Security Incident Report

A security incident report documents a specific event that needs more than a one-line DAR entry: theft, trespass, medical aid, property damage, an alarm, a workplace disturbance, or any situation your post orders say must be written up.

What this form is

Unlike a Daily Activity Report, which covers the whole shift, an incident report is built around one occurrence. It should let a supervisor, client, insurer, or investigator understand what happened without calling the officer. The usual backbone is who, what, where, when, what you did, what you saw, and what happens next.

What security professionals use it for

Officers use it to lock in facts while they are fresh. Supervisors use it to notify the client and decide whether police, facilities, or HR should be involved. Companies keep incident reports because they may be reviewed long after the shift — sometimes in insurance or legal settings. That is why vague language (“suspicious person hanging around”) is weaker than observable detail (description, direction of travel, times, and what you actually did).

Typical information included

• Report number, site, exact location on the property
• Date and time of the incident, and date and time the report was written
• Reporting officer name and identification
• Incident type or category your company uses
• People involved: names if known, or a factual description if not; role (complainant, witness, involved party)
• A chronological narrative of what the officer observed or was told, with sources attributed
• Actions taken: notifications, first aid, police case number, property recovered, area secured
• Injuries, property damage, evidence, photos, and camera references if applicable
• Follow-up still needed, and signatures

When it should be used

Write an incident report when something happened that a client or supervisor would expect to hear about, even if it was resolved on scene. A DAR line can note “see incident report 2026-0415.” Do not rely on the DAR alone for events that may be questioned later. If new facts arrive after the original is submitted, add a supplemental incident report instead of rewriting history on the original.

Practical completion practices

• Stick to facts. Separate what you saw from what you were told.
• Use times. “About 21:35” is more useful than “late evening.”
• Do not guess motive or guilt. Describe behavior and outcomes.
• List notifications with names or titles and approximate times.
• If police responded, record the agency, officer name if provided, and any case or event number they give you.
• Cross-reference the DAR so the shift log and the incident file tell the same story.

No single template meets every client, state, or industry rule. Use this form as a professional starting point, then follow your company policy and the site’s post orders.

These pages and templates are general resources for security companies and in-house teams. They are not legal advice and they do not guarantee that a document will meet a particular client’s, insurer’s, state’s, or workplace’s requirements. Follow your post orders and company policy.