Reproducing the CSR Number in a Poster: Why It’s Harder Than It Sounds

How database locks, analysis populations, and data cutoffs drift apart between the Clinical Study Report and the congress poster, and how to trace, attribute, and reconcile every number so a reader or regulator can follow the paper trail.

It sounds like the easiest request in publication programming. The poster needs the hazard ratio for progression-free survival; the Clinical Study Report already has it; just copy the number across. A medical writer asks for it on a Tuesday, expects it by Wednesday, and cannot understand why the statistical programmer looks pained. Surely the number exists. Surely it is a matter of transcription.

It is almost never that simple. The value on a congress poster and the value in the CSR are two photographs of the same subject taken at different moments, with different cameras, cropped to different edges. They should tell a consistent story, and a well-run team makes sure they do, but they will rarely be bit-for-bit identical, and when they differ, someone eventually asks why. That someone might be a co-author, a peer reviewer, a sponsor’s medical director, or, years later, a regulator reconciling a marketing claim back to the pivotal trial. For the CRO statistical programmer supporting a sponsor’s Medical Affairs team, being able to answer that question precisely is the whole job. This article is about why the numbers drift, and how to pin, trace, and reconcile them.

Why “just copy the number from the CSR” fails

The instinct to copy is reasonable, and sometimes it is exactly right: if the poster reports the identical endpoint, on the identical population, from the identical locked database, then the CSR value is the number, and any deviation is an error to be hunted down. The trouble is that congress work almost never lines up that cleanly with the CSR snapshot. A poster is usually built for a specific scientific audience, at a specific meeting, on a specific timeline, and each of those specifics quietly pulls the analysis away from the CSR.

The CSR is a formal deliverable structured under ICH E3, built on a locked database, a signed Statistical Analysis Plan, and a defined set of analysis populations. It is a fixed point. A poster, by contrast, is frequently produced months after the CSR, when a longer-follow-up data cut has become available, when a few data queries have resolved, or when the scientific committee wants the endpoint shown on a population that differs from the CSR’s primary one. The moment any of those things is true, the poster number is a different estimate of the same quantity, not a copy. Treating it as a copy is how teams end up with a poster that silently contradicts the document it is supposed to summarize.

The many sources of divergence

When two versions of the same endpoint disagree, the cause is almost always one, often several, of a small, recurring set of culprits. Naming them is the first step to controlling them, because each has a characteristic fingerprint and a characteristic way of being detected. The table below is the field guide.

Table 1. The recurring causes of CSR-to-poster divergence, each with its mechanism and its detection signature. Most real-world discrepancies are a combination of two or three rows, not one.

Two of these deserve special emphasis because they cause the most confusion in practice. The first is the analysis population. The distinction between ITT (all randomized), mITT (a modified set, e.g., all randomized who received at least one dose and had a baseline assessment), safety (all treated, analyzed as treated), per-protocol (subjects without major protocol deviations), and evaluable (subjects with adequate data for the endpoint) is not academic. Each population has a different N, a different risk set, and therefore a different estimate. A poster that reports the endpoint on the mITT population and a CSR that reports it on the ITT population are not in disagreement; they are answering slightly different questions, and the paper trail has to say so.

The second is the data cutoff, which we return to below because it is the single most common reason a congress number differs from the CSR, and the one most likely to be misread as an error.

Figure 1. The same progression-free survival endpoint at two data cuts. The CSR curves (solid) stop at the CSR clinical cutoff; the later congress cut (dashed) accrues seven more months of follow-up and more events, shifting the estimated hazard ratio from an illustrative 0.76 to 0.71. Neither is wrong; they are different snapshots. Values are illustrative.

The specific trap: longer-follow-up data cuts for congress

Here is the scenario that catches teams most often. The CSR is finalized on a database locked at, say, a 24-month clinical cutoff. Six months later, a major congress (an ASCO, an ESMO, an ASH) offers the chance to present updated results. The scientific value of the presentation comes precisely from the fresher data: more mature survival curves, more events, a tighter confidence interval. So Medical Affairs commissions a new data cut, and the poster reports a hazard ratio that is genuinely more up to date than the CSR’s.

This is good science and legitimate practice, and congresses reward mature data. But it is a reconciliation landmine if it is not documented. To a reader holding both the CSR and the poster, the numbers simply disagree, and the natural inference is that one of them is wrong. The defense is not to force the poster to match the CSR; that would throw away the more informative analysis. The defense is to make the difference legible: to state, on the poster and in its backing documentation, the data cutoff date, the population, and the fact that this is an updated analysis with longer follow-up than the CSR. A single well-worded footnote converts an apparent contradiction into an obvious, expected consequence of added follow-up.

Pinning a number’s provenance

Underneath all of this is one discipline: every number that leaves the building should carry its provenance. Provenance is the complete set of coordinates that locates a value in space and time, enough that an independent programmer, handed only the provenance record, could regenerate the number and get the same answer. When a value is fully pinned, reconciliation stops being detective work and becomes arithmetic.

A pinned number names, at minimum, the study (or pool), the database lock or extract date, the clinical data-cutoff date, the analysis population, the endpoint definition and its governing SAP/protocol version, the analysis dataset name and version, the program and its version-control commit, the software and version, and the display-precision rule. That is a lot of metadata for one hazard ratio, which is exactly why it belongs in a structured record rather than in someone’s memory or a stray email. The payoff comes the day the number is challenged: instead of reconstructing what was done from fragments, you read it off the provenance record.

The reconciliation workflow and the difference-attribution log

Reconciliation is not a vibe check that the two numbers are “close enough.” It is a structured walk from one value to the other, attributing every unit of the gap to a named cause until nothing unexplained remains. The tool that makes this rigorous is the difference-attribution log: a line-by-line ledger that starts at the CSR anchor, applies one change at a time, and records the resulting estimate after each. Done well, the final line equals the poster value exactly, and the residual, the part you cannot explain, is zero. A non-zero residual is a red flag that means keep digging: there is a factor you have not accounted for, and it might be an error.

The log below reconciles the worked example. Each row toggles a single factor and re-runs the analysis, so the effect of that factor is isolated rather than confounded with the others. The order matters for interpretation but not for the endpoint: whatever order you toggle the factors, a complete log lands on the poster value with no residual.

Table 2. A difference-attribution log reconciling a poster HR of 0.71 to a CSR HR of 0.76, one factor at a time. The residual at the final step is zero: every unit of the 0.05 gap is attributed to a named, evidenced cause. All values are illustrative.

Figure 2. The same reconciliation as a waterfall: each factor moves the hazard ratio a measurable amount from the CSR anchor (0.76) to the reported poster value (0.71). Visualizing the attribution makes it obvious which factor dominates: here, the later data cutoff. Illustrative.

A single source of truth and analysis-dataset versioning

Attribution logs are only trustworthy if the datasets and programs they point to are themselves under control. This is where a single source of truth earns its keep. In CDISC terms, the analysis-ready ADaM datasets, derived from SDTM, should be the one authoritative substrate from which every output, CSR and poster alike, is produced. When the poster is built by re-deriving from a spreadsheet someone pulled months ago, reconciliation becomes nearly impossible because the substrate itself is unpinned.

Versioning closes the loop. Each ADaM dataset should carry a version and be tied to a specific database snapshot, and each output should record which dataset version it consumed. That way “the number changed” always resolves to “the number was produced from ADaM v2, which reflects the congress data cut, whereas the CSR number came from ADaM v1.” Add version-controlled analysis code, and any historical number can be regenerated on demand. Provenance, single source of truth, and versioning are three views of the same discipline: never let a published number float free of the exact inputs that made it.

Sign-off and traceability: closing the loop for a regulator

The last mile is governance. A reconciled number is not finished until the reconciliation is reviewed, signed, and filed with the output it defends. The standard to aim for is simple to state and demanding to meet: a reader holding the poster and the CSR (a co-author, a journal reviewer, a sponsor medical director, or a regulator) should be able to reconcile one to the other from the documentation alone, without phoning the programmer. GPP 2022 and ICMJE expectations around accuracy and transparency assume exactly this kind of traceability sits behind every published figure, even though the audience never sees it.

Concretely, the sign-off packet for a poster number should bundle the provenance record for each value, the difference-attribution log where the value differs from the CSR, the QC evidence, and a dated sign-off from the responsible statistician or programmer. Filed together, these turn a future challenge into a lookup. The regulator who asks, three years on, why a marketing claim cites a hazard ratio that does not appear verbatim in the CSR gets a one-page answer instead of a fire drill.

A reconciliation checklist

• Confirm whether the poster endpoint is the same estimand as the CSR, with the same population, cutoff, and endpoint definition, before assuming the CSR value applies.
• Pin the provenance of both numbers: study/pool, database lock, data cutoff, population flag, endpoint/SAP version, ADaM dataset version, program commit, software version, precision rule.
• Identify every candidate source of divergence from Table 1 that applies to this pair of outputs.
• Build a difference-attribution log: start at the CSR anchor, toggle one factor at a time, and re-run so each factor’s effect is isolated.
• Drive the residual to zero. An unexplained gap is a signal to keep investigating, not to round away.
• For longer-follow-up congress cuts, state the data-cutoff date and updated-analysis status on the poster and in its backing documents.
• Confirm the number was produced from the single-source-of-truth ADaM datasets at a known version, via version-controlled code.
• Bundle provenance, attribution log, QC evidence, and a dated sign-off so a reader or regulator can reconcile poster to CSR unaided.

The bottom line

“Just copy the number from the CSR” fails because the poster and the CSR are rarely the same analysis: different snapshot, different population, different cutoff, different rules. And the differences are legitimate more often than they are mistakes. The professional response is neither to force a false match nor to wave away the gap, but to make the divergence fully legible: to pin each number’s provenance, attribute every unit of difference to a named cause, anchor everything to versioned datasets and code, and file a sign-off that lets any future reader retrace the path. Reproducing the CSR number in a poster is harder than it sounds. The teams that do it well are not the ones whose numbers never differ. They are the ones who can explain, on a single page, exactly why they do.