From a study that has just been created to a released design capturing production data. This is the one workflow where the handoffs are also legal controls, so it is worth reading before you plan a timeline.
The flow
The handoffs
| # | Who | Does | Passes to |
|---|---|---|---|
| 1 | Organization Admin | Creates the study and names its Project Manager (Create a study) | The Project Manager |
| 2 | Project Manager | Staffs the team: designer, data manager, monitors, medical officer, sponsor staff (Staff a study team) | The build team |
| 3 | eCRF Designer, Project Manager | Draw the forms and the visit schedule, map forms to visits, set the study's settings (Build a study) | The Project Manager |
| 4 | Project Manager or Organization Admin | Submit to UAT; the design is frozen (Review and release a study) | The testers |
| 5 | The team | Rehearse on test participants at test sites; raise issues (Test a version in UAT) | The Project Manager |
| 6 | Project Manager or Organization Admin | Pass or fail the cycle | The three signatories |
| 7 | Project Manager, Data Manager, Sponsor Manager | Sign as Author, QA and Approver (Sign off a version and go live) | The Project Manager |
| 8 | Project Manager | Registers and activates the Live sites, provisions the investigators (Open a site) | |
| 9 | Project Manager or Organization Admin | Go live, typing the version number | The sites |
The gates
Submit to UAT freezes the design. It publishes the draft forms, compiles the whole design into a snapshot with a content hash, opens UAT cycle 1 and moves the version to UAT. From then on forms, visits, mappings and rules are read-only. The submit is refused with the whole list at once if the design has problems: an empty design, duplicate codes, a binding or rule to something that does not exist, a form no visit holds, a visit with no form, no protocol on file, event forms that do not say what they are.
A cycle that fails comes back. A failed cycle returns the version to Build with its findings as the requirements of the next round (Correct a design after UAT); the next submit is a new snapshot and a new cycle.
The three sign-offs are three people in three capacities. The capacity comes from the role, not from a choice: the Project Manager signs as author, the Data Manager as QA, the Sponsor Manager as approver. The designer and the Organization Admin have no control to sign. Each signature needs a fresh code and is bound to the snapshot the passed cycle tested; a rejection returns the version to Build and withdraws the signatures given so far.
Go live needs the checklist complete: a passed cycle, three current sign-offs, the same snapshot, and (for the first go-live) an active Live site with an investigator at every active one. UAT sites do not carry over; Live sites are registered fresh. It is one transaction: the version becomes the Live design, the study moves from Setup to Active, and with no downtime.
Roles can be given while the study is in Setup. The old rule that held back the operational roles until UAT was retired (ADR 0013); the team can be staffed from the start, which is how the simulation did it.
What UAT is for
Everything captured in UAT is test data, kept in its own workspace; it never appears once the study is Live. You rehearse the whole study (register a site, enroll a participant, capture a visit, raise a query, sign a record) and keep the evidence. Production sites and participants are created fresh after the release.
Watch a study come to life. It advances Build → UAT → Live; roles enter as they’re needed, and every operation is marked built, partial, or not built yet — honestly.
These clinical capabilities would live in the Live environment but aren’t built. Shown here so the picture is honest, not aspirational.
Generating and sending expedited reports (E2B), a gateway, and automatic reconciliation with the safety database.
What is not built yetInventory, dispensing, resupply, kits, depots and shipments.
What is not built yetAllocation of participants to treatment, and hiding the arm from the people who must not see it.
What is not built yetCoding of adverse events, history and medications to standard dictionaries.
What is not built yetKey risk indicators, central statistical monitoring and monitoring-visit reports.
What is not built yetWhere this goes wrong
| Symptom | Cause |
|---|---|
| "Submit to UAT is refused" | The design has problems, or there is no protocol on file. The refusal lists every one |
| "The form won't let me edit it" | The version has been submitted. A failed cycle reopens Build; after release only an amendment does |
| "I have no Sign off control" | You are the designer or an Organization Admin, or you already signed as another capacity, or the version is not Awaiting sign-off |
| "Go live stays off" | The checklist shows which item is missing: the cycle, a signature, the snapshot, or a Live site with an investigator |
| "Release of an amendment is refused: the SDV plan names something this version does not have" | A verification requirement of the version being replaced names a form, field or visit the amendment no longer has. Retire the requirement in the Live SDV Plan, or restore what it names (which needs sign-offs again) |
Do it
Create a study · Build a study · Design forms · Plan visits · Review and release a study
Compliance Q&A
Yes. The design is frozen with a hash when it is submitted, tested in a cycle of its own, signed by three different people in three capacities, and released by a step that refuses to proceed until the checklist is complete. Every step is in the audit trail.
Limits: what is tested in UAT, and whether it is enough, is the customer's validation plan; the system provides the cycle, the issues and the evidence.
Evidence: server versions (frozen snapshot with content hashUAT cyclethree sign-offs bound to the snapshotgo-live checklist)simulation of 20 Oct 2026, steps 4 to 6