The short version
- Unlocking a locked database reopens data, programs, QC and review. The data change is the cheap part.
- The decision should be made against written criteria: does the error change a conclusion, a safety signal or something a regulator will rely on?
- A short decision template, agreed before lock, turns a week of discussion into an hour.
What unlocking actually reopens
Database lock is the point at which the clinical data are declared final for analysis. Edits are then prevented, and any later change must be authorized and leave a trace. In regulated electronic systems, that trace is the audit trail: 21 CFR Part 11 requires secure, computer-generated, time-stamped audit trails that record the creation, modification and deletion of electronic records, without obscuring previous values [1]. ICH E6(R3) likewise expects data changes to be attributable and documented, with data integrity protected through the data life cycle [2].
An unlock therefore triggers a chain:
- Authorization of the unlock and documentation of the reason.
- The data correction itself, with an audit trail.
- Re-lock, with the same sign-offs as the first lock.
- A new data transfer, re-run of SDTM and ADaM, and comparison with the previous run.
- Re-QC of every output whose numbers changed, and review of the changes.
- If results were already shared or unblinded, documentation of what was known when.
The bill, in a synthetic example
For the fictional ZEPHYR-101 study, the team estimates an unlock to correct one subject's randomization stratum:
| Step | Effort |
|---|---|
| Authorization, documentation and data correction | 1 day, data management and clinical |
| Re-lock and transfer | 1 day |
| Re-run and compare all datasets and outputs | 2 days, programming |
| Re-QC of changed outputs (primary analysis is stratified) | 3 days, programming and statistics |
| Review and sign-off | 2 days |
| Total elapsed | about 2 working weeks |
Because the error affects the stratification used in the primary analysis, the team unlocks. A wrong unit on one vital sign record would not justify the same bill.
Decide against criteria, not urgency
Agree the criteria before lock, in the lock plan. A useful set:
- Unlock if the error could change a primary or key secondary result, a safety conclusion, a population assignment or anything stated in the label or a regulatory response.
- Do not unlock if the impact assessment shows no change to any conclusion. Document the error, the assessment and the decision; where relevant, describe it in the clinical study report, which ICH E3 expects to describe data handling and any changes to the planned analyses [3].
- Never correct the analysis data alone. It creates a difference between source and analysis that no reviewer can trace.
Make the decision quick
Prepare a one-page template: the error, how it was found, the records affected, the outputs affected, the impact on each conclusion, the options with cost and time, and a recommendation. The person who finds the error fills it in the same day. The decision makers named in the lock plan decide within a day. Without the template, the same decision takes a week of meetings, and the week is the cost.
Do this today
- Check that your lock plan names who can authorize an unlock and the criteria they use.
- Draft the one-page unlock decision template and attach it to the plan.
- Estimate the re-run, re-QC and review effort an unlock would trigger for your next lock, so the cost is known before it is needed.
Check yourself
One question
Show the answer
Answer 2. Unlocking is justified when an error could change a conclusion or a regulatory decision. For an isolated error with no impact, a documented assessment is usually proportionate. Correcting analysis data without changing the source breaks traceability and the audit trail.
Apply it
Turn it into a plan
The brief says what to check. The Navigator and the Handbook turn it into dated, owned actions for your milestone, in your browser, with no study data.
Sources
References
- U.S. Code of Federal Regulations. 21 CFR Part 11: Electronic Records; Electronic Signatures. www.ecfr.gov ↗
- ICH. E6(R3) Guideline for Good Clinical Practice. International Council for Harmonisation; 2025. www.ich.org ↗
- ICH. E3 Structure and Content of Clinical Study Reports. Step 4, 1995. www.ich.org ↗
Standards and guidance change. Confirm the version in force for your study, sponsor and region before relying on any reference. Examples are synthetic and illustrative. This brief is generalized professional guidance, not regulatory advice.
Next brief · Wednesday 10:00 ET · Reviewer's Eye