Property managers hire your team because visible security is one way they demonstrate precaution. But most officers don’t know that presence only protects the client until an incident happens. The moment it does, what carries the weight is the incident report your officer writes. In case of lawsuits, the incident report is the first document everyone reaches for.
And just to show you how serious this can be, Florida’s court filings alone recorded 342 negligent security cases in a single year, nearly one filed every day. And the most damaging evidence gap defense attorneys face isn’t missing surveillance footage or absent witnesses. It’s vague and incomplete incident narratives. That means in most of these cases, the quality of the paper trail is what can get you off the hook.
A good example of what a bad report can cost you is a guest who slipped on a wet lobby floor at a Miami hotel. The guard’s report was three sentences long. When litigation followed, plaintiff attorneys ran that report against the security footage and found holes in the report. Rather than defend what their officer had written in front of a jury, the property settled for $4.75 million. In this guide, I’ll show you how to write a concise, objective incident report, and then give you a free security incident report template and show you how to fill it out, so you don’t fall into such a trap.
What is a security incident report?
A security incident report is a formal operational record documenting a specific event that occurred during a guard’s shift. That can be something criminal, an accident, a safety hazard, an unauthorized entry, or anything out of the ordinary that requires a response. The report answers six questions: what happened, when and where it happened, who was involved, what your officer did in response, who was notified, and what evidence was collected.
The report serves as legal documentation in court cases and insurance claims, as accountability evidence that your team acted appropriately, and as an operational tool for identifying site patterns. And let me clarify something. An incident report is different from a daily activity log and different from a police report. The DAR is the full shift record that records every patrol completed, every checkpoint visited, every access event logged, every observation made during rounds. The incident report is narrower as it’s built around a single event.
On the other hand, a police report is a law enforcement document that initiates investigations and supports prosecutions. Your security incident report is internal, with access limited to the people with a legitimate reason to review it, such as your client, your chain of command, and legal counsel. And when law enforcement does respond to a scene, both documents get created, and both end up as evidence. That means one doesn’t eliminate the need for the other. So make sure your officers understand that completing their report isn’t redundant just because law enforcement showed up.
Who creates and who reads the report
The officer who was present, who observed the incident, responded to it, or first received the report, is the one who writes it. That comes from the fact that first-hand accounts are far harder to challenge than narratives that have passed through multiple people. In fact, ASIS International now formally recognizes incident report writing as a core professional competency for security officers. An officer who can’t produce a clear, accurate, and complete report is a liability exposure regardless of how well they perform in the field.
As for who reads those reports, the report moves up the chain. As the supervisor, you review the report first, and then the signed report proceeds to other parties such as your client, an insurance adjuster, a civil attorney, a law enforcement investigator, and a regulatory authority. Build a culture where your officers write as if the report will be read aloud in a courtroom.
Something else worth mentioning is that you should keep commercial property incident reports for a minimum of 5-7 years, which is the standard statute of limitations window for premises liability claims in most jurisdictions.
Why you need a standardized report template
The whole point of having a standardized report template is to have the same information, captured the same way, by every officer, on every incident, at every property. But before we get into how to do it, let’s see what it can cost you if you don’t standardize.
Legal protection
When an incident moves into litigation, the report is the primary evidence. Defense attorneys rely on the report to establish that the property owner maintained an active, responsive security program. Plaintiff attorneys rely on gaps, missing fields, and inconsistencies to argue the opposite. A standardized form helps make sure the officers include all the information worth putting in the report, not deciding what to include.
Client accountability
The property manager who hired your company wasn’t on site when the incident happened. Their entire picture of what occurred and how professionally your team handled it is built from the report. In competitive bids for managed properties, your security company can win or lose based on how you demonstrate reporting standards.
Insurance claims
When a security-related incident generates a claim, the adjuster’s first move is the incident report. A complete, structured report keeps the claim moving. But when the report conflicts with available video, or leaves fields blank, it gives the insurer grounds to dispute coverage. And keep in mind that a pattern of poor documentation can drive premiums up by 15-25%.
Other than that, most general liability carriers require written notice of a claimable event within one business day to preserve coverage. An officer who delays filing easily hands the insurer a reason to deny the claim.
Pattern detection
Research from the National Safety Council shows that 72% of workplace injuries were preceded by at least one near-miss that went undocumented. You can only recognize a recurring hazard at the same location when each observation is logged in a format that connects it to prior ones. And free-form narratives can’t support that analysis. But when every report uses the same categories, the same location fields, and the same incident classifications, you can easily join the dots.
Regulatory compliance
In some industries, incident documentation is a legal requirement with hard deadlines and escalating penalties. For example, at the federal level, OSHA requires employers to report any work-related fatality within 8 hours, and any inpatient hospitalization, amputation, or loss of an eye within 24 hours. As of 2025, the penalty for a serious recordkeeping violation goes as high as $16,550, with willful or repeated violations reaching up to $165,514.
For security firms specifically, most jurisdictions require a written report submitted to the state licensing authority within 24 hours of any physical altercation, firearm discharge, or use of a deadly weapon by an officer on duty. California extends that window to 7 days, but the non-compliance penalty has climbed to $5,000 per violation.
How to fill out an incident report
The value of an incident report is dependent on what goes into it, so you want to capture everything critical, without making it a hard read with excessive and unnecessary details. Here are the template fields to consider:
- Report number/reference ID: Report’s unique identifier. This helps to track, retrieve, and cross-reference the report against patrol logs, CCTV footage, police reports, and prior incident history.
- Date and time of incident: Exact date and time the incident happened. When investigators are reviewing surveillance footage, they’re working backward from your officer’s timestamp. So this is a compulsory field.
- Date and time of report filed: This is the time when the report was written, which is a separate field from the incident time. Plaintiff attorneys use any lag between incident time and report time to argue memory drift or fabrication. So, the tighter that gap, the stronger the document’s credibility.
- Reporting officer name and badge/ID number: Full name, badge number, and employee ID for the filing officer and any officer who assisted. These identifiers establish accountability and create a traceable record of who was on site and in what capacity.
- Property/site name and address: In an operation running multiple sites, the complete address shows exactly where the incident happened.
- Exact location within the property: Beyond the street address, your officer identifies precisely where the incident occurred, such as specific building, floor, entrance, wing, parking section, stairwell, or loading area. I suggest you coach your officers to write as if someone who has never set foot on the property is reading this report and needs to find exactly where the incident happened.
- Incident type: You need to classify the incident, as this helps route the report through the correct escalation path. For example, a use-of-force incident and a maintenance concern carry different response chains. Standardized categories such as theft, trespass, vandalism, assault, medical emergency, unauthorized access, and suspicious activity turn individual reports into comparable data points over time.
- Incident narrative: This is the core of the report, and where the most consequential errors happen. The narrative should be a clear, factual, chronological account of what was observed, heard, or reported, and in what sequence.
- Victims involved: Every victim needs their own entry with full name, contact information, and their status when the officer’s involvement concluded: did they remain on scene, leave on their own, or get transported by EMS?
- Suspects involved: For suspects, the description needs to be specific enough to be actionable, such as gender, approximate age, height, build, skin tone, hair color and style, clothing, and any distinctive identifying marks.
- Witnesses involved: For witnesses, document their physical location relative to the incident, because a witness adjacent to the event carries different observational weight than one many feet away. When quoting a witness in the narrative, use their actual words and attribute them, not a paraphrase written as if the officer observed it.
- Actions taken: Document every action your officer took in response, such as verbal commands issued, notifications to dispatch or supervisors, requests for emergency services, scene control measures, access control actions, welfare checks, and assistance rendered.
- Evidence collected: This is where the chain of custody begins. Document every handling, every location change, and every person who had contact with the evidence. If that chain breaks at any point, the evidence may be ruled inadmissible.
- Follow-up actions required: Not every incident is fully resolved when the shift ends. Document what still needs to happen, such as supervisor review, client notification, law enforcement follow-up, insurance notice, or regulatory reporting.
- Supervisor review and sign-off: Every incident report should clear your desk before it enters the official record or reaches the client. Your role is to verify the report is complete, internally consistent, and free of language that creates legal exposure. Your signature is the final quality checkpoint before this document becomes the organization’s official account of what happened.
Common mistakes when filling out an incident report
The template structure solves the blank-page problem. What it can’t solve on its own is what your officers are putting into it. Here are some things to watch for when you’re reviewing reports before they leave your desk.
- Filing too late: Every hour between the incident and the filed report is an hour of detail softening. So the earlier the better.
- Vague language: Subjective language such as “the area was in disarray” and “the subject was acting suspiciously” makes the reports sound like personal opinions. Write observable behaviors, exact conditions, and measurable details only.
- Confusing direct observation with secondhand information: If someone told the officer something, it needs to be attributed rightly. That’s helpful when someone asks in a proceeding how the officer knew what they claimed to know.
- Leaving fields blank: Every skipped section is a question mark in any future investigation or legal proceeding. Your review process should be stopping blank fields before a report gets approved.
- Inconsistencies with other available records: If the report places your officer at the south entrance at 11:30 p.m. and the access control log shows something different, the report looks deliberately constructed. Cross-check the narrative before the report becomes official.
- Jargon, abbreviations, and slang: Your officers know what their internal shorthand means, but the report gets read by many third parties. Couch the officers to write the reports in plain, complete language that any reader, without any background in security operations, can follow.
- Failing to update when new information comes up: Document the updates and formally append them to the original report. Remember that the report is a living document until the matter is fully closed.
Paper template vs digital system
The template in this guide gives your team a clear, structured framework for capturing what matters. But whether that framework lives on paper or in a digital system determines what happens with the information afterward.
Paper reporting has real structural limits. Research across industries puts documents lost altogether at around 7.5%, with another 3% misfiled. AIIM research found that 35% of organizations have faced fines or litigation linked directly to inadequate document management.
Other than that, there’s no independently verifiable patrol trail. When you or your client read when and where the incident happened, the paper-based answer is whatever the officer chose to record, with no location data and no timestamped position history.
Digital systems eliminate those limitations. Patrol guard platforms log officer positions in real time, timestamp checkpoint arrivals automatically, and where GPS signal is unreliable, QR code or NFC checkpoint scanning fills the gap. That means the report carries embedded photo metadata of time, date, and GPS coordinates, locked at the moment the incident photos are taken.
Also, with a digital app, you can configure the structured incident forms in a way they require completion of specific fields before a report is submissible. That way, you make sure all critical sections can’t be skipped through oversight. And on top of that, these platforms store the reports in the cloud, so you have no worries of misfiled and lost reports.
Final thoughts
This free template is a functional starting point. It helps remove the blank-page problem, defines what needs to be captured, and gives your review process a consistent standard to hold reports against. But the biggest limitation of a manual template is the fact that you can’t independently verify some of the things included in the report, such as time and location. And sometimes you’ll still have to deal with blank fields. A digital system eliminates these limitations by making sure the structure surrounding that information, such as the timestamps and locations, is independently verifiable, and critical fields are all filled before submitting the report for review.
