CRC SOP 08c Application validation, data base construction, security, back up, change control, close and lock V1 Page 1 of 4
THIS SOP REMAINS THE PROPERTY OF THE UCT FACULTY OF HEALTH SCIENCES
University of Cape Town
Clinical Research Centre
Standard Operating Procedures
Title
Application validation, data base construction, security, back up, change control, close and lock
Number
08c
Version
1
Name
Title
Signature
Date
Reviewer
Authoriser
Effective date
Review date
1. Purpose
To provide instruction to those data management team members delegated responsibility for validating the
clinical data management system (CDMS), constructing a database and ensuring its security and back-up
functions, change control, database close/lock and releasing data after the study.
2. Scope
The Clinical Research Centre (CRC) will advise whether this document is mandatory for research where UCT’s
Faculty of Health Sciences (FHS) is the named sponsor or where CRC facilities are used (CRC SOP 02). This SOP
may, however, also be adapted for use for studies conducted by UCT clinical researchers where UCT is not the
sponsor.
3. Templates/forms
CRC 08c.1
Data specification review form
CRC 08c.2
Database review form
CRC 08c.3
Database back-up log
CRC 08c.4
Database lock form
4. Glossary/definitions
Clinical Research Centre (CRC)
A centre located in UCT’s FHS that provides advice and services to researchers in order to produce high quality
clinical research. The CRC may agree to take on the role of sponsor for specific studies should certain criteria be
fulfilled.
Printed copies of this SOP should be checked against the original version on the CRC website (www.crc.uct.ac.za)
CRC SOP 08c Application validation, data base construction, security, back up, change control, close and lock V1 Page 2 of 4
THIS SOP REMAINS THE PROPERTY OF THE UCT FACULTY OF HEALTH SCIENCES
Master File
Files for each project containing key documents (such as Essential Documents for clinical trials). The Master File is
in two parts – a Sponsor File and Investigator Site File (ISF).
5. Responsibilities and procedure
5.1. The Principal Investigator (PI) will delegate responsibility for the validation of the application,
development of the database specifications and database construction to an appropriately experienced
data manager or contractor(s). Wherever possible, and when necessary, the CDMS will be validated
according to a validation plan, and documented evidence of the validation will be provided in the
installation, operating and performance certificates. The database should be constructed prior to the
first participant enters the study. The database specifications will include at least the following fields:
database variable name; source document/case record form (CRF) variable name; variable type; allowed
values. The database specifications will be tested against the source document,, CRF and protocol, and
the test results will be documented on a Database specification review form (CRC 08c.1).
5.2. Database construction will commence once database specifications' tests have been completed and
corrections made. The database will be constructed using the tested database specifications. During
construction, performance of the database will be tested using dummy CRF data or participant data if
this has been recorded prior to database construction; these are entered and then manually compared
with the data from the CRFs. The results of the database test will be documented on a Database review
form (CRC 08c.2) which will be signed/dated and retained in the Master File (MF). The test database is
archived to disc with status set to locked. It is recommended that any changes required during database
construction are made by a different person to whoever is testing the dummy data. Internal edit checks
may be programmed according to eligibility criteria and out-of-range values (including dates) etc. Edit
checks and error messages that fire automatically once the data is entered into the database will be
tested and results documented on CRC 08c.1. It is recommended that an audit trail be implemented
within the database structure to document data entries and changes. Once the database has been
released for data-entry, data entry personnel, specifically, may not be able to make changes to its
structure (such as subsequent programming of coding variables for statistical analysis).
5.3. During the study the database will be stored on a suitable shared drive at UCT, preferably maintained by
UCT Information and Communication Technology Services (ICTS), which has been restricted to certain
members of the study team or hosted on the UCT server in a controlled environment. It will be protected
by a user logon and password only available to those members of the team designated as directly
involved in data entry or supervision of data management functions; such personnel will be assigned
Printed copies of this SOP should be checked against the original version on the CRC website (www.crc.uct.ac.za)
CRC SOP 08c Application validation, data base construction, security, back up, change control, close and lock V1 Page 3 of 4
THIS SOP REMAINS THE PROPERTY OF THE UCT FACULTY OF HEALTH SCIENCES
privileges relating to specific functions (CRC SOP 08a). Data management personnel should be aware of
the importance of data privacy.
5.4. During the study, any changes to the protocol that would impact on data collected in the database,
including but not limited to changes in the inclusion/exclusion criteria, additional visits, safely laboratory,
will be subject to a new version release. The additional data requirements will be included in the data
specifications; these will be reviewed and accepted before the changes are included in the database. The
additional data items will be added to the database and tested in a test environment; the additional data
items will be tested, and once the additional data items have been accepted as validated, the new
release of the database will be deployed. The database specifications and database will be given a new
version, the old version of the production database status will be set to locked, and training will be
provided to data entry personnel as necessary. Each version of the database will be indicated by the
study name and the date.
5.5. If applicable, the data entry clerks or the data manager will ensure that data are backed-up daily after
working on the database: A copy of the day’s database will be made and stored as back-up in the data
base back-up folder in the study-specific SharePoint library. Previous versions of the database will also be
placed in an archive folder in the study-specific SharePoint library, leaving only a current version in the
network-drive current database folder. If the database is hosted on the UCT server the back-up will be
according to UCT standard internal procedures.
5.6. If applicable, and the database is not able to be backed-up in SharePoint, the database will be backed-up
on the network in a study-specific folder for back-up. In addition, the database is also backed at least
weekly during data entry to a removable storage device(s) kept in a secure off-site location for the
duration of the study, as determined by the PI.
5.7. If applicable, a log of the database back-up will be maintained (CRC 08c.3).
5.8. If applicable, data management personnel will check security and integrity of the back-up process
periodically by checking that the current removable storage back-up database may be copied onto
his/her C drive. This process will also be documented on the above log.
5.9. Should data-entry need to be conducted outside of UCT, the PI will authorise a specific SOP to ensure that
data integrity is maintained.
5.10.
Should other members of the study team require access to the database (other than as part of
electronic CRF data entry), a read-only copy will be made available as documented in a file note or the
data will be exported as a SAS file and imported into STATA for analysis/reporting. Integrity of blinded
information will be ensured by following the procedure detailed in the data management plan specific to
the study. All data released should be date and time stamped and stored in a data export folder in a
study-specific SharePoint library maintained by UCT ICTS. The original data extract will remain in this
Printed copies of this SOP should be checked against the original version on the CRC website (www.crc.uct.ac.za)
CRC SOP 08c Application validation, data base construction, security, back up, change control, close and lock V1 Page 4 of 4
THIS SOP REMAINS THE PROPERTY OF THE UCT FACULTY OF HEALTH SCIENCES
folder, and those that requested the data may copy the data extract. Should a statistician or other
designated team member need full access, this will be made available under documented conditions
approved by the PI. Any changes to that version of the database (e.g. processing of data for statistical
analysis) will be documented such that it is possible to compare the original data and observations with
the processed data.
5.11.
The data manager will follow the following procedure for database close and lock.

All fields will be checked for completeness.

Any queries generated from this process will be validated against source documents and data
changes made using a data clarification form (DCF: CRC SOP 08b).

If applicable, investigator signatures are present.

All serious adverse events (SAEs) have been reconciled.

All third party data has been uploaded and validated, all outstanding upload issues resolved.

All coding has been completed.

Any unresolvable queries have been explained and documented.
Database lock

The database will be locked once all the above conditions have been met, and a database lock
document (CRC 08c.4) will be signed by the data manager and the PI.
Post-database lock

If applicable, all access will be disabled by changing the start window and the database given a
password or user access will be terminated.

If applicable, the password will be written down and locked in a secure location by the data
manager.

Read-only copies of the locked database will be given to the PI and stored in the MF, or datasets
will be exported as SAS files to STATA. The STATA datasets will be archived to disc once the final
report has been signed off as complete.

If applicable, a read-only copy of the database/STATA datasets will be stored in a study-specific
library in SharePoint.
5.12.
All documentation relating to data management for a study will be filed in the MF.
6. Document history:
Version No.
Date
Reviewer
Details of changes
Printed copies of this SOP should be checked against the original version on the CRC website (www.crc.uct.ac.za)