A Prior Predictive Audit For A Survival Trial

Why Audit a Survival Prior?

A prior for a survival endpoint is not clinically interpretable merely because its parameter values look reasonable. A hazard rate that seems numerically small or a hazard ratio centered near one can still imply implausibly early events, very few events during the planned follow-up, or treatment-arm survival probabilities that conflict with clinical knowledge. A prior predictive audit makes these implications visible by generating possible trial outcomes under the proposed prior and design.

The audit is conditional on a stated survival model and trial plan. Its purpose is not to decide whether the prior is “true,” nor to assess whether observed trial data fit the model. It asks a design-stage question: if the proposed prior and sampling assumptions were used, what event patterns and follow-up data could plausibly result?

Specify the Survival Model and Design

For a transparent first audit, suppose event times follow an exponential model with constant hazard \(\lambda\) per month. The hazard is the instantaneous event rate among individuals who have not yet had the event. Under this model, the survival probability through time \(t\) is \(S(t\mid\lambda)=\exp(-\lambda t)\), and the event-time density is \(f(t\mid\lambda)=\lambda\exp(-\lambda t)\), for \(t\geq 0\). This model assumes the hazard is constant over time and, within an arm, is the same for all participants conditional on the model parameters.

For two randomized arms, one simple specification is a control-arm hazard \(\lambda_0\) and a hazard ratio \(r\), with treatment-arm hazard \(\lambda_1=\lambda_0r\). Here \(r<1\) represents a lower treatment hazard under this model. If a prior is placed on \(\log(\lambda_0)\) and \(\log(r)\), their exponentials are positive, as required for rates and hazard ratios. A complete audit states whether these parameters are independent or dependent in the prior; dependence changes the generated treatment-arm outcomes.

The survival model alone is not the complete sampling model. The audit must also specify the number allocated to each arm, when participants enter, the analysis cutoff, and how censoring is generated. With administrative censoring at a fixed follow-up time \(T\), an event occurs by the cutoff with probability \(1-\exp(-\lambda T)\). If participants enter at different times, their available follow-up differs, so the event probability must be evaluated at each participant’s potential follow-up time. If loss to follow-up is included, its model and any assumption about its relationship to event times must also be stated.

From Priors to Generated Outcomes

Let \(\theta\) denote all unknown survival parameters and \(Y\) the trial outcomes, including event indicators and observed follow-up. The prior predictive distribution is obtained by averaging the sampling distribution over the prior:

In practice, simulation approximates this integration. For each replication, draw the parameters once from their joint prior, then generate event times and apply the trial’s censoring and follow-up rules. Use a fresh parameter draw for the next replication. Drawing a separate hazard for every participant would instead describe individual-level heterogeneity, a different model that must be explicitly intended.

A short derivation helps connect the hazard prior to event counts. For a fixed \(\lambda\), each participant with complete follow-up to \(T\) has an event indicator with probability \(q(\lambda)=1-\exp(-\lambda T)\). Conditional independence then gives \(Y\mid\lambda\sim\text{Binomial}(n,q(\lambda))\), so \(E(Y\mid\lambda)=nq(\lambda)\). Averaging over the prior yields

This is generally not equal to \(n[1-\exp(-E(\lambda)T)]\): the nonlinear transformation means that substituting the prior mean hazard does not usually recover the prior predictive mean event count. Moreover, a mean alone can conceal a prior that puts appreciable probability on both near-zero and very high event counts.

What to Inspect and How to Diagnose Trouble

Useful audit summaries should be selected before inspecting simulated outcomes, based on clinical meaning and the planned trial. At a minimum, consider event counts by arm, survival probabilities at clinically relevant times, and the distribution of observed follow-up. A survival probability at a selected time can be computed for each parameter draw as \(\exp(-\lambda t)\); a generated event count additionally includes sampling variability. Keeping those two objects distinct helps identify whether an alarming result comes from the prior’s parameter implications or from ordinary outcome variation.

For staggered entry or loss to follow-up, inspect more than the total number of events. Check whether most participants are censored before clinically informative follow-up, whether implausibly many events occur very soon after entry, and whether the generated censoring pattern agrees with the stated assumptions. In an independent censoring model, event and censoring times are generated according to the specified independent mechanisms before recording the observed time and event indicator. If censoring depends on prognosis, that assumption is not justified by simply simulating independent times.

A practical warning sign is a mismatch between the implied event rate and what is clinically plausible for the population, follow-up horizon, or treatment. Another is a prior that allows substantial probability on extremes—such as nearly no events in either arm or near-universal early events—without a defensible clinical reason. Graphical comparisons with prespecified clinical benchmarks and prior predictive tail probabilities can help describe such concerns, but neither supplies a universal threshold for declaring a prior acceptable.

Alternatives, Limitations, and a Common Pitfall

The exponential model is convenient because its hazard is constant and its survival probability has a simple form. It may be unsuitable when the clinical event rate changes materially over time. A Weibull model allows a time-varying hazard of a particular parametric form, while a piecewise-exponential model permits different hazards in prespecified intervals. Those alternatives require their own parameter priors and assumptions; they are not interchangeable labels for the same audit. The model should be chosen to represent a defensible outcome process, not selected solely because its simulation is easy.

A prior predictive audit is sensitive to the design assumptions used in the simulation. Incorrect entry times, an omitted source of censoring, or an unrealistic constant-hazard assumption can make generated outcomes misleading even if the prior parameters are specified correctly. The audit also cannot establish that a prior is scientifically correct, guarantee good operating characteristics, or substitute for expert review. Its conclusions are conditional on the model and design that were simulated.

Common pitfall: “The prior median hazard gives 50% survival at 12 months, so the prior is clinically reasonable.” This reasoning confuses one parameter summary with the full prior predictive distribution. For instance, in the first example, the median hazard of \(0.060\) implies \(S(12)=\exp(-0.72)\approx0.4868\), but the prior’s central hazard quantiles imply much more varied survival values. The correction is to simulate across the joint prior, translate draws into survival probabilities and trial outcomes, and assess the range and frequency of clinically important implications.