Why Intersection Hypotheses Are Needed
When a trial monitors more than one endpoint, a favorable result on one endpoint does not by itself establish that the family of endpoint claims has controlled type I error. The closure principle addresses this by requiring tests not only of the individual endpoint null hypotheses, but also of every nonempty intersection of them. With interim looks, each of those tests must account for the opportunity to reject at multiple looks.
This tutorial constructs those hypotheses for two- and three-endpoint families and identifies the group sequential test required for each. The examples use one-sided efficacy hypotheses, with positive effects denoting benefit. Other scientific directions can be handled by defining the endpoint nulls appropriately before forming their intersections.
For example, suppose endpoint \(i\) has effect parameter \(\theta_i\), with benefit in the positive direction. A common one-sided formulation is \(H_i:\theta_i\leq 0\) versus \(H_{a,i}:\theta_i>0\). For two endpoints, \(H_{12}\) means \(\theta_1\leq0\) and \(\theta_2\leq0\) simultaneously. Its alternative is that \(\theta_1>0\) or \(\theta_2>0\), or both. It is not the hypothesis that both endpoints are beneficial.
What Must Be Tested at Each Intersection
For each nonempty set \(I\) of endpoints, specify a test of \(H_I\). In a group sequential design, that test must control its type I error over all planned interim and final looks. A test that has level \(\alpha\) at a single final analysis is not automatically level \(\alpha\) when the data are examined repeatedly.
One general construction uses endpoint statistics \(Z_{i,k}\), where \(k=1,\ldots,K\) indexes the looks. For a one-sided design, a test of \(H_I\) may reject if an endpoint statistic in \(I\) crosses its prespecified boundary at any look. The boundaries for the intersection test must be calibrated for the joint behavior of the relevant endpoint statistics over the planned looks. They can depend on endpoint correlation, information fractions, and the chosen group sequential error-spending design.
The essential validity requirement is that the probability of \(R_I\) be at most the test's local significance level whenever \(H_I\) is true. If the familywise target is \(\alpha\), closure commonly uses local tests at level \(\alpha\) for every intersection. The test may use a joint boundary for the maximum statistic, a more general joint rejection region, or another valid construction. What matters here is that its calibration controls error for the entire intersection test across endpoints and looks—not that every endpoint be tested as though it were the only endpoint.
Two-Endpoint Families
With two endpoint nulls, there are three nonempty intersections: each singleton and the intersection of both. The singleton tests are the group sequential tests for the individual endpoint hypotheses. The joint test is a group sequential test of the conjunction \(H_1\cap H_2\).
| Index set \(I\) | Intersection null \(H_I\) | Required group sequential test |
|---|---|---|
| \(\{1\}\) | \(H_1\) | Test endpoint 1 across its planned looks |
| \(\{2\}\) | \(H_2\) | Test endpoint 2 across its planned looks |
| \(\{1,2\}\) | \(H_1\cap H_2\) | Test the joint intersection across endpoints and looks |
The closure rule determines the endpoint-level conclusions. Endpoint 1 can be rejected only if both \(H_1\) and \(H_{12}\) are rejected by their respective group sequential tests. Endpoint 2 can be rejected only if both \(H_2\) and \(H_{12}\) are rejected. Thus, a crossing in a singleton test alone is insufficient.
Worked Example: Listing the Tests for Two Clinical Endpoints
Suppose a hypothetical trial has two one-sided primary efficacy endpoints: symptom improvement, with effect \(\theta_1\), and functional improvement, with effect \(\theta_2\). For each endpoint, \(H_i:\theta_i\leq0\) and \(H_{a,i}:\theta_i>0\). The design has three planned looks.
There are three required intersection tests:
Endpoint 1: Test \(H_1:\theta_1\leq0\) with the prespecified group sequential procedure for symptom improvement over all three looks.
Endpoint 2: Test \(H_2:\theta_2\leq0\) with the prespecified group sequential procedure for functional improvement over all three looks.
Both endpoints: Test \(H_{12}:\theta_1\leq0\) and \(\theta_2\leq0\) with a group sequential procedure calibrated for the joint endpoint statistics over all three looks. Rejection of this intersection means there is evidence against at least one of its component nulls; it does not assert that both endpoints are beneficial.
If the familywise target is \(\alpha=0.025\), each local intersection test must satisfy its level requirement at 0.025 under its own null. The joint test cannot simply reuse a boundary that is valid for a single endpoint unless that boundary has also been shown to control the joint test's error over both endpoints and all three looks.
Three-Endpoint Families
For three endpoints, there are seven nonempty intersections: three singletons, three pairwise intersections, and the intersection of all three. Each requires a group sequential test. The list is determined by taking every nonempty subset of endpoint indices, not just the individual hypotheses and the global intersection.
| Intersection size | Index sets | Tests required |
|---|---|---|
| One endpoint | \(\{1\},\{2\},\{3\}\) | Three singleton group sequential tests |
| Two endpoints | \(\{1,2\},\{1,3\},\{2,3\}\) | Three pairwise intersection group sequential tests |
| Three endpoints | \(\{1,2,3\}\) | One group sequential test of the full intersection |
In set notation, the complete family is \(\{I:I\subseteq\{1,2,3\}, I\neq\varnothing\}\). For endpoint 1 to be rejected under closure, all four tests whose index sets contain 1 must reject: \(H_1\), \(H_{12}\), \(H_{13}\), and \(H_{123}\). For endpoint 2 the required set is \(H_2,H_{12},H_{23},H_{123}\); for endpoint 3 it is \(H_3,H_{13},H_{23},H_{123}\).
Worked Example: Constructing All Intersections for Three Endpoints
Consider a hypothetical trial with endpoints for pain, mobility, and rescue-medication use. Let \(H_1,H_2,H_3\) be the prespecified one-sided null hypotheses for these endpoints, each stating that there is no beneficial effect or that the effect is in the unfavorable direction.
The singleton tests are tests of \(H_1\), \(H_2\), and \(H_3\), each using its planned group sequential monitoring. The pairwise tests are tests of \(H_1\cap H_2\), \(H_1\cap H_3\), and \(H_2\cap H_3\), each calibrated jointly over the two named endpoints and all planned looks. Finally, \(H_1\cap H_2\cap H_3\) requires a group sequential test calibrated over all three endpoint processes and their looks.
For example, rejecting \(H_1\) as an endpoint claim requires rejection of \(H_1\), \(H_1\cap H_2\), \(H_1\cap H_3\), and \(H_1\cap H_2\cap H_3\). Rejection of the triple intersection alone is not enough: it only indicates evidence against at least one of the three nulls, without identifying which endpoint has passed all closure requirements.
Justification of the Closure Rule
The error-control argument explains why the intersection tests are arranged this way. Suppose at least one elementary null is true, and let \(I_0\) be the set of all endpoints whose null hypotheses are true. Then \(I_0\) is nonempty and \(H_{I_0}\) is true. If closure falsely rejects any true elementary null \(H_i\), the closure rule requires rejection of every intersection containing \(i\), including \(H_{I_0}\).
Because the group sequential test of \(H_{I_0}\) controls its type I error at level \(\alpha\), the probability of the event on the right is at most \(\alpha\). The probability of falsely rejecting one or more true endpoint nulls is therefore also at most \(\alpha\). This is the familywise error guarantee, provided every intersection test is valid at its stated level, including its repeated looks.
Worked Sequential Decisions and Diagnostics
Worked Example: A Singleton Crossing Does Not Complete Closure
Suppose two hypothetical endpoints are monitored at two looks. Assume a valid calibration has supplied the following illustrative one-sided boundaries: for each singleton test, 2.50 at look 1 and 2.00 at look 2; for the joint \(H_{12}\) test based on the maximum of the two endpoint statistics, 2.65 at look 1 and 2.15 at look 2. These boundaries are stipulated as outputs of an appropriate joint calibration; they are not universal cutoffs.
The observed statistics are \(Z_{1,1}=2.20\), \(Z_{2,1}=1.60\), \(Z_{1,2}=2.05\), and \(Z_{2,2}=2.10\). Endpoint 1 crosses its singleton boundary at look 2 because \(2.05\geq2.00\), so \(H_1\) is rejected. Endpoint 2 also crosses its singleton boundary at look 2 because \(2.10\geq2.00\), so \(H_2\) is rejected.
For the joint intersection test, the maximum statistic is 2.20 at look 1, below 2.65, and 2.10 at look 2, below 2.15. Thus \(H_{12}\) is not rejected. Although both singleton tests crossed, neither endpoint null can be rejected under closure: the required joint intersection test did not reject. The numerical comparison is valid only because the example stipulates boundaries already calibrated for these specific tests and looks.
Useful diagnostics focus on whether the tests being applied match the hypotheses being claimed. Check that every nonempty subset is present; that the joint test for each subset uses the correct endpoint statistics; and that its calibration covers the entire planned look schedule. In particular, a boundary calibrated for one endpoint is not automatically valid for a maximum across endpoints. Correlation among endpoints can affect the joint calibration, so independence should not be assumed unless justified by the design and analysis.
Common Pitfalls and Scope
- Testing only the individual endpoints. Even valid group sequential tests of each endpoint do not by themselves establish closure-based familywise control. Include the required intersections.
- Requiring every endpoint in an intersection to be beneficial. The intersection null is a conjunction of nulls; its alternative is that at least one component null is false.
- Ignoring the interim looks in joint tests. A joint endpoint calibration at the final look alone does not necessarily control rejection over repeated looks.
- Assuming a single universal joint boundary. The valid boundary or rejection region depends on the test statistics, dependence, information pattern, and monitoring plan.
The closure construction identifies which hypotheses must be tested and which tests must reject; it does not prescribe one uniquely optimal joint test. Different valid group sequential procedures may be used for an intersection, with different power and implementation requirements. The specified procedure must be fixed and calibrated before its results are used for confirmatory claims.
Check Your Understanding
Answer each question, then compare your reasoning with the solutions.
- For two endpoint nulls \(H_1\) and \(H_2\), list every nonempty intersection and state the test type required for each.
- For three endpoints, how many intersection tests are required in total, and how many are pairwise?
- Under closure with three endpoints, which tests must reject before \(H_2\) can be rejected?
- A singleton group sequential test rejects \(H_1\), but \(H_1\cap H_2\) does not reject. Can \(H_1\) be rejected under closure? Explain.
Solutions. (1) The intersections are \(H_1\), \(H_2\), and \(H_1\cap H_2\); each needs a valid group sequential test across its relevant endpoint or endpoints and all planned looks. (2) There are seven tests: three singleton, three pairwise, and one triple intersection test; three are pairwise. (3) The tests of \(H_2\), \(H_1\cap H_2\), \(H_2\cap H_3\), and \(H_1\cap H_2\cap H_3\) must all reject. (4) No. Closure requires rejection of every intersection containing endpoint 1, including \(H_1\cap H_2\), so its failure to reject prevents rejection of \(H_1\).