Security templates/Incident report
Security incident report template
A security incident report records one event in full: when and where it happened, who was involved, what the officer saw and did, who was told and what evidence exists. This free template has eight sections, fields for US and UK licence numbers, and a filled-in example written in guard language.
Free, no sign-up. Every file has the blank form first and a filled-in worked example at the end. Edit the Word file to add your logo, site details and wording.
What a security incident report must contain
An incident report has to stand on its own. A client, an insurer or a court should understand the event without phoning the officer. That requires exact times, an exact location, the names or descriptions of everyone involved, a factual narrative in time order, and a record of who was notified and when.
- Report details
- Type of incident
- People involved
- What happened
- Action taken
- Notifications
- Evidence and damage
- Sign-off
| Field | Why it matters |
|---|---|
| Report number | Links the report to the log line, the use of force report, police references and later correspondence. |
| Time of incident and time discovered | Often different. A theft found on the 02:00 patrol may have happened at 23:00. Both times matter for CCTV searches and insurance claims. |
| Exact location | "Yard, trailer bay 12" lets someone find the right camera. "Car park" does not. |
| Licence or registration number | Shows the report was written by a licensed officer and lets anyone check it on the SIA register or the state lookup. |
| Narrative in time order | The core of the report. Facts the officer saw, heard and did, with quoted words in quotation marks. |
| Notifications with reference numbers | Proves the police, client and supervisor were told, and when. Insurers usually ask for the police reference number on a claim. |
| Evidence | Which camera, which time span, who has the footage. CCTV systems overwrite recordings, so this field forces the officer to secure it. |
How to write the narrative
Write in the first person, in time order, with the 24-hour clock at the start of each step. Record what you saw and heard, not what you concluded. "He smelled of alcohol and was unsteady on his feet" is evidence; "he was drunk" is an opinion. Quote threats and key statements word for word. If you did not see something, say who told you.
From the worked example in the download:
02:10 On yard patrol 2 I found the rear doors of trailer 12 open and the seal cut.
02:11 I saw one male climbing the east fence near camera C4. I shouted "Security, stop". He climbed over and ran towards Mill Lane. I did not follow off site.
02:12 I called the police on 999 and told the duty supervisor by radio.
02:14 I checked trailer 12. About 10 cartons were missing from the rear row (my estimate).
Each line is checkable against CCTV, radio logs and the police call record. "(my estimate)" marks the one figure the officer could not count. Write the report before the end of the shift, while times are still exact.
Reporting deadlines: US and UK
An incident report for the client is a contract matter. Some incidents also have to be reported to an authority within fixed deadlines, and the template's notification table has a row for this. Which rules apply depends on the country, the state and whether someone was injured.
| Rule | When it applies | Deadline |
|---|---|---|
| RIDDOR (Great Britain) | Death, specified injury to a worker, or a member of the public taken from the scene to hospital | Without delay; the report must be received within 10 days |
| RIDDOR, over-seven-day injury | A worker unable to do normal work for more than seven consecutive days | Within 15 days |
| OSHA 29 CFR 1904.39 (US) | Work-related death of an employee | Within 8 hours |
| OSHA 29 CFR 1904.39 | In-patient hospitalization, amputation or loss of an eye | Within 24 hours |
| California B&P Code 7583.2(f) | Firearm discharge, or a physical altercation on duty that leads to an arrest, a police report, medical attention, discipline, or any use of force | Written report to BSIS within 7 business days |
RIDDOR covers violence too. HSE's own examples include a security guard whose arm was broken by a fleeing thief: reportable if it happened in a private area, as an act of non-consensual violence to a person at work. Verbal abuse without physical injury is not reportable under RIDDOR. In the US, check your state regulator as well; California is shown here because its rule is specific and public.
Template preview
/Images/en-resources-templates/security-incident-report-template-p1.webp?width=850&height=1100&name=security-incident-report-template-p1.webp)
/Images/en-resources-templates/security-incident-report-template-example.webp?width=850&height=1100&name=security-incident-report-template-example.webp)
Incident reports in a guard tour app
On paper, the report reaches the office at the end of the shift, often later, and photos stay on the officer's own phone. In COREDINATE's guard tour system, officers record an incident from anywhere in the app, attach photos, and the entry is in the portal straight away. The portal marks whether a photo was taken with the camera or picked from the gallery, so reused images stand out. Incident types carry an impact level, and notification rules can email the supervisor as soon as a high-impact incident is logged. Incidents can pass through states such as "internal review" before the client sees them, which matches the ACS expectation that incident procedures are agreed with the client.
For incidents that need follow-up over several days, our article on incident documentation beyond the daily occurrence book covers the handling chain from first entry to closed case.
Frequently asked questions
What should be included in a security incident report?
The report number, date and exact location, the time of the incident and the time it was discovered, the officer's name and licence number, the type of incident, the people involved, a factual narrative in time order, the action taken, who was notified with reference numbers, the evidence secured and signatures.
When should a security officer write an incident report?
Before the end of the shift in which the incident happened, while times and details are exact. Log the incident immediately in the daily activity report or occurrence book and give the incident report number there.
Is an incident report the same as a daily activity report?
No. The daily activity report or occurrence book lists everything in a shift, one line per entry. The incident report covers one event in full and is referenced from the log by its number.
Do I have to report an assault on a security guard to HSE?
Under RIDDOR, a work-related act of physical violence that causes a reportable injury to a worker must be reported. HSE's examples include a guard injured by a fleeing thief in a private area. Verbal abuse without physical injury is not reportable.
How long should incident reports be kept?
Retention depends on the client contract, insurer terms, data protection law and any legal claims that may follow. Agree a retention period with each client and write it into the post orders.
Get incident reports while the shift is still running
Order a free test kit and try incident logging with photos and instant notifications in COREDINATE's guard tour app for 14 days.
/Images/en-resources-templates/post-orders-template-p1.webp?width=850&height=1100&name=post-orders-template-p1.webp)
/Images/en-resources-templates/daily-activity-report-template-p1.webp?width=850&height=1100&name=daily-activity-report-template-p1.webp)
/Images/en-resources-templates/daily-occurrence-book-template-p1.webp?width=850&height=1100&name=daily-occurrence-book-template-p1.webp)
/Images/en-resources-templates/security-shift-handover-template-p1.webp?width=850&height=1100&name=security-shift-handover-template-p1.webp)
/Images/en-resources-templates/use-of-force-report-template-p1.webp?width=850&height=1100&name=use-of-force-report-template-p1.webp)
/Images/en-resources-templates/trespass-notice-template-p1.webp?width=850&height=1100&name=trespass-notice-template-p1.webp)