Reviewing notes and identifying information sources helps prevent assumptions from entering a report

In Brief: How to Write a Security Incident Report

Learning how to write a security incident report means learning to document what happened without guessing why it happened. A useful report identifies when and where an incident occurred, describes direct observations, attributes witness statements, and records actions in chronological order. This guide uses a fictional workplace incident to demonstrate the difference between facts and assumptions, followed by an instructional review of the writing.

A clear security incident report allows someone who wasn’t present to understand what happened, when it happened, and how the situation was handled. That sounds straightforward, but writing an accurate account requires more than recalling events. You need to distinguish what you personally observed from what others reported, avoid unsupported conclusions, and present the details in a logical sequence.

Learning how to write a security incident report is an important part of preparing for work in security and community safety. Whether you’re documenting a disturbance, a safety concern, or an unusual interaction, the quality of your report depends on your attention to detail and ability to communicate objectively. Let’s explore what effective incident reporting involves, using a fictional workplace scenario to put these principles into practice.

What Makes a Security Incident Report Clear and Reliable?

A security incident report is a factual record of an event, including the circumstances observed, information received, and actions taken by the person reporting it.

A clear report generally establishes:

• When: The date and relevant times, distinguishing exact times from estimates.
• Where: The specific location of the incident.
• Who: People involved, using verified identities or neutral descriptions where appropriate.
• What: Observable actions, statements, and conditions.
• Response: Steps taken, people notified, and the situation when the reporting officer’s involvement ended.

The report should also identify where information came from. Something witnessed directly is different from an account provided by another person.

There is no single format used by every employer. Reports should follow the applicable organization’s procedures, including requirements for confidentiality and handling personal information.

How Do You Separate Facts From Assumptions?

Objective report writing describes what can be observed or reliably attributed without presenting an interpretation as established fact.

Consider the difference between these statements:

The factual alternatives do not automatically establish intent, guilt, intoxication, or motive. They give the reader information that can be assessed without adopting the writer’s conclusions. When uncertainty remains, acknowledge it rather than filling the gap with a guess.

How to Write a Security Incident Report: A Fictional Example

The following security incident report example is entirely fictional. It demonstrates how rough observations can become a chronological workplace record.

Scenario: A security officer is stationed at the entrance of a fictional commercial building in British Columbia. During an evening shift, the officer observes a disagreement involving two visitors.

First Draft: What Needs Improvement?

“Two suspicious people started fighting in the lobby. One was clearly threatening the other, and they tried to leave before security could catch them. A witness confirmed that one of them was causing trouble.”

This account creates several problems. It describes a fight without identifying physical contact, assumes threatening intent, implies the visitors were avoiding security, and treats an unidentified witness’s opinion as confirmation.

Revised Fictional Incident Report

TRAINING EXAMPLE: FICTIONAL INCIDENT

Incident type: Verbal disturbance

Date: November 4, 2026

Location: Main lobby, fictional commercial building, British Columbia

Reporting officer: Security Officer A

Incident narrative

18:42: While stationed at the lobby reception desk, I heard two people speaking loudly near the main entrance. I observed one individual wearing a dark jacket pointing towards another individual wearing a grey sweater.

18:43: The individual in the grey sweater stepped backwards. A shopping bag fell to the floor. I did not observe physical contact between the individuals.

18:44: I approached to assess the situation and asked whether assistance was required. Neither individual responded. Both walked towards the east exit and left the lobby.

18:46: A person standing near reception told me, “The person in the dark jacket was shouting before you came over.” I did not personally observe the events described as occurring before I approached.

18:48: I notified the shift supervisor of my observations and the information provided by the person near reception.

Status at conclusion: Both individuals had left the lobby. I observed no further disturbance before returning to my assigned position.

Notice what the revised report does not claim. It doesn’t identify either visitor as the aggressor, assume that an assault occurred, or speculate about why they left.

The witness’s statement is attributed rather than presented as the officer’s own observation. The officer’s response is recorded alongside the event, allowing a reader to follow the sequence without reconstructing it from scattered details.

Students interested in different roles can also compare DCC’s community safety training paths to understand how the programs differ.

What Would an Instructor Look for When Reviewing This Report?

An instructional review would focus on whether the report is accurate, complete, and understandable to someone who was not present.

Illustrative instructor-review checklist:

• Events appear in chronological order, with clear time references.
• Direct observations are separated from witness information.
• Descriptions avoid unsupported conclusions about intent or behaviour.
• The officer’s actions and supervisor notification are documented.
• The final status is stated without implying that the entire incident was resolved.
• Identifying details are limited to information relevant to the report.

This is an illustrative teaching review, not a review conducted by a DCC instructor. An instructor might also ask whether the officer’s notes support the precise times, whether the witness’s identity was recorded under the applicable procedure, and whether any additional notifications were required.

Good reporting includes recognizing what is missing. Students should not invent information to make a report appear more complete.

Why Does Report Writing Matter in Community Safety Work?

Security and community safety professionals often need to communicate information to people who did not witness the original event.

An unclear report can leave readers uncertain about what happened, which details were verified, and what response followed. A well-organized account makes that information easier to evaluate. For prospective students, the example illustrates the practical value of writing skills alongside observation, communication, and professional judgement.

Discovery Community College’s Justice & Community Safety Leadership Diploma includes 56 hours of Professional Report Writing, helping students develop the clear, accurate, and objective documentation skills used in community safety and justice-related work.

Develop Professional Report-Writing Skills at DCC

Clear incident reporting begins with careful observation, but it also requires the discipline to separate evidence from interpretation. Explore Discovery Community College’s Justice & Community Safety Leadership program and ask our team how Professional Report Writing helps students develop this practical workplace skill.

Are you looking for comprehensive Security Professional training?

Contact DCC for more information.

Key Takeaways

• A security incident report should document relevant observations, information received, actions taken, and the incident’s final known status.
• Chronological reporting helps readers understand the sequence of events without reconstructing it themselves.
• Facts, witness statements, and assumptions must remain clearly distinguishable.
• Neutral descriptions are more useful than unsupported conclusions about someone’s intentions or behaviour.
• Report-writing practice develops observation, communication, and professional judgement skills relevant to community safety work.

FAQ

What should a security incident report include?

A security incident report should include the date, time, location, relevant people, a factual description of events, actions taken, and the final known status. The precise format and additional documentation requirements depend on the employer’s procedures.

How do you separate facts from opinions in an incident report?

Describe observable behaviour rather than assigning motives, emotions, or blame. For example, write “The individual raised their voice and struck the counter” rather than “The individual became aggressive.” If something remains uncertain, state that uncertainty.

How should information provided by a witness be identified?

Witness information should be clearly attributed to the person who provided it, rather than presented as the reporting officer’s firsthand observation. Record relevant statements accurately and follow workplace procedures for identifying witnesses and protecting personal information.

Do community safety students need strong writing skills?

Yes. Community safety professionals may need to document incidents, communicate observations, and prepare records for supervisors or other authorized readers. Clear, accurate writing helps ensure important details can be understood and evaluated.