CPEDC cheat sheet

ICH E6 Good Clinical Practice governs trial conduct; E6(R2) added risk-based monitoring and quality management requirements.

21 CFR Part 11 defines criteria for electronic records and electronic signatures to be trustworthy, reliable, and equivalent to paper.

21 CFR Part 312 (IND) governs investigational new drug obligations, including safety reporting timelines.

ICH E2A defines serious adverse event (SAE) criteria: death, life-threatening, hospitalization, disability, congenital anomaly, or other significant hazard.

ICH E2B specifies the electronic transmission standard (E2B(R3)) for individual case safety reports.

HIPAA Privacy Rule governs protected health information use and disclosure; de-identification requires removal of 18 identifiers.

ALCOA+ principles: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available.

ICH E8(R1) establishes quality by design; critical-to-quality factors drive protocol and data decisions.

ICH M11 enables a single protocol format (CDISC USDM-derived) for multi-region submissions.

EDC systems require unique user IDs, role-based access, and automatic session timeouts to meet Part 11.

An audit trail must capture who, what, when, and why (for changes) and be computer-generated, time-stamped, and immutable.

Electronic signatures require two distinct components (e.g., ID plus password) and must record signer name, date/time, and meaning.

Data entry screens should enforce edit checks at point of entry to reduce downstream query volume.

System architecture should separate presentation, application, and database layers to support validation and security controls.

Database builds should support protocol versioning so amendments do not corrupt prior data versions.

EDC must support both paper-source transcription and direct-entry (eSource) workflows with appropriate source documentation.

Interfaces to external systems (labs, IRT/RTSM, ePRO) require documented mapping and reconciliation processes.

CRF design should match protocol endpoints; each field should map to a protocol objective or safety requirement.

CDASH provides standard CRF field names and structures to align with SDTM submission variables.

Controlled terminology (CDISC CT) should be used for coded fields to support downstream SDTM mapping.

Edit check specification should define type (range, format, logic), timing (entry, save, batch), and query text.

Database build requires documented UAT (user acceptance testing) with test scripts and sign-off before go-live.

Version control of the build (eCRFs, edit checks, derivations) should be maintained with change logs.

Skip logic and dynamic forms should be validated to prevent missing required data.

Data dictionary should define each variable's name, label, type, format, and code list.

Validation types: hard edit checks block save; soft edit checks raise queries but allow entry.

Query lifecycle: auto-generated or manual query → site response → resolution → close; each step time-stamped.

Query aging metrics (open query count, median days open) are key trial oversight indicators.

Discrepancy management should classify queries by type (missing, inconsistent, out-of-range, illegible).

Source data verification (SDV) confirms CRF entries against source; risk-based monitoring targets critical variables.

Data entry guidelines should specify who enters, when, and how corrections are documented with reason for change.

Queries should reference the specific field and rule violated to enable efficient site resolution.

Medical coding (MedDRA for AEs, WHO Drug for concomitant meds) is performed after data cleaning.

Data cleaning includes range checks, consistency checks, cross-form checks, and free-text review.

Reconciliation compares internal data (EDC) with external sources (labs, IRT, ePRO) and documents discrepancies.

SAE reconciliation matches EDC AE data against the safety database to ensure consistency.

Serious adverse events must be consistent between clinical and pharmacovigilance databases before database lock.

Outlier detection and statistical review support data quality assessment prior to analysis.

Data quality metrics include query rate per CRF page, SDV findings, and protocol deviation rates.

Reconciliation should be documented with dates, responsible parties, and resolution status.

Free-text fields require review for consistency and potential coding (e.g., AE verbatim terms).

Role-based access control (RBAC) restricts users to functions required for their role (e.g., investigator, CRA, data manager).

Unique user IDs must not be shared; accounts must be deactivated upon role change or termination.

Audit trails must be retained for at least as long as the underlying records and be available for inspection.

Password policies should enforce complexity, expiration, and lockout after failed attempts.

Data in transit should be encrypted (TLS); data at rest should be encrypted per organizational policy.

Audit trail review should be documented periodically to detect unauthorized changes.

System administrators should not have routine access to clinical data (segregation of duties).

Backup and disaster recovery plans must be tested and documented.

Computer system validation (CSV) follows a lifecycle: planning, specification, verification, and reporting.

GAMP 5 categories systems by risk and complexity (Category 1 infrastructure through Category 5 custom code).

Validation deliverables include URS, FS, IQ, OQ, PQ, traceability matrix, and validation summary report.

Change control requires impact assessment, approval, testing, and documentation before implementation.

Emergency changes require retrospective documentation and approval within a defined window.

Periodic review of validated systems confirms continued validated state.

Vendor audits and qualification (e.g., SOC 2, ISO 27001) support supplier assessment.

Validation must be risk-proportionate; critical functions require more rigorous testing.

Data Management Plan (DMP) documents processes, roles, systems, and timelines for the study.

Essential documents must be retained per ICH E6 (Section 8) and applicable local regulations.

Database lock requires documented evidence that all queries are closed, data cleaned, and reconciliation complete.

Database lock sign-off typically involves data management, statistics, clinical, and medical monitor.

Archival must preserve data, audit trails, metadata, and documentation in a retrievable format.

Transfer of data to statistics should follow a documented specification (e.g., SDTM or ADaM).

Closeout documentation includes final DMP, validation reports, query logs, and reconciliation records.

Post-lock changes require documented unblinding/unlocking procedures with approvals and audit trail.