A security incident report template should answer what happened, what the writer actually observed, what action was taken and what still needs attention. Its purpose is a reliable record. It should not turn an uncertain event into an accusation or hide an important detail behind the phrase “handled by security.”
Use the structure below for a property-management reporting process. Adapt it to the organization’s approved system and obligations. Emergency assistance comes first; completing paperwork must never delay help for someone in immediate danger.
Record the basics before writing the narrative
Assign the report reference, author, role, date and time of writing. Record the incident time separately from the time it was reported or discovered. Include a time zone when records may be compared across systems. If a time is estimated, say so instead of presenting it as exact.
Identify the location clearly enough for an authorized reviewer to understand it. Use the property’s agreed location names. Keep personal contact details and sensitive attachments in restricted fields rather than repeating them in every copy of the narrative.
Copy this report structure
- Reference and author: report number, writer, role and preparation time.
- Event details: location, occurrence or discovery time, and how the matter came to attention.
- Direct observations: relevant actions, conditions and words personally seen or heard.
- Other accounts: who provided each account and when, clearly attributed.
- Timeline: significant events and notifications in sequence.
- Actions: assistance requested, people notified and instructions received.
- Supporting records: references to authorized photographs, messages, access records or other material.
- Open items: unresolved facts, assigned follow-up owner and review date.
- Review: supervisor review and any later correction or supplement.
Separate fact, quotation and inference
“The visitor raised their voice and struck the desk with an open hand” describes conduct. “The visitor was a criminal” assigns a conclusion the writer may not be qualified to make. Avoid diagnosing intoxication or a medical condition; describe relevant observations and the assistance requested.
Use quotation marks only for words recalled accurately. A paraphrase should be identified as a summary. If another employee describes an earlier event, attribute that account rather than writing as if you witnessed it. Do not copy an old narrative and replace the date.
Use a short sample timeline
Fictional example: at 18:12, an officer noticed water near a lobby entrance. At 18:14, the officer notified the property manager using the approved contact channel. At 18:17, maintenance acknowledged the request. The officer followed the site’s instructions for directing arrivals away from the affected area. Maintenance follow-up remained open when the report was submitted.
The example records an observation, a communication and a remaining responsibility. It does not claim to identify the source of the water or certify that repairs were complete. A factual limitation is more useful than a confident guess.
Preserve supporting material without spreading it
Use authorized systems to preserve relevant original files. Note the source and reference so a qualified reviewer can locate them. Do not edit an original image to strengthen a conclusion, forward private footage to a personal group chat or collect information outside your role.
Follow the organization’s retention requirements and any applicable preservation instruction. The FTC’s Start with Security guidance emphasizes protecting sensitive records and limiting unnecessary access. A security report may contain personal information even when the event initially appears routine.
Correct the record transparently
If a detail is later found to be wrong, use the approved correction or supplemental-report process. Preserve the original record and identify what changed, why and when. Do not silently rewrite a timeline after another witness provides a different account.
A supervisor should check clarity, attribution and missing follow-up without forcing every witness account into one version. Disagreement may be relevant evidence. Keep the unresolved issue visible and assign it to the appropriate reviewer.
Make reporting part of the security assignment
Agree who receives urgent notifications, routine reports and restricted attachments before service starts. FSO Guard’s commercial security team can discuss those reporting expectations as part of a defined scope. For periodic oversight rather than a single event, see how to review a security patrol report.
Frequently asked questions
Should a security incident report include opinions?
Relevant observations and attributed accounts should be clear. If an assessment is required by the reporting process, label it and explain its basis rather than presenting it as a witnessed fact.
Can a report be corrected after submission?
Use the organization’s correction or supplement process, retaining the original and identifying the change, reason and date.
Is a daily patrol report the same as an incident report?
No. A patrol report records routine assigned activity. An incident report documents a particular event, its response and outstanding follow-up.
