Why Trace an Interim Results Workflow?
An interim analysis is not a single report appearing at a single moment. Information moves from trial systems through extraction, preparation, analysis, review, decision, and communication. At each step, a file may gain or lose identifiers, combine participant records into summaries, or reveal which coded group received which treatment. A workflow is safe only when those changes and the people who can see them are understood.
The key question is not just whether a person is “blinded.” Ask what exact information that person receives, in what form, at what stage, and with what other information they can combine it. The earlier material on adaptation access plans establishes the importance of matching access to a role’s responsibilities; here, the emphasis is on tracing that match through an end-to-end process.
“Pooled” does not automatically mean harmless or non-identifying. A total may disclose sensitive information if it is based on a very small number of participants, and a supposedly pooled report can leak a contrast through subtotals or comparisons. Likewise, replacing treatment names with A and B is not enough to preserve masking if the recipient also has the A/B-to-treatment mapping.
Trace Each Handoff
A useful trace records, for every stage, the information input, the transformation performed, the output, the recipient, and the permissions that apply. These are operational questions, not a statistical test. The intended treatment comparison and the permitted access should be specified before the interim data are processed.
Specify the data cutoff, eligible participants, outcome status rules, and any data queries to be resolved. Record who can make or approve changes to the extract. A changing cutoff can change which observations enter the interim analysis.
Identify the source systems and fields, including participant codes, treatment-assignment codes, outcomes, and any direct identifiers. Limit extraction privileges to authorized data-management personnel; do not assume that access to a trial system implies permission to view every field.
Remove direct identifiers where they are not required, apply prespecified derivations, and check completeness and consistency. Keep any linkage file and treatment-code mapping under their separately specified controls. Record which copy is the analysis dataset.
State whether the analyst receives pooled data, participant-coded records, or treatment-unblinded records. If the analysis requires unblinded assignments, restrict it to the designated independent statistician or other authorized role and use controlled storage and output review.
Specify which interim outputs go to the decision-making body and which findings are withheld from the sponsor or trial operations team. Record the decision and the information on which it was based, without circulating restricted material more widely than needed.
Check each report, slide, email, file name, and meeting record for treatment labels, small-cell results, and other clues. Distribute only the approved version to its intended recipients, and retain access and version records according to the trial’s procedures.
This trace supports a simple justification: each recipient should receive no more interim information than is needed for the assigned task, and each transfer should preserve the access restrictions established for that information. If a later step needs a more detailed or unblinded output, its intended recipients and safeguards should be defined before that output is produced, rather than inferred after it has been circulated.
Worked Example: A Pooled Safety Summary
In a hypothetical two-arm trial, a prespecified interim cutoff includes 80 participants with safety follow-up. The database contains participant codes, assignment codes, and adverse-event records; the separate assignment key links codes to the treatment names. The data team extracts the records and confirms 5 participants with at least one qualifying event among 40 assigned to each arm. The intended summary for the sponsor is pooled.
Extraction and preparation. Authorized data-management staff can access the source records needed to make the extract. For the analysis copy, direct identifiers are removed, while participant codes remain so records can be checked. The assignment key is not included in the file sent to the sponsor-facing team. Participant-coded records remain sensitive even without names.
Analysis. The independent statistician receives the participant-coded extract and the assignment mapping if the prespecified safety analysis requires arm-specific counts. This is treatment-unblinded access: the statistician can connect each code to its treatment. The statistician creates the approved pooled output: \(5+5=10\) participants with an event among \(40+40=80\) participants, or \(10/80=0.125\), which is 12.5%.
Communication. The sponsor-facing recipient receives only the pooled count and proportion, with no arm-specific rows, participant codes, or mapping key. The summary says that 10 of 80 participants (12.5%) had a qualifying event by the cutoff. It does not claim that the event rate is the same in both arms; the pooled result alone cannot establish that.
Check. This workflow is consistent with the stated access plan only if the independent statistician is authorized to use the assignment mapping, the sponsor-facing recipient is not given it, and the pooled output does not contain other fields that reveal arm-specific counts. Removing names alone would not make an arm-specific table pooled.
Access Depends on the Information, Not Just the File Name
A label such as “blinded extract” is not a sufficient description of access. It may mean that treatment names have been replaced with codes; it does not say whether participant identifiers remain, whether arm-specific outcomes are present, or whether the recipient knows the code mapping. An access description should state each of these separately. The same role can appropriately receive different information at different stages, provided those permissions are explicit and the transitions are controlled.
The distinction also matters when a workflow uses an external statistician, an independent monitoring committee, or a sponsor team. A role’s authorization is not determined by its title alone. For example, a statistician may be permitted to inspect unblinded records for a defined analysis, while a data manager may see identified records only to resolve queries. A committee may receive arm-specific summaries, while the operational team receives a recommendation without the underlying comparisons. These arrangements depend on the trial’s prespecified procedures; none is universal.
Worked Example: Coded Arms in a Dose-Selection Analysis
In a hypothetical trial with three doses and a control group, the analysis plan calls for an interim comparison of response rates to support a dose-selection decision. The extract contains participant codes and outcome indicators. In a file sent to the independent statistician, the arms are labelled A, B, C, and D, but the statistician also receives the restricted mapping showing which label is control and which labels are doses.
What the statistician can see. The records are participant-coded rather than directly identified, but the data are treatment-unblinded because the mapping is available. The statistician can calculate arm-specific response rates and prepare the prespecified decision output. For illustration, suppose the analysis finds 18 responses among 40 participants in A, 24 among 40 in B, 20 among 40 in C, and 22 among 40 in D. The corresponding rates are \(18/40=0.450\), \(24/40=0.600\), \(20/40=0.500\), and \(22/40=0.550\).
What the committee can see. If authorized by the trial procedures, the independent committee may receive those coded arm-specific rates and the mapping needed to interpret them. It can consider the planned selection rule. The sponsor’s recruitment and site teams, by contrast, receive only the authorized operational instruction, such as which dose to continue, without the comparative table or mapping.
Why “coded” is not “blinded.” If the statistician had received labels A through D but not their mapping, the statistician could still see that rates differ by code. Whether that is considered adequate masking depends on what the role needs to do and what else is known. If an arm’s dose is inferable from external information, labels alone do not conceal its identity. The workflow must therefore describe both the coded records and the mapping access.
Detecting Workflow Problems
A trace is useful only if it can be checked against what actually happened. Reconcile the planned and observed recipients, files, and versions at each handoff. Warning signs include an extract with unexpected fields, a treatment key stored beside the analysis file, outputs circulated before approval, or a report whose labels do not match the approved version. Review access logs and distribution records where available, and document deviations promptly.
Some leaks are indirect. A report may omit treatment names yet include small group counts that allow a recipient to infer which arm is which. A file name, slide title, metadata field, or email text may disclose a mapping that the table itself withholds. A pooled summary can also become revealing if another report supplies totals or subgroup counts that allow the missing value to be calculated. Check the combined information a recipient can access, not only the visible contents of one output.
If a discrepancy is found, first establish what information was accessed, by whom, and when. Preserve relevant records, notify the roles designated by trial procedures, and assess whether further distribution should stop. Do not assume that deleting a message erases the disclosure, or that a potential leak necessarily invalidates the trial’s conclusions. The consequences depend on the information disclosed and subsequent actions; the response and any impact assessment should be documented through the applicable governance process.
Worked Example: A Report With a Hidden Arm Contrast
A hypothetical two-arm trial plans to send the sponsor a pooled interim report. The independent statistician has generated a report with a total of 12 events among 100 participants, but a draft appendix also gives 4 events among 50 participants in coded arm A. The sponsor is not authorized to see arm-specific interim results.
Trace the disclosure. The total is pooled, but the appendix is arm-specific. Its presence means the sponsor could calculate the other arm’s event count as \(12-4=8\) among \(100-50=50\) participants. The draft therefore reveals a contrast even if the second arm’s row and treatment mapping are omitted.
Correct the handoff. Before distribution, remove the arm-specific appendix and check the complete report, including tables, file names, and supplementary materials. Send only the approved pooled summary to the sponsor. The statistician’s unblinded analysis may still be appropriate if authorized; the error is the unintended disclosure to a recipient whose access does not include that information.
After a release. If the draft has already been sent, record the recipient, time, and information disclosed, follow the trial’s reporting and containment procedures, and assess whether the recipient could identify the treatment mapping. Do not describe the event as harmless merely because the labels were coded.
Choosing and Limiting a Workflow
A central, independent analysis route can reduce the number of operational staff who see treatment comparisons, but it depends on reliable separation of the analysis function, controlled transfers, and an appropriate review of outputs. A more distributed route may be operationally convenient, but it creates more points where mappings, arm-specific summaries, or participant-level records can be exposed. A pooled-only route limits group-specific disclosure to recipients, but it may not provide the detail required by the adaptation or safety review.
These are trade-offs, not a ranking that applies to every trial. The workflow must provide the information required for the planned decision, maintain appropriate access restrictions, and leave a record of how interim results informed that decision. Access control also does not guarantee correct analysis: the cutoff, data derivations, analysis method, and output accuracy need their own checks. Conversely, a statistically correct analysis does not justify sending its unblinded results to unauthorized recipients.
A common mistake is to reason, “The sponsor received no names, so the report was blinded.” That conclusion confuses participant identification with treatment masking. The correction is to ask separately whether the sponsor can identify participants, distinguish arm-specific results, or map an arm code to a treatment. The answers may differ, and each needs to be assessed for every information handoff.
Check Your Understanding
Answer each question, then compare your reasoning with the brief solutions.
- A participant-level extract contains study IDs and arm-specific outcomes, but no names. Is it identified, pooled, or treatment-unblinded? What further fact is needed to assess masking?
- An authorized statistician has the A/B-to-treatment mapping, while the sponsor receives only an overall event count and total sample size. What information can each role see?
- A pooled report gives 9 events overall and 3 events in coded arm A. Explain why it may reveal a group-specific result even if arm B is omitted.
- Name two checks that should occur before an interim report is sent to its intended recipients.
Solutions. (1) It is participant-coded, not directly identified, and it is arm-specific rather than pooled. It is treatment-unblinded if the recipient has, or can infer, the mapping from A/B to treatments. (2) The statistician can interpret treatment-specific comparisons because the mapping is available; the sponsor sees only the pooled count and total, assuming no other disclosure enables a contrast to be reconstructed. (3) If the total includes only A and B, the omitted arm’s count is \(9-3=6\); the report therefore exposes an arm-specific result. (4) Examples include verifying recipient permissions, checking the complete report and attachments for arm-specific results or identifiers, confirming the correct approved version, and reviewing file names and metadata for unintended clues.