Chapter 8: What Must Be Locked, and When?
The question the entire book leaves open
Every prior chapter asked a design question and demanded an answer before enrollment begins. Chapter 1 required the estimand. Chapter 2 required the effect measure. Chapter 3 required the sample size with owned assumptions. Chapter 4 required the interim analysis plan. Chapter 5 required the bias protection system. Chapter 6 required the claim structure. Chapter 7 required the adaptive rules.
Each of these requirements was framed as pre-specification. Pre-specify the estimand. Pre-specify the nuisance parameters. Pre-specify the hierarchy. Pre-specify the enrichment rule.
What none of those chapters addressed is what pre-specification means in practice. Pre-specification is not a state of mind—a sincere intention to specify before looking. It is a documentary condition: a document exists, with sufficient specificity to be audited, finalized at a time that can be verified, by people whose authority to finalize it is established. Without the documentary condition, the sincere intention is indistinguishable from a post-hoc rationalization, and the regulatory agency reviewing the trial has no way to verify which it was.
Chapter 8 addresses the documentary condition. It is the governance chapter—not in the sense of the DSMB governance addressed in Chapter 4, but in the deeper sense: the governance of the design process itself. Who finalizes what document, when, under what review, with what consequence for the trial if the document is not finalized on time. These are the questions that determine whether the book’s prior demands were actually met or merely stated.
Why governance of the design process matters
The pre-specification principle is widely understood in clinical trial methodology. It is widely violated in clinical trial practice. The gap between understanding and practice is not primarily a gap in statistical knowledge; it is a governance gap.
The governance gap has a specific anatomy. The protocol is finalized before enrollment—this is a regulatory requirement—but the statistical analysis plan is sometimes finalized after interim data are available, sometimes after the database is locked, occasionally after the primary analysis has been run. The hierarchical testing order is specified in the protocol in general terms and detailed in the SAP, and if the SAP is finalized after data trends are visible, the hierarchy detail may be shaped by what the data show. The subgroup analyses listed in the SAP may be more numerous than those in the protocol, and the additions may reflect questions generated by the data rather than questions the design was built to answer.
None of this requires dishonesty. It requires only that the design process does not enforce documentary discipline—that the team does not treat the finalization of each design document as a governance event with a hard deadline, independent review, and consequences for the trial’s credibility if the deadline is missed. When the process does not enforce discipline, the documents slide toward the data, and what looks like pre-specification from the outside is shaped by the results from the inside.
Chapter 8 establishes the documentary discipline that the pre-specification principle requires. It does so not as a compliance exercise—not as a list of things that must be in the file—but as a design requirement: the documents that govern the trial must be finalized before the events that could compromise their independence, and the finalization must be verifiable.
What this chapter covers
Section 8.1 — What Must Be Pre-specified establishes the complete list of design elements that must be documented before specific trial events, with the rationale for each deadline. The list is not the same for every trial; a fixed-design superiority trial has a different pre-specification requirement than an adaptive NI trial with a seamless phase II/III structure. But the principle is constant: every element that, if finalized after the triggering event, could be shaped by knowledge of the interim data or the final result, must be finalized before that event.
Section 8.2 — Adaptive Rules and Their Lock Requirements addresses the specific pre-specification demands of adaptive designs—the designs whose rules must be finalized before enrollment begins, not before the adaptation is triggered, because the adaptation will be governed by parties who must not exercise discretion beyond what the pre-specified rule allows.
Section 8.3 — The Decision Log examines the documentation of decisions made during the trial—not the pre-specified decisions, but the governance decisions that occur in response to unexpected events, DSMB recommendations, protocol deviations, and regulatory interactions. The decision log is the audit trail for the trial’s conduct, and its completeness determines whether the trial’s integrity can be verified from the outside.
Section 8.4 — Design Review and the Independent Challenge addresses the role of independent review in the design process—the prospective scrutiny of the design by parties who were not part of its construction and who can identify gaps, inconsistencies, and vulnerabilities that the design team, close to their own work, may not see. Independent review is not a quality control step at the end of the design process; it is a governance requirement at each stage of the process.
The four lock events
The documentary discipline of Chapter 8 organizes around four events in the trial’s timeline at which specific documents must be finalized and locked.
Lock 1: Protocol finalization before first patient enrolled. The protocol contains the estimand, the primary endpoint, the effect measure, the eligibility criteria, the randomization scheme, the blinding design, the interim analysis plan (at the level of information fractions and stopping criteria categories), the co-primary decision rule if applicable, and the pre-specified subgroup analysis list with their confirmatory or exploratory status. The protocol is the public commitment to the trial’s design, registered in a clinical trial registry before enrollment begins.
Lock 2: Statistical analysis plan finalization before any unblinded data access. The SAP contains the complete hierarchical testing plan in order, the specific analysis models for each endpoint, the pre-specified sensitivity analyses, the detailed definitions of all endpoints and their adjudication criteria, the handling of missing data under each intercurrent event strategy, the adaptive rule details (SSR rule with bounds, enrichment threshold and criteria), and the combination test method for adaptive trials. The SAP must be finalized before any member of the analysis team or the sponsor has access to unblinded data from the trial—including interim DSMB reports that contain arm-specific results.
Lock 3: DSMB charter and SSR charter finalization before first interim analysis. The DSMB charter—as described in Chapter 4—is finalized before the first interim. The SSR charter, for adaptive designs, is finalized on the same timeline. Both documents are governance instruments for events that will occur during the trial; they must be in place before the events they govern.
Lock 4: Decision log completeness before database lock. The decision log documents every governance decision made during the trial—every protocol amendment, every deviation from the pre-specified plan, every DSMB recommendation and the sponsor’s response, every interaction with the regulatory agency that affected the trial’s conduct. The decision log must be complete before the database is locked, so that the analysis team and the regulatory reviewer have a complete record of the decisions that shaped the trial’s conduct and the data it produced.
What this chapter is not about
This chapter is not about regulatory submission formatting, clinical study report structure, or the specific content requirements of ICH E3 for clinical study reports. Those are post-trial documentation requirements; this chapter is about pre-trial and during-trial governance.
It is also not about data management—the systems and processes for collecting, cleaning, and locking the clinical database. Data management is the operational infrastructure for the trial; this chapter is about the governance of the design decisions that determine what data are collected and how they will be analyzed.
The book’s final question
Chapter 8 is the last of the eight design chapters. Its subject—the governance of the design process—is last not because it is least important, but because it can only be understood after all the prior decisions have been made. The governance requirements of Chapter 8 are the governance of the decisions established in Chapters 1 through 7. Without those decisions, there is nothing to govern. With them, the governance question is: how do we ensure that the decisions that were made become the decisions that were implemented?
That question is the book’s final question. It is also, in a specific sense, the most consequential one—because a design that was correctly conceived but incorrectly documented is, from the outside, indistinguishable from a design that was post-hoc rationalized. The trial’s scientific integrity and its regulatory defensibility both depend on the answer being verifiable, not just sincere.