Quality records retention: what you must still be able to produce years later

Retention length follows exposure, not filing convenience

Four drivers set the period, and the longest one wins. The service life of the product decides how long a failure can plausibly be attributed to your manufacture. Contract terms with customers frequently impose their own duration and sometimes exceed anything you would choose. Liability exposure in the markets you sell into extends the window for products whose failure could injure. Sector-specific obligations apply to regulated goods. Set the policy per record family rather than per document, publish it, and resist the temptation to apply the longest period to everything, because indiscriminate retention makes retrieval slower and destruction decisions impossible to defend later.

Retrieval speed is the property that actually gets tested

Holding a record and being able to find it are different capabilities. The realistic test is a customer naming a part and a rough delivery window and asking for the evidence behind it. That requires an index keyed to something the customer can quote — a serial, a lot code, a delivery note, a date of manufacture — and a chain from that identifier to the material certificate, the process parameters, the inspection result and the person who released it. Plants that store by cabinet and month rather than by identifier discover the gap during a recall, when hours matter and the whole scope depends on how much they can prove.

Media outlive their readers

Long retention creates a technology problem rather than a storage one. Thermal print fades to blank, ink runs where an archive is damp, and paper stored near a plant gets contaminated or crushed. Digital records fare no better when the system that wrote them is decommissioned, the export is a proprietary format nobody can open, or an approval that was meaningful inside the old application becomes an unattributed field in a spreadsheet. Any retention period beyond a few product cycles needs a stated migration approach and a periodic check that a sample of the oldest records can still be opened and read.

What makes a record credible to somebody outside the company

A retained result carries weight when it identifies what was measured, against which revision of the specification, with which instrument, by whom, and when — and when it is evidently contemporaneous rather than reconstructed. Records that show only conforming results across every batch invite suspicion, since a process that never produces an out-of-limit reading is usually one where readings are being written rather than taken. Corrections should be visible as corrections. Any system where an earlier value can be overwritten without trace weakens every record it holds, including the honest ones.

Destruction is a controlled act with its own record

Keeping everything forever is not a safe default. It expands the volume of material discoverable in a dispute, holds personal data beyond any lawful purpose, and buries the records that matter under those that do not. Disposal should follow the published schedule, be authorised by a named person, cover both the paper and every system copy, and produce a note of what was destroyed and under what authority. The one absolute rule is suspension: once a claim, investigation or dispute is foreseeable, routine destruction stops for anything connected to it, and that hold needs to reach whoever operates the archive.

Frequently asked questions

Can we scan paper records and destroy the originals?

Usually yes, provided the scan is complete, legible, indexed, backed up and produced under a documented process that a third party could inspect. The risks are practical: partial scanning that loses the reverse of a form, images captured at a resolution that cannot resolve handwritten measurements, and originals destroyed before anyone verifies the batch imported correctly. Where a wet signature or an original certificate carries contractual weight, keep the physical document.

What happens if a customer asks for records we no longer hold?

Say so plainly, state the retention period you applied and the date the material was disposed of under it, and offer whatever adjacent evidence still exists — process data, equipment calibration history, the release procedure in force at the time. A defensible published schedule consistently applied is a reasonable position. Improvising an explanation, or worse, reconstructing a record after the request, converts a documentation gap into a credibility problem.

Should supplier certificates be retained on the same schedule as our own results?

At minimum for as long as the product they went into, because a material claim is answered with the certificate rather than with your inspection sheet. Treat incoming certificates as records from the moment they arrive, link them to the lot they cover rather than to the supplier folder, and check on receipt that they are legible and reference the correct specification. A certificate found years later to name the wrong grade is only useful if somebody read it at the time.