A security officer may handle an incident professionally in the moment and still create a serious problem afterward with a vague, incomplete, or inaccurate report. Supervisors, clients, police, attorneys, and licensing authorities may rely on the written record long after memories fade. Knowing how to document security incidents is therefore a core professional skill, not an administrative afterthought.

For officers working in Virginia, Washington, DC, and Maryland, incident documentation must show discipline, objectivity, and respect for the limits of your authority. A report should allow someone who was not present to understand what happened, what you observed, what actions you took, who was notified, and what evidence or property was handled.

Document the Facts, Not Your Assumptions

An incident report is not the place to speculate about motive, diagnose a person’s behavior, or assign guilt. Your responsibility is to record relevant observations and actions accurately.

Write what you saw, heard, did, and were told. If a person appeared intoxicated, for example, avoid stating that the person was intoxicated unless a qualified authority makes that determination. Instead, record observable facts: the individual had an odor of an alcoholic beverage, spoke with slurred speech, stumbled while walking, or admitted to consuming alcohol.

The same rule applies to suspected theft, trespassing, assault, or property damage. Do not write, “The suspect stole merchandise,” if you did not see the act occur. A more defensible entry is: “At approximately 2145 hours, the store manager stated that two boxed headphones were missing from the display. I observed an open, empty product package on the floor near the display.”

Objective language protects everyone involved. It helps your employer make sound decisions, supports law enforcement when a crime may have occurred, and demonstrates that you understand professional reporting standards.

Start Your Report as Soon as Conditions Permit

Safety, medical care, scene control, and emergency notification come first. Once the immediate threat is controlled and your supervisor has been notified, begin documenting while details are fresh.

Record the exact date, time, and location. Use the reporting format required by your employer, such as 24-hour time, a site post number, floor, entrance, parking area, or camera reference. “Near the front” is not as useful as “north entrance vestibule, outside the east-facing glass doors.”

If you cannot complete the report immediately because you are waiting for police, providing access control, or preserving a scene, make brief field notes. Note times for key events: when you were dispatched, when you arrived, when you contacted the involved person, when emergency services were called, and when the incident was turned over to a supervisor or law enforcement officer.

Do not rely on memory at the end of a long shift. Small details, especially the sequence of events, are often the first to become unclear.

Build a Clear Timeline of Events

A strong report follows a logical order. The reader should not have to reconstruct the incident from scattered statements.

Begin with how you became aware of the issue. State whether you observed it directly, received a radio call, were contacted by an employee, reviewed a camera feed, or responded to an alarm. Then document what you found on arrival and the actions that followed.

Use separate paragraphs for significant changes in the event. For example, one paragraph may cover your initial contact with a trespasser, another may cover the individual’s refusal to leave, and a third may cover police arrival and the final disposition.

Include direct statements only when the exact wording matters. Place them in quotation marks and identify the speaker. Do not rewrite a statement to make it sound stronger or more damaging. If someone says, “I was just looking for my friend,” record that statement as made. If the person later changes the statement, document the change and the time it occurred.

What Every Security Incident Report Should Include

Your employer may use a specific electronic platform, daily activity report, use-of-force form, witness form, or property log. Follow that policy first. In most cases, a complete incident report should address the following distinct areas:

• Your name, title, employer, assignment, shift, and contact method.
• The date, exact times, and specific incident location.
• Names and identifying information for involved persons, witnesses, staff, and responding agencies, when available.
• A factual account of your observations, statements received, actions taken, and notifications made.
• A description of injuries, property damage, evidence, surveillance footage, or items recovered.
• The final disposition, including whether police, fire, EMS, management, or a supervisor responded.

Descriptions matter. When documenting a person, use neutral identifiers such as clothing, height estimate, build, hairstyle, direction of travel, and distinguishing features. Do not use insulting labels or unsupported conclusions. When describing property, include the make, model, color, serial number, condition, and location whenever those details are available.

Preserve Evidence and Maintain Chain of Custody

Security personnel frequently encounter evidence without being the investigating law enforcement agency. That creates a duty to protect the item or scene without contaminating, altering, or mishandling it.

If safe and consistent with site policy, restrict access to the area. Do not move a weapon, suspicious package, bloodstained item, or other potential evidence unless there is an immediate safety reason. Contact law enforcement and your supervisor according to post orders.

When property must be secured, document exactly what you received, from whom, where it was found, its condition, and every transfer of custody. Record dates and times. If you place an item in a designated evidence locker or secure container, identify the locker number or storage location.

Video footage also requires careful documentation. Note the camera number, recorded time range, person who preserved or exported the video, and the storage method used. Never edit footage or circulate it through personal text messages, social media, or unauthorized email accounts.

Document Force, Restraints, and Medical Concerns Precisely

Any use of force, physical restraint, defensive equipment deployment, or handcuffing incident requires heightened attention to detail. Your report must match your training, your employer’s policies, and the actual circumstances.

Describe the behavior that caused you to act. Then describe the commands you gave, attempts at de-escalation, force or restraint used, the duration of the event, the person’s condition afterward, and medical assistance offered or requested. Avoid broad statements such as “necessary force was used.” Explain the specific actions in plain language.

For example, document the subject’s conduct, your verbal commands, whether the subject complied, and how the encounter ended. If handcuffs were applied, record the time applied, the reason, whether they were double-locked when applicable, any safety checks conducted, and the time the person was transferred or released.

If anyone reports pain, appears injured, requests medical aid, or shows signs of distress, notify the appropriate emergency resource and record the response. Do not minimize complaints simply because no visible injury is apparent.

Review Before You Submit

A rushed report can create contradictions that affect your credibility later. Before submission, read the report from start to finish. Check names, dates, times, pronouns, locations, and the event sequence. Make sure your narrative explains why you took each significant action.

Correct errors according to company policy. Never erase, backdate, alter, or quietly replace an original report to hide a mistake. If a correction is necessary after submission, use the approved supplemental-report process and explain what was corrected.

Keep reports professional and confidential. Discuss an incident only with authorized supervisors, client representatives, law enforcement, attorneys, or others who have a legitimate need to know. A report is a professional record, not a shift-storytelling opportunity.

How to Document Security Incidents That May Become Legal Matters

Some incidents are routine policy violations. Others may result in criminal charges, civil claims, licensing review, insurance investigation, or client action. You may not know which category an event will fall into when you write the report, so write every report as if it could be reviewed later.

That does not mean using dramatic language or filling the report with unnecessary detail. It means being complete, factual, timely, and accurate. A concise report is appropriate when the event was minor. A longer report is appropriate when there are multiple parties, injuries, police involvement, force, evidence, or conflicting accounts.

Professional security work is built on sound judgment at the post and disciplined documentation afterward. The report you write may be the clearest account of an incident available, so make it specific enough to stand on its own and factual enough to withstand scrutiny.