One of a security guard’s most important responsibilities is documenting incidents accurately and professionally. A report may record a medical emergency, suspicious activity, property damage, theft, a fire alarm, an unauthorized entry, a water leak, or another unusual event that occurs during a shift.

A well-written report gives supervisors and property management a clear account of what happened. It may also be reviewed by law enforcement, emergency responders, insurers, attorneys, or investigators. The report should therefore be timely, factual, objective, complete, and consistent with the officer’s post orders and employer procedures.

What is a security incident report

A security incident report is a written record of an unusual event, safety concern, policy violation, emergency, or response that occurs while a security officer is on duty. The report documents what the officer observed, what others reported, what actions were taken, and how the incident concluded at the time of writing.

Depending on the incident and site policy, the report may be reviewed by:

  • Security supervisors and account managers
  • Property managers, building owners, or client representatives
  • Law enforcement, FDNY, EMS, or other emergency agencies
  • Insurance representatives, attorneys, or investigators
  • Human resources, safety teams, or compliance personnel

Because a report can become part of an investigation, claim, disciplinary review, or legal proceeding, write it as though someone unfamiliar with the site will need to understand exactly what occurred.

When should a security guard write an incident report

Complete a report when required by your post orders, employer policy, supervisor, or the circumstances of the event. Common reportable incidents include:

  • Theft, shoplifting, vandalism, or property damage
  • Suspicious persons, trespassing, or unauthorized access
  • Medical emergencies, workplace accidents, or injuries
  • Fire alarms, smoke conditions, water leaks, or equipment failures
  • Assaults, threats, disturbances, or disorderly conduct
  • Police, FDNY, EMS, or other emergency responses
  • Lost property, access-control problems, or policy violations
  • Any unusual event your supervisor directs you to document

If you are unsure whether an event requires a formal report, notify your supervisor and follow the site’s reporting instructions. Do not let uncertainty delay an emergency notification or immediate safety response.

The six questions every incident report should answer

A complete report should help the reader understand who, what, when, where, why, and how. The cause or motive may not be known, so never invent an answer simply to fill a gap.

Who was involved

Identify the security officers, employees, visitors, witnesses, contractors, emergency responders, and other involved people. Record full names, titles, contact information, or identifying details only when available, relevant, and permitted by site policy.

What happened

Describe the event using facts you personally observed and clearly attributed statements from other people. Separate observation from secondhand information.

Avoid: “The individual was intoxicated.” Better: “The individual staggered while walking, spoke with slurred speech, and had a strong odor of alcohol on their breath.”

The second version records observable behavior rather than an unverified diagnosis or conclusion.

When did each event occur

Build a clear timeline. Record relevant times such as:

  • When the incident began or was first observed
  • When it was reported to security
  • When a supervisor or emergency agency was notified
  • When responders arrived and cleared the scene
  • When access was restored, equipment was reset, or the incident concluded

Where did it happen

Use the most specific location available, such as Main Lobby, Parking Garage Level 2, North Stairwell, Loading Dock, Apartment 5A, Mechanical Room, or Roof Access Door. Include the building address when the form or policy requires it.

Why did it happen

State the cause only when it is known and supported. If a technician, responder, witness, or supervisor provides the explanation, identify the source. If the cause is unknown, write that it was unknown at the time of the report or remained under investigation.

How did the incident unfold

Write the narrative in chronological order. Explain what you observed, what you did, who you notified, how involved people responded, what responders did, and the condition of the scene when responsibility was transferred or the incident ended.

Important details to collect

When relevant and permitted, document:

  • Names and contact information for involved people and witnesses
  • Physical descriptions, clothing, direction of travel, and identifying details
  • Vehicle make, model, color, plate number, and location
  • Damage, hazards, injuries reported, and observable conditions
  • Photographs, video references, access-control records, or other attachments authorized by policy
  • Property recovered, secured, transferred, or left in place
  • Notifications made and instructions received

Do not disturb potential evidence unless necessary for immediate safety or specifically directed by an authorized responder or supervisor. Protect confidential and personal information according to policy, and never post incident details or report images on personal social media.

How to document emergency responders

If NYPD, FDNY, EMS, or another agency responds, record the information that is available without interfering with the response. Useful details may include:

  • Responding agency and unit, company, or vehicle number
  • Responder name, rank, badge, shield, or identification number when provided
  • Arrival and departure times
  • Incident, complaint, aided, or report number when available
  • Actions taken, instructions given, and the person who received custody or responsibility

Attribute conclusions to the responder who provided them. For example: “FDNY personnel stated that the alarm was caused by smoke from burnt food,” rather than presenting the cause as your own finding.

Example security incident report

The following example is fictional and shows a concise chronological narrative:

On July 20, 2026, at approximately 8:47 p.m., while monitoring the Main Lobby, I observed an adult individual attempt to enter through the secured employee entrance. I approached the individual and asked for identification and the name of the person they intended to visit. The individual stated they were visiting a tenant but did not provide the tenant’s name or apartment number. I denied access and directed the individual to contact the tenant from outside the building. At approximately 8:50 p.m., the individual exited through the main doors and walked eastbound. No threats were made, no injuries were reported, and no property damage was observed. Police response was not requested. I notified the shift supervisor at approximately 8:53 p.m.

The example records the officer’s observations, actions, times, location, notifications, and outcome without guessing the person’s motive.

Tips for writing better incident reports

Write facts and attribute statements

Document what you personally saw, heard, smelled, or did. When someone else provides information, identify the speaker and use wording such as “stated,” “reported,” or “advised.” Do not present a rumor or assumption as fact.

Use chronological order

A clear beginning-to-end timeline makes the report easier to understand. If you learned information later, explain when and how you received it rather than placing it earlier in the sequence.

Be specific

Avoid: “The hallway was messy.” Better: “Approximately ten cardboard boxes blocked about half of the hallway near Stairwell B.”

Use professional language

Avoid: “The person freaked out.” Better: “The individual yelled repeatedly and struck the reception desk three times with an open hand.”

Proofread before submitting

Before submitting the report, verify:

  • Names, identification numbers, dates, and times
  • Locations, addresses, and direction of travel
  • The order of events and all required notifications
  • Spelling, grammar, abbreviations, and clear sentence structure
  • Attachments, signatures, report numbers, and required supervisor review

Common report-writing mistakes to avoid

  • Guessing a motive, cause, medical condition, or level of intoxication
  • Using insulting, emotional, vague, or slang language
  • Failing to distinguish personal observations from witness statements
  • Leaving out times, exact locations, witnesses, or emergency responder information
  • Using unexplained abbreviations or copying language that does not match the incident
  • Altering, backdating, or adding unsupported details to a completed report
  • Sharing confidential reports, photographs, or incident information without authorization

A useful rule is: if you did not personally observe it, do not write it as your own fact. Attribute it to the person or record that provided the information.

Download the free New York State Security Guard Manual

Radiant hosts the New York State Security Guard Manual as a free PDF reference. The manual covers core security responsibilities and can help students review topics connected to professional conduct, communication, patrol, access control, emergency response, and report writing.

Continue your security training with Radiant

Report writing is included among New York’s security guard training topics. Radiant offers the Eight-Hour Pre-Assignment Training Course for new applicants, the Sixteen-Hour On-the-Job Training Course for newly employed guards, and the Eight-Hour Annual In-Service Training Course for continuing requirements.

The 16-hour course builds practical knowledge for working security guards, including field responsibilities and professional documentation. Use the current Radiant registration page rather than a generic enrollment link.