A security incident can become an insurance claim, a disciplinary matter, a police enquiry, or evidence in court. The report written during the shift may be the only reliable record of what happened.
For that reason, these reports should be fact-based, chronological and properly stored. They’re not a place for blame, assumptions or vague recollections written hours later.
A sound reporting process protects people, the client and the security team when the ordinary routine suddenly stops being ordinary.
Key takeaways for UK businesses
- Record the facts as soon as it is safe to do so, using exact times, locations, actions and names where known.
- Keep the incident account in chronological order, separating what the officer saw from what another person said.
- Preserve relevant evidence, including CCTV footage, photographs, access-control records and damaged property.
- Escalate medical emergencies, violence, serious safety issues and suspected criminal activity without waiting for the report to be completed.
- Restrict access to reports and evidence because they often contain personal data, sensitive details and operational information.
- Check the contract, site procedures, risk assessment and sector rules. Reporting requirements are not identical at every site.
What a security incident report is, and what it is not
An incident report is a formal account of an unusual event that affected security, safety, people, property or normal operations. It should allow someone who was not present to understand what occurred, in what order, and what action followed.
A useful report is plain, specific and testable. “At 21:14, the fire exit alarm sounded” is useful. “The premises became unsafe” is too broad to investigate.
Incident report versus Daily Activity Report
A Daily Activity Report records routine work: patrols completed, doors checked, visitors admitted, deliveries received and scheduled handovers. It forms part of the site’s operational documentation, but it does not replace an incident report.
An incident report is needed when something out of the ordinary happens. That could be an unauthorised entry attempt, a missing key, a damaged gate, threatening behaviour, a welfare concern or a suspected safety violation.
The two documents should match where they overlap. If the Daily Activity Report states that a patrol took place at 22:00, the incident report should not place the discovery of damage at 21:45 without a clear explanation.
Why the detail matters later
Reports may be reviewed by the client, a security manager, HR, insurers, police, solicitors, health and safety staff, or an auditor. They may also support client, insurance or internal investigations. Months can pass before that happens.
Memory is not an evidence system. A properly completed report is.
A report does not need to prove why an event happened. It needs to record what was observed, what was said, and what was done next.
When security guard incident reports should be written
The simple rule is that a security guard should write a formal report whenever an event requires more than routine action, creates a risk, causes loss or damage, or may be questioned later. If a supervisor has to be called, emergency services attend, CCTV or witness statements are preserved, or a person is refused entry, there should normally be a record.
The security officer’s first duty is always safety. Deal with immediate danger, summon appropriate help and protect the scene where possible. Then record the event in notebooks or the approved system while the details remain clear.
Incidents that normally require a report
Site-specific reporting procedures determine when a formal record is required. Most will include the following:
- Security breaches, attempted unauthorised access, lost passes, missing keys and alarm activations.
- Criminal activity or suspected criminal activity, including theft, vandalism, threats, assault and fraud.
- Medical emergencies, fires, evacuations, accidents and serious welfare concerns.
- Damage to premises, vehicles, equipment or stock, even where the cause is not yet known.
- Safety violations, such as blocked fire exits, unsafe contractors, spills or failed barriers.
- Use of force, physical intervention, refusal of entry, removal from site or police attendance.
A minor event can still matter if it shows a pattern. Three separate reports about a faulty rear door are more useful than one vague comment in a handover book.
Escalation and RIDDOR screening
A security incident report is not the same as a statutory report. The HSE’s RIDDOR guidance covers certain work-related deaths, injuries, diseases and dangerous occurrences. The responsible person, often the employer or person in control of the premises, makes the RIDDOR report. It is not automatically the security officer.
Non-consensual violence at work can fall within HSE’s definition of an accident. The applicable category and deadline depend on the facts. For example, an injury causing more than seven consecutive days of incapacity may be reportable, and HSE’s reportable incident categories set out the current thresholds.
Escalate the internal report immediately where there is serious injury, violence, a fire, a safeguarding issue, criminal activity, significant property damage or risk to life. The manager can then decide whether police, emergency services, the client, insurers or HSE need to be notified.
Writing fact-based incident reports with factual language
The strongest reports answer five practical questions: who, what, when, where and how. “Why” should only be included when it is known or clearly attributed to a person’s account.
Use real times, full locations and plain descriptions. Site reporting procedures should define the level of detail required for each incident.
The person completing the account, whether a security guard or another member of staff, should avoid jargon that external readers may not understand.
Record the event in chronological order
Start with how the incident came to the officer’s attention. Continue through each action, contact and observation. Finish with the current position, including whether the site was handed over, secured or left under police control.
A clear sequence might include:
- The time and method of discovery, such as an alarm activation or patrol observation.
- The exact location, including floor, entrance, room, car park zone or gate number.
- People present, their names where available, and a physical description only where necessary.
- Actions taken by the officer, colleagues, emergency services or the client contact.
- Evidence identified, saved or handed over, with reference numbers where used.
Write “I saw”, “I heard” or “I was told by” when appropriate. This makes the source of each detail clear.
Keep observation separate from assumption
Objective language isn’t cold or evasive. It’s accurate. A security officer should write “Mr Khan raised his voice and struck the reception counter with an open hand” rather than “Mr Khan became aggressive”. The first account describes conduct. The second gives an opinion.
Likewise, write “the side window was broken and glass was on the internal floor” rather than “an intruder forced entry”. Forced entry may be likely, but the report shouldn’t turn a reasonable suspicion into a stated fact.
Witness statements should be recorded as attributed accounts, not folded into the officer’s own narrative. Note the witness’s name, contact details where authorised, the time spoken to and the words used as accurately as possible.
Accurate notes begin at the scene
Notebooks remain useful even where the business uses a digital platform. They help an officer capture times and observations when moving between an alarm panel, a control room, a first aider and the police.
Use bound notebooks where the contract’s security guard reporting procedures require them. Do not tear out pages, overwrite entries or leave blank spaces that could later create doubt about the record.
Make time-stamped working notes
Write the date, site, shift start time and each relevant time as it happens. Check against the control room clock, access-control system or emergency service log where available.
If an earlier time was estimated, say so. “At approximately 18:40” is honest. A precise time invented after the event is not.
Record descriptions that can be checked: clothing colour, vehicle registration, direction of travel, door number, alarm zone and the names of people contacted. Avoid unnecessary personal detail.
Correct errors properly
Paper notes should be corrected with a single line through the error, followed by the correct entry, initials and time if required by site policy. A clean page with altered facts is worse than a visible correction, so keep the original notebooks available when checking or transcribing entries.
Digital records need the same discipline. A security officer should not be able to silently rewrite a submitted report. A system should retain the original entry, the amendment, who made it and when.
Evidence, data and secure storage
Evidence can disappear quickly. CCTV may overwrite, a damaged item may be repaired, and witnesses may leave. A security guard should record what exists and how it was preserved, even when someone else collected it.
Build an evidence log
Relevant material may include CCTV footage, body-worn video, photographs, radio recordings, access-card logs, visitor records, alarm logs, keys, damaged property and witness statements.
This evidence log supports consistent evidence recording. It should identify each item, its source, the time it was obtained, who handled it and where it is stored. Where CCTV is retained, record the camera reference and the start and end time of the clip.
Do not edit original footage, annotate it or send copies through personal messaging accounts. Keep the original file intact and create controlled copies only where authorised.
Handle personal data with care
Incident reports often contain names, contact details, health information, allegations and images of identifiable people. They are personal data, not ordinary shift paperwork.
The ICO says CCTV material should be held securely, accessible only to authorised people, and retained no longer than necessary for the stated purpose. Its video surveillance guidance makes clear that UK GDPR does not impose one fixed retention period.
A month may suit some routine CCTV systems, but it is not a universal legal rule. Where footage relates to an active investigation, claim or legal proceedings, retain it under the organisation’s documented process and review the decision regularly.
Digital reporting needs a proper audit trail
An incident report form can improve speed and retrieval, but only when it creates a proper audit trail. A decorative form that produces a PDF is not enough.
Configure the system around clear reporting procedures, with automatic timestamps, officer identity, report version history, attachments, supervisor review and controlled exports. The report should also be searchable by site, date, incident type and reference number.
Control who can see what
A security guard may need to submit reports. Supervisors may need to amend classifications or add follow-up actions. Clients may need a redacted summary. Those are different access levels.
Limit full access to people with a genuine operational, legal or compliance reason. Keep a record of who viewed, downloaded or shared sensitive files. This protects confidentiality and gives the business an audit trail if disclosure is questioned.
Keep records retrievable, not forgotten
A report stored in an inbox is easy to lose. A report stored without a retention rule is easy to keep for too long.
Set retention periods by incident type, contractual requirement, insurance purposes and legal risk. A routine false alarm will not normally need the same treatment as an assault allegation or serious accident. The ICO’s storage limitation guidance requires organisations to justify how long personal data is retained.
Common failures, and who reviews the record
The usual failures are not dramatic. They are missing times, unclear locations, emotional language, copied-and-pasted wording, incomplete witness statements and no record of preserved CCTV.
Another common mistake is treating the report as a formality after the real work is done. The report is part of the real work. It gives managers the information needed to repair a control failure, update a risk assessment or respond fairly to a complaint.
Avoid these weak reporting habits
Do not write “nothing happened” when an alarm was investigated. Record the alarm zone, checks completed and final outcome.
Do not identify someone as intoxicated, dishonest or aggressive unless you are recording a direct observation or attributed statement. Do not include private details that have no bearing on the incident. Do not share the report casually with colleagues who were not involved.
Review reports for action, not paperwork
A manager should check that the security officer’s account is complete, factual and internally consistent. Reporting procedures should guide supervisors’ checks for completeness and trigger follow-up.
A security guard is responsible for providing a complete record. Managers should also identify actions: repair the lock, preserve footage, contact the client, update the post orders, or speak to a witness. Completed reports may be retained as compliance records where documented operational or compliance purposes require it.
SIA licence holders must follow the current SIA licence conditions. Employers should also make reporting expectations part of induction, site briefings and supervisors’ checks.
Frequently asked questions
Does every security incident need a formal report?
No. Routine patrols and expected activity belong in the Daily Activity Report. A security guard should complete an incident report when an event involves a security, safety, welfare, property or conduct issue that may need later review.
Can a guard include a personal opinion?
No, unless it is clearly identified as an opinion and the contract requires it. Reports should focus on direct observations, recorded facts and attributed witness accounts.
How quickly should an incident report be completed?
Complete it as soon as the immediate risk is controlled and the officer is able to write accurately. If the incident is still developing, make time-stamped notebook entries and submit the full report at the earliest practical point.
Who owns the report and its attachments?
The report, attachments and witness statements will usually be controlled by the employer or client under the service contract. That doesn’t permit unrestricted sharing. Access, disclosure and retention should follow the organisation’s data protection and information security rules.
A record that can stand up to scrutiny
Good incident reporting is unglamorous work, but it is where professional security becomes visible. Record what happened, record what you did, preserve what supports the account, and pass serious matters to the right person without delay.
The best security guard incident reports do not guess, exaggerate or tidy away uncertainty. They leave a clear, honest record for the people who must act on it.
0 Comments