Why Audit Censoring Records?
A censoring indicator is not merely a code attached to a follow-up time. It summarizes a sequence of records: when observation began, whether an event occurred, when the participant was last known to be event-free, and why observation ended. A wrong date or reason can change a participant from censored to an observed event, assign the wrong competing event cause, or misstate the length of follow-up. Each error can affect the risk sets and summaries used in event-history analyses.
An audit checks whether the analysis fields agree with the study definitions and source records. It does not, by itself, establish that censoring is statistically independent of the event process. That is a separate assumption, discussed in the earlier material on right-censoring mechanisms and independent censoring.
Define the Records Being Checked
The event time \(T_i\) is not observed for a participant censored before an event. In that case, the data contain the censoring time and status, not a known event-free time beyond the last adequate evidence of being event-free. The audit therefore compares the analysis record with documented event and follow-up information; it must not fill in an unobserved event date.
Before checking arithmetic, specify the intended origin, eligible event definitions, censoring rules, and date precision. For date-only records, a useful convention is elapsed calendar days: the origin date is day zero, and the difference between two dates is the later date minus the earlier date. Thus a date one calendar day after the origin corresponds to one elapsed day, not two. If timestamps or a different convention are used, state that rule explicitly and apply it consistently.
A Reproducible Audit
A sound audit links each derived field to a defined source and checks the chain in both directions. Start with the protocol and data dictionary, then compare the analysis file with the relevant event, contact, withdrawal, and vital-status records. Do not decide a discrepancy from the analysis code alone: first determine what the source documents establish under the study definitions.
Check that the participant, origin date, event definition, and event-cause categories match the study rules. Verify that the chosen origin is the one intended for the analysis.
Compare the event indicator and, when applicable, cause code with event records. For a censored record, check that the stated reason describes the documented end of observation and does not conflict with evidence of an eligible event.
Subtract the origin date from the event date or last adequately documented event-free date, using the declared convention. Check for impossible ordering, missing dates, and a recorded duration that does not match the dates.
Record the evidence used, the decision, and any corrected fields. Re-run consistency checks after corrections and retain unresolved cases for explicit review rather than silently assigning a status.
Worked Audits
Worked Example: Checking an Event Date and Duration
Suppose a hypothetical study defines randomization as time zero and records the first qualifying event. One participant was randomized on January 1, 2025. The event record gives February 1, 2025, and the analysis file records an observed event with a duration of 32 days. Check the duration using elapsed calendar days.
The origin date is day zero. January 1 to February 1, 2025, is 31 elapsed days: January 1 to February 1 is the difference between those calendar dates, not a count that includes both endpoints as separate elapsed days. Therefore,
The event indicator is consistent with the event record if the documented event meets the study definition, but the stored duration of 32 days does not match the stated date convention. The record should be flagged for correction or clarification. If the source actually used a different origin or timestamp convention, that must be established from the study specification rather than inferred to make 32 days fit.
Worked Example: Resolving a Status and Reason Conflict
In a hypothetical competing-risks dataset, a participant's origin date is April 2, 2025. The analysis file labels the participant as censored on May 11 and gives “lost contact” as the reason. A separately linked, verified event record documents a qualifying event of cause 1 on May 12. Assume the event record is confirmed to refer to this participant and the event qualifies under the protocol.
The dates imply 39 elapsed days to the recorded last-known-alive date (April 2 to May 11) and 40 elapsed days to the documented event date (April 2 to May 12). Those calculations are consistent with the calendar. But the analysis status and reason conflict with the verified event record: if the event is in scope and the date is confirmed, this observation is an event of cause 1 at 40 days, not a censoring at 39 days. The value \(J_i\) should identify cause 1, and \(\Delta_i=1\).
The review should retain the evidence and the correction rationale. If the event were not qualifying, or the linkage uncertain, the status could not be changed solely because a date appears in another file; the case would need adjudication under the event definition. A reason label such as “lost contact” is not enough to override an established event, and a reason label alone cannot establish the exact censoring date.
Worked Example: Detecting a Time-Origin Mismatch
Consider a hypothetical participant diagnosed on January 1, 2025, enrolled on January 15, and observed to have a qualifying event on February 1. The analysis is intended to measure time from enrollment, but a data-processing script used diagnosis as the origin.
With enrollment as the defined origin, the event duration is January 15 to February 1, or 17 elapsed days. Using diagnosis instead gives January 1 to February 1, or 31 elapsed days. The discrepancy is not an arithmetic error; it is a mismatch in the time origin.
The correction depends on the estimand and study design. If follow-up is intended to begin at enrollment, the analysis duration should be 17 days. If the scientific time scale is time since diagnosis, the 31-day event time may be relevant, but the participant was only observed from day 14 after diagnosis. The analysis record must represent that entry point appropriately; simply relabeling the 31-day duration as follow-up since enrollment would be wrong. The audit should therefore check the origin and the observation start together, not just recalculate one duration.
Why the Checks Matter
A misclassified status changes more than a descriptive label. Treating an observed competing event as censoring removes an event that should be represented as a distinct outcome. Treating a censored participant as an observed event adds an unsupported event time. A shifted origin can change durations for many records at once and may alter who is considered under observation at a given analysis time.
The reason field is useful for finding patterns and guiding review, but it is not a substitute for the status definition. “Withdrawal,” “lost contact,” and “administrative end” can be recorded inconsistently across systems. The analyst should distinguish the operational reason observation stopped from whether an eligible event had already occurred. Also, a consistent status, reason, and date do not prove the censoring assumption: the participant may still differ systematically from those remaining under observation.
For audit work, compare complementary approaches. Automated validation is efficient for detecting impossible date orders, durations that fail to recalculate, missing reason codes, and incompatible status-code combinations. It cannot reliably interpret ambiguous source text or decide whether an event meets a clinical definition. Manual source review can resolve those substantive questions, but is slower and can be inconsistent unless decisions are documented. A combined process uses code to flag records and structured human review to adjudicate them.
Useful diagnostics include counts of records in each status-reason combination, summaries of date differences between source and analysis files, and listings of negative or unusually long durations. Inspect individual records behind unexpected patterns. A “no discrepancies” report is informative only if the checks cover the actual definitions, origins, and source fields used in the analysis.
Common Pitfalls and Limits
- Counting both endpoint dates as elapsed days. Under the elapsed-calendar-day convention, the origin date is day zero. Inclusive counting can add one day to every duration.
- Assuming a censoring reason determines the status. A reason code describes why observation may have ended; it does not overrule a qualifying event documented before or at that time.
- Fixing durations without checking origins. A duration can be arithmetically correct for the wrong origin. Reconcile the origin definition and observation start before changing a value.
- Using the last contact date as the censoring date without checking its content. A contact date is a censoring date only if it provides adequate evidence of event-free status under the study rules.
- Equating a clean audit with valid censoring assumptions. Internal consistency cannot show that censoring is unrelated to future event experience, either marginally or conditional on measured information.
- Silently resolving ambiguous records. If evidence does not establish a status or date, preserve the uncertainty and follow a documented adjudication rule rather than guessing.
Auditing also has limits: source records can be incomplete, dates may be recorded only to the day, and event definitions may require adjudication. If event and censoring are both recorded on the same date, date-only data may not identify their ordering. Apply the prespecified tie rule, seek finer timing if available, and report unresolved ambiguity rather than inventing a sequence.
Check Your Understanding
Answer each question, then compare with the solutions.
- A participant's origin is March 3, 2025, and the last adequately documented event-free date is March 10, 2025. Under elapsed-calendar-day counting, what is the duration?
- An analysis record says “censored: withdrew,” but a verified record documents a qualifying event before withdrawal. What should the audit check before changing the analysis status?
- A participant has an event 20 days after enrollment, but the analysis file reports 35 days from an earlier diagnosis. Name the inconsistency and one additional design feature to check.
- Why does a complete, internally consistent censoring audit not establish independent censoring?
Solutions. (1) March 3 to March 10 is 7 elapsed days, with March 3 as day zero. (2) Confirm participant linkage, event date, event definition, and source reliability; if the event qualifies and precedes or coincides with the relevant censoring time under the tie rule, record it as an event with its cause rather than as censoring. (3) The time origins differ: 20 days is measured from enrollment and 35 from diagnosis. Check when observation began relative to diagnosis and whether the analysis represents that entry time correctly. (4) An audit checks whether recorded fields agree with definitions and evidence. Independent censoring concerns the relationship between censoring and event experience, which cannot be established merely by consistent dates, codes, and reasons.