Security Incident Report Writing Guide
A security incident report records what happened, where and when it happened, who was involved and what action was taken. Clear writing helps the people reviewing an incident understand the information available to you.
Explore the principles of security incident report writing, learn how to organise a factual account and see examples that help you distinguish observations from assumptions.
For Security Guards, Door Supervisors and learners preparing for public-facing security work.
What makes a clear security incident report?
A useful report gives an accurate account in a logical order. The reader should be able to distinguish your direct observations, information received from others and any details that remain unknown.
Reporting is part of wider security responsibilities. Our Security Guard duties and responsibilities guide explains how observation, communication and reporting connect with day-to-day security work.
Describe facts and identify sources
Record what you observed without guessing motives or drawing unsupported conclusions. If a witness gives you information, make clear that it came from that person rather than from your own observation.
Put events in chronological order
Explain the sequence from the first relevant observation through to the response and outcome known to you. If a time is approximate, label it as approximate rather than presenting it as exact.
Use plain, specific language
Write short, clear sentences and explain unfamiliar abbreviations. Describe relevant behaviour, locations and actions precisely so a reader does not have to guess what you mean.
Example: replace a judgement with an observation
This fictional example shows how wording changes the usefulness of a report.
“The visitor was aggressive and caused trouble at reception.”
“At approximately 14:20, I saw a visitor strike the reception desk twice with an open hand and heard them shout, ‘Let me in.’ I informed the duty supervisor by radio.”
The second account identifies the approximate time, location, observed behaviour, words heard and action taken. It gives the reviewer concrete information rather than a general label.
What should a security incident report include?
Use your workplace form or reporting system. The following structure helps you organise the main details without mixing observations, actions and information received from others.
Report details
Record the incident reference, your name or staff identifier, your role and when you completed the report. Distinguish the report-writing time from the incident time.
Date, time and location
Identify where the incident happened using a specific location. Record known times accurately and label estimates as approximate. Note the time source where relevant.
People involved and information sources
Include relevant identities or factual descriptions where appropriate. Identify witnesses and distinguish what they told you from what you personally observed.
Sequence of events
Describe the relevant events in chronological order. Use quotation marks only for words you can accurately recall; identify a paraphrase as a summary.
Actions and notifications
Explain what you did, who you informed and when. Distinguish your own actions from those taken by colleagues or others. Reference related records where appropriate.
Outcome and outstanding matters
Record the outcome known to you, relevant evidence references and any follow-up or handover. Make clear which details remain unknown or have not been checked.
Security incident report example with writing notes
This fictional reception incident demonstrates a clear account. All names, locations and references are invented. Adapt the structure to your employer’s form rather than copying the example as a real report.
Visitor incident at reception
1. Initial observation
At approximately 14:20, while standing beside the reception desk, I saw a visitor strike the desk twice with an open hand. I heard the visitor shout, “Let me in.” The visitor was wearing a grey jacket and carrying a black backpack. I did not know their name.
2. Information from another person
Receptionist Sam Taylor told me that the visitor had requested access to a tenant’s office and that an appointment had not been confirmed. I did not witness the earlier conversation or check the appointment record myself.
3. Actions and notifications
At 14:21, using the reception clock, I notified Duty Supervisor Jordan Lee by radio and requested attendance at reception. I asked the visitor to wait while the supervisor attended. Jordan Lee arrived at approximately 14:24 and spoke with the visitor.
4. Outcome and handover
At approximately 14:27, I saw the visitor leave through the main entrance. I did not observe any injury. I made a corresponding entry in the site log under reference TRAINING-LOG-001 and submitted this report to Jordan Lee through the site reporting system at 14:45. I had not reviewed CCTV footage when completing this account.
Connect reporting with your wider security skills
Clear reports depend on careful observation and communication. Explore the licence guide or use the practice quiz to revise broader Security Guard topics.
Common report writing mistakes and your final checklist
Review your account for accuracy, clarity and completeness. A careful check helps the reader understand what happened without introducing information you cannot support.
Common mistakes to avoid
- Using labels without describing behaviour Explain what you observed rather than relying on words such as “aggressive”, “suspicious” or “uncooperative”.
- Mixing observations with second-hand information Identify who supplied information and make clear which events you did not personally witness.
- Presenting estimates as exact details Label approximate times and uncertain details. Do not invent missing information.
- Leaving actions or outcomes unexplained Record who was notified, what you did and the outcome known to you when completing the report.
- Adding unnecessary personal information Keep details relevant to the incident and follow your workplace’s information-handling procedure.
Before you submit your report
- Check the incident reference, date, location and your reporting details.
- Confirm that events appear in a clear chronological order.
- Separate direct observations from witness accounts and unknown details.
- Check the actions, notifications and related record references.
- Read for unclear wording, unexplained abbreviations and typing errors.
- Submit through the authorised workplace system within the required timescale.
Security incident report writing: your questions
Find answers about report length, witness information, uncertain details and submitting your account.
How long should a security incident report be?
There is no single length that suits every incident. Include the relevant facts, actions and known outcome without unnecessary repetition. Follow the structure and instructions used by your workplace.
Should I write my report in the first person?
First-person wording such as “I saw”, “I heard” and “I notified” can clarify your own observations and actions. Follow your employer’s required style and distinguish your account from information supplied by others.
What if I cannot remember the exact time?
Identify the time as approximate and record the basis for your estimate where useful. If you later check an authorised record, distinguish that information from your original recollection.
Can I include information from a witness?
Include relevant witness information through your workplace’s reporting procedure. Identify its source and explain that it was reported to you. Do not present a witness account as something you personally observed.
Should I include my opinion about why someone acted a certain way?
Avoid guessing motives or making unsupported judgements. Describe the behaviour you observed. If the reporting system asks for an assessment, distinguish it from facts and explain the observations on which it is based.
Does this guide replace my employer’s reporting procedure?
No. Use this guide to improve clarity, while following your employer’s reporting form, notification requirements, submission deadlines and information-handling instructions. Explore the Security Guard licence guide for wider training and licensing information.
Explore your next security training step
Clear reporting is one part of professional security work. Review the Security Guard licence guide, or ask Securex which training route fits your experience and intended role.