How Security Guards Write Incident Reports (And Why It Matters)

A security guard's job does not end when an incident is resolved. The incident report that follows is often just as important as the response itself — and in many cases, the quality of that documentation determines whether an insurance claim succeeds, whether a legal matter is resolved in your favour, and whether the same incident recurs.

This guide explains what professional incident reports contain, why they matter, and what you should expect from a security provider operating at a professional standard.

Why Incident Reports Matter More Than Most Clients Realise

When an incident occurs on your premises — a theft, an assault, a trespass, a property damage event — the immediate security response is only part of the picture. What happens next often depends entirely on the quality of the written record.

Insurance companies require detailed, contemporaneous incident documentation to process claims. Courts and tribunals admit properly maintained security records as evidence. Victoria Police investigations are significantly more productive when they have a detailed initial incident record to work from. And internally, incident reports are the primary tool for identifying patterns, improving site security, and demonstrating due diligence.

A security company that does not take incident reporting seriously is a liability, not an asset. When evaluating a commercial security provider, incident reporting quality should be one of your key assessment criteria.

What a Professional Incident Report Must Contain

A professional security incident report is not a brief narrative summary. It is a structured document that captures every relevant detail at the time it is freshest in the officer's memory. Key elements include:

Date, Time, and Location

Precise time of observation, time of response, and time of resolution — not just the date. Location details should be specific: not "the car park" but "the northern section of the basement car park, Level B2, near exit stairwell C." Vague location descriptions make insurance claims and investigations significantly harder to progress.

Names and Descriptions of All Parties

Full names, dates of birth, and contact details of anyone involved — injured parties, witnesses, subjects, responding officers. Where names cannot be obtained (e.g., a trespasser who refuses to identify themselves), a detailed physical description is recorded: approximate height, build, clothing, distinguishing features, and direction of departure.

Chronological Narrative

A factual, chronological account of events as observed by the reporting officer. Good incident reports use objective, observable language — what was seen, heard, and done — rather than interpretation or subjective assessment. "The individual was observed entering the site via the southern fence gap at 22:47" is correct. "The individual appeared to be intoxicated and looked suspicious" introduces subjectivity that can be challenged.

Actions Taken

Every action taken by the security officer must be documented: who they contacted, what instructions were given, when police were called, when an ambulance was requested, what physical actions (if any) were taken. If force was used, a separate Use of Force report is completed in addition to the standard incident report.

Evidence Collected

Details of any CCTV footage captured, photographs taken, property recovered or secured, and any physical evidence documented or preserved. CCTV footage references should include camera ID, time range, and confirmation that the footage has been saved and preserved.

Outcome and Follow-Up Actions

The resolution of the incident and any recommended follow-up: police report number (if police were called), medical attention provided, client notification, site access changes, or recommended security improvements. Follow-up items should be clearly assigned with a responsible party and expected completion date.

The Difference Between Good and Poor Incident Reporting

Poor incident report (what you do not want):

"At approximately 11pm a man tried to break into the storeroom. Security responded and he left. Police were called but no arrest was made."

Professional incident report (what you should expect):

"At 22:53 on 15 May 2026, Security Officer James Hollis (Licence VIC-009433) observed via camera 4 (south loading dock) a male subject, approximately 180cm, heavy build, wearing a dark hoodie and jeans, attempting to force the padlock on the storeroom roller door. Officer Hollis immediately responded to the loading dock, making verbal contact with the subject at 22:56. The subject made no verbal response and departed south via the lane adjacent to the loading dock. Victoria Police were notified at 22:57, reference number E-284830. CCTV footage from cameras 3, 4, and 7 covering the period 22:45–23:05 has been preserved on the site DVR and a copy provided to Police. Client contact James Vella was notified at 23:01. Recommended follow-up: replacement of damaged padlock on storeroom roller door; assessment of lighting in south lane."

The difference in evidentiary value between these two reports is enormous. One is nearly useless for an insurance claim. The other is a complete, professional record of the incident.

Digital vs Paper Reporting Systems

Modern security operations use digital incident reporting systems — mobile apps that capture GPS location, timestamps, and photos automatically, with reports submitted in real time to supervisors and clients. This removes the risk of reports being lost, edited, or not completed, and creates an auditable record that is timestamped at the point of entry rather than written up after the shift.

When assessing a security provider, ask specifically about their incident reporting system. Providers who still rely on handwritten paper reports completed at the end of a shift are not operating at a current professional standard.

Client Access to Incident Reports

You should have immediate access to all incident reports from your site. A professional security provider will deliver reports to your nominated contact within a defined timeframe — typically within 24 hours of a significant incident, often in real time for serious events. Reports should be retained by the provider for a minimum of seven years to support any future legal proceedings.

If your current provider does not provide you with written incident reports — or provides reports that lack basic detail — this is a red flag that warrants a review of your security contract. Our licensing guide covers the obligations security providers hold under Victorian law, including record-keeping requirements.

Incident Reporting and Your Security Management Plan

Incident reports feed directly into your security management plan review cycle. Patterns visible across multiple reports — repeated access attempts at the same point, recurring disturbances at the same time, consistent property theft from the same area — drive tactical security improvements that reduce incident frequency over time. A security company that does not analyse and report on incident trends across your site is delivering a reactive, rather than proactive, service.

Working with Security Guard Company Melbourne

All of our security officers are trained in professional incident documentation. We use digital reporting systems that deliver timestamped, GPS-verified reports to client contacts in real time. Contact us to discuss your security requirements and ask about our reporting standards.