ExpertIndependently reviewed, not yet spot-checked by a human

Events per variable, and the Riley sample size criteria

The rule of ten events per variable is a rough heuristic from 1990s simulation work, and it has been superseded by the Riley sample size calculation. This page runs both rules on the same breast cancer cohort, then actually fits the model three hundred times at each of the two sample sizes — the sample that only satisfies ten events per variable returns a calibration slope well below 1, with an absolute prediction error nearly twice that of the Riley sample. An inadequate sample does not cost you power; it costs you a model that is overfitted.

Where EPV ≥ 10 came from

EPV (events per variable) is the number of events divided by the number of model parameters. The “at least 10” threshold comes from a series of simulation studies around the 1990s: they fitted logistic and Cox models under various conditions and watched the bias in the coefficients, the accuracy of the standard errors and the coverage of the confidence intervals, and found that these properties started to degrade noticeably once EPV dropped below 10.

The rule has two virtues, which are exactly why it has lasted so long: it is memorable, and it needs only one number to compute.

That is also the source of its structural problem: it looks at the event count and the parameter count, and at nothing else.

The modern approach: say first what you need the model to achieve

The Riley sample size calculation turns the question around: decide how good you need this model to be, then work backwards to the number of people.

“How good” is broken into criteria that can each be written as an equation. The full form for a continuous outcome has four; pmsampsize reports only three for binary or survival outcomes, because the fourth (estimating the residual standard deviation precisely) only means something for a continuous outcome:

CriterionWhat it guards againstDefault target
1. Keep overfitting smallCoefficients too extreme, calibration slope falling below 1Expected uniform shrinkage factor ≥ 0.9
2. Keep apparent and adjusted R² closeA model that looks like it explains a lot, most of which is noiseThe two differ by ≤ 0.05
3. Estimate the overall risk preciselyError in a survival model’s baseline risk (the equivalent of the intercept) shifts the whole scaleMargin of error ≤ 0.05
4. Estimate the residual standard deviation preciselyPrediction intervals too narrow for a continuous outcomeContinuous outcomes only

To run the calculation you need the inputs in hand beforehand, and the survival and binary versions want different things: the survival version needs the number of parameters, the expected Cox-Snell R² (or the equivalent C-index), the event rate, and the mean follow-up and time horizon. The binary version drops the time axis and asks instead for the number of parameters, the expected C-index (or R²) and the prevalence (the proportion who have an event by the horizon).

Two rules, one model

The model: a Cox regression with 8 parameters and a 5-year time horizon. Reading the inputs the formulas need out of survival::rotterdam:

InputValueUsed byWhere it came from
Number of parameters8BothThe prespecified candidate variables
Cox-Snell R²0.151BothConverted from the model’s likelihood ratio chi-square
(Nagelkerke R² for the same model)0.182BothCox-Snell divided by its theoretical maximum of 0.832
Event rate0.100 per person-yearSurvival versionTotal events ÷ total person-years
Mean follow-up5.74 yearsSurvival versionThe cohort mean
Time horizon5 yearsSurvival versionThe prespecified prediction time point
Cumulative risk at the horizon43.6%Binary version only, as the prevalenceKaplan-Meier

The EPV rule: 8 parameters × 10 = 80 events, which works out to roughly 140 patients.

The Riley calculation (pmsampsize, survival version):

CriterionPatients requiredCorresponding expected shrinkage factorEvents per parameter
Criterion 1: keep overfitting small (target shrinkage factor 0.9)4360.90031.3
Criterion 2: keep apparent and adjusted R² close1740.78412.5
Criterion 3: estimate the overall risk precisely4360.90031.3
Adopted (the largest of the three criteria)4360.90031.3
The left panel is three bars: the 140 patients required by the rule of ten events per variable, the 436 required by the Riley calculation, and the 2982 in the whole cohort. In the right panel the horizontal axis is development sample size and the vertical axis is the calibration slope measured on held-out patients; two points correspond to the first two sample sizes, each with a bar spanning the tenth to ninetieth percentile. The point for the EPV rule sits clearly below the horizontal reference line at the Riley target of 0.9, while the point for the Riley sample is close to that line but still slightly under it.
Left: the development sample each rule requires, next to how many people this cohort actually contains. Right: at each sample size the model was refitted on 300 draws and applied to the patients not drawn, where the calibration slope was measured. The bars span the tenth to ninetieth percentile.Plotting script figures/scripts/B5-03-sample-size.R

The Riley calculation asks for 436 patients, 3.11 times what the EPV rule asks for. The number is set by criterion 1 (overfitting), and at that sample size each parameter gets 31.3 events — far more than 10.

Actually fitting a model at each of those two sample sizes

Everything above is arithmetic. rotterdam is large enough to draw each of the two sample sizes 300 times, fit the model, and apply it to the people who were not drawn. Those people come from the same cohort, so the difference can only be the sample size:

RulePatientsEventsEPVHeld-out calibration slopeC-index optimismMean absolute error in five-year risk
EPV = 101408010.00.688 (0.487–0.927)0.0388.4 percentage points
Riley (pmsampsize)43625031.30.874 (0.712–1.036)0.0174.5 percentage points
whole cohort29821713214.1— (reference model)

The whole-cohort row is what defines truth5, so it reports no held-out mean absolute error; that blank is not a performance result of zero error.

An inadequate sample does not mean “underpowered”

This is the sentence from this page that gets misquoted most often.

In the world of hypothesis testing, too small a sample means too little power means something that should have been significant was not. That is a conservative failure: you claim fewer things, but the things you do claim are not made wrong by it.

Prediction models do not work like that. With too small a sample the model still fits, the C-index is still computable, and it looks especially good (see the optimism column in the table above). The failure takes these forms instead:

  • Coefficients too extreme → predictions too extreme → calibration slope below 1
  • Apparent performance inflated → the paper reports a number higher than anything achievable in practice
  • Rerun on different people → a substantially different model

Run it yourself

library(survival); library(pmsampsize)
data(cancer, package = "survival")

rot <- rotterdam
rot$time_y    <- pmin(rot$rtime, rot$dtime) / 365.25
rot$rfs_event <- as.integer(rot$recur == 1 | rot$death == 1)
rot$size_mm   <- c("<=20" = 15, "20-50" = 35, ">50" = 60)[as.character(rot$size)]
rot$grade3    <- as.integer(rot$grade >= 3)
rot$log_pgr   <- log1p(rot$pgr); rot$log_er <- log1p(rot$er)

fit <- coxph(Surv(time_y, rfs_event) ~ age + meno + size_mm + grade3 +
               nodes + log_pgr + log_er + hormon, data = rot)

# Three inputs, all read off the model and the cohort
lr    <- 2 * diff(fit$loglik)
r2cs  <- 1 - exp(-lr / nrow(rot))                 # Cox-Snell R^2
rate  <- sum(rot$rfs_event) / sum(rot$time_y)     # events per person-year
mfu   <- mean(rot$time_y)

pmsampsize(type = "s", csrsquared = r2cs, parameters = 8,
           rate = rate, timepoint = 5, meanfup = mfu)

# The old rule, one line: 10 events per parameter
ceiling(10 * 8 / mean(rot$rfs_event))

# The binary version of the same model (outcome becomes "event within five years")
km <- survfit(Surv(time_y, rfs_event) ~ 1, data = rot)
p5 <- 1 - summary(km, times = 5)$surv
pmsampsize(type = "b", cstatistic = summary(fit)$concordance[1],
           parameters = 8, prevalence = p5)

Verified with R 4.6.0 + survival 3.8.6 + pmsampsize 1.1.3. pmsampsize takes csrsquared or nagrsquared but not both; type = "s" additionally needs rate, timepoint and meanfup.

Three questions to ask when reading a paper

  1. Is there a sample size calculation at all? Prediction model papers often skip it entirely, or dispose of it with one sentence about meeting the EPV ≥ 10 recommendation.
  2. How was the number of parameters counted? A three-level categorical variable is two parameters; a spline is several; candidates that were considered but did not reach the final model still count, because the screening itself spent degrees of freedom.
  3. What did the authors do about an inadequate sample? The honest options are to cut the candidate variables, switch to penalisation, or state plainly that the model is exploratory. A paper that did none of these and simply reports apparent performance needs its numbers discounted.

Common misuses

MisuseWhy it is wrong
“EPV is over 10, so the sample is adequate”The 10 is a rough 1990s threshold for coefficient accuracy, which is not the same thing as predictive accuracy
Computing EPV from the parameters in the final modelUse the number of candidate variables; screening consumes degrees of freedom too
Saying an inadequate sample makes the results “conservative”A prediction model fails in the opposite direction: apparent performance is inflated and the model looks better
Using the R² computed from the data in hand as the calculation’s inputThat is retrospective; a prospective input has to be borrowed from a published model or pilot data
Reporting only the final sample size, not what each of the three criteria demandedThe reader cannot tell which criterion is driving the result
Reusing the same number for a binary and a survival outcomeDropping the timing information lowers the information content, so the two need different sample sizes
Counting a categorical variable as one parameterA k-level variable is k − 1
Falling back on penalised regression when the sample is too smallA penalty improves calibration; it does not invent signal the data never held

Reproducing every number on this page

/opt/homebrew/bin/Rscript figures/scripts/B5-03-sample-size.R

Read the figure

The answer comes from the same statistical output that produced this page's figures, not from a number typed in beside them.

For the same eight-parameter Cox model, the rule of ten events per variable asks for 140 people and the Riley calculation asks for 436. Where does that gap come from?

Show the answer and why

Correct answer: At the Riley sample size every parameter gets 31 events, far above the old threshold - the two rules aim at different things

31 events per parameter is far above the old threshold, so the Riley calculation is not the more relaxed of the two here; 174 is simply the least demanding of the three criteria, and the figure adopted is always the largest, because all three have to hold at once. The binary 795 is not about coding either: throwing away the timing leaves the same people carrying less information, so more of them are needed, and that still comes out of the same set of criteria. What really separates the two rules is what each guards against. The old rule comes from last century's simulations about coefficient bias and interval coverage, which is the acceptance standard of aetiological research; a prediction model is accepted on whether its predictions are accurate, and that depends on expected discrimination, the event rate, the length of the time axis and the number of parameters - none of which an events-per-variable count can see.

Fitting the model at the sample size where events per variable is exactly 10, repeated three hundred times, gives a hold-out calibration slope of 0.688. What does that number say?

Show the answer and why

Correct answer: 0.688 is well below 1, meaning the risk differences the model produces should be discounted by roughly three tenths; too small a sample in a prediction model produces overfitting, not a lack of power

0.688 says that when the model claims one person's risk exceeds another's by some amount, the real gap is about seven tenths of that. This is how an inadequate sample shows itself in a prediction model - not as the conservative failure of missing a real effect, but as a model that fits perfectly well and looks unusually good on its own data. Optimism of 0.038 looks small only because the C-index scale is compressed; the calibration slope in the same row magnifies the same problem into something visible, which is precisely why acceptance cannot rest on discrimination alone. 0.874 has not reached 1 either, but it is much closer, and the first criterion targets an expected uniform shrinkage factor while this measures a calibration slope actually observed in a hold-out sample, which additionally absorbs that sample's own sampling error, so the two were never going to line up exactly.

A model fitted at the events-per-variable sample size gives each person a five-year risk that departs from the reference model by 0.084 on average, as a proportion. What is the right thing to compare that error against?

Show the answer and why

Correct answer: Against the spread of five-year risk in the cohort itself - a median of 0.396, the central eight tenths between 0.273 and 0.677, so 0.084 is about a fifth of that band

Whether an absolute error is large depends on the spread of the quantity being predicted. Five-year risk in this cohort has a median of 0.396, with the central eight tenths of people between 0.273 and 0.677, a band about forty points wide, so an average departure of 0.084 - roughly a fifth of it - can move somebody from one side of a threshold to the other. Comparing it with the Riley sample size's 0.045 says only that the other one is smaller, which is not a yardstick for whether this one is large - and 0.045 is not small either; the near-doubling between them is exactly what this section is demonstrating. Using the maximum of 0.999 as the reference is worse still: that is the extreme of the distribution, not a typical person. Note also that average departure per person is not the quantity any of the three criteria targets; it is an extra check this page adds.

The survival version of pmsampsize prints a requirement for each of three criteria for this model - 436, 174 and 436 - and adopts 436. Why that figure?

Show the answer and why

Correct answer: All three have to hold at once, so the figure adopted is the largest; 436 is set by the first, which targets a shrinkage factor of 0.9, and by the third

436 is the largest of the three requirements, and three criteria means three things must all be achieved, so the sample size adopted is always the maximum; 174 says only that the second criterion, about the gap between apparent and adjusted R-squared, is easier to satisfy for this model. It is neither a compromise nor a standard to work to. The 31 events per parameter is an output, not an input: once 436 people are computed, the events they would supply at this event rate and time horizon are worked out and divided by the number of parameters. Read the other way round it collapses back into another events-per-variable rule, which is the thing this calculation exists to replace. And the 0.9 the first criterion targets is the expected uniform shrinkage factor, meaning coefficients should need shrinking by only about a tenth.

Same model, same people: the survival version of the Riley calculation asks 436, 174 and 436 for its three criteria and adopts 436, while a binary outcome of an event within five years ends up asking for 795. Why does the binary version need more?

Show the answer and why

Correct answer: 795 exceeds the survival requirement because dichotomising throws the timing away: the same people are reduced to a single yes-or-no about five years, they carry less information, and reaching the same shrinkage factor takes more of them

The gap between 795 and 436 is a matter of information. The survival version uses when each event happened, and how long each censored person was known to be event-free; dichotomising collapses all of that into one yes-or-no. The 43 events per parameter is higher than the survival version not because there are more events - the binary event definition is no looser - but because more people are required, so more events come with them. The 201 row cannot be read backwards either: each criterion is computed separately and the maximum is always adopted, so the final figure being set by the strictest criterion says nothing about the others being negligible - and 201 is in fact above the corresponding 174 of the survival version, so even the claim that every binary criterion is looser does not hold. It also shows why counting events alone cannot answer the sample-size question: that count cannot see the time axis.

In hypothesis testing, too small a sample means too little power, which is a conservative kind of failure. Prediction models do not work that way. Which number on this page shows that most directly?

Show the answer and why

Correct answer: Optimism in the C-index at the events-per-variable sample size is 0.038: with too small a sample the model still fits and still looks unusually good on its own data

0.038 is how far apparent performance exceeds hold-out performance. The anti-conservatism is right there: too small a sample does not leave you with nothing, it leaves you with a model that looks good and cannot be used, and the number a paper reports is the one that looks good. 0.017 says only that the bias shrinks when the sample is ample; it cannot be turned into a claim that the failure is conservative, since the bias is positive in both rows and never changes sign. The percentile at 0.487 does show that the variation between runs is large as well, but that is a separate problem: even from a single run, reading only the point estimate, the point estimate is already optimistic. This is why sample-size calculation in prediction-model research is not about being able to see an effect if there is one, but about the computed risk being fit to show a patient.

Watch next

Sample size calculations for clinical prediction model research
ENRichard_D_Riley· 17 minThe author of these criteria explaining them himself in seventeen minutes; it maps directly onto the third and fourth sections of this page.
RSS Seminar with Richard Riley
ENRoyalStatSoc· 71 minThe full seminar. Watch it when you want to see how the simulations behind those criteria were actually done.

Sources and licences

This page is original writing

Report a content problem

The statistics on this site are written by AI and reviewed by AI; a human only spot-checks. What you can see may be what we cannot.

The more specific, the more fixable — e.g. which sentence disagrees with which textbook or paper.

Needed only if you want a reply; reports without it are still read.

Sent along with your report

These are attached automatically. You can drop any of them.