Practical checklist

Clinical Research Data Quality Readiness Checklist

Use these checks before study go-live and during controlled review. Adapt each item to the protocol, sponsor, ethics and regulatory requirements.

CRF and data design

1. Every variable maps to a protocol objective, eligibility rule, safety need or operational purpose.
2. Field labels, units, formats, controlled terms and missing-value conventions are defined.
3. Visit schedules, repeat events and unscheduled data are represented clearly.
4. Branching and skip logic have expected and exception test cases.
5. Identifiers minimise personal data while preserving authorised linkage.

Validation and release

6. Edit checks are traceable to approved requirements.
7. Critical calculations and derived fields have independent expected results.
8. User-acceptance testing covers each role, device and material workflow.
9. Defects have severity, owner, resolution and retest evidence.
10. The released form/database version and change-control route are recorded.

Access and security

11. Each user has a unique account and least-privilege role.
12. Privileged access and inactive accounts have a review schedule.
13. Transport, exports and backups follow the approved data classification.
14. Secrets and credentials are not embedded in analysis or application code.
15. Incident contacts and escalation steps are known to the team.

Queries, monitoring and reconciliation

16. Query creation, response, review and closure responsibilities are defined.
17. Completeness, timeliness, query ageing and site variation have agreed definitions.
18. External data and safety/laboratory records have reconciliation rules.
19. Reports state numerator, denominator, refresh date and exclusions.
20. Thresholds trigger a documented action rather than a dashboard colour alone.

Closeout and evidence

21. Backup success is monitored and a representative restore has been tested.
22. Data transfers and final extracts have format, checksum and acceptance controls.
23. Soft-lock and hard-lock criteria, exceptions and approvers are documented.
24. Audit logs, dictionaries, validation evidence and decisions are archived.
25. Retention, lawful deletion and customer handover responsibilities are agreed.