Co-Primary Endpoints Under Group Sequential Testing

Why Co-Primary Endpoints Require a Joint Decision

A study with co-primary endpoints is designed to support its principal efficacy conclusion only if every required endpoint demonstrates benefit. For example, a hypothetical treatment might need to improve both symptom severity and physical function. A strong result on symptoms does not compensate for a failure on function if both are necessary to justify the intended claim.

Group sequential monitoring adds a second dimension to this requirement. Each endpoint may be assessed at several planned interim looks, and it may cross its efficacy boundary at a different look from the other endpoints. The design must therefore specify both how each endpoint is tested over time and when the combined co-primary conclusion is allowed.

For a one-sided efficacy test on endpoint \(j\), let \(Z_{jk}\) be its test statistic at interim look \(k\), and let \(b_{jk}\) be the prespecified upper efficacy boundary at that look. The endpoint is rejected if its statistic crosses a boundary at any permitted look. Write \(R_j=1\) if endpoint \(j\) is rejected by the planned end of monitoring and \(R_j=0\) otherwise. The overall study succeeds only if every endpoint is rejected.

In an implementation, the first crossing for each endpoint is recorded as a rejection; a later value that falls below the boundary does not undo it. The trial may stop for efficacy as soon as all required endpoints have crossed. If one or more have not crossed by the final planned look, the co-primary success criterion is not met, even if the remaining endpoints have shown strong evidence.

Sequential Error Control for the Joint Claim

Suppose each endpoint's group sequential test controls its type I error at level \(\alpha\) over all its planned looks. This means that, when \(H_{0j}\) is true, the probability that endpoint \(j\) crosses an efficacy boundary at any look is at most \(\alpha\). This component-level guarantee must be valid for the actual monitoring plan, including its boundary calibration, information times, and any permitted changes to the plan.

No assumption that endpoint statistics are independent is needed to control the type I error of the joint co-primary claim. If the joint null is true, at least one component null, say \(H_{0r}\), is true. Joint success requires rejecting that true component null. Therefore the event of a false joint claim is contained in the event of rejecting \(H_{0r}\), which has probability at most \(\alpha\).

This is the intersection-union logic of co-primary testing: the overall alternative requires all component alternatives, so the study declares success only after rejecting every component null. It explains why one does not automatically divide \(\alpha\) among co-primary endpoints to control the type I error of this single, all-endpoints claim. Each component test can use level \(\alpha\), provided its sequential procedure is itself valid at that level.

This conclusion is specific to the joint success claim. It does not mean that one may make an unrestricted collection of separate endpoint claims at level \(\alpha\). If the intended conclusion includes claims such as “the treatment is effective on endpoint 1” even when endpoint 2 fails, those component claims form a different inferential objective and require an appropriate multiplicity procedure.

A Simple Valid Boundary Construction

A group sequential design will usually choose boundaries that account for the correlation of repeated statistics across looks and allocate error over time using a prespecified spending rule. As a transparent conservative construction, consider \(K\) looks for one endpoint, with a one-sided marginal \(Z\)-statistic that is standard normal under its null at each look. Testing each look at level \(\alpha/K\) gives the endpoint a sequential type I error no greater than \(\alpha\), by the union bound:

This construction is valid without assuming independence across looks, because it bounds the probability of the union of crossing events by the sum of their probabilities. It is generally conservative: standard group sequential boundaries can use the joint distribution of statistics across looks to avoid paying the full union-bound penalty. Either way, it is the validity of each endpoint's whole sequential test—not a nominal single-look threshold by itself—that supports the joint error-control argument.

Interim Timing and the Probability of Joint Success

The joint type I error bound is not a statement about power. Power for the co-primary claim is the probability that all required endpoint tests reject when all corresponding alternatives are true. It depends on the endpoint effects, information accrued at each look, boundary choices, and dependence among the endpoint statistics.

For each endpoint, define \(T_j\) as the first look at which its efficacy boundary is crossed; set \(T_j=\infty\) if it never crosses by the final look. The joint stopping look for efficacy is the latest of the endpoint crossing times, provided all are finite. Thus early crossing on one endpoint can reduce neither the evidence requirement nor the information needed on another: the study cannot make the joint claim until the last required endpoint has crossed.

If the endpoint processes are independent under a specified alternative, then their joint power is the product of their individual sequential powers. Without independence, marginal powers alone do not determine joint power. For two events with marginal probabilities \(p_1\) and \(p_2\), their intersection probability can range from \(\max(0,p_1+p_2-1)\) to \(\min(p_1,p_2)\). Correlated endpoint statistics and shared interim data can therefore materially alter the chance of meeting the all-endpoints criterion.

What Interim Monitoring Changes—and What It Does Not

For co-primary endpoints, interim monitoring changes the opportunities to establish each endpoint's efficacy and can change when the joint claim becomes available. It does not change the logical form of the claim: every required endpoint must still be rejected. If one endpoint crosses early and another crosses later, joint success occurs only at the later crossing. If any endpoint never crosses, no joint success is declared.

The principal alternatives are different testing objectives, not interchangeable ways of stating the same objective. A co-primary rule is an intersection-union test for a single all-endpoints claim. A procedure that allocates alpha across endpoints, such as a Bonferroni procedure, is often used when separate endpoint rejections themselves support claims and familywise control is required. Graphical procedures can specify how testing levels change after rejections when the aim includes a broader family of claims. For the co-primary joint claim, such allocation is not required solely to control the probability of falsely declaring that all endpoints are effective; it may still be required by a different claim structure or protocol commitment.

Diagnostics, Pitfalls, and Limitations

• Using a single-look threshold at every look. Repeatedly checking an ordinary level-\(\alpha\) test generally inflates that endpoint's type I error. Use boundaries or a spending rule calibrated for the complete monitoring schedule.
• Splitting alpha automatically across co-primary endpoints. That is not needed solely for the all-endpoints claim, because a false joint success entails rejection of at least one true component null. It may be needed for a different goal involving separate endpoint claims.
• Calling the trial successful when only some endpoints cross. A co-primary design requires every endpoint. Report which endpoint did not meet its criterion and do not replace the prespecified joint rule with a favorable subset after seeing results.
• Undoing a prior crossing after a later statistic falls. Under a standard sequential rejection rule, crossing is the endpoint's rejection event. A later statistic below the boundary does not erase that event; any alternative rule must be specified and calibrated in advance.
• Multiplying marginal powers without checking dependence. The product is justified only under independence of the relevant endpoint rejection events under the alternative. Otherwise use a joint model or simulation consistent with the design.
• Ignoring endpoint-specific information or missing results. If endpoints mature at different times, or a required endpoint is unavailable at a look, the all-endpoints claim cannot be treated as met by the available results. The planned handling of delayed or missing endpoint information must be followed.

The simple error-control result also has limits. It assumes the component sequential tests really do control their stated levels under the nulls, and that the endpoint hypotheses and efficacy directions have been prespecified. It does not validate a boundary after unplanned looks, changes in the analysis, or data-dependent endpoint selection. Nor does type I error control guarantee adequate joint power: when several endpoints must all succeed, the overall probability of success may be substantially lower than any individual endpoint's power.