Clinical Trial Data Reconciliation Between EDC, Safety, and IRT Systems

Three Systems, Three Versions of the Same Trial

A single serious adverse event in a blinded, randomized trial touches all three systems within days. The site enters the event in the EDC. The investigator sends an SAE report to the sponsor, which drug safety enters in the safety database, codes, assesses for expectedness, and may submit to regulators. If the case needs to be reported on an expedited basis, someone unblinds the treatment assignment, and that assignment lives in the IRT. If the participant’s dose was titrated or held because of the event, the IRT records a dispensing change. Each system gets its own copy of related facts, entered by different people, on different timelines, for different purposes.

None of this is unusual. A Tufts Center for the Study of Drug Development study with Veeva Systems, covering nearly 260 sponsor and CRO companies, found that organizations use an average of six applications to support each clinical study, and that about three-quarters use dedicated applications for randomization and trial supply management and for safety and pharmacovigilance.¹ The same study found that 77% of respondents reported difficulty loading data into their primary EDC system because of compatibility, technical, and integration challenges.¹

What Each System Is For

The three systems exist for different reasons, and that is the root of most mismatches. It helps to state each one’s purpose plainly.

• EDC (electronic data capture) is where the investigator records protocol-required data for each participant, usually through an electronic case report form (eCRF). It feeds the clinical database and, eventually, the analysis datasets. Its adverse event pages capture all adverse events, serious or not, in the terms the site uses.
• The safety database is where drug safety manages individual case safety reports. It is built for case processing: receipt dates, medical review, coding, causality and expectedness assessment, and regulatory submission. It holds serious cases from this trial, from other trials in the program, and sometimes from postmarketing sources.
• IRT (interactive response technology), also called RTSM (randomization and trial supply management), assigns participants to treatment arms, applies stratification, assigns kits and doses, manages drug supply at sites, and provides emergency unblinding. It holds the treatment assignment, which the other two systems should not show to blinded users.

Why the Copies Drift Apart

The copies drift for predictable reasons. The same fact is entered more than once by different people (a site coordinator entering weight in IRT for dose calculation and again in the EDC vital signs page). The same event is described at different stages (a site enters an adverse event as nonserious, then it becomes serious and a separate SAE form goes to safety). The systems use different dictionaries or dictionary versions. Follow-up information arrives in one system and not the other. And the systems update on different schedules: a safety case can be updated the same day a follow-up report arrives, while the corresponding EDC page waits for the next monitoring visit.

What Regulators Expect

The expectation to reconcile is explicit. ICH E6(R3), the current good clinical practice (GCP) guideline, says that validated processes or other appropriate processes, such as reconciliation, should be in place so that electronic data transferred between computerized systems keeps its integrity, and that data reconciliation should be used as appropriate to avoid data loss and unintended changes.² Section 4.2.6 goes further: the activities that finalize data sets before analysis, which may include reconciliation of relevant databases, should be confirmed and documented according to pre-specified procedures.²

The EMA guideline on computerized systems and electronic data in clinical trials is specific about IRT. Where an IRT collects clinical data, important data should be subject to source data verification or reconciliation with the same data in the data acquisition tool, and the guideline gives stratification data as its example.³ It also expects a data flow diagram and description that states, among other things, what actions are applied to transferred data, including reconciliation.³

FDA’s compliance program for inspecting sponsors and CROs (Compliance Program 7348.810) tells investigators to determine whether there is a separate safety database, who is responsible for it, who has access, and whether and how information from it is transferred to the EDC system, “including reconciliation of all data.”⁴ In other words, a US inspector is instructed to ask the question this article is about.

What Must Match: The Three Reconciliation Pairs

Most reconciliation plans treat EDC and safety as the only pair that matters, and treat IRT as a supply system. That leaves two of the three comparisons to chance. A more complete model looks at three pairs, each with its own purpose, its own data elements, and its own owner.

Pair One: EDC and the Safety Database

This is classic SAE reconciliation. Its purpose is to confirm that every serious adverse event the site recorded reached drug safety, and that the key facts agree. The Society for Clinical Data Management (SCDM) chapter on SAE data reconciliation, first published in 2002 and republished in the Journal of the Society for Clinical Data Management in 2023, lists the data items typically compared.⁵ They include protocol, investigator, subject identification, randomization number, initials, date of birth, gender, race, event number, diagnosis, verbatim term, coded or preferred term, onset date, resolution date, date of death, outcome, severity, causality assessment, and action taken with study drug.⁵ The chapter also notes that items from the demography, discontinuation, and concomitant medication modules can be used to clarify discrepancies.⁵

The two directions of comparison mean different things. An SAE in the EDC that is missing from the safety database is a potentially unreported event, and SCDM recommends documenting each one and sending the relevant CRF pages to the safety contact.⁵ An SAE in the safety database that is missing from the EDC usually means the site has not yet entered it, or the monitor has not yet reviewed the page, and it needs research, not an automatic update. SCDM is firm that SAEs should not be added to the clinical database from safety information without the visit data having been monitored against source.⁵

Pair Two: EDC and IRT

This pair protects the integrity of randomization and dosing. The purpose is to confirm that the participant the IRT randomized is the participant the EDC describes, in the stratum the EDC data supports, receiving the dose the protocol requires for their recorded characteristics. Typical elements:

• Identity and status: subject number, screening and randomization dates, screen failure and discontinuation status, and site.
• Stratification factors: the values entered in IRT at randomization compared with the same baseline values in the EDC (for example, disease stage, region, prior therapy, age group).
• Dose inputs: weight, body surface area, renal function, or other values the IRT uses to calculate or assign a dose, compared with the EDC values for the same visit.
• Dispensing and exposure: kits or dose levels assigned by IRT compared with the study drug administration and accountability pages in the EDC, including dose holds, reductions, and titration steps.
• Emergency unblinding events: the IRT log of unblinding compared with any protocol deviation or unblinding record in the EDC.

The EMA guideline makes the dose and stratification risk concrete. It asks sponsors to verify IRT dose look-up tables against the approved protocol, using test data on the borderline between dose levels, and to test every combination of strata to confirm that allocation comes from the correct randomization table.³ Reconciliation in production is the ongoing check that what was tested is still what happens.

Pair Three: IRT and the Safety Database

This is the pair most often left out, and it is where some of the most serious findings have come from. Its purpose is to confirm that treatment assignment and exposure information used for safety decisions is correct. Typical elements:

• Treatment assignment for unblinded cases: when a case is unblinded for expedited reporting, the treatment recorded in the safety case should match the IRT assignment for that participant.
• Dose at the time of the event: the suspect product dose in the safety case compared with the IRT dispensing record for the relevant period.
• Dosing errors: any IRT allocation that deviates from the protocol, compared with the safety database, to confirm that any associated adverse events were captured and assessed.
• Exposure for periodic reports: the participant counts and exposure figures used in aggregate safety reports compared with IRT randomization and dispensing counts.

The last item matters because ICH E2F, the guideline for the Development Safety Update Report (DSUR), expects an estimate of cumulative subject exposure in clinical trials to give context to the cumulative tables of serious adverse events, and notes that the accuracy of this estimate can be limited, for example by the number of ongoing trials that remain blinded.⁶ IRT is usually the most reliable count of who was randomized and dispensed product, so exposure figures that do not tie back to it deserve a question.

Expected Differences Versus Real Discrepancies

A reconciliation that flags every difference buries the important ones. A reconciliation that ignores differences it has decided are “normal” can miss a real problem that looks like a normal one. The practical answer is to name, in the reconciliation plan, which differences are expected and how each one is handled, so that reviewers spend their attention on the rest.

Differences SCDM Treats as Acceptable

The SCDM chapter says plainly that some discrepancies are acceptable. Slight variations in the terms used to describe an event may be of no consequence, and start dates may differ because an event may begin as nonserious and later become serious.⁵ The chapter also recommends that data management, safety, and clinical operations agree a turnaround time for researching and correcting discrepancies found during each reconciliation period.⁵

The important word is “slight.” A reconciliation rule that treats all term differences as acceptable would let “chest pain” in the EDC and “myocardial infarction” in the safety case pass without comment. That is a clinical difference, and it may change the seriousness, the expectedness assessment, or both. The plan should say which comparisons are made at the coded term level, which need medical review, and who performs it.

The MedDRA Version Problem

Coded terms are a common source of false discrepancies, and the reason is structural. The MedDRA Maintenance and Support Services Organization (MSSO) recommends that single case reporting, including premarket serious adverse event reports, use the most recently released MedDRA version.⁷ New versions are released on 1 March and 1 September, and the MSSO recommends that each become the reporting version on the first Monday of the second month after release, so in May and November.⁷ For clinical trials, the same MSSO document assumes that a project or trial will often freeze on one MedDRA version and optionally recode at a later milestone.⁷

The result is that a safety database following the single case recommendation and a clinical database frozen at study start can code the same verbatim term differently, with neither being wrong. The reconciliation plan should state which version each system uses, whether comparison happens at the verbatim, lowest level term, or preferred term level, and how version differences are recognized so they do not generate queries to sites.

Stratification Mismatches: Document, Do Not Correct

When EDC and IRT disagree on a stratification factor, the natural instinct is to fix the IRT so the two match. That is usually the wrong move. In guidance on handling randomization errors, Yelland and colleagues argue that documenting, rather than correcting, randomization errors is most consistent with the intention-to-treat principle, and recommend that when a participant is randomized using incorrect baseline information, the randomization is accepted and the correct baseline data is recorded.⁸ Their examples include a participant placed in the wrong age stratum because a date of birth was entered incorrectly into the randomization service.⁸

Timing: A Cadence Built Around the Regulatory Clocks

Many reconciliation plans set a fixed calendar cadence, often monthly or quarterly, plus a final reconciliation before database lock. A fixed cadence is better than nothing, but it ignores the fact that safety data already runs on regulatory clocks, and a reconciliation that misses those clocks can let a reporting failure run for months.

The Clocks That Already Exist

Under US regulations, an investigator must immediately report to the sponsor any serious adverse event, whether or not it is considered drug related.⁹ The sponsor must then submit an IND safety report for qualifying serious and unexpected suspected adverse reactions no later than 15 calendar days after determining the information qualifies, and must report any unexpected fatal or life-threatening suspected adverse reaction no later than 7 calendar days after its initial receipt of the information.¹⁰ ICH E2A sets the same 7-day and 15-day framework internationally, with the 7-day notification followed by as complete a report as possible within 8 more calendar days.¹¹

The periodic clock is the DSUR. Under ICH E2F, the data lock point of the DSUR is the last day of the one-year reporting period, and the report should be submitted no later than 60 calendar days after that data lock point.⁶ The line listings and cumulative tables in the DSUR come from the safety database. If the safety database is missing SAEs that are recorded in the EDC, the DSUR is wrong.

The reporting format has also changed. FDA’s April 2024 guidance on the electronic format for IND safety reports made submission to FDA’s adverse event system a requirement 24 months after publication, which was April 1, 2026, for IND safety reports of serious and unexpected suspected adverse reactions under 21 CFR 312.32(c)(1)(i).¹² FDA’s electronic submissions page, now under the name FDA Adverse Event Monitoring System (AEMS), formerly FAERS, confirms that as of April 1, 2026, FDA requires premarketing (IND) individual case safety reports in the ICH E2B(R3) data standard, and that the requirement applies to commercial IND sponsors submitting electronically through ESG NextGen using database-to-database transmission.¹³ Structured, field-level case data going to FDA is one more reason the fields in the safety database need to agree with the clinical record.

An Inspection Finding About Timing

The MHRA GCP inspection metrics report for April 2018 to March 2019 describes a critical finding that shows why cadence alone is not enough. Inspectors found no evidence of SAE reconciliation outcome resolution for outputs from a number of trials. The data review plan required SAE reconciliation between the clinical and safety databases twice a year and at database lock, but nothing specified that reconciliation had to be done before DSUR line listings were produced.¹⁴ The same finding recorded examples of late receipt of serious cases by the pharmacovigilance department.¹⁴

That finding describes a plan that looked reasonable on paper. It had a cadence and a final check. What it lacked was a link between the reconciliation schedule and the documents that depend on reconciled data, and evidence that the discrepancies found were closed.

A Trigger-Based Cadence

The last step comes directly from SCDM, which notes that SAEs often continue to be reported after a trial has concluded and recommends establishing a cutoff point after which no SAEs are added to the clinical database, even if the safety database is updated.⁵ SCDM also recommends written notification when reconciliation is complete, to avoid confusion if the safety database is held open after the study ends.⁵

Unblinding: Where IRT and the Safety Database Meet

Reconciliation between IRT and safety is complicated by blinding. The safety database will, for some cases, hold the treatment assignment. The IRT always holds it. The EDC, and most people who work in it, should not. Any reconciliation process that pulls data from all three systems into one output can unblind people who should stay blinded.

When Cases Are Unblinded

ICH E2A recommends that when a serious adverse reaction is judged reportable on an expedited basis, the sponsor break the blind for that specific patient even if the investigator has not, and that the blind be maintained, when possible, for people such as biometrics staff who are responsible for analysis and interpretation at the study’s end.¹¹ E2A also notes that when a fatal or other serious outcome is the primary efficacy endpoint, it may be appropriate to agree with regulators in advance on events that will be treated as disease related and not subject to routine expedited reporting.¹¹

FDA’s final guidance on sponsor safety reporting responsibilities, published in December 2025 and finalizing the 2021 draft, says the blind should ordinarily be broken for IND safety reports of individual occurrences, and that if the unblinded participant was receiving placebo, the event should not be reported in an IND safety report, while if the participant was receiving the investigational drug or an active comparator, it must be.¹⁵ That makes the IRT assignment a direct input into whether a report is filed. A wrong assignment in the safety case can mean a report that should have been filed was not, or one that should not have been filed was.

Firewalls and Who Sees What

The same FDA guidance recommends that the safety surveillance plan specify the positions and names of the individuals and entities who have access to unblinded individual or aggregate safety data, that internal personnel conducting unblinded safety reviews not participate in the conduct or analysis of the trial, and that a firewalled external group reviewing aggregate data have access only to the unblinded analyses it needs.¹⁵ ICH E6(R3) asks sponsors to describe who was unblinded, at what time, and for what purpose, who should remain blinded, and what safeguards preserve the blind.² It also says the potential for unblinding should be part of the risk assessment of a blinded trial, and that any planned or unplanned unblinding should be documented and assessed for impact.²

Emergency Unblinding Is a Reconciliation Item Too

The EMA guideline asks sponsors to test the emergency unblinding process, to have a backup process in case the online unblinding function is unavailable, and to confirm that a site can unblind before it administers product to a participant.³ ICH E6(R3) requires a mechanism that lets the investigator rapidly identify the product in a medical emergency while protecting the treatment assignment of other participants.² Each emergency unblinding in IRT should have a matching record in the EDC or deviation log, and, if it followed an SAE, a matching safety case. Comparing these three records is simple and is often not done.

Automating Reconciliation Without Losing Control

The case for automating reconciliation is not new. SCDM recommends that, where possible, fields used in reconciliation be set up so they can be compared programmatically without compromising the integrity of the software or databases, and observes that programmatic reconciliation can be worthwhile in time and quality even for fewer than 100 events, because the process can be validated once and run as often as data and time allow.⁵ The same chapter is equally clear that whether the comparison is manual or programmatic, the differences still need manual review by trained staff.⁵

That balance is the right one. Automation is good at finding and sorting differences. People are needed to decide what a difference means.

What Makes Automated Comparison Work

• A shared key. Subject number alone is not enough for event-level matching. The EDC adverse event record and the safety case need a common identifier, such as an SAE number assigned at the site and carried on the SAE form, or a case number written back to the EDC. Without one, matching falls back to date and term similarity, which produces false matches and false gaps.
• Standardized fields. SCDM’s minimum standards include standardizing the capture of SAE data elements in both the clinical database and the safety database.⁵ If the EDC captures outcome as a free-text field and the safety database uses a coded list, automated comparison will fail on every record.
• Written tolerance rules. Which date differences are acceptable, which term comparisons happen at preferred term level, and how MedDRA version differences are handled. These rules belong in the reconciliation plan, not in a programmer’s head.
• An exception queue with owners. Each discrepancy gets a category (timing, terminology, entry error, process failure), an owner, a due date based on the agreed turnaround time, and a resolution record.
• A record of each run. Date, data extracts used, program version, number of records compared, number of discrepancies by category, and who reviewed the output.

Integration Does Not Remove the Need to Reconcile

Some sponsors respond to reconciliation burden by integrating the systems: IRT sends stratification data to the EDC, or the EDC sends SAE forms to the safety database. Integration reduces double entry, but it does not remove the need to check. ICH E6(R3) still expects validated processes, or reconciliation, to confirm that transferred data keeps its integrity.² The EMA guideline says that where IRT clinical data is transferred into the EDC, the eCRF requirements of ICH E6, such as investigator control of site-entered data and investigator authorization of data changes, should be addressed in the IRT system requirements and user acceptance testing.³

This connects to a question that is easy to skip: which data in IRT belongs to the investigator and which belongs to the sponsor. A January 2026 article in Applied Clinical Trials distinguishes protocol-required, subject-level data entered in IRT, which falls under investigator control, from operational data such as kit status changes, which the sponsor manages.¹⁶ The reconciliation design follows from that split. Subject-level clinical data in IRT needs site correction paths and comparison with EDC. Operational data needs comparison with supply and accountability records.

What to Automate and What to Keep Human

The comparison programs themselves need validation proportionate to their risk. A script that decides whether an SAE was reported feeds a regulatory reporting decision, so it deserves requirements, testing, and change control, not an unversioned spreadsheet macro on a data manager’s laptop.

The Documentation an Inspector Will Ask For

Reconciliation that happened but left no record did not happen, as far as an inspection is concerned. The MHRA critical finding described earlier was not that reconciliation was never run. It was that there was no evidence of reconciliation outcome resolution.¹⁴

What FDA’s Compliance Program Directs Investigators to Review

FDA’s Compliance Program 7348.810 gives a clear picture of what US inspectors look at in this area. Beyond the safety database questions already quoted, it directs them to review how SAE reports are received from sites, who receives and tracks them, who evaluates and codes them, and how evaluations are documented, and to review the process for unblinding after SAEs and whether any accidental unblinding occurred and how it was handled.⁴ It directs review of validation for IRT functions, naming screening, randomization, dosing, drug supply, and emergency unblinding modules, and critical functions such as IRT dosing titrations and reductions.⁴ It also directs review of the data reconciliation plan, including reconciliation of raw data extracts or transfers from electronic systems, with particular attention to efficacy and safety data, and integration of data from different systems.⁴

Access Rights Are Part of the Record

SCDM recommends that read-write access be granted to either database, but not both, for personnel responsible for data entry and modification, with read-only access for people involved in reconciliation who are not responsible for changing data.⁵ That separation is worth keeping even when a single team handles both functions, because it makes clear which system each correction was made in and by whom. It also supports the attribution expectation in ICH E6(R3) that corrections be attributed to the person or system making them and justified.²

Drug Accountability Belongs Here Too

FDA’s compliance program also directs inspectors to determine whether the sponsor’s records demonstrate reconciliation of shipment, receipt, and disposition of investigational product, comparing the amount sent with the amount used and returned or disposed of.⁴ IRT is usually the system that records what was sent and assigned. The EDC or site accountability logs record what was taken. The same discipline that reconciles SAEs should reconcile these counts, and any gap should be checked against the safety database for possible dosing errors.

Ownership When Vendors Run the Systems

In many sponsor organizations, especially smaller biotechs, a CRO runs the EDC, a specialist vendor builds the IRT, and either the CRO or a pharmacovigilance provider runs the safety database. Reconciliation then crosses company boundaries, and responsibility becomes easy to assume and hard to prove.

What Regulators Have Seen When IRT Goes Wrong

The MHRA inspectorate’s blog on serious breaches reported in 2018 describes a commercial sponsor whose IRT failed to allocate investigational product according to the protocol. Thirty-two subjects received the incorrect dose, most of them an overdose because the system did not down-titrate as it should, and some affected subjects experienced serious adverse events that the sponsor could not rule out as caused by the dosing error.¹⁷ The vendor told the sponsor the issue was resolved. It was not, further dosing errors followed, and the sponsor put in place an urgent safety measure to unblind the trial so that titration allocations could be checked manually.¹⁷

The MHRA metrics report for the same period describes critical findings at a CRO, including IRT systems in production that were inconsistent with the approved protocol, and a separate case where the MHRA was notified of IRT functionality issues that resulted in overdosing of multiple trial participants, with several participants experiencing SAEs and one fatality, which was reported as a SUSAR as a conservative approach because the sponsor could not confirm whether the overdose was the cause.¹⁴ In the same report, inspectors raised concern that non-compliant eCRF or IRT builds could lead to incorrect or missing data, or to participants being randomized or dosed incorrectly.¹⁴

Routine IRT-to-EDC dose comparison and IRT-to-safety cross-checks will not prevent a faulty IRT build. They can shorten the time between the first wrong dose and the moment someone notices, and they can show whether a vendor’s fix worked. A 2025 review of major randomization failures by Yelland and colleagues makes the same point from the statistician’s side, recommending thorough testing of the randomization process before a trial starts and regular monitoring of treatment allocations throughout to identify unexpected patterns.¹⁸

Putting Oversight in the Contract

The EMA guideline says that responsible parties should oversee delegated trial duties, for example by reviewing defined key performance indicators or reconciliations, and that the approved protocol partly defines the specification for IRT and data acquisition tool configuration, so agreements should make clear how protocol changes reach the vendor’s system.³ For reconciliation, that translates into concrete contract terms: who runs each pair, how often, in what format results are delivered, what turnaround applies to discrepancies, and how the sponsor sees the outcome.

The table is a starting point, not a standard. The point is that every cell with a verb has a named role, and that the sponsor, not the vendor, holds the record that the work was done. The serious breaches reported to MHRA in 2018 included examples of under-reporting of SUSARs and issues with potential unblinding, both of which a working three-pair reconciliation is designed to catch.¹⁷

Conclusion

Reconciliation between EDC, safety, and IRT is often treated as a data cleaning step that happens near the end of a study. The evidence from inspection findings and serious breach reports points the other way. The most damaging failures (unreported SAEs, wrong doses assigned by IRT, wrong treatment arms in reported cases, periodic reports built on unreconciled data) are safety and compliance failures first, and data quality failures second. They are found soonest by a process that compares all three pairs, runs on triggers tied to the regulatory clocks, separates expected differences from real ones, protects the blind, and leaves a record of every discrepancy and its resolution.

None of this needs new technology. It needs a written plan that names the three pairs and their owners, comparison programs that are validated and versioned, contracts that make vendors deliver reconciliation results the sponsor can see, and a habit of treating “reconciliation complete” as a signed statement rather than an assumption. Sakara Digital works with pharma and biotech teams on clinical data flows, system oversight, and inspection readiness. If you are reviewing how your EDC, safety, and IRT data are reconciled and want an independent view of where the gaps are, we are glad to have that conversation.

For Further Reading