When an incident report is needed
An incident report is the full written account of one event on a site. Your post orders should say which events need one; a typical list is:
- injuries and medical emergencies, to anyone on the site;
- theft, damage, vandalism or signs of attempted entry;
- trespass, refused entry that turned confrontational, or anyone removed from the site;
- fire, flood, gas leaks and other alarms that turn out to be real;
- any use of force, and any time police, fire or ambulance attended;
- near misses and hazards that could have hurt someone.
When in doubt, write one. A report that turns out not to be needed costs ten minutes; a missing one can cost a contract or a claim.
The facts to record
Good incident reports answer the same questions every time, in the same order.
| Question | What to write |
|---|---|
| Who | Everyone involved: names, roles, companies, descriptions of anyone unidentified, and witnesses with contact details. |
| What | What happened, step by step, as the officer saw it. |
| When | The date and the time of each step, including when the officer arrived and when others were called. |
| Where | The exact location: building, floor, room, door, zone or checkpoint. |
| How | How it was discovered: seen, reported by someone, alarm, camera. |
| Action taken | What the officer did, in order, and why. |
| Notifications | Who was told (supervisor, client, police, emergency services), how and at what time, and any reference numbers. |
| Evidence | Photos, CCTV references, items found, and where they are kept. |
| Outcome | How it ended and what is still open. |
How to write it
- Write it as soon as it is safe to do so. Memory fades fast, and details such as times and descriptions are the first to go.
- Stick to facts. Write what you saw, heard and did. "The man was shouting and pushed the door with his shoulder" is evidence; "the man was aggressive" is an opinion.
- Use plain words and full names. Avoid slang, codes only your team understands, and abbreviations a client or court would not know.
- Keep the order of events. Write it as a timeline, so a reader can follow what happened first.
- Quote people exactly when what they said matters, in quotation marks, and say who said it.
- Say what you did not see. "I did not see who broke the window" is better than leaving a reader to guess.
- Do not guess at causes or blame. If something is unclear, say so.
- Check it before you submit: names, times, locations and the spelling of anything that might be searched for later.
Common mistakes
- Opinions instead of observations. "Suspicious", "drunk" and "aggressive" need the facts that led to them.
- Missing times. An incident report without times is very hard to check against CCTV, alarm logs or witness statements.
- Reports written days later, or rewritten after a conversation with a manager. Corrections should be added and dated, not used to replace the original.
- No record of who was told. Clients often judge an incident by how quickly they heard about it.
- Evidence without a trail. Note who took each photo or item, when, and where it is now.
What happens after the report
An incident report is the start of the follow-up, not the end of it.
- Supervisor review the same day: is the report complete, and is anything still open?
- Client notification as agreed in the contract, often immediately by phone for serious incidents, then in writing.
- Corrective action: repairs, changes to post orders or patrol routes, extra cover.
- Trends: review incidents across sites each month. Repeated incidents at one location or time usually point to a fixable cause.
Incident reports in ForceVera
In ForceVera, admins and dispatchers record and review incident reports, with a photo attached; filing them from the guard app with several photos is coming soon. Open incidents are tracked on the dashboard, and on Pro and Enterprise dispatchers see new reports in the command center's activity feed. Incidents are included in the daily client report, and clients on Pro and Enterprise can read incident reports with their photos in the client portal and download them as PDFs.
Need a format for paper or email? Use the free security incident report template, laid out in the order above.