There is a moment in a difficult investigation when everyone wants the answer.
What happened?
Why did it happen?
Did it affect the batch?
What do we need to fix before this happens again?
That is when teams reach for the evidence.
The batch record.
The environmental monitoring data.
The training record.
The interview notes.
And, increasingly, the video.
Here is the problem: sometimes the video is used to reach the conclusion, then quietly disappears before anyone needs to defend the conclusion.
That is not a technology problem.
It is a quality-system problem.
FDA's point was not subtle
In a September 14, 2026 warning letter to SCA Pharmaceuticals, FDA described serious deficiencies in sterile drug production practices.
The letter said the firm used production video to examine aseptic practices and determine possible root causes during a microbial contamination investigation. But instead of retaining the video as a quality-related document, the firm retained still images. The video was overwritten after a short period.
That creates an awkward question:
How strong is an investigation when the underlying record used to understand the event is no longer available?
The issue is not that every second of every camera feed needs to be archived forever. That is not operationally realistic, and it is not the point.
The point is that a record does not become unimportant just because the investigation team is finished looking at it.
If the record helped establish root cause, assess impact, or justify corrective action, it belongs inside the evidence strategy.
The investigation cannot outlive its evidence
Teams often think about retention in categories:
- Batch records
- Lab data
- Environmental monitoring
- Training records
- Equipment logs
- Deviation reports
Video can get treated as something else.
Something operational.
Something that lives on a local drive.
Something that is useful for a week and then gets overwritten because the system needs the space.
That distinction falls apart as soon as the video is used to answer a quality question.
Once a recording is used to evaluate a contamination event, a personnel practice, a line intervention, a material transfer, or a possible airflow disruption, it is no longer just surveillance footage.
It is part of the factual record.
And a factual record needs ownership, access control, retention rules, and a way to show that it has not been altered.
Three questions to ask before the next investigation
1. What evidence are we using before we know we need it?
This is the uncomfortable one.
By the time a deviation is opened, the useful window may already be closing.
Camera footage can be overwritten.
System logs can roll off.
Temporary files can disappear.
Instrument data can be harder to reconstruct than anyone wants to admit.
The response should not depend on one investigator remembering to press save.
Define the trigger conditions early. If an event involves sterile processing, contamination, a critical intervention, or a potential data-integrity question, the relevant digital records should be preserved as part of the initial response.
2. Can someone else reproduce the conclusion?
An investigation should not depend on a screenshot that makes sense only to the person who captured it.
If a still image was selected from a video, the team should be able to explain:
- Where it came from
- What happened before and after it
- Why it was relevant
- Who reviewed the source recording
- How the source was preserved
The screenshot may be useful.
It is not automatically a substitute for the source.
3. Does the retention rule match the risk?
Retention periods often come from system defaults, storage limits, or old assumptions.
Those are not the same thing as risk-based control.
If an event could lead to product impact, a regulatory response, a recall decision, or a significant CAPA, the evidence retention decision should be made by the quality process, not by the camera system's overwrite setting.
The camera does not get to decide what matters.
This is bigger than video
The same failure mode shows up in other forms.
A team reviews an audit trail but does not preserve the export.
A lab relies on an instrument file that is stored only on a workstation.
A deviation team uses a chat thread to reconstruct timing, then discovers the thread was deleted during routine cleanup.
A contractor sends a temporary data file that explains the result, but nobody defines where the original belongs.
In each case, the organization may retain the conclusion while losing the evidence that made the conclusion credible.
That is how a clean-looking investigation becomes a fragile one.
Make the right thing easy during the first hour
The first hour after a serious event is already busy. People are protecting product, securing the area, notifying the right leaders, and trying to understand what they are seeing.
Do not add a scavenger hunt.
Build the evidence response into the playbook:
- Identify which systems and recordings may be relevant.
- Place a hold on automatic overwrite when the trigger is met.
- Record the source, time window, and person who preserved it.
- Store the original in a controlled location.
- Keep working copies separate from the source.
- Link the preserved evidence to the deviation or investigation record.
- Define who can approve release of the hold.
None of this is glamorous.
That is usually a sign it belongs in the process.
The close
Good investigations do not just produce answers.
They produce answers that can survive a second look.
By Quality.
By Operations.
By management.
By an inspector who was not in the room when the event happened.
If a video helps explain what happened, keep the video.
If a system log helps establish the timeline, preserve the log.
If a record makes the conclusion credible, treat it like evidence before the retention clock runs out.
The quality system is not finished when the team writes the conclusion.
It is finished when the conclusion can still be defended.
Source: FDA warning letter to SCA Pharmaceuticals, LLC, September 14, 2026: https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/sca-pharmaceuticals-llc-724202-09142026