The Safety Reconciliation

Part of Clinical Data Management and Integrity: External Data and Reconciliation.

About 5 minutes. Free, in your language, no account needed.

Why this matters

Serious adverse events exist in two systems, and they get there by different routes.

The site reports the event to the sponsor's safety function, usually urgently, on a form, against a regulatory clock. The site also records the event in the clinical database as an adverse event, in the ordinary course of data entry.

Two entries, two routes, two moments, frequently two people. They describe the same event and they disagree more often than anyone expects.

This reconciliation is the one that matters most, because the safety database drives regulatory reporting and the clinical database drives the analysis, and a disagreement between them means one of those two is built on something the other contradicts.

What must match

That the event exists in both. An event in safety and not in the clinical database, or the reverse, is the most serious category.

The onset date, which drives the reporting clock and the treatment-emergent determination.

The reported term, which drives the coding and therefore every frequency table the study produces.

The seriousness criterion, which determines whether expedited reporting was required at all.

The outcome and the resolution date.

The causality assessment, which determines whether the event was reportable as a suspected reaction.

Why they diverge

Understanding the causes tells you where to look.

Timing. The safety report is made within hours of awareness; the clinical entry may be days or weeks later. In between, the clinical picture develops, and the later entry reflects a better understanding. That is not an error, and it must still be reconciled, because the safety report may need updating.

Different people. The safety form is often completed by the investigator, the clinical entry by the coordinator, from the same source, with different emphasis.

Different granularity. The safety system may capture one event where the clinical database captures three, because the site recorded the presenting symptom, the diagnosis and a complication separately.

Follow-up asymmetry. Safety follow-up updates the safety database. Whether the corresponding clinical record is updated depends on a process that frequently does not exist.

Counting is not reconciling

This deserves stating on its own, because it is the most common way a reconciliation that runs faithfully for years detects nothing.

Comparing the number of serious events in each system confirms that the same number of things exist in two places. It is entirely compatible with them being different things, with one system holding events the other does not and vice versa in equal number.

A real reconciliation matches record to record, on participant and event, and compares the fields that matter.

In practice

A data manager runs the first line-by-line safety reconciliation on a study 14 months in, having inherited a process that compared counts monthly and had always matched.

The comparison finds: two events in the safety database with no clinical database counterpart, one event in the clinical database flagged serious with no safety report, eleven onset date differences ranging from one to nine days, and three where the reported term differs materially, including one recorded as "cardiac failure" in safety and "dyspnea" in the clinical database.

The single event with no safety report is the serious finding. It was flagged serious in the clinical database and no expedited report was ever made, which is a reporting failure with a regulatory consequence, discovered 14 months late.

The counts had matched every month because a different event existed in safety without a clinical counterpart, offsetting it exactly.

What this looks like when it goes wrong

A participant experiences a serious event. The site reports it to safety with an onset of 3 June and enters it in the clinical database with an onset of 28 May.

The safety report was made on 4 June, within the required window of the 3 June date.

The clinical database says the event began on 28 May, which puts the sponsor's awareness in question and the report potentially outside the window.

Neither date is obviously wrong. The 28 May date reflects when symptoms began; the 3 June date reflects when the event met the seriousness criterion by requiring hospitalization. Both are defensible and the two systems recorded different things under the same label.

At inspection, the sponsor is asked to explain a serious adverse event whose two records disagree on onset by six days, with a reporting clock that depends on the answer.

The explanation is available and nobody had written it down, because the discrepancy was never surfaced. A line-by-line reconciliation would have raised it within a month, and the explanation recorded then would have been contemporaneous rather than reconstructed under pressure.

Key takeaways