Security Incident Reporting: Best Practices for Businesses

A security incident can happen at almost any business.

It may involve theft, unauthorized access, vandalism, trespassing, workplace violence, property damage, a suspicious person, a security alarm, or another event that requires attention from management or security personnel.

What happens after the incident can be just as important as the initial response.

A well-written security incident report creates a factual record of what happened, when it happened, who was involved, what actions were taken, and what follow-up may be required. It can help management identify recurring problems, support insurance or legal processes when appropriate, improve security procedures, and provide useful information to law enforcement or other authorized parties.

A poor report can do the opposite.

Vague descriptions, unsupported assumptions, missing times, incomplete witness information, or unclear accounts of what happened can make an incident much harder to understand later.

For businesses, the goal should be straightforward:

Document what was observed, preserve relevant information, identify what was done, and create a useful record for follow-up.

What is a security incident report?

A security incident report is a written record documenting a security-related event and the response to that event.

Depending on the business, reports may cover incidents such as:

• Theft
• Shoplifting
• Burglary
• Trespassing
• Unauthorized access
• Vandalism
• Property damage
• Workplace disturbances
• Physical altercations
• Suspicious activity
• Security alarm activations
• Lost or stolen access credentials
• Vehicle incidents
• Parking incidents
• Safety-related security events
• Threats or concerning behavior
• Attempts to enter restricted areas

The exact reporting requirements should be established by the business and its security provider.

A security incident report is not necessarily the same thing as a police report, insurance claim, OSHA record, or employee disciplinary record. Different records can have different purposes and requirements.

Why are security incident reports important?

A good report provides a reliable reference after an incident has ended.

Memory can become less precise with time. Different people may remember the same event differently. Video footage may eventually be overwritten. Employees may forget exact times or sequences of events.

A contemporaneous report can preserve important information while it is still fresh.

Incident reports can help businesses:

• Understand what happened
• Identify recurring security problems
• Review guard performance
• Improve security procedures
• Preserve important details
• Support internal investigations
• Coordinate with law enforcement
• Provide information to insurers when appropriate
• Identify training needs
• Evaluate security staffing
• Support corrective actions

OSHA similarly emphasizes that incident investigation can help employers identify hazards and underlying causes rather than simply assigning blame.

What should a security incident report contain?

There is no single universal format for every business.

However, a useful report generally answers the basic questions:

Who? What? When? Where? How? What happened afterward?

A quick reference looks like this:

Report Element	What to Include
Date and time	When the incident occurred and when it was reported
Location	Specific building, room, entrance, parking area, or other location
People involved	Names or descriptions when appropriately available
Incident type	Theft, trespassing, vandalism, disturbance, etc.
Observations	What the reporting person actually saw, heard, or otherwise observed
Actions taken	Notifications, security response, first aid, evacuation, etc.
Witnesses	Names and relevant contact information when appropriate
Evidence	CCTV, photographs, access records, physical evidence, documents
Law enforcement	Whether police or other emergency services were contacted
Outcome	What happened when the incident response concluded
Follow-up	Recommended or required additional action

The report should be detailed enough to be useful without turning into speculation or unnecessary narrative.

Start with the basic facts

The first part of a report should establish the basic facts.

Include:

• Date
• Approximate or exact time
• Location
• Reporting employee or guard
• Incident category
• Date and time the incident was discovered
• Date and time it was reported

If the exact time is unknown, do not invent one.

Instead, state that the time is approximate or explain how the time was determined.

For example:

“At approximately 10:15 p.m., the security officer observed…”

is preferable to presenting an estimated time as though it were exact.

Describe what was actually observed.

This is one of the most important principles in incident reporting.

A report should distinguish between observation and interpretation.

Consider these two descriptions:

“The individual stole a laptop.”

versus:

“The individual picked up a laptop from the display table, placed it inside a backpack, and walked past the checkout area without presenting the item for payment.”

The second description focuses on observable conduct.

Whether the conduct legally constitutes theft is a matter that may require additional facts and, where appropriate, a determination by law enforcement or legal professionals.

Security personnel should therefore avoid turning their reports into legal conclusions unless they are simply documenting a fact or quoting someone else’s statement.

Avoid speculation

A security report should not become a collection of guesses.

Avoid statements such as:

• “He was definitely planning to steal.”
• “She was obviously intoxicated.”
• “They were probably working together.”
• “The person must have known the alarm was disabled.”
• “He looked like a criminal.”

Instead, describe the facts that led to the observation.

For example:

“The individual repeatedly looked toward the security desk before entering the restricted area.”

That gives the reader useful information without claiming to know what the person was thinking.

Record the sequence of events.

A chronological report is generally easier to understand than a collection of disconnected observations.

A useful structure might be:

1. Initial observation

What first drew attention to the situation?

2. Incident

What happened next?

3. Security response

What did the guard or employee do?

4. Notifications

Who was contacted?

5. Outcome

How did the situation end?

6. Follow-up

What evidence or additional action was identified?

This structure helps management reconstruct the incident later.

Record the exact location

“Warehouse” may not be specific enough.

Where possible, identify the relevant area:

• Main entrance
• Employee entrance
• Loading dock 3
• Parking level 2
• North side of the building
• Retail sales floor
• Guest elevator lobby
• Storage room
• Reception area

Specific locations can help investigators identify relevant cameras, witnesses, access records, and physical conditions.

Identify people accurately

When appropriate and lawfully available, a report may include:

• Full name
• Role
• Employee identification
• Visitor information
• Physical description
• Vehicle information
• Relationship to the business

However, security personnel should not collect or distribute unnecessary personal information simply because it might be interesting.

The report should contain the information necessary for the legitimate purpose of documenting the incident and should be handled according to the organization’s privacy and information-security procedures.

What if the person’s identity is unknown?

Do not guess.

Describe observable characteristics that are relevant and appropriate, such as:

• Approximate height
• Clothing
• Direction of travel
• Vehicle description
• Vehicle color
• License plate information when lawfully observed and appropriate
• Distinguishing features relevant to identification

A description should be factual rather than exaggerated.

Document witness information

Witnesses can be important, particularly when the incident is later reviewed.

A report may identify:

• Employees who witnessed the incident
• Customers
• Contractors
• Security personnel
• Other relevant individuals

If a witness provides a statement, the report should distinguish between what the reporting guard personally observed and what the witness reported.

For example:

“The security officer did not observe the initial interaction. Store employee Jane Smith stated that she saw the individual remove the merchandise from the shelf.”

That distinction preserves the source of the information.

Include relevant security-camera information.

If CCTV footage may be relevant, the report should identify:

• Camera number, if known
• Approximate time range
• Location covered by the camera
• Whether footage was reviewed
• Whether relevant footage was preserved
• Who handled the footage

A report might state:

“Camera 14 was reviewed for approximately 9:40 p.m. to 9:55 p.m. Relevant footage was identified and preserved according to company procedure.”

This is more useful than simply writing:

“CCTV checked.”

Preserve evidence promptly

If an incident may require further investigation, relevant evidence should be preserved according to the organization’s procedures.

Potential evidence may include:

• CCTV footage
• Photographs
• Access-control records
• Alarm records
• Visitor logs
• Delivery records
• Emails
• Digital messages
• Physical property
• Documents
• Employee statements

Businesses should have a defined process for determining who is responsible for preserving relevant information.

This is particularly important when video systems automatically overwrite older recordings.

Do not alter evidence unnecessarily.

Security personnel should avoid modifying, deleting, overwriting, or unnecessarily handling potentially relevant evidence.

For physical evidence, the appropriate handling procedure may depend on the incident and company policy.

For digital evidence, security personnel should follow the organization’s established evidence-preservation procedures.

When an incident may involve criminal conduct, litigation, or another formal investigation, businesses may need to involve appropriate legal or investigative personnel.

Document actions taken

A report should explain what security personnel actually did.

Examples include:

• Contacted a supervisor
• Secured an area
• Requested medical assistance
• Contacted law enforcement
• Reviewed CCTV
• Directed unauthorized individuals to leave
• Notified hotel or property management
• Preserved relevant footage
• Assisted with evacuation procedures

Avoid writing simply:

“Security handled the situation.”

Explain what that means.

Document notifications

The report should identify important notifications made during the incident.

Depending on the circumstances, this could include:

• Security supervisor
• Property manager
• Business owner
• Human resources
• Emergency services
• Police
• Fire department
• Medical personnel
• Building management
• Client representative

The report should indicate approximately when the notification occurred when that information is relevant.

Do not confuse a security report with a police report

A private security incident report and a police report serve different purposes.

A security guard may document what happened at the property.

Law enforcement may create its own report if officers respond and conduct an investigation.

A business should not assume that creating an internal security report satisfies every external reporting requirement.

Some incidents may trigger separate legal, regulatory, insurance, workplace-safety, or contractual reporting obligations.

Workplace injuries require additional attention.

If a security incident involves a work-related injury or illness, businesses may have obligations beyond their ordinary security incident-reporting process.

Under federal OSHA rules, many employers must maintain records of qualifying work-related injuries and illnesses. OSHA also has specific reporting requirements for certain serious incidents. For example, employers must report a work-related fatality within 8 hours and certain incidents involving inpatient hospitalization, amputation, or loss of an eye within 24 hours.

OSHA’s requirements apply to qualifying workplace injuries and illnesses, not simply every security incident.

Businesses should therefore avoid assuming that a security incident report automatically substitutes for OSHA recordkeeping or reporting.

Near misses should also be documented.

A security incident does not have to result in injury or property loss to be worth documenting.

Consider a situation where:

• An unauthorized person attempts to enter a restricted area but is stopped.
• A suspicious vehicle repeatedly approaches a secured facility.
• A door is found unsecured during an overnight patrol.
• A potential workplace confrontation is interrupted before anyone is injured.
• A security alarm activates because of a procedural problem.

These events can reveal vulnerabilities.

OSHA specifically encourages employers to investigate close calls because they can reveal hazards and opportunities for corrective action.

Businesses can apply the same preventive mindset to security operations.

Focus investigations on causes, not blame

After an incident, it is tempting to ask:

“Who is responsible?”

That question may eventually be relevant, but it should not be the only question.

A more useful security review asks:

• What happened?
• Why was the incident possible?
• What security control failed?
• Was a procedure unclear?
• Was training adequate?
• Was equipment functioning?
• Was access properly controlled?
• Was the security staffing level appropriate?
• Was information available to the people who needed it?
• What could prevent recurrence?

OSHA recommends looking beyond immediate causes and examining underlying or root causes when investigating workplace incidents.

A similar approach can make business security reviews more useful.

Establish a clear reporting chain

Employees and guards should know exactly who receives an incident report.

Depending on the business, the chain may involve:

Security officer → Security supervisor → Property management → Client management

Serious incidents may also require immediate escalation to:

• Senior management
• Emergency services
• Law enforcement
• Legal counsel
• Risk management
• Insurance representatives

The reporting structure should be established before an incident occurs.

CISA’s incident-response guidance similarly emphasizes defining roles, responsibilities, key contacts, and reporting procedures in advance.

Create different reporting levels.

Not every event requires the same reporting process.

A business may use categories such as:

Incident Level	Example	Typical Response
Routine	Minor access issue or non-serious policy violation	Document and notify designated supervisor
Significant	Theft, property damage, repeated trespassing	Detailed report and management review
Serious	Violence, major theft, significant injury	Immediate escalation and emergency response as appropriate
Critical	Fatality, major emergency, serious ongoing threat	Activate emergency procedures and required external notifications

The exact categories should be customized to the business.

The important principle is that employees should know when an incident requires immediate escalation rather than waiting until the end of a shift.

Do not delay urgent notifications.

A detailed report can be completed after immediate safety issues are addressed.

If there is an active threat, serious injury, fire, or other emergency, personnel should follow the appropriate emergency procedure rather than stopping to complete paperwork.

The general sequence is:

Protect people → summon appropriate assistance → control the immediate situation → preserve information → document the incident.

Paperwork should never delay an emergency response.

Use standardized report forms

A consistent report structure makes reports easier to review.

A form can include fields for:

• Incident number
• Date
• Time
• Location
• Reporting person
• Incident category
• People involved
• Witnesses
• Description
• Actions taken
• Notifications
• Evidence
• Police response
• Follow-up
• Supervisor review

Standardization also makes it easier to identify trends across multiple incidents.

Digital reporting can improve consistency.

Businesses and security companies may use electronic incident-reporting systems instead of paper forms.

Digital systems can provide:

• Standardized fields
• Time stamps
• Centralized storage
• Supervisor review
• Attachment capability
• Searchable records
• Faster management notification

However, digital reporting introduces its own requirements.

Businesses should consider:

• Access permissions
• Authentication
• Data retention
• Privacy
• Backup
• Audit trails
• Mobile-device security

The reporting system itself becomes part of the organization’s information-security environment.

Keep reports secure

Security reports may contain sensitive information.

Depending on the incident, they may include:

• Employee information
• Customer information
• Security vulnerabilities
• CCTV details
• Access-control information
• Witness information
• Law-enforcement information
• Incident photographs

Access should therefore be limited to people with a legitimate business or legal need.

A report about a security vulnerability should not be casually distributed to an unrestricted mailing list.

Be careful with sensitive personal information.

A security report should contain enough information to document the incident, but unnecessary personal information should be avoided.

Particular care may be appropriate for:

• Medical information
• Employee records
• Identification numbers
• Financial information
• Customer information
• Information involving minors
• Information concerning victims of sensitive incidents

Businesses should follow applicable privacy requirements and internal policies when collecting, storing, and sharing such information.

Do not edit reports casually after submission.

If an important error is discovered, the business should have a controlled correction process.

Simply deleting the original report and replacing it with a revised version can create questions about what changed and why.

Depending on the reporting system, corrections may be made through:

• Supplemental reports
• Documented amendments
• Supervisor-approved corrections
• Version-controlled records

The exact process should be established by the organization.

Have supervisors review significant reports

Supervisor review can identify:

• Missing information
• Contradictions
• Unclear descriptions
• Incorrect classifications
• Required notifications
• Follow-up actions
• Training issues

Review should not mean rewriting the guard’s observations to make the incident look better.

The objective is to improve accuracy and completeness.

Avoid emotional or judgmental language

Security reports should remain professional.

Avoid phrases such as:

• “Crazy customer”
• “Dangerous-looking man”
• “Obviously guilty”
• “Bad employee”
• “Suspicious foreigner”
• “Known troublemaker”

Instead, describe specific behavior.

For example:

“The individual raised their voice, struck the counter with an open hand, and refused three requests to leave the lobby.”

Specific facts are more useful than labels.

Quote important statements carefully.

If a person’s statement is relevant, the report can document it.

For example:

The individual stated, “I have permission to be here.”

The report should make clear that this was the person’s statement rather than a fact.

If exact wording is uncertain, it may be better to paraphrase rather than use quotation marks.

Separate observation from conclusion

A useful report often follows this pattern:

Observed:
“The employee entered the restricted storage room at approximately 11:42 p.m.”

Verified:
“Access-control records showed the employee’s credential was used at 11:41 p.m.”

Reported by another person:
“The warehouse supervisor stated that the employee was not scheduled to work that evening.”

Conclusion:
Only make conclusions that are supported and appropriate for the reporting role.

This structure helps preserve the reliability of the record.

What should security guards do immediately after an incident?

A practical sequence is:

1. Address immediate safety concerns.
2. Notify the appropriate person or emergency service.
3. Secure the relevant area when appropriate.
4. Identify witnesses.
5. Preserve relevant evidence.
6. Record the basic facts while they are fresh.
7. Complete the formal report.
8. Escalate for follow-up when required.

The precise procedure should follow the company’s post orders and emergency protocols.

Review incidents for patterns.

One report may tell you what happened once.

A collection of reports can reveal a pattern.

Management can analyze reports for:

• Repeated theft locations
• Repeated access violations
• Time-of-day patterns
• Recurring disturbances
• Frequent alarm activations
• Lighting problems
• Camera blind spots
• Staffing gaps
• Repeated employee procedural errors

This turns incident reporting from paperwork into a security-management tool.

Use reports to improve security.

Suppose three separate reports show that unauthorized people repeatedly enter through the same side door.

The solution may not be to simply instruct guards to “watch the door more closely.”

Management might consider:

• Improving the door lock
• Adjusting access permissions
• Adding an access-control reader
• Repositioning a camera
• Improving lighting
• Changing patrol routes
• Revising employee procedures

The report identifies the problem.

The security review determines the solution.

Conduct periodic incident reviews.

Businesses should periodically review incident data rather than waiting for a major event.

A monthly, quarterly, or other appropriate review can examine:

• Number of incidents
• Incident categories
• Locations
• Time periods
• Response times
• Repeat incidents
• Corrective actions
• Outstanding vulnerabilities

The appropriate review frequency depends on the size and risk profile of the organization.

A practical incident-report workflow

A useful business process can be summarized as:

Incident occurs
↓
Immediate safety response
↓
Notify appropriate personnel
↓
Preserve evidence
↓
Document facts
↓
Supervisor review
↓
Investigation/follow-up if required
↓
Corrective action
↓
Trend analysis

This creates a continuous feedback loop rather than treating each report as a standalone document.

Common security incident-reporting mistakes

Writing the report hours or days later

Important details can be forgotten.

Recording conclusions instead of observations

Statements about what someone “intended” may be impossible to verify.

Leaving out exact locations

A vague location makes investigation harder.

Failing to identify witnesses

Witness information can become difficult to recover later.

Not preserving CCTV

Relevant footage may be overwritten.

Mixing multiple incidents into one report

Separate incidents should generally be documented separately unless company procedures specify otherwise.

Using emotional language

Subjective descriptions reduce clarity.

Failing to report near misses

A problem that almost caused harm can reveal a vulnerability before someone is injured or property is lost.

Treating the report as the end of the process

The most useful question after an incident is often:

What should change so this is less likely to happen again?

What should businesses expect from a professional security company?

If a business uses contracted security personnel, incident reporting should be part of the service discussion.

Businesses should ask:

• What incidents must guards report?
• How quickly must serious incidents be escalated?
• Who receives reports?
• Is there a standardized report format?
• Are photographs or video references included?
• How are reports reviewed?
• How are serious incidents escalated?
• How are reports stored?
• How is client information protected?
• Are recurring incidents reviewed with management?

A professional security provider should be able to explain its reporting process clearly.

The bottom line

Security incident reporting is more than administrative paperwork.

A well-prepared report creates a factual record that can help a business understand what happened, coordinate an appropriate response, preserve important information, identify recurring vulnerabilities, and improve its security program.

The strongest reports are:

Accurate.
Timely.
Specific.
Objective.
Relevant.
Secure.

Security personnel should document what they observed, distinguish firsthand observations from information received from others, avoid unsupported conclusions, preserve relevant evidence, and follow the organization’s escalation procedures.

Businesses should also remember that a security incident report may be only one part of a larger process. Certain workplace injuries and serious incidents can trigger separate OSHA recordkeeping or reporting requirements, while other events may involve law enforcement, insurance, legal, privacy, or contractual obligations.

Ultimately, the value of incident reporting goes beyond documenting the past.

A good incident report helps a business make better security decisions in the future.

Frequently Asked Questions

What is a security incident report?

A security incident report is a written record of a security-related event, including what occurred, where and when it happened, who was involved, what was observed, what actions were taken, and what follow-up may be necessary.

What should be included in a security incident report?

At minimum, a useful report should identify the date, time, location, incident type, people involved when appropriate, factual observations, actions taken, notifications, relevant evidence, and follow-up requirements.

Should security reports include opinions?

They should generally focus on factual observations rather than unsupported opinions or assumptions. If an interpretation is necessary, it should be clearly distinguished from what was directly observed.

Should security guards report near misses?

Yes. Near misses can reveal vulnerabilities even when nobody is injured and no property is lost. OSHA encourages investigation of workplace close calls because they can identify hazards and opportunities for prevention.

How quickly should a security incident be reported?

The answer depends on the organization’s procedures and the seriousness of the incident. Serious or ongoing threats should be escalated immediately. Routine incidents may follow the organization’s normal reporting deadline.

Does every security incident need to be reported to police?

No. Whether law enforcement should be contacted depends on the circumstances, applicable law, company policy, and the seriousness of the event. Security personnel should follow established escalation procedures.

Is a security incident report the same as an OSHA report?

No. A private security incident report is not automatically an OSHA record or notification. Certain work-related injuries and serious incidents are subject to separate OSHA requirements. Employers should evaluate those obligations independently.

Should CCTV footage be included with the report?

Relevant footage should be identified and preserved according to the organization’s procedures. Whether the actual video file is attached to the report depends on the company’s evidence-management and privacy practices.

How long should businesses keep security incident reports?

There is no single retention period applicable to every type of security incident report. Retention requirements can depend on the type of incident, applicable law, insurance requirements, litigation considerations, contractual obligations, and company policy.

Can incident reports be stored digitally?

Yes. Digital systems can make reports easier to standardize, search, review, and secure. Businesses should implement appropriate access controls, retention procedures, backups, and privacy protections.

Who should review security incident reports?

Routine reports may be reviewed by a security supervisor or designated manager. Significant incidents may require review by senior management, risk management, human resources, legal counsel, or other appropriate personnel.

Why should businesses analyze old incident reports?

Reviewing historical reports can reveal recurring locations, times, vulnerabilities, and incident types. This information can help businesses improve staffing, access control, surveillance, lighting, procedures, training, and other security measures.

A note about incident reporting

This article provides general information about security incident reporting practices. Businesses should establish reporting procedures appropriate to their operations and should account for applicable employment, workplace-safety, privacy, insurance, contractual, and other legal requirements.

Where an incident involves serious injury, death, suspected criminal conduct, significant property loss, litigation, or other high-consequence circumstances, businesses should obtain appropriate professional advice and follow applicable reporting and preservation requirements.