Validation kit and study archive

The validation kit of an eCRF version, the UAT scripts on paper, the archive of the whole study in ZIP volumes.

A validated study needs two things on file besides its data: proof that each eCRF version was tested before its release, and an archive of the whole study that can be read in ten years without YouEDC. The page Validation and archive makes both as ZIP files. Every file in a ZIP comes with its SHA-256, so anyone can check later that nothing was changed.

Where to find it

Open Settings of the study: the last section is Validation and archive. The same page opens from the button Validation and archive on the eCRF versions page. The project administrator, the data manager and the monitor see the validation kits and the UAT scripts. The archive is for those who may export the data of every site: the project administrator and a data manager without a site limit.

Version 2 was released from candidate 2 with the approved UAT run 1; version 1 was released before the study had a QA environment. Each version has its ZIP.

The validation kit of a version

Press ZIP in the row of a version (the list of versions has the same button). The kit holds:

• 01_spec: the eCRF specification of that very version (visits, forms, fields with their bounds, codes and conditions), the data validation plan (every check with a value that makes it fire and one that does not), the snapshot of the design exactly as it was signed, and the changes since the previous version.
• 02_uat: the UAT scripts and the results of every run of the candidate the version was released from, with the executor's and the approver's signatures.
• 03_traceability.xlsx: every element of the eCRF with the steps that tested it and their outcomes.
• 04_release: who released the version, when and why, the signature, the candidate tried, and whether exactly what was tried was released. A version released without an approved UAT says so here, with the reason.
• 05_qa_audit_trail.csv: the audit trail of the QA environment, with test patients only.
• 00_manifest.json and SHA256SUMS.txt: every file with its SHA-256, the hash of the version and the release of YouEDC that made the kit.

The randomisation list never goes into a kit. Each download is written to the study's audit trail.

The UAT scripts on paper

When a sponsor or an auditor wants the testing done on paper, download the steps of the candidate in the QA environment with PDF or Excel. It is a blank sheet: the outcome, the actual result, the initials and the date are written by hand. The same buttons are on the UAT page of the QA environment. Before the first run the steps are made from the candidate's design; afterwards they are the steps of its run.

The study archive

Press Build the archive. It is built in the background, and you get an e-mail when it is ready; on the server only one archive is built at a time. Tick With the uploaded files and DICOM when the archive must hold the pictures and scans as well: they can weigh gigabytes.

• 01_design: every released eCRF version with its snapshot, specification and DVP.
• 02_data: the data in CDISC ODM 1.3.2, in Excel and in CSV, and the data cuts as they were frozen.
• 03_casebooks: one ZIP per site with a PDF/A casebook per patient.
• 04_audit: the whole audit trail of the study and the check of its chain of hashes.
• 06_signatures, 07_randomisation, 09_files, 12_team: the signatures, the assignments and code breaks, the files, the sites and the team.
• 13_validation and 14_platform: the validation kit of every version and the releases of YouEDC installed while the study ran.

The database of REG-DIAB-01 is not locked yet, so its archive is interim. The volume downloads with one click; the manifest's SHA-256 is shown under it.

A big study is split into volumes of up to 2 GB; a file is never cut between two volumes. Each volume has its own SHA256SUMS.txt, and the last one holds 00_manifest.json with every file of every volume.

Interim and final

An archive built before the database is locked is marked interim: useful as a safety copy or for an inspection. Build the final one after the hard lock. A blinded member's archive leaves out the forms for the unblinded team and the randomisation, and its README says so. Patients who withdrew the use of their data are left out of the data files, as in every export.

Checking the files

Unpack a volume and run sha256sum -c SHA256SUMS.txt (on Windows, compare with Get-FileHash in PowerShell). Every line must say OK. The manifest's SHA-256 is in the study's audit trail, together with who built the archive and who downloaded it.

Before the study is deleted

A Portal Owner can delete a study for good (Administration › Projects). The deletion removes the archives from the server too, so download the final archive first and hand it to the sponsor. The Portal Owner's delete page shows the last archive: when it was made, by whom and how many times it was downloaded, or that none was made.