A brief note that an incident occurred is not enough to support a clear response. Effective security guard incident reporting records what happened, when and where it happened, the actions taken, and any notifications or follow-up, in chronological order. Complete the report on the same day, ideally within a few hours, after immediate safety needs have been addressed.
Accurate records matter because supervisors and others may need to understand the event after the shift has ended. A factual account separates what the officer directly saw or heard from information provided by others, without speculating about intent.
This guide explains what to include, which incidents to record and how to write a clear, chronological account. It also covers evidence, injuries, accidents, theft and data breaches, helping you document relevant details and actions consistently.
Key Takeaways
- Capture the essential incident details, officer identification and actions taken so the record supports clear review and follow-up.
- Build the narrative in time order, separating what you observed from information reported by others.
- Record relevant witness details and evidence, including where items were found and who took responsibility for them.
- Document injuries, accidents, theft, breaches and other events that may require investigation or further action.
What is a security guard incident report?
A security incident report records an unusual event, safety concern, breach or emergency during a shift. It gives supervisors a clear account to support decisions, investigation and follow-up.
-
Record facts honestly and objectively
Record the incident’s date, time, location, type and severity, along with your name or identification and the report number. Describe what you directly saw or heard in clear, neutral language. For example, write “the visitor raised their voice” rather than labelling them aggressive. Attribute a witness’s account to that person, and don’t present assumptions about intent as facts.
There is no single reporting route for every incident. Follow your organisation’s internal reporting policy. Certain workplace events may also require external reporting under RIDDOR.
-
Document responses and follow-up
Set out your actions chronologically, including who you informed, which procedures you followed and what happened next. Record whether you contacted emergency services, the police, a supervisor or an affected person, and when. Note immediate steps taken to reduce further harm or protect people and property. Identify outstanding actions and, where possible, who is responsible for each.
-
Escalate incidents when needed
Contact emergency services when the situation calls for an urgent response, such as immediate danger or a medical emergency. If you witness a crime, you may need to contact the police and file a report. Record whom you contacted, when you notified them and any instructions received. Don’t delay immediate safety measures to complete paperwork; record the incident as soon as it’s safe.
SIA licensing does not replace workplace procedures. Follow your employer’s reporting process and the timeframe it sets for submitting reports.
-
Submit and protect the record
Complete the report promptly, ideally on the same day and within a few hours, while details are fresh. Sign it with your name and role, and record when you completed it. Your organisation’s policy sets the submission timeframe. Keep notebooks and records secure, whether they’re held in paper logs, electronic databases or cloud-based systems.
Retain reports according to your organisation’s record-keeping requirements. A supervisor or colleague should review serious reports before finalisation to help correct omissions and preserve a reliable account for future reference.
Factual chronological incident narratives
Arrange the account in the order events occurred, using times and observable details. A clear security guard incident reporting narrative helps readers understand decisions without relying on assumptions.
-
Describe each event objectively
Record specific behaviour rather than conclusions. For example, write that a person raised their voice and stepped forward at 21:30; avoid labelling them aggressive without describing the actions behind that assessment. Distinguish what you observed from what another person told you, and identify the source of each account.
Use direct language and separate a person’s claims from established facts. If someone says they are visiting a tenant on Level 4, record that as their statement, not as confirmation of their purpose. In security guard incident reporting, clarity about what was seen, heard or reported allows supervisors to assess the account without mistaking opinion for evidence.
-
Structure the report chronologically
Begin the narrative with the first relevant event, then record each action and outcome in time order. For example, the account can state that an officer escorted the person from the premises at 21:49, followed by notifying the supervisor at 21:50. This sequence shows how the response developed and when responsibility was handed over.
Keep administrative details, such as the report number, distinct from the event narrative. When CCTV footage from 21:30 to 21:55 is saved, identify it as supporting material and record its reference. Check the written sequence against notes before submission. If you find errors, correct them transparently so the final account remains understandable and preserves the original meaning.
What are Incidents to record for security officers?
Gather information from people involved and preserve details that may clarify the situation. UK security companies may use paper forms, electronic databases or cloud-based systems—and for operators seeking to refine their workflow systems, Cardinal Consulting CSM provides guidance and software to help guard firms scale effectively. Whatever the format, useful records identify the event, people, witnesses and evidence.
-
Gather incident facts
Collect relevant details at the scene as soon as it’s safe. Note what happened, where and when it occurred, and the circumstances leading up to it. Identify affected equipment, systems or resources, such as a damaged access door. Separate your observations from information supplied by others, so the source of each detail is clear.
-
Identify people involved
Document the people involved, including anyone affected, witnesses and staff who responded. Record names, roles and relevant descriptions, adding contact details when needed for follow-up. Where practical, verify details with the person or an available record. Don’t present an unverified identity or account as fact; distinguish confirmed information from details still being gathered.
-
Collect witness statements
Ask witnesses to describe what they personally saw or heard, and record their words accurately. Take statements as soon as possible, while recollections are fresh. A witness statement form can capture identity, contact details and the witness’s account. Keep each account distinct; combining separate recollections can obscure who observed each event.
-
Document witnesses and evidence
Link each witness to the relevant events and note how they can be contacted. Record evidence such as CCTV footage, photographs, physical items, access logs or property damage records. For each item, document where it was found and who collected it. An evidence log connects the item to its source; also note where it was stored or who took responsibility for it.
Security incidents including injuries, accidents, theft and data breaches
Record incidents affecting people, property, access or information. An injury, attempted theft or data breach may each call for a distinct response, evidence trail and follow-up.
- For an injury or accident, prioritise immediate safety and record the circumstances you observed. Note the location, what happened, any visible injury or damage, and the actions taken. Notify the supervisor and record when you did so. In the UK, certain workplace events may need external reporting under RIDDOR; an accurate written report can support that process.
- For theft or attempted theft, document what appears to be missing or damaged, where it was last recorded, and any signs of unauthorised access. Distinguish observed facts from reports by staff or witnesses. Record relevant access logs, CCTV footage or photographs, noting the source of each item. These details can help later investigations establish the sequence of events and identify outstanding enquiries.
- For a suspected data breach, report the discovery promptly through your organisation’s procedure. Record the affected system, equipment or resource, how the issue came to light, and any known disruption or potential data loss. Avoid accessing or altering information beyond your role. Note whom you informed and when, so responsible personnel can assess the impact and direct further action.
- Complete an initial account as soon as it’s safe, then add verified information through the proper process. A fuller report may follow over the next few days as evidence and accounts are gathered. Check dates, times, names and actions for accuracy before submission. Reviewing reports over time can reveal patterns, such as recurring access breaches, and help organisations assess their security procedures.
For structured protection at a commercial site, discuss your site security requirements.
FMT Security: Construction Security
FMT Security provides Construction Security for sites where unauthorised access, theft or damage could disrupt operations. Site-specific guarding provides a security presence, while clear incident records help responsible teams understand events and organise follow-up. For office, industrial or event settings, Corporate Security, Industrial Security and Event Security address different operational needs.
Consider Construction Security when a building project needs a consistent on-site security presence alongside clear procedures for recording and escalating incidents. Appropriate arrangements depend on the site, its access points and the risks affecting its people and assets. Contact FMT Security to discuss security requirements for your site or organisation.
Turn reliable records into stronger site oversight
A written report has lasting value when its findings inform practical decisions. Make the next operational step clear in each handover, so recurring concerns receive attention and outstanding actions aren’t lost between shifts. Consistent security guard incident reporting can help managers identify procedures to review and site-specific safeguards that need closer oversight.
FMT Security provides Construction Security, Corporate Security and Industrial Security for organisations managing risks across working sites and business premises. A considered security presence can complement established reporting procedures, helping teams respond to incidents and maintain operational discipline.
Discuss the security requirements of your site or organisation with FMT Security. A clear conversation about your operating environment is a practical next step towards more structured protection and confident day-to-day oversight.
Frequently Asked Questions
What Should Be Checked Before Submitting an Incident Report?
Check that the report is complete, consistent and ready for review. Match names, dates, times and locations against your notes, and confirm that each account is attributed to its source. Make sure attachments are clearly identified and follow-up actions have an owner where possible. Correct errors transparently, then sign and date the final record.
What are the reporting procedures for security officers?
Follow your employer’s reporting procedure and submission route. Address immediate safety needs first, notify the supervisor according to workplace arrangements, then complete and submit the relevant record. Note who received the notification and when. Certain workplace events may also require external reporting under RIDDOR, so internal reporting does not replace that process.
What should a security guard include in an incident report?
Include enough information for someone unfamiliar with the incident to understand its scope and status. Identify affected people, property, systems or equipment, and state whether anything remains unresolved. For example, note if an access point is still damaged or a system remains unavailable. Name attachments so the reviewer can locate supporting material.
How quickly should a security guard submit an incident report?
Submit the report promptly, ideally on the same day and within a few hours, while details are fresh. Follow the timeframe in your organisation’s policy. If further evidence or information is needed for a full account, a preliminary report can alert relevant people first. Prepare the fuller account over the next few days, adding verified details through the approved process.
How should security guards record witness statements, evidence and CCTV?
Keep each witness’s account separate and identify who provided it. Record relevant contact details and what each witness personally saw or heard. For CCTV, note the camera or location, relevant footage period and who saved or received the material. Identify photographs, physical evidence and logs in an evidence record, including where each item was found and where it is stored.
What UK SIA rules or guidance apply to security incident reporting?
SIA licensing does not replace workplace procedures. Follow your employer’s reporting process and submission timeframe. Certain workplace events may also require external reporting under RIDDOR.
