Guard OperationsAction checklist

Incident Report and Evidence-Preservation Quality Checklist

A strong security incident report records what happened, when and where it happened, who was involved or notified, what the writer directly observed, what others reported and what authorized actions followed. Life safety and emergency notification come before documentation. Guards should protect a potential scene from unnecessary disturbance when safe and directed, but should not collect, package or analyze evidence unless specifically trained, authorized and acting under approved procedures. Relevant video, access logs and original notes should be preserved through the organization's authorized legal and records process. This checklist is not law-enforcement training, legal advice or permission to detain, search, treat injuries or enter danger.

17 checks4 sectionsSources checked July 19, 2026
Why it matters

Use a system view, not a single-control view

An incident report may support emergency follow-up, client decisions, insurance review, internal investigation or law enforcement. Missing times, unattributed statements and unsupported conclusions reduce its usefulness.

Evidence can also be harmed by well-intended action. Separating scene protection and records preservation from collection and analysis helps private security remain within training, post orders and legal authority.

Before you begin

How to use this checklist

  1. Complete emergency actions and required notifications first; never delay a 911 call to fill out the checklist.
  2. Use the employer's approved report system and retention rules, not this public page, for real incident information.
  3. Review each statement for source, time and objective wording and keep corrections within the audit trail.
  4. Escalate potential evidence and preservation requests to the supervisor, law enforcement, counsel or authorized records owner.
  5. Have a supervisor review high-consequence reports promptly and document requested follow-up.
Interactive checklist

Mark each task from current evidence

Use Not applicable only when the item genuinely does not apply, and follow the site’s approved escalation process for any urgent condition.

Section 1 of 4

Immediate safety and notifications

Confirm that the response prioritized people and summoned the right help.

01Immediate threats, injuries, fire or other emergencies were reported to 911 without avoidable delay. Priority review item

Evidence to look for: The report records the call or known notification and does not imply that internal approval was required before emergency help.

02The responder avoided unnecessary entry, confrontation or disturbance of a potentially dangerous scene. Priority review item

Evidence to look for: Actions remained within training and post orders, with life safety taking priority over property or evidence.

03Required supervisor and client notifications were made through approved channels. Priority review item

Evidence to look for: Record recipient, time and method, and distinguish a completed notification from an unanswered attempt.

04Medical assistance was left to trained and authorized responders except for actions within the writer's documented training and policy. Priority review item

Evidence to look for: The report states what was requested or provided without diagnosing a person or claiming an outcome.

Section 2 of 4

Objective incident record

Make the report specific, chronological and clear about the source of information.

05The report includes the incident date, location, discovery time and key event times.

Evidence to look for: Identify whether each time came from direct observation, a system record, dispatch or another person.

06People and vehicles are described with relevant, observable facts and authorized identifiers.

Evidence to look for: Avoid labels, diagnoses, stereotypes and unnecessary personal data; use identity information only under policy.

07Direct observations are separated from witness, client, dispatch or other second-hand statements.

Evidence to look for: Attribute material statements to their source and use quotation marks only for words recorded accurately.

08The narrative follows a clear chronology and explains authorized actions taken.

Evidence to look for: A reader can understand what occurred before, during and after the guard's involvement without guessing.

09Every material notification, instruction and transfer of responsibility is documented.

Evidence to look for: Include who, when, method, response and any agency or work-order reference available under policy.

Section 3 of 4

Scene and digital-record preservation

Protect potential evidence without turning private security staff into investigators.

10Potential evidence was left in place and protected from unnecessary handling when safe to do so. Priority review item

Evidence to look for: Life safety comes first; guards observe, limit unnecessary access under post orders and await qualified authorities rather than collecting items.

11People entering or leaving a protected scene are documented when assigned and safe.

Evidence to look for: Use the approved scene log and do not physically block or detain someone beyond lawful authority and post orders.

12Relevant video, access-control or communication records were referred promptly to their authorized system owner for preservation. Priority review item

Evidence to look for: Record the request and recipient; do not export, alter or share data outside approved access and legal procedures.

13Photographs or recordings were made only when safe, authorized, relevant and consistent with privacy and evidence procedures.

Evidence to look for: Do not photograph private areas, medical treatment or sensitive material merely for completeness, and never post incident media publicly.

Section 4 of 4

Review, security and follow-up

Protect the record and make sure unresolved actions remain visible.

14The report has been checked for completeness, clarity, spelling and internal time consistency.

Evidence to look for: Review improves readability without changing facts or deleting the history of corrections.

15Sensitive reports, notes and media are stored and shared only through authorized systems. Priority review item

Evidence to look for: Access is need-to-know and retention follows client, employer, legal and insurer requirements.

16Corrections and supplemental information preserve the original record and identify author and time.

Evidence to look for: The audit trail distinguishes an original error from later clarification.

17Unresolved safety, maintenance, access or client actions have a named owner and due date.

Evidence to look for: The incident is not treated as closed merely because the narrative was submitted.

Current result

Complete the checklist to see a summary

Results are informational and do not certify compliance or eliminate risk.

Common mistakes

What can weaken the review

  • Delaying emergency notification while collecting details or photographs.
  • Writing conclusions such as guilt, intoxication or mental state without competent evidence.
  • Failing to attribute a witness statement or identify a time as an estimate.
  • Handling, moving, packaging or analyzing potential evidence without training and authority.
  • Emailing reports or video to broad recipient lists or using personal devices outside policy.
  • Silently editing the original report instead of creating an auditable correction or supplement.
Practical questions

Frequently asked questions

What should a security incident report include?

Include dates, times, locations, objective observations, attributed statements, authorized actions, emergency and internal notifications, involved roles, relevant record-preservation steps and unresolved follow-up.

What is objective incident-report language?

Objective language describes observable behavior, conditions and attributed statements without guessing motive, making a diagnosis or declaring guilt. It distinguishes what the writer saw from what someone else reported.

Should a security guard collect evidence?

A public checklist should not direct evidence collection. Guards should prioritize safety, avoid unnecessary disturbance, protect the area when safe and authorized, and follow law-enforcement, employer and legal direction.

How should video be preserved after an incident?

Notify the authorized system owner promptly and use the organization's retention, legal-hold, export and chain-of-custody process. Do not alter, publicly share or access recordings beyond permission.

Can a report be corrected after submission?

Use the approved amendment or supplemental-report process so the original and the author and time of the correction remain traceable. Never backdate or silently replace a record.

Sources and evidence baseline

These references support the general planning baseline. Site-specific decisions still require the responsible organization and appropriate qualified professionals.

  1. Crime Scene Investigation: A Guide for Law EnforcementNational Institute of Justice, U.S. Department of Justice

    Principle of protecting a scene from contamination and documenting initial observations; adapted conservatively because the guide is for law enforcement.

  2. A.R.S. 32-2634 — Authority; LimitationsArizona State Legislature

    Boundary between Arizona private security work and peace-officer authority.

  3. Start with Security: A Guide for BusinessFederal Trade Commission

    Limiting data, restricting access, secure storage, retention and verification of controls.

Source links checked: July 19, 2026

Related services and checklists

Continue with the service context or a neighboring planning tool that helps you act on what you found.