Clinical Data Management: Processes, Systems, and Standards

Clinical data management (CDM) is the set of processes, standards, and quality controls that turn raw information collected during a clinical trial — case report form entries, laboratory results, patient-reported outcomes, imaging read-outs, device data — into a clean, complete, traceable dataset that a sponsor can submit to a regulator and a statistician can analyze. It sits between data collection and biostatistics in the clinical trial workflow, and it is where most of the operational work of “making trial data trustworthy” actually happens.

This guide covers what clinical data management includes operationally, the standards and systems that govern it, how it fits into the broader research-data and research-integrity landscape CASRAI works in, and where it differs from adjacent disciplines (biostatistics, clinical trial management, pharmacovigilance) that are often confused with it.

What clinical data management actually covers

A clinical data manager’s responsibilities span the full data lifecycle of a trial, not just database administration. The core activities, roughly in workflow order, are:

• Case report form (CRF) design — defining what data is collected, in what format, at what visit, mapped to the study protocol and statistical analysis plan.
• Database build and validation — configuring the electronic data capture (EDC) system with the CRF structure, edit checks, and skip logic, then running user acceptance testing (UAT) against a documented validation plan before the system moves from build to live data entry. This is the point at which 21 CFR Part 11 validation requirements attach to the system itself, not just the data it later holds.
• Edit check specification — programming automated range, consistency, and logic checks that flag implausible or incomplete entries as data is entered.
• Data cleaning and query management — issuing queries to sites when data looks wrong or is missing, tracking query resolution, and re-verifying corrected values.
• Medical coding — mapping free-text adverse events, medical history, and concomitant medications to standardized dictionaries (see below) so terms are analyzable and comparable across sites and studies.
• External data reconciliation — merging and cross-checking data from sources outside the EDC: central laboratories, ECG cores, imaging vendors, wearables, interactive response technology (IRT) for randomization and drug supply.
• Source data verification (SDV) follow-through — while SDV itself is usually performed by clinical monitors/CRAs rather than the CDM team, discrepancies it turns up against site source documents are logged and resolved through the same query-management process CDM runs for its own edit-check findings. See CASRAI’s Source Data Verification (SDV) entry.
• Database lock — the formal, documented point at which the dataset is frozen (no further edits without a controlled unlock process) once cleaning is complete, so statistical analysis can begin against a fixed dataset.
• Dataset preparation for submission — transforming the cleaned collection data into the tabulation and analysis formats regulators require (see CDISC below).

CDM is distinct from biostatistics (which designs the analysis and interprets the locked dataset), clinical trial management (site selection, monitoring visits, regulatory submissions to IRBs/ethics committees — see CASRAI’s guide on the IRB/REC approval process), and pharmacovigilance (ongoing safety-signal monitoring, which consumes coded adverse-event data CDM produces but runs its own separate workflow). In practice the boundaries blur at a smaller sponsor or CRO, where one team may cover several of these functions, but the underlying activities are recognizably distinct disciplines with distinct professional bodies and standards.

Electronic data capture (EDC) vs. a clinical data management system (CDMS)

These terms are frequently used interchangeably in vendor marketing, which causes real confusion for people searching for what a “clinical data management system” actually is:

• Electronic Data Capture (EDC) is, strictly, the system through which sites enter case report form data — the patient-facing/site-facing data entry layer.
• Clinical Data Management System (CDMS) is the broader term for the platform (which may be the same commercial product as the EDC, or a connected suite) that also handles query management, coding, edit-check logic, audit trails, and data export/reconciliation across the full CDM workflow described above.
• Clinical Trial Management System (CTMS) is a separate category entirely — it manages trial operations (site contracts, monitoring visit tracking, enrollment, budgets), not the clinical data itself, though it typically integrates with the CDMS/EDC.

Most contemporary commercial products (e.g., unified EDC/CDMS platforms) blur these lines by design, but the functional distinction — data capture and cleaning (CDM/EDC) vs. trial operations (CTMS) vs. safety-signal analysis (pharmacovigilance) — is still the correct way to reason about which system does what when evaluating or describing a trial’s technology stack.

How CDM connects to source data verification and clinical monitoring

Source data verification, centralized monitoring, and scheduled interim monitoring visits are typically run by the clinical monitoring / CRA function rather than the CDM team itself, but the two workflows feed each other directly and both have to clear before database lock:

• Source Data Verification (SDV) — monitors cross-check what was entered in the EDC against the site’s original source documents (charts, lab reports, imaging read-outs). Discrepancies become queries that route into CDM’s standard query-management workflow, the same pipeline that handles automated edit-check findings.
• Centralized monitoring — a remote, risk-based review of aggregated trial data across sites, often built directly on CDM’s own edit-check rates, query metrics, and other data-quality indicators as inputs for identifying which sites or data points need closer attention.
• Interim monitoring visits (IMVs) — the scheduled, periodic site visits (on-site or remote) at which SDV and other source-document checks are actually performed across the course of the trial, rather than only at trial closeout.

This is why database lock is a cross-functional milestone rather than a CDM-only sign-off: a lock checklist has to confirm not just that CDM’s own edit checks and coding queue are clear, but that outstanding SDV findings and open monitoring queries are resolved too.

The standards that govern clinical data management

CDISC foundational standards

The Clinical Data Interchange Standards Consortium (CDISC) maintains the standards that let clinical trial data move from collection through regulatory submission in a consistent, machine-readable structure:

• CDASH (Clinical Data Acquisition Standards Harmonization) — standardizes how data is collected: recommended variable names, definitions, and CRF structure at the point of data entry.
• SDTM (Study Data Tabulation Model) — the standard structure collected data is mapped into for tabulation and regulatory submission, organized into standardized domains (e.g., demographics, adverse events, laboratory results).
• ADaM (Analysis Data Model) — derived from SDTM, structures data specifically for the statistical analyses defined in the statistical analysis plan.
• SEND (Standard for Exchange of Nonclinical Data) — the SDTM-family equivalent for nonclinical (animal/toxicology) study data.

FDA’s Study Data Technical Conformance Guide specifies SDTM, ADaM, and SEND (plus a define.xml metadata file describing the dataset structure) as the required formats for standardized study data submitted to CDER and CBER — this is the direct regulatory reason CDM teams build to CDISC standards from the start of a study rather than reformatting data after the fact. CDISC’s standards portfolio continues to evolve; SDTM reached version 2.1 in 2024, with newer major versions and a Dataset-JSON exchange format in various stages of public review as of 2026 — check cdisc.org/standards directly for the current version in force for a given submission, since FDA’s supported-standards catalog is updated on its own cycle separate from CDISC’s release cycle.

Medical coding dictionaries

Free-text clinical terms (what a patient or investigator actually writes on a form) are coded to standardized dictionaries so they can be aggregated and compared:

• MedDRA (Medical Dictionary for Regulatory Activities) codes adverse events, medical history, and indications. It was developed under ICH and is maintained by the Maintenance and Support Services Organization (MSSO); a MedDRA-coded term is a requirement for electronic submission of individual case safety reports to regulators in the US, EU, and Japan.
• WHODrug codes medications and concomitant drug therapy, maintained by the Uppsala Monitoring Centre (the WHO Programme for International Drug Monitoring).

Both dictionaries are versioned and updated on regular release cycles; CDM teams typically fix the dictionary version at study start and document any mid-study up-versioning, since a coding change mid-trial affects comparability of coded terms across the dataset.

Good Clinical Data Management Practices (GCDMP)

The Society for Clinical Data Management (SCDM) publishes Good Clinical Data Management Practices (GCDMP), the field’s own reference standard, organized into chapters covering each CDM area of responsibility (CRF design, database design, data quality, coding, database closure, and more), each with a “Minimum Standards” and “Best Practices” section. It functions as the discipline’s equivalent of a professional practice standard where CDM itself isn’t directly named in ICH’s core GCP text. SCDM also administers the Certified Clinical Data Manager (CCDM) credential, the field’s recognized professional certification.

Regulatory framework: ICH GCP, 21 CFR Part 11, and data integrity

Clinical data management operates inside the same Good Clinical Practice framework as the rest of a trial. See CASRAI’s dictionary entry on ICH GCP (Good Clinical Practice) for the full standard. Two points specific to data management:

• ICH E6(R3), the current revision of the core GCP guideline, was finalized on 6 January 2025, with the EMA setting a 23 July 2025 effective date for the Principles and Annex 1 in the EU, and FDA issuing its own final E6(R3) guidance on 8 September 2025. E6(R3) places more explicit emphasis on data governance, risk-based quality management, and the use of technology in trials than prior revisions — directly relevant to how CDM processes are designed and documented going forward.
• 21 CFR Part 11 is FDA’s regulation governing electronic records and electronic signatures used in regulated studies — it sets the requirements (audit trails, access controls, electronic signature validation) that any EDC/CDMS handling submission-bound data must meet.
• ALCOA+ — the data-integrity framework requiring that data be Attributable, Legible, Contemporaneous, Original, and Accurate (plus Complete, Consistent, and Enduring) — originated in FDA’s CGMP data-integrity guidance but is applied across GxP domains, including clinical data management, as the working shorthand for “is this record trustworthy.” An audit trail that shows who entered or changed a value, and when, is the operational mechanism that makes a dataset ALCOA+-compliant.

Why this matters beyond the compliance office

Clinical trial data is research data, and the same principles CASRAI documents for research data management generally — documented provenance, standardized structure, planned retention and reuse — apply to it with an added regulatory layer. A locked, SDTM-formatted clinical dataset is, functionally, a highly governed instance of the research data lifecycle described in CASRAI’s Research Data Lifecycle guide: collection, quality control, structured formatting, and archiving for later reuse (secondary analysis, meta-analysis, regulatory re-review, or data sharing under a funder or journal data-sharing policy). Where a clinical trial produces a data management plan, the same operational distinctions covered in CASRAI’s Data Management Plan (DMP) entry apply, adapted to the regulatory-submission end point rather than open deposit.

Roles like data curation — covered in CASRAI’s CRediT context via Data Stewardship and the Data Curator Role in Research — and the growing use of synthetic clinical data for training, testing, or privacy-preserving sharing (see CASRAI’s guide to synthetic data in research) both intersect with clinical data management practice as trials increasingly generate data intended for reuse well beyond the original submission.

Frequently asked questions

What is clinical data management in simple terms?

It is the process of collecting, cleaning, coding, and structuring the data generated during a clinical trial so that it is accurate, complete, and ready for statistical analysis and regulatory submission. It covers everything from case report form design through database lock.

What is a clinical data management system (CDMS)?

A CDMS is the software platform used to run clinical data management activities — typically combining or connecting electronic data capture (site data entry), edit checks, query management, medical coding, and audit trails. It is broader than “EDC,” which strictly refers to the data-entry layer, and is a different category from a clinical trial management system (CTMS), which manages trial operations rather than the data itself.

What is the difference between clinical data management and biostatistics?

Clinical data management produces the clean, locked dataset; biostatistics designs the statistical analysis plan and analyzes that locked dataset. CDM is upstream of biostatistics in the trial workflow, and the two typically sit in separate teams with separate professional standards, though they coordinate closely on data structure (CDASH/SDTM/ADaM) so the handoff is clean.

What standards govern clinical data management?

The CDISC foundational standards (CDASH for collection, SDTM for tabulation, ADaM for analysis-ready datasets) govern data structure; MedDRA and WHODrug govern medical/drug coding; the Society for Clinical Data Management’s Good Clinical Data Management Practices (GCDMP) is the field’s own practice standard; and ICH E6 GCP, 21 CFR Part 11, and the ALCOA+ data-integrity framework govern the regulatory and quality-assurance context all of the above operates within.

What does “database lock” mean?

Database lock is the formal, documented point at which a clinical trial dataset is frozen — all outstanding queries resolved, all coding complete, all planned quality checks passed — so that statistical analysis proceeds against a fixed, unchanging dataset. Any post-lock correction requires a controlled, documented unlock process, not an ad hoc edit.

Is clinical data management the same as data management under a research data management plan?

They share the same underlying discipline (structured, quality-controlled, documented handling of data across its lifecycle) but operate under different frameworks. A clinical trial’s data management is governed by GCP, CDISC standards, and CDMS/EDC validation requirements aimed at a regulatory submission; a general research data management plan (DMP), as required by funders like NIH or NSF, is broader and aimed primarily at long-term preservation, FAIR-ness, and reuse. A trial can, and often does, need both.

Does the clinical data management team perform source data verification?

Not usually. Source data verification is typically performed by clinical monitors or CRAs during site visits, not by the CDM team. The two functions are tightly linked operationally, though: SDV discrepancies become queries that flow into the same query-management process CDM uses for its own automated edit-check findings, and both have to be cleared before database lock.

Related CASRAI resources

• Clinical Trial Registration and Reporting Compliance
• Clinical Trial Registration (dictionary term)
• Prospective Clinical Trial Registration (dictionary term)
• ICH GCP (Good Clinical Practice) (dictionary term)
• IRB/REC Approval Process: What Needs Review and What Doesn’t
• Informed Consent (dictionary term) and Informed Consent in Research
• Data Management Plan (DMP) (dictionary term)
• The Research Data Lifecycle
• Data Stewardship and the Data Curator Role in Research
• Synthetic Data in Research
• Source Data Verification (SDV) (dictionary term)
• Centralized Monitoring (dictionary term)
• Interim Monitoring Visit (IMV) (dictionary term)