The longest-running loop in the trial, and the one with the most separation of duties in it. Data goes in once, is checked by machine and by people, and comes to rest signed.
What happens when someone presses Submit form
The cleaning loop
Who may do what
| Act | Who | Who may not |
|---|---|---|
| Enter and change data | Coordinator, Investigator. Pharmacy for dispensing forms only | Everyone else, including data management and the Organization Admin |
| Raise a query | Project Manager, Clinical Research Associate, Data Manager, Medical Officer, Site Monitor | The site; the Clinical Data Coordinator |
| Answer a query | Investigator, Coordinator, Pharmacy | Whoever raised it |
| Close a query | Data Manager, Medical Officer, Clinical Data Coordinator | The site, and whoever answered it |
| Reopen a query | Clinical Research Associate, Data Manager, Medical Officer | The site |
| Write the SDV plan | Data Manager, Project Manager, Organization Admin | |
| Record a verification | Clinical Research Associate only | Everyone else, including whoever wrote the plan, and whoever entered the value |
| Sign a record | Principal Investigator only | Everyone else |
Three lines are the substance of the workflow: the raiser cannot answer, the answerer cannot close, and the person who writes the verification plan does not execute it.
What is automatic
Dashed arrows in the diagrams. Nobody triggers these.
- Checks run on every save. Each check has a severity: Query (the save succeeds and a query appears), Block (the save is refused) or Warn (the save succeeds with a message). The server repeats the checks and recalculates calculated fields and table cells; it never trusts the browser (Validation, edit checks and their severities).
- Auto queries close themselves when the check stops firing and nobody has answered them; a rule query and a validation query on the same field are reconciled together.
- Verifications go stale. Each stores a hash of the value the monitor saw; if the value changes the verification becomes Stale and returns to the monitor's queue.
- Signatures are withdrawn the same way: a change to signed content is an authorized correction that withdraws the signature, with the withdrawal in the audit trail. The record is never silently changed behind a signature.
Correcting data is deliberately hard
A saved value is read-only. It opens for correction only while a live query on it exists that somebody else raised (or that a check raised), and the save asks a reason for change. A query you raised yourself never opens the value for you. Every correction is therefore attributable to a question someone else asked, which is what makes the audit trail meaningful (Correct data).
The window blocks in one direction only
Before a visit's window opens, entry is blocked; a coordinator or investigator may lift it for that visit with an audited early access and a reason. After the window has passed, entry is never blocked: a late visit is flagged out of window, but recording real, late data beats not recording it.
Where this goes wrong
| Symptom | Cause |
|---|---|
| "It won't let me change this value" | No live query on it from someone else. Ask for one to be raised |
| "The window hasn't opened" | Too early. Record early access if there is a reason |
| "I answered my own query and it refused" | You raised it. Someone else must answer |
| "The query reopened by itself" | It is an automatic query and the value still fails its check |
| "A verified field is back in my queue" | Someone changed the value; verify it again |
| "My signature was withdrawn" | An authorized correction changed the signed content; the investigator signs again |
| "Submit form saved nothing" | A required value is empty, or a Block check failed. The problems are listed |
Do it
Enter visit data · Correct data · Work with queries · Monitor and verify data · Sign records
Compliance Q&A
Yes. A saved value changes only when another person has raised a live query on it, with a reason; the audit trail keeps the earlier value, the new value, who changed it, when and why, and a signature on the record is withdrawn by the change, never overwritten.
Evidence: server data-capture (a saved value changes only through a query raised by someone elsereason requiredaudit events form.field_entered and form.field_modified)simulation of 20 Oct 2026, steps 6.1 to 6.12