include boundary and error behavior.

Retain: Reusable-component specification.

Run reviewed tests using known expected results, including missing values, limits and invalid inputs. Retain code version, environment, logs and discrepancy resolutions.

Check: Evidence supports intended use; tool qualification is not inferred from popularity.

Retain: Validation/qualification record.

Approve a versioned release and restrict modification. For upgrades, assess affected uses and rerun appropriate tests before adoption.

Check: Users can identify the approved version and reproduce its environment.

Retain: Release, dependency inventory and change history.

The SDTM programmer prepares mappings from accepted source definitions, including origin, transformations and terminology. The assigned reviewer checks completeness and interpretation with CDM or standards expertise where needed. The programming lead approves the identified specification before production use; changes require impact assessment and repeat checks of affected datasets.

Check: Mapping decisions and their review are approved and traceable.

Retain: Mapping specification, review and approval.

Open the accepted source manifest and approved SDTM strategy. Map each variable, origin and transformation in the specification; record unresolved source questions.

Check: Critical mappings are unambiguous and trace back to the accepted source.

Retain: Versioned SDTM mapping specification.

Program domains from the frozen input version. Record program dependencies and produce reconciliation counts and transformation checks.

Check: No manual untracked dataset edits or unexplained record loss occur.

Retain: Programs, logs and reconciliation evidence.

Have an independent reviewer verify the prespecified scope, including keys, domains, units, timing and derivations. Compare against source and approved specifications.

Check: Differences are explained and resolved using evidence, not simply matched totals.

Retain: Independent QC record.

Run applicable conformance checks, investigate findings and reconcile final data to metadata and specifications. Obtain release approval of the exact manifest.

Check: Validator findings have reviewed disposition; semantic correctness is also checked.

Retain: Validation disposition and SDTM release record.

The analysis programmer specifies populations, endpoints, derivations, timing rules, missing-data handling and treatment variables from the approved SAP. Obtain statistical approval of scientific content and programming-lead acceptance of implementability before production use. Resolve conflicts in the controlling document or approved decision record and reassess affected validation after changes.

Check: Scientific intent and implementable derivations are approved before production.

Retain: ADaM specification and statistical/programming approvals.

Translate approved SAP rules into population, treatment, endpoint, timing and derivation specifications. Obtain statistician decisions for ambiguity before coding.

Check: Definitions agree with the analysis objective and protocol/SAP baseline.

Retain: Approved ADaM specification.

Build analysis datasets from identified source versions and record derivation lineage. Preserve identifiers and intermediate evidence needed to explain results.

Check: Each derived value can be traced to inputs and the applied rule.

Retain: Programs, logs and traceability metadata.

Independently verify critical derivations, including boundary dates, missing values, censoring and treatment/population assignments where applicable.

Check: Reviewer checks the scientific rule, not only agreement between two implementations.

Retain: Independent derivation/QC evidence.

Resolve discrepancies and conformance findings; reconcile datasets, specifications and metadata before release.

Check: Unresolved endpoint, treatment, population or material lineage issues block approval.

Retain: ADaM review conclusion and release manifest.

The Programming Lead coordinates shells prepared from the approved SAP. For each output, identify its population, estimand or endpoint, statistic, denominator, display rules, footnotes and data source. Obtain statistical approval and documented programming feasibility review for Critical Outputs, with the validation method planned before production. The author shall not be the sole person approving both statistical content and feasibility for a Critical Output. Request Clinical, Medical, Safety, DM, Medical Writing or Regulatory review only where content, intended use, criticality or assigned responsibility requires that expertise.

Check: Approved shells and planned checks cover the output purpose and critical content.

Retain: Shell specification, statistical approval, feasibility review and validation plan.

Obtain the approved output shells/specifications and analysis data baseline. Give the author and independent reviewer the same version; confirm populations, denominators, statistics and labels.

Check: No affected programming proceeds on unresolved scientific requirements.

Retain: Version-confirmed shell/specification handoff.

Generate outputs using approved programs and data. Record program/output identity, run time and all relevant logs; inspect pagination, labels, footnotes and suppressed values.

Check: Output content and presentation match the approved specification.

Retain: Production outputs and execution logs.

Independently check key results against analysis data and methods, including denominators, rounding, missing data and figure/table consistency. Document review scope and discrepancies.

Check: A visually correct output is not accepted without numerical/scientific checks.

Retain: Output QC and result traceability record.

Reconcile the reviewed outputs with the final manifest and obtain the authorized approval. Use an approved-with-conditions status only if the adopted workflow defines it, and only for administrative or non-statistical matters. Record each condition, owner, due date, affected outputs and closure evidence. Close any condition affecting production execution before that execution; close conditions affecting validation, interpretation, blinding or release before the affected release.

Check: Scientific ambiguities or incorrect results block the affected output release.

Retain: Approved output package and conditions record.

For each released output, the TFL programmer records its identifier/version, analysis-data baseline, generating program/version, parameter or run context and relevant analysis/specification reference. Reconcile applicable results metadata with the output and obtain reviewer confirmation. Record authorized exclusions rather than inventing metadata requirements for an unsupported submission type.

Check: Each released result can be traced to its analysis inputs and generating code.

Retain: Output lineage and applicable results-metadata review.

The Programming Lead identifies the requested deliverables, intended use and criticality. Assign a production programmer, qualified reviewer and release approver; document permitted role combinations. Select independent programming, targeted derivation checks or another justified method for each output and agree acceptance criteria before execution. Record any shared code or dependencies so the review addresses common-mode errors.

Check: The plan defines review scope, method, independence and acceptance criteria before execution.

Retain: Validation scope and reviewer assignment.

The receiving programmer compares the transfer with the approved request: sender, study, source system, cut date/time and time zone, extraction rules, file names, versions, counts and available integrity checks. Preserve the received originals in the restricted input area. Quarantine an unexpected, incomplete or unauthorized delivery; obtain resolution from the data owner before use. Record acceptance separately from database freeze or lock.

Check: Accepted inputs match the authorized cut; receipt does not imply database lock.

Retain: Receipt manifest, integrity results and acceptance decision.

Read the transfer specification before importing. Set encoding, delimiter, quoting, line endings and variable types explicitly where relevant. Preserve leading zeros in identifiers and distinguish missing values from literal text. Verify date/time interpretation, time zone, units, character lengths and truncation using representative and boundary records. Compare imported counts and key values with the source; retain the import code and log.

Check: Import preserves the defined values and structure without silent conversion or truncation.

Retain: Import settings, source-to-import checks and log.

For a replacement or incremental delivery, identify the prior accepted version and the specified insert, update and deletion rules. Check keys and duplicates before merging; reconcile added, changed, removed and unchanged records. Test reprocessing behavior so the same delivery cannot silently duplicate records. Preserve the prior baseline and document which downstream work must be repeated.

Check: Delta handling follows the agreed rules and reconciles to the accepted baseline.

Retain: Delta reconciliation and downstream impact assessment.

Identify the approved specification, source baseline, code revision, reusable components, software versions and run parameters. Stage the candidate output separately from prior runs. Execute programs in dependency order using authorized access. Capture start/end time, execution status, complete logs and output identities, including failed runs; do not overwrite the only evidence of a failure.

Check: Every output can be tied to the actual run, inputs, code and environment.

Retain: Run manifest, dependency order, status and complete logs.

The reviewer reads the complete log and execution status, then traces relevant messages to the affected data and code. Assess errors, warnings, conversion notes, merge issues, missing/uninitialized variables, empty outputs, incomplete execution and model convergence where applicable. Check that files are newly generated for this run. Record the disposition and evidence for each relevant issue; a clean keyword scan alone is insufficient.

Check: No unexplained material log issue, failed fit, stale file or incomplete run remains.

Retain: Log review with message-level dispositions.

The reviewer inspects the code against the approved specification and confirms derivations, joins, filters, populations, treatment rules and dependency use. Perform the planned independent checks using the same accepted baseline. Check key uniqueness, required variables, unmatched records, missingness and counts before comparing values. Define justified numeric tolerances before evaluating results; compare unrounded values where needed and do not mask differences by dropping records or suppressing missing values.

Check: The comparison is complete and independent enough to detect incorrect shared logic.

Retain: Code review and independent QC results with comparison rules.

For each discrepancy, retain expected and actual results, affected versions, impact, owner and disposition. Correct source code or obtain an authorized source/specification correction; do not hand-edit the final output. Assess effects on related datasets, outputs and prior releases. Rerun affected work and have the reviewer verify the corrected result and necessary regression checks against the exact replacement version.

Check: Discrepancies and affected regression checks are closed on evidence.

Retain: Issue disposition, change impact and independent retest.

The release approver reconciles the final manifest with completed reviews and the intended use. Confirm required statistical decisions, blinding status, permitted recipients and closure of release-blocking issues. Approve the exact versions. Transfer through the authorized channel, obtain receipt or escalate failed delivery, and archive inputs, code, logs, QC and approvals with the release. Link superseded releases and notify affected recipients when a correction changes their authorized baseline.

Check: Only the reviewed version is released; custody, restrictions and supersession are traceable.

Retain: Final approval, transfer receipt and archive manifest.

For legacy or rescued data, inventory available source, specifications, code and metadata. Compare recovered records with an authoritative baseline where available; document missing provenance and tests that cannot be performed. Obtain statistical acceptance of the remaining limitations for the intended use before integration or release.

Check: Unresolved provenance or fitness limitations are explicit and do not disappear after conversion.

Retain: Recovery inventory, reconciliation and fit-for-use decision.

Inventory source studies/data and their provenance, permissions, design differences, collection methods and missingness. Ask scientific owners to assess fitness for the proposed analysis.

Check: Technical availability is not confused with scientific suitability.

Retain: Source fitness and integration assessment.

Specify harmonization, pooling, conversion and derivation rules. Record incompatible definitions and how they affect interpretation; obtain scientific approval.

Check: Differences are explicit and no unjustified equivalence is introduced.

Retain: Approved pooling/conversion strategy.

Run the conversion or integration and reconcile against retained originals. Independently test key values, counts and transformations; quantify information loss where relevant.

Check: Unexpected differences and loss are investigated with traceable disposition.

Retain: Conversion QC and remediation evidence.

Document limitations and remaining approved restrictions in the delivery record and reviewer information. Obtain acceptance from the receiving scientific owner.

Check: The delivered package states what it can and cannot support.

Retain: Integration release and limitation statement.

Confirm the charter, approved cut, output scope and named unblinded recipients. Verify role separation and access before opening restricted inputs.

Check: No blinded user can access treatment-revealing working files or outputs.

Retain: Firewall/access verification.

Produce the authorized outputs in segregated storage using the restricted baseline. Keep logs, output names and metadata within the same protection boundary.

Check: Restricted information is not copied into general trackers, email or shared folders.

Retain: Restricted run and package manifest.

Have an authorized independent reviewer verify results, masking, hidden metadata and final recipients. Obtain the designated unblinded release approval.

Check: Review and release occur entirely within authorized roles.

Retain: Restricted QC and approval.

Before transfer, reconcile the released output IDs, versions, cut, meeting/session and approved audience with the release manifest. Record each recipient, role, authorization and access restriction. If meeting participation is relevant, link the controlled attendance record or record only the attendees who received or accessed the outputs; do not create a duplicate general attendance sheet. Transfer through the authorized channel, record time and receipt, and reconcile delivery failures. For unintended disclosure, preserve the chronology and start containment and impact assessment.

Check: Receipt and any incident disposition are documented without exposing the data further.

Retain: DMC transfer receipt and incident record.

Before study use and after relevant changes, the blind custodian confirms the access matrix, communication routes, primary/backup contacts and emergency mechanism with site and system owners. Test an authorized emergency-access scenario without disclosing live allocations unnecessarily. Clinical Operations verifies site readiness and training evidence; DM verifies treatment-data restrictions; QA reviews significant failures and their disposition within authorized access.

Check: Blind protection, communication boundaries and emergency/backup access are demonstrably ready.

Retain: Blind-maintenance plan, access matrix and readiness test.

The authorized randomization specialist translates the approved allocation specification into a controlled sequence-generation method. A separate qualified reviewer verifies allocation ratio, strata, block handling where applicable, identifiers and reproducibility within restricted access. The designated statistical approver approves the sequence before controlled transfer to the allocation-system custodian; retain generation and receipt evidence separately from blinded records.

Check: Allocation conforms to the approved design and custody is established before use.

Retain: Restricted generation, independent verification, approval and custody evidence.

The blind custodian confirms the allocation custody agreement and authorized-role matrix. Define who may communicate each category of restricted content, to whom, by which secure route and where the record is retained. Before sending, check recipients, attachments, file names, hidden content and permissions; keep treatment-revealing information out of blinded minutes and general distribution lists. Authorized unblinded personnel follow these restrictions; DMC communications follow the charter. Refer suspected disclosure to the restricted incident route with QA review proportionate to impact.

Check: Custody and role separation are established before handling treatment information.

Retain: Blind-maintenance and access review.

Derive treatment variables only from the authorized allocation inputs and approved rules. Have a qualified independent restricted reviewer verify mappings and exceptions.

Check: Randomization/actual treatment distinctions follow the approved analysis plan.

Retain: Treatment-handling QC record.

For planned unblinded access or disclosure, the blind custodian records the rationale, affected study/activity, impacted vendor procedure or process if applicable, named authorized personnel, exact unblinded content, access location, effective date/time, closure criteria, approving role/function and required records. Obtain authorization before enabling access. Verify recipient permissions and the content to be disclosed, then retain actual access/disclosure evidence. At closure, verify the criteria, remove time-limited permissions and record the disposition of restricted material.

Check: Only authorized scope is disclosed and the planned event is fully traceable.

Retain: Planned blind-break authorization.

For emergency medical unblinding, the investigator or treating physician uses the tested study-specific mechanism immediately when treatment knowledge is needed for care. Confirm only the necessary allocation is disclosed. Record participant, reason, requester, executor, time, information revealed and subsequent notifications; administrative approval must not delay care.

Check: Emergency access and backup arrangements are available; care is not delayed and disclosure is documented.

Retain: Restricted emergency-unblinding event and notification record.

For accidental or suspected disclosure, the recipient stops further distribution, preserves access/transfer evidence and notifies the blind custodian through the restricted route. The custodian records what was disclosed, to whom and when. Obtain statistical/medical assessment of bias and participant impact, CDM/IT containment where applicable and QA assessment of significant process failure. Record affected activities, safeguards, required notifications and authorized closure; do not automatically apply the medical-emergency route.

Check: Disclosure extent and impact are assessed; corrective actions and remaining restrictions are documented.

Retain: Restricted accidental-disclosure assessment and closure record.

The submission programmer prepares applicable define metadata, annotated CRF and reviewer guides from approved specifications and released datasets. Reconcile variable origin, derivations, terminology and dataset relationships; explain relevant limitations and nonconformance dispositions. Obtain statistical/data-owner input for scientific content and regulatory confirmation of package requirements; independently review consistency before assembly.

Check: Required supporting documents are authored and reviewed against the actual deliverables.

Retain: Metadata/reviewer documents, scoped review and version approval.

Reconcile the final datasets with define metadata, annotated collection information and reviewer guides. Verify dataset/variable names, labels, types and derivations against the manifest.

Check: Metadata describes the actual delivered data and references resolve.

Retain: Metadata and guide QC.

Run the applicable conformance rules on the candidate package and record validator/tool version, rule set, date and input manifest.

Check: The validation report belongs to the exact package under review.

Retain: Validator execution record.

Investigate each finding with the relevant data/standards/scientific owner. Correct the package or record a justified reviewed explanation; rerun affected validation.

Check: Critical unexplained inconsistencies are not dismissed as tool noise.

Retain: Findings disposition and retest.

Assemble the final package, reconcile inventory and verify file/link readability. Obtain programming and applicable regulatory authorization before transfer.

Check: Final inventory matches the reviewed package and the receiving team accepts it.

Retain: Submission package approval and receipt.

Collect the released input, specification, program, log, QC, approval and output versions. Compare them with the final manifest and identify missing links.

Check: An independent person can follow the lineage from output back to authorized inputs.

Retain: Archive inventory and lineage check.

Capture software/package versions, dependencies, run order and required configuration without copying secrets into the archive index.

Check: Reconstruction information is sufficient and credentials remain protected.

Retain: Environment and reconstruction record.

Ask an authorized reviewer to retrieve a risk-based sample and reconstruct selected results in the approved environment. Record expected versus actual results and differences.

Check: Retrieval succeeds and material reproduction differences are resolved or explained.

Retain: Retrieval/reproducibility test.

Transfer archive custody with access restrictions, retention/hold requirements and ownership. Obtain acceptance before retiring working infrastructure.

Check: Required records remain readable and accessible for their retention period.

Retain: Archive acceptance and decommission handoff.

Record the requester, intended use, recipients, requested variables and permissions. Obtain authorized data-owner/privacy review before preparing an extract.

Check: Purpose and permitted scope are established; unnecessary data is excluded.

Retain: Data sharing authorization.

Apply the approved de-identification method to the authorized copy, including dates, rare attributes, free text and metadata as appropriate. Assess residual risk in the release context.

Check: Pseudonymized data is not labeled anonymous merely because names were removed.

Retain: De-identification specification and risk assessment.

Have an independent qualified reviewer inspect the exact outgoing package and test the defined disclosure checks. Correct failures and reassess utility and risk.

Check: No unexplained disclosure finding remains and recipient restrictions are documented.

Retain: Privacy QC and release approval.

Transfer through the approved channel under the applicable agreement, log the package and obtain receipt. Retain source custody and track permitted use/end-of-access obligations.

Check: Only the approved recipient receives the approved version.

Retain: Transfer, acknowledgment and access/retention record.