A method for use in a programmable device for auditing video analytics data, the method comprising: receiving an alert triggered by a video analytics component for a visual image stream; in response to the alert, generating a set of alert images from the visual image stream including an image contemporaneous with the triggered alert and at least one other image occurring before or after the contemporaneous image in the visual image stream such that a reviewer can review whether the alert is a true or false alert using the set of alert images; and subsequently providing additional images from the visual image stream on request by the reviewer so as to confirm a determination of whether the alert is a true or false alert such that said additional images are provided only in response to said request; the method further comprising: archiving the visual image stream in a repository; retrieving the additional images provided from the visual image stream; and incorporating text data associated with the contemporaneous image and the at least one other image into the set of alert images such that the text data is available to the reviewer; wherein the triggering alert indicates a suspected occurrence of an event constituting an intentional failure to scan an item, for an item scanned in an item scanning system, the triggering alert being generated when a time gap between pick-up, scanning and/or dropping of an item is longer than a predefined time interval; wherein the visual image stream is a video stream of images of a scanning station in the scanning system; wherein the text data is a transaction log stream temporally related to the video stream; wherein the image contemporaneous with the triggering alert is a frame image in the video stream of a scanner area of the scanning station occurring contemporaneous with a logged scan event; and wherein the at least one other image occurring before or after the contemporaneous image comprises: a previous-in-time frame image of a pickup area of the scanning station occurring prior to the scanner area image; and a later-in-time frame image of a drop area of the scanning station occurring after the scanner area image. receiving an alert triggered by a video analytics component for a visual image stream; in response to the alert, generating a set of alert images from the visual image stream including an image contemporaneous with the triggered alert and at least one other image occurring before or after the contemporaneous image in the visual image stream such that a reviewer can review whether the alert is a true or false alert using the set of alert images; and subsequently providing additional images from the visual image stream on request by the reviewer so as to confirm a determination of whether the alert is a true or false alert such that said additional images are provided only in response to said request; the method further comprising: archiving the visual image stream in a repository; retrieving the additional images provided from the visual image stream; and incorporating text data associated with the contemporaneous image and the at least one other image into the set of alert images such that the text data is available to the reviewer; wherein the triggering alert indicates a suspected occurrence of an event constituting an intentional failure to scan an item, for an item scanned in an item scanning system, the triggering alert being generated when a time gap between pick-up, scanning and/or dropping of an item is longer than a predefined time interval; wherein the visual image stream is a video stream of images of a scanning station in the scanning system; wherein the text data is a transaction log stream temporally related to the video stream; wherein the image contemporaneous with the triggering alert is a frame image in the video stream of a scanner area of the scanning station occurring contemporaneous with a logged scan event; and wherein the at least one other image occurring before or after the contemporaneous image comprises: archiving the visual image stream in a repository; retrieving the additional images provided from the visual image stream; and incorporating text data associated with the contemporaneous image and the at least one other image into the set of alert images such that the text data is available to the reviewer; wherein the triggering alert indicates a suspected occurrence of an event constituting an intentional failure to scan an item, for an item scanned in an item scanning system, the triggering alert being generated when a time gap between pick-up, scanning and/or dropping of an item is longer than a predefined time interval; wherein the visual image stream is a video stream of images of a scanning station in the scanning system; wherein the text data is a transaction log stream temporally related to the video stream; wherein the image contemporaneous with the triggering alert is a frame image in the video stream of a scanner area of the scanning station occurring contemporaneous with a logged scan event; and wherein the at least one other image occurring before or after the contemporaneous image comprises: a previous-in-time frame image of a pickup area of the scanning station occurring prior to the scanner area image; and a later-in-time frame image of a drop area of the scanning station occurring after the scanner area image.