Why this matters
A database lock marks the point where analysis may proceed because the study data are complete, reviewed, and no further changes are allowed except through a documented, approved unlock. In a blinded study, treatment codes are released only after lock. A rehearsal (mock cut) is the cheapest way to surface last‑mile issues: lingering reconciliations, missing signatures, version drift, or surprises in listings/tables. The ceremony records who approved what, when, and preserves everything needed to reproduce the final datasets.
Plain‑English glossary (terms used below):
- EDC: Electronic Data Capture system.
- LPLV: Last Patient Last Visit, the last visit of the last subject in the study.
- DM: Data Manager.
- Stats/Biostats: Biostatistics team.
- PV/MM: Pharmacovigilance / Medical Monitor.
- SAE: Serious Adverse Event.
- ClinOps: Clinical Operations.
- CCG: CRF (Case Report Form) Completion Guidelines.
- DMP/DVP: Data Management Plan / Data Validation Plan.
- External data: Data generated outside the EDC (e.g., central labs, ECG, imaging, electronic patient‑reported outcomes (ePRO), devices).
- Freeze vs lock: A freeze makes data read‑only until DM lifts it; the lock removes every role’s edit rights and is reversed only by an approved unlock.
- Checksum/hash: A short fingerprint of a file used to confirm it hasn’t changed.
Rehearsal (mock cut)
Think of this as a dress rehearsal for lock. You run the full play with “near‑final” data and systems, then fix what breaks.
Dry‑run extract Pull the complete set of near‑final datasets from the EDC and external sources. Include raw (“as‑received”) and curated/analysis‑ready layers if your process creates both.
Gate check Confirm critical gates are truly green:
- Externals reconciled: Every expected external record is matched to the CRF (or justified).
- Medical coding & adjudication complete: All terms coded and QC’d to fixed dictionary versions (e.g., MedDRA/WHODrug), and every required adjudication decision final.
- Critical open issues = 0: No open critical queries, protocol deviations pending classification, or unresolved endpoint flags. Non‑critical items have a documented plan.
Reproducibility test Rerun derivations (any computed fields or datasets) with frozen algorithm + dictionary versions. Run them twice on the same frozen snapshot: row counts and checksums must be identical (same inputs + same versions = same outputs). Against the last known‑good run, every difference must be traced to a data change or an approved version change.
Outputs for human review Generate draft listings, tables, and figures (as they would be delivered) to catch outliers, formatting defects, or population mis‑counts. In a blinded study, use dummy treatment codes so the rehearsal unblinds no one. Rehearse the audit trail snapshot: can you export and filter important change events within the lock window?
Actions & timing Build a visible burndown of remaining tasks with owners and dates. Based on rehearsal results, set (or re‑confirm) the lock ceremony date and pre‑lock cut‑off times.
Lock ceremony (the real thing)
A short, scripted event with clear roles and evidence capture. For the final lock it runs after LPLV on the final data, once every gate is re‑checked on those data, including: all queries closed, source verification complete per the monitoring plan, investigator signatures in place after the last data change.
Freeze
- Put EDC and integrated systems into read‑only (or equivalent controls).
- Lock derivation code and dictionary versions (tag in version control and record exact commit + tool versions).
- Disable job schedulers that could mutate data.
Sign‑offs (with timestamps & meaning)
- DM: Data complete, reviewed, reconciled to plan (DMP/DVP).
- Stats: Analysis‑readiness, population definitions, and derivations fit‑for‑use.
- PV/MM: Safety reconciliations and SAE status final.
- ClinOps/Study Lead: Source verification complete per the monitoring plan; investigator signatures in place (site close‑out usually follows lock). Capture signatures in system or via validated e‑signature. Each approval should state what was reviewed and the scope (e.g., “all randomized subjects’ data through LPLV”). Together these signatures form the written lock approval (the sponsor’s SOP names the signatories, typically at least data management, biostatistics and a clinical/scientific representative). Only then does DM apply the lock, removing edit rights for every role.
Final extracts Produce final datasets and compute checksums. Label every artifact with study ID, cut date/time (UTC), and version tags for code, dictionaries, and transformation pipelines.
Archive the evidence Save as‑received externals, mapping specs, derivation catalog, test evidence, audit trails, and signed approvals in a readable long‑term format (e.g., CSV/Parquet + PDF/TXT for logs, not just proprietary binaries).
Communicate Issue a lock notification with a version manifest: what was frozen (systems + versions), what files were produced (names + checksums), and who signed off.
If an error surfaces after lock: the EDC blocks every edit. A correction needs a documented, approved unlock of the affected records only: the site corrects its EDC data with a reason for change (a vendor corrects and re‑sends its own data), the investigator re‑signs, the database is re‑locked on fresh approval, and extracts, checksums and manifest are re‑issued as a new version.
Artifacts to archive
- Plans & conventions: DMP, DVP, CCG, coder conventions, reconciliation SOP/work‑instructions.
- Derivation catalog: For each derived value/dataset—algorithm name + version, inputs, owner, and audit of changes. Include test cases and results.
- Audit trails: The complete audit trail for the whole study, kept with the data it belongs to. Add a targeted review extract for key domains around lock (e.g., −7 to +2 days), and system access/user logs.
- Final data & fingerprints: Final datasets with checksums, plus any mapping specs (CRF → SDTM/ADaM, the CDISC tabulation and analysis datasets, or curated layer).
- Reconciliation logs: What was expected, received, matched, and justified; final SAE reconciliation report.
- Version manifest: Exact versions for EDC, code repos/commits, dictionaries, and toolchains.
Worked examples
Below are self‑contained scenarios you can read on their own.
Example A — Phase 3 oncology study, EDC + central lab + ePRO
Context: 600 subjects; EDC is the main data capture system. External data: central lab results and ePRO (electronic patient‑reported outcomes).
Rehearsal (week −6 relative to LPLV; figures are for data due to date):
- Pull near‑final EDC, lab, and ePRO.
- Gate check: lab expected vs. received = 100% matched; ePRO completion 96% with 4% justified (missed entries documented).
- Reproducibility: ADaM derivations re‑run with MedDRA 26.1 and WHODrug March 2025—two runs of tag derive‑ae‑v1.3 on the same snapshot give identical hashes; the differences from the previous tag are traced to its approved bugfix.
- Findings: a visit window rule excluded 12 late labs; Biostats confirms the rule matches the statistical analysis plan (SAP), and the subjects remain analyzable.
- Action: record the window rule, with examples, in the derivation catalog and reference it from the DVP.
Ceremony (after LPLV, gates re‑checked on the final data):
- Set EDC to read‑only; disable ePRO backfill jobs.
- DM, Stats, PV/MM, and ClinOps sign off with scope “all randomized subjects through LPLV (2025‑08‑02 23:59 UTC).” DM then applies the lock.
- Final datasets produced; SHA‑256 checksums recorded; version manifest lists EDC build tag edc‑2025.05.30 (unchanged since the rehearsal), derivation repo commit a1b2c3d, MedDRA 26.1, WHODrug March 2025.
- Archive includes as‑received lab CSVs, ePRO exports, mapping specs, audit trail PDFs, reconciliation logs, and signed approvals.
Example B — Device study with continuous sensor data
Context: 120 subjects wearing a device that streams minute‑level data; curated daily aggregates feed the EDC.
Rehearsal (week −8 relative to LPLV):
- Confirm time‑zone normalization from sensor → curated layer (all UTC).
- Reproducibility: rerun aggregation code agg‑v2.4; row counts per subject/day match, but two runs on the same snapshot give different hashes for some daily files: a daylight‑saving edge case in the code. The fix is released as agg‑v2.5, tested and approved; repeat runs of v2.5 give identical hashes.
- Gate check: 2 subjects with device swaps—traceability tables show proper device→subject linkage.
Ceremony:
- Freeze ingestion pipeline at the agreed cut‑off; data arriving later are logged, not loaded.
- Sign‑offs captured and the lock applied; final “as‑received” sensor files (compressed CSV) plus curated aggregates and EDC extracts archived with checksums.
- Version manifest links pipeline commit, Docker image digest, and OS/runtime versions to ensure future reproducibility.
Pitfalls & misconceptions
- Changing derivations without a version bump Even a one‑line fix is a new version. Record impact, rerun tests, and re‑approve.
- “UAT covers it” misconception User Acceptance Testing proves the system works as specified; you still need fitness‑for‑use evidence that derivations and integrations produce the right study outputs under real conditions.
- Skipping rehearsal Missing signatures or an overlooked reconciliation then surface on lock day, forcing delay or risky exceptions.
- Only archiving final datasets Without as‑received externals, mapping specs, and audit trails, you cannot defend lineage or reproduce results.
- Relying on filenames as evidence Filenames can lie. Checksums + manifests are what auditors trust.
Practice in the wild (checklist)
- Run a first mock cut 6–8 weeks pre‑LPLV (Last Patient Last Visit), repeat it nearer lock if the findings were significant, and log every finding with an owner and due date.
- Freeze versions: derivation code, pipelines, and dictionaries tagged; capture approvals stating scope and meaning.
- Produce final datasets and compute checksums; export the complete audit trail plus a review extract for key domains and the lock window.
- Archive a complete lock package: as‑received externals, mapping specs, derivation catalog + tests, reconciliation logs, signed approvals, and the version manifest.
- Issue a concise lock notice to stakeholders listing artifacts and where they are stored.
Key points to remember
- Treat lock as a two‑act process: rehearsal → ceremony (freeze → sign‑off → extract → archive). The lock is applied once the sign‑offs are complete, before the final extract.
- Rehearsal goals: confirm gates (externals reconciled; coding/adjudication final; zero critical issues), prove reproducibility with version‑locked algorithms/dictionaries, generate draft outputs for human review, snapshot audit trails, and drive a burndown with owners/dates to a firm ceremony date.
- Freeze controls before approvals: set EDC/integrations to read‑only, lock derivation code and dictionary versions (record exact tags/commits), and disable any jobs that could mutate data.
- Sign‑offs must carry scope and meaning (what was reviewed, through which cut/date) and be captured with authenticated timestamps.
- Reproducibility evidence = stable inputs + versioned derivations + identical counts/checksums (on the same snapshot; differences from an earlier run are traced to a data change or an approved version change).
- Minimum lock package (archive): final datasets with checksums; the complete audit trail plus a review extract around the lock window; derivation catalog (versions + test evidence); as‑received externals; mapping specs; reconciliation logs; signed approvals; and a version manifest listing EDC build, code commits, dictionary and toolchain versions.
- Remember: UAT ≠ fitness‑for‑use—you still need study‑specific evidence that integrations/derivations produce the right outputs under real lock conditions.
- Every derived value must reference the exact algorithm/version used; filenames alone are not evidence—checksums + manifests are.
- Issue a concise lock notice that states what was frozen, what files were produced (names + checksums), where they are stored, and who approved.
- After lock nobody can edit: a correction needs a documented, approved unlock, then re‑signature, re‑lock and re‑issued extracts.
- The DM‑authored DVP frames the checks and reviews that lead to a defensible, reproducible lock.
- Well‑prepared studies often lock within days of LPLV once rehearsal findings are closed and gates are truly green.