Incident documentation: beyond the Daily Occurrence Book

An alarm is not a result. A camera triggers, a sensor trips, an officer on patrol notices something. Only the documentation that follows turns it into a record that holds up. This operational layer decides whether a security company can prove its work afterwards.

Modern site security produces more events than ever. Access control, CCTV and sensor systems flag anomalies around the clock. Each one lands with a person who has to decide and act. The technology delivers the signal. It does not deliver the proof.

The proof comes from what the person on site records after the alarm. UK security operations have a name for it: the Daily Occurrence Book, the chronological shift record that officers and control rooms have kept for decades. In practice, that is where things break down. What an officer saw, when they responded and how an incident ended often exists only in their memory or on a scrap of paper. For the client, the insurer and, if it comes to proceedings, the court, the incident might as well not have happened.

In short: A defensible incident record captures what happened, when and where, who logged it and how the incident was handled. What counts is the unbroken chain from the first entry to closure, every step with a tamper-proof timestamp. Only that chain makes security work provable.

The handling chain: from first entry to closed incident

An incident becomes defensible through the traceable chain of its handling. Take one example: logged at 02:14, photo attached, reported to the control room, closed at 02:40. Every step carries a tamper-proof timestamp and names the person responsible.

A ticket system collects incoming reports, assigns tasks and records the handling status of each incident. Who has taken an incident over, and when it was closed, stays visible at all times. That is how a control room keeps its overview when several incidents run at once.

Secure evidence at the scene

The best time to document is the moment of the incident, not the end of the shift. A photo of a forced lock preserves the state before it changes. Written up from memory two hours later, half the detail is gone. Industry guidance has long compared the occurrence book to a police officer's notebook for the same reason: an entry made at the time counts as the officer's best recollection of events.

With incident logging, the officer attaches photos directly to the report and dictates the description as a voice note with automatic transcription. For recurring incidents, digital forms make sure the same fields are captured every time. That lowers the barrier to documenting at all. In daily operations, this is where it most often fails.

The continuous thread: the Daily Occurrence Book

Individual incident reports prove individual incidents. The Daily Occurrence Book joins them into one continuous account. Stationers still sell it as a numbered A4 duplicate book, filled in line by line and initialled by hand. A digital Daily Occurrence Book keeps that discipline and removes the manual work. It logs checkpoint scans, incidents and shift times automatically and chronologically. Nobody has to write anything up afterwards.

The value is that nothing is missing. A digital Daily Occurrence Book shows the incidents that were reported and proves at the same time that the site was patrolled in between. If damage occurs, you can show minute by minute what happened on the site. This unbroken record is the core of a guard tour system.

Why documentation becomes a management issue

Incident documentation is the basis on which a security company proves its service and limits its liability. In a client audit it is among the first things checked. Clients read the occurrence book to confirm that agreed patrol frequencies and response times were met. If an incident leads to an injury claim or a prosecution, the Daily Occurrence Book is typically among the first documents solicitors ask for.

The duty of care towards your own staff rests on the same records. The Health and Safety at Work Act 1974 places that duty on every employer, and a company that works on verbal handovers cannot show it met it when something goes wrong. A complete, unalterable record shows that reported hazards were recognised and dealt with. That counts with clients, and insurers and loss adjusters expect the same: a record made at the time. Tenders often ask for audit-proof documentation outright. A company with a defensible record meets that condition. Without one, it drops out of the running.

Defensible incident documentation: five checks

Check your own documentation against these points:

• Is every incident logged with a tamper-proof timestamp?
• Can photos and notes be attached at the scene, not at the end of the shift?
• Can you trace who took over an incident and when it was closed?
• Does everything come together in one continuous Daily Occurrence Book?
• Are the records unalterable after upload, so that they stand up in a client audit?

Wherever one of these points is missing, you cannot prove afterwards what actually happened.

Frequently asked questions about incident documentation

Make your incident documentation audit-proof. Order the 14-day test kit or talk to our sales team.