Audited UAT package and regulatory submission exports

Purpose

Provide retained, audited evidence that the configured study works as intended before go-live (21 CFR 11.10(a), FDA Computer Software Assurance guidance) and produce the datasets typically requested for submission or inspection.

Expected outcome

The Lifecycle & Exports tab shows a QA-released UAT package for the current design revision, activation is allowed, and submission files are downloaded with a SHA-256 manifest.

Prerequisites

An approved current design revision (Design Step 9). Generating and executing cases requires Studies.Manage. Sign-offs require Biostatistics (unblinded with Randomization.Manage), CTSM (Inventory.Manage) and QA (Audit.View). Exports require Data.Export.

Section 1: The audited UAT package

• Traceability matrix - each URS requirement maps to at least one UAT case.
• Pre-approved script - a person other than the author approves the Draft by electronic signature; the script SHA-256 is frozen and cases can no longer change.
• Executed results and objective evidence - time-stamped Pass, Fail or N/A with inputs, actual result and evidence references; executions are append-only.
• Deviations and bug log - a Fail opens a deviation that closes only with root cause, resolution, risk impact and a later passing retest.
• Part 11 sign-off - Biostatistics, then CTSM, then QA last; each signer is a different person and QA must not have executed any case. QA release stores a PDF and its SHA-256.

Section 2: Activation gate

Moving from Setup to Active is blocked until a QA-released package exists for the current design revision. Any later design change requires a new package.

Section 3: Submission exports

1. Subject and randomization - SDTM DM, DS, TV and the code-break log.
2. IP exposure - SDTM EX.
3. Supply accountability - lots, shipments, kit chain of custody, reconciliation.
4. Cold chain - temperature readings and excursions with QA decisions.
5. GxP audit trail - audit trail with old/new values and the user access log.
6. eCTD validation artefacts - master randomization list (unblinded only), URS traceability and the released UAT PDF.

The ZIP package contains manifest.csv with record counts and SHA-256 per file and a README stating BLINDED or UNBLINDED status. Every export is recorded in the audit trail.

Troubleshooting and checks

"Not available" in the manifest means the source does not exist yet, for example no released UAT package. "Withheld" means your role cannot receive that dataset. Blinded users receive masked treatment columns.