Security incident report writing that holds up

A security incident report protects the client, the company and the officer who wrote it. A bad one surfaces eighteen months later in a deposition, when nobody remembers the shift and the record is four sentences saying almost nothing.

Why does an incident report matter months after the shift?

Because it becomes evidence. In litigation, both sides comb the report for consistency, completeness and credibility, and a document written the night of the incident usually beats a witness's memory of it. Federal Rule of Evidence 803(6) admits a business record precisely because it was "made at or near the time by, or from information transmitted by, someone with knowledge" (Federal Rules of Evidence, Rule 803). Write it three days later and you have weakened the thing that gave it weight.

Insurance turns on the same details. Adjusters look for specifics that either support the claim narrative or contradict it. A vague report gets read in whichever direction is cheapest for the carrier.

Clients read reports as proof the security spend is doing something. When a property manager asks what happened Saturday night, your report is the answer. Consistent, comparable reports also make pattern analysis possible: which lot, which hour, which door. Vague reports produce vague trends. The client reporting guide covers how those reports roll up into the monthly package.

None of this is a reason to write more. It is a reason to write findable facts.

What has to be in every incident report?

Four questions: who, what, when, where. Every gap in one of them is a question somebody asks you later, under oath, when you no longer remember.

Who

Start with everyone identified. Full names where known, plus whatever pins the person to the site: employee number, unit number, company on the work order, plate on the vehicle. For anyone unidentified, write the description that would let someone else pick them out: height, build, hair, clothing, tattoos, limp, accent.

Then witnesses, with phone numbers, captured while they are still standing in front of you. A witness you did not record is a witness who no longer exists. Note which officers responded and which agencies arrived.

What

Tell it in order, from the first thing you noticed to the moment it ended. What happened, what you did, what others did. Quote directly when you remember the exact words and say plainly when you are paraphrasing. Keep a hard line between what you saw yourself and what somebody told you they saw.

When

Record the time the incident started, not the time you found out about it. Timestamp each significant event as it happened, then the resolution, then when you finished writing. That timeline is what gets compared against camera footage, access logs and other people's statements.

Where

"Parking lot" is not a location. Which lot, which section, which row, which numbered space. Anchor it to something fixed that a stranger could find a year later: the northeast corner of Building C, the door labeled 3B, camera 14. If people moved during the incident, write the direction and the path.

How should you write it so it holds up?

First person, from the reporting officer's perspective. "I observed" and "I responded" make attribution obvious. That distinction is the first thing a cross-examination goes after.

Plain language beats official language every time. The goal is communication, not the appearance of authority. Short sentences that state facts survive scrutiny better than formal prose the writer was not comfortable with. Forced formality is where invented detail hides.

Specificity is the whole job. "2247 hours" instead of "around 11 PM." "Approximately 30 feet from the west entrance" instead of "near the door." And when you conclude something, show the observations behind it rather than the conclusion alone.

Instead of writing	Write
The subject was intoxicated.	The subject's speech was slurred, he braced against the wall twice while walking, and I detected an odor of alcohol.
He became aggressive.	He stepped within arm's length, raised his voice, and said "you can't do anything to me."
I checked the area.	I walked the north fence line from the gate to the transformer pad and checked both roll-up doors, which were secured.
Someone reported a disturbance.	Resident in unit 214, Maria Delgado (555-0139), reported shouting from unit 216 at 2231 hours.

What you leave out matters just as much. No unlabeled opinions. No language that can be read two ways. Never omit a detail because it is unhelpful to the client, since an incomplete report damages your credibility far more than an inconvenient fact does. And never write down something you did not see yourself without saying who told you.

California treats this as a licensing matter, not a style preference: Observation and Documentation is one of the four mandatory four-hour courses every registered guard has to complete after registration (BSIS security guard training regulation). Check your own state board, then build report writing into your guard training program rather than hoping new hires arrive with it.

What should you photograph, and when?

Before anything moves. Once a vehicle is towed or a broken pane is swept up, the original state of the scene is gone permanently, and no amount of narrative brings it back.

Shoot wide and close. The wide shot establishes where you were and how the space is laid out. The close-up carries the damage, the injury, the position of the object. A report with only close-ups leaves the reader unable to place anything.

Document property damage from several angles, visible injuries with the subject's consent where you can get it, the positions of people and objects, and conditions that contributed to the incident: the burned-out light, the ice, the propped door. When something could not be photographed, write down what and why. "Subject declined to be photographed" is itself a fact worth having.

Photos attached to the report at the moment of capture, with a GPS fix and a timestamp, remove an entire category of argument about when and where they were taken. That is the practical case for digital incident reporting instead of paper, and for the same officer's daily activity report living in the same system.

Know before you write which incidents also trigger a phone call. A security escalation matrix settles who gets notified, at what hour, for which category, so the report is never the only thing that happened.