Clinical Data Management Basics: CRFs, EDC and Data Cleaning

Clinical data management (CDM) is the process of collecting, cleaning and controlling clinical trial data so that it is complete, accurate and ready for analysis. It runs from protocol review and case report form (CRF) design through database build, edit checks, query management and medical coding to database lock.

Weak data management shows up late and expensively: unresolved queries delay lock, inconsistent coding distorts safety tables and missing audit trails become inspection findings. Good CDM protects the trial's conclusions and its participants.

The table summarises the CDM life cycle, stage by stage.

Start-up: protocol review and CRF design

Data managers review the protocol to understand which data answer the study objectives and keep participants safe. In line with the risk-based approach of ICH E6(R3), the focus is on critical data: eligibility, primary and key secondary endpoints, safety events and investigational product exposure.

The CRF, now usually an electronic CRF (eCRF) in an electronic data capture (EDC) system, should collect what the protocol needs and nothing more. Good design uses standard modules, clear labels and coded responses. The data management plan records how data will be collected, cleaned, coded, reconciled and locked, and who is responsible for each step.

CDISC standards: CDASH and SDTM

The Clinical Data Interchange Standards Consortium (CDISC) publishes standards used across the industry. CDASH standardises how data are collected on CRFs, and SDTM standardises how they are tabulated for submission. Designing CRFs with CDASH makes SDTM conversion smoother, and regulators including the US FDA and Japan's PMDA expect submission datasets in CDISC formats.

Database build, edit checks and validation

Edit checks are programmed rules that flag missing, out-of-range or inconsistent data, such as a visit date before the consent date or a systolic blood pressure entered as 1200. Before go-live, the team runs user acceptance testing (UAT) with test data against written scripts and keeps the evidence.

The EDC system itself must be validated and fit for purpose. In the US, 21 CFR Part 11 sets requirements for electronic records and signatures, including system validation, secure computer-generated audit trails, access controls and signature controls. ICH E6(R3) adds expectations on data governance and computerised systems, including traceability and confidentiality across the data life cycle.

Conduct: data entry, queries and cleaning

Site staff enter data into EDC from source records. When an edit check fires or manual review finds a problem, a query goes to the site, which answers it and corrects the data if needed, and the data manager then closes it. The audit trail records who changed what, when and why.

Manual review catches what automated checks miss, such as an adverse event treated with a medication that never appears on the concomitant medications page, or a site recording identical vital signs at every visit. Query wording matters:

• Weak: Please change systolic BP to 120.
• Strong: Systolic BP at Visit 3 is recorded as 1200 mmHg. Please check against source and correct or confirm.
• Rule: ask a specific, neutral question and never lead the site to an answer

Coding and reconciliation

Medical coding with MedDRA and WHODrug

Free-text terms are coded to standard dictionaries so they can be grouped and analysed. MedDRA (Medical Dictionary for Regulatory Activities) is used for adverse events, medical history and indications, and WHODrug Global for concomitant medications. Coders select the most accurate MedDRA lowest level term, which links to a preferred term and system organ class, and query vague verbatim terms such as pain with no location. The MedDRA version and coding conventions should be fixed in the DMP.

SAE and external data reconciliation

Serious adverse events are reported to the safety database on expedited timelines and also recorded in the clinical database. SAE reconciliation compares the two on key fields, such as event term, onset date, seriousness and outcome, and resolves differences before lock. External data, such as central laboratory results, ECGs and randomisation data, are reconciled against agreed transfer specifications.

Database lock

Before lock, the team confirms that expected data are entered, queries are closed, coding is approved, reconciliations are signed off and investigator signatures are in place. Many teams run a soft lock or freeze first, then a hard lock after sign-off from data management, biostatistics, clinical and safety leads. After lock, edit access is removed and any change requires a documented database reopening procedure. In blinded trials, the randomisation code is released only after lock.

Roles and career entry

Entry roles include clinical data associate or coordinator, medical coder and EDC or clinical programmer. Life sciences, pharmacy and nursing graduates are commonly hired; attention to detail, spreadsheet skills and some SQL or SAS help. Progression runs to data manager, lead data manager and project lead, and the Society for Clinical Data Management (SCDM) offers a professional certification for experienced practitioners.

Worked example: locking a phase II database in Bengaluru

A CRO data team in Bengaluru supports a 12-site, double-blind phase II asthma study.

Eight weeks out, the lead data manager starts a lock tracker. Each week the team reviews open queries by site, asks the CRAs to follow up with the two slowest sites and runs listings of missing visits and protocol deviations. The medical coder works through the remaining uncoded adverse event terms, querying chest discomfort after inhaler use for more detail before coding.

SAE reconciliation finds three mismatches: two onset dates and one outcome recorded as recovering in EDC but recovered in the safety database. The sites check source and the data are corrected. Central lab data are reconciled against the transfer specification, and one missing transfer is re-sent.

With queries closed, coding approved and investigator signatures complete, the team applies a soft lock and holds a final data review with biostatistics, clinical and safety. Sign-offs are documented, the hard lock is applied, and only then is the randomisation code released.

Common mistakes

• Collecting data the protocol does not need, which adds queries and site burden
• Releasing edit checks without proper UAT
• Writing leading queries that suggest an answer
• Coding inconsistently across studies or MedDRA versions
• Leaving SAE reconciliation until the week of lock
• Changing locked data without a documented reopening procedure

Key takeaway: Clean data at lock is built from day one: a focused CRF, tested edit checks, neutral queries, consistent coding and reconciliation done throughout the study, not in the final week.

Frequently Asked Questions

What does a clinical data manager do?

A clinical data manager makes sure trial data are complete, accurate and ready for analysis. The role covers CRF design input, the data management plan, database build and testing, edit checks, query management, coding oversight, reconciliation with safety and external data, and database lock. They work closely with CRAs, sites and biostatisticians.

What is the difference between a CRF and an eCRF?

A CRF is the form, paper or electronic, that captures the protocol-required data for each participant. An eCRF is the electronic version built in an EDC system. eCRFs allow automated edit checks at entry, faster query handling and a built-in audit trail, which is why most trials now use them instead of paper.

What is database lock in clinical trials?

Database lock is the point at which the clinical database is closed to further changes so the final analysis can begin. Before lock, queries are resolved, coding is approved, reconciliations are complete and sign-offs are documented. In blinded trials, unblinding happens only after lock, which protects the integrity of the results.

Why are MedDRA and WHODrug used in clinical trials?

They turn free-text terms into standard codes. MedDRA codes adverse events, medical history and indications, and WHODrug codes medications. Standard coding lets safety and efficacy data be grouped, compared and reported consistently across sites, studies and regulatory submissions, using the dictionary versions fixed in the plan.

Do I need programming skills for clinical data management?

Not for entry roles such as clinical data associate, where accuracy, EDC familiarity and clear communication matter most. Programming skills such as SQL or SAS become important for edit check programming, custom data listings and clinical programming roles, and they broaden later options.

Next steps

Build the foundations with Clinical Research & GCP Essentials and Data Integrity & Computerised System Validation, both delivered online by Innoryx to learners in India and the GCC.

Then read ALCOA+ data integrity explained, ICH GCP E6(R3): a beginner's guide and the pharmacovigilance case processing workflow, or speak to a counsellor.