Guard OperationsAction checklist

Suspicious Activity Observation and Reporting Checklist

A suspicious activity reporting checklist helps a guard or employee capture observable behavior and circumstances, make a safe notification and preserve an accurate record for people authorized to assess it. Report what happened, when and where, what you directly observed, what another person reported, relevant descriptions, direction of travel, actions taken and who was notified. Race, ethnicity, sex, national origin, religion, disability and other protected characteristics are not suspicious. Do not confront, follow, search or detain someone merely to complete this checklist. Call 911 for an immediate threat, follow site policy, and let trained law-enforcement or security leaders determine what further action is warranted.

16 checks4 sectionsSources checked July 19, 2026
Why it matters

Use a system view, not a single-control view

A label such as 'suspicious person' gives a reviewer little reliable information and can embed bias. Observable actions, timing, location and context allow an authorized decision-maker to evaluate the situation more accurately.

DHS explicitly instructs the public to report suspicious behavior and situations rather than appearance and notes that some activity may be innocent. In Arizona, ACTIC provides a state reporting channel for terrorism-related suspicious activity, while emergencies should go to 911.

Before you begin

How to use this checklist

  1. Prioritize safety: move to a safe position and call 911 when there is an immediate threat, violence, weapon, fire or other emergency.
  2. Write contemporaneous notes using observable facts and distinguish direct observation from information supplied by others.
  3. Notify the role required by post orders and, when appropriate, use the official local law-enforcement or Arizona ACTIC channel; do not post the report publicly.
  4. Submit the required incident record, protect personal information and remain available for authorized follow-up without conducting your own investigation.
Interactive checklist

Mark each task from current evidence

Use Not applicable only when the item genuinely does not apply, and follow the site’s approved escalation process for any urgent condition.

Section 1 of 4

Safety and reporting threshold

Choose the safe notification path before trying to gather more detail.

01Immediate threats and emergencies are directed to 911 without delaying for checklist completion. Priority review item

Evidence to look for: Examples include violence, a weapon being brandished, used or otherwise associated with a credible immediate threat, fire, a dangerous package condition or a person in immediate danger; follow dispatcher instructions.

02Non-emergency activity is reported through the approved site, local-law-enforcement or ACTIC path as appropriate. Priority review item

Evidence to look for: Use post orders and official channels; ACTIC is for suspicious activity that may be terrorism-related, not a replacement for 911.

03The observer maintains a safe distance and does not provoke, confront or pursue merely to obtain information. Priority review item

Evidence to look for: Continue observation only when lawful, authorized and safe; personal safety and emergency notification come first.

04Any guard action stays within Arizona private-citizen authority, training, policy and post orders. Priority review item

Evidence to look for: This public checklist does not authorize detention, search, force, trespass enforcement or evidence collection.

Section 2 of 4

Observable facts and context

Describe the event in terms another authorized reviewer can evaluate.

05The report gives the specific date, time, location and duration or sequence.

Evidence to look for: Use synchronized time and identifiable public or site locations without publishing restricted layouts.

06The report describes specific behavior, objects and circumstances rather than only using the word 'suspicious.' Priority review item

Evidence to look for: Examples may include attempted entry to a restricted area or repeated testing of a locked door; context and authorization matter.

07Direct observations are separated from statements, rumors or assumptions. Priority review item

Evidence to look for: Attribute another person's report and identify what the guard independently confirmed, if anything.

08Relevant normal context and possible innocent explanations are recorded when known.

Evidence to look for: Note visible credentials, scheduled work, public access or sponsor confirmation without deciding the ultimate explanation.

Section 3 of 4

Descriptions without profiling

Record identifying information only when it is relevant to the observed event.

09The report does not treat race, ethnicity, sex, national origin, religion or disability as suspicious. Priority review item

Evidence to look for: DHS states these factors are not suspicious; behavior and circumstances should drive the report.

10A person description begins with relevant actions and uses neutral, observable physical or clothing details only when needed for identification.

Evidence to look for: Avoid insulting, speculative or diagnostic language; state uncertainty about estimates.

11Vehicle, object and direction details are recorded accurately without unsafe pursuit.

Evidence to look for: Include make, model, color, plate, unique features or direction only when observed safely and lawfully.

12Photographs or video are captured, accessed and shared only when lawful, safe and authorized. Priority review item

Evidence to look for: Preserve original system records through the approved owner; do not post images to personal accounts or social media.

Section 4 of 4

Notification, record and follow-through

Create a usable handoff while protecting the integrity and privacy of the information.

13The report records actions, notification times, recipients and instructions received. Priority review item

Evidence to look for: Use role or agency, acknowledgment and official reference number when provided; do not expose personal contact details.

14Original notes, video references and related records are preserved under the approved process. Priority review item

Evidence to look for: Do not edit source footage, delete notes or create an informal evidence chain; trained authorities determine evidentiary value.

15Personal and investigative information is shared only with authorized recipients who need it. Priority review item

Evidence to look for: Use the approved report system; avoid personal messaging, public forms and social media.

16The observer remains available for authorized clarification and does not conduct an independent investigation.

Evidence to look for: Provide factual follow-up to supervisors or law enforcement and document material additions through the approved amendment process.

Current result

Complete the checklist to see a summary

Results are informational and do not certify compliance or eliminate risk.

Common mistakes

What can weaken the review

  • Reporting a person as suspicious based on race, religion, disability, clothing style or presence alone.
  • Writing conclusions about intent instead of observable actions and circumstances.
  • Approaching or following a person to obtain a better description when doing so increases risk.
  • Mixing a witness statement with the guard's direct observations without attribution.
  • Posting photos, video or report details in a group chat or on social media.
  • Using ACTIC or a routine supervisor report instead of calling 911 for an active emergency.
Practical questions

Frequently asked questions

What makes activity suspicious?

Contextually unusual behavior that may indicate crime or pre-operational planning can warrant reporting, but some behavior may be innocent. Describe the observable action and circumstances and let trained authorities assess it.

Which personal characteristics are not suspicious?

DHS states that race, ethnicity, sex, national origin, religion and disability are not suspicious. A report must be based on behavior and circumstances, not protected traits or stereotypes.

When should suspicious activity be reported to 911?

Call 911 for an immediate threat, active crime, violence, a threatening display or use of a weapon, a dangerous package condition, fire, serious injury or another emergency. Follow dispatcher instructions and notify the site role when safe.

What is ACTIC and when is it used?

The Arizona Counter Terrorism Information Center is the state's fusion center and accepts tips about suspicious activity that may be terrorism-related. It does not replace 911 for emergencies or local police for ordinary non-emergency matters.

Can a security guard detain or search someone based on this checklist?

No. This checklist authorizes neither detention nor search. Arizona security guards are not peace officers and act as private citizens; any such subject requires law, employer policy, qualified training and legal review.

Sources and evidence baseline

These references support the general planning baseline. Site-specific decisions still require the responsible organization and appropriate qualified professionals.

  1. Recognize Suspicious ActivityU.S. Department of Homeland Security

    Behavior-based reporting and explicit civil-rights and anti-profiling guidance.

  2. Arizona Counter Terrorism Information CenterArizona Department of Public Safety

    Arizona fusion-center role and suspicious-activity reporting channel.

  3. A.R.S. § 32-2634: Authority; LimitationsArizona State Legislature

    Private-citizen authority limitation for Arizona security guards.

  4. ISE-SAR Functional StandardU.S. Department of Justice, Office of Justice Programs

    Current federal suspicious-activity information-sharing and privacy framework.

Source links checked: July 19, 2026

Related services and checklists

Continue with the service context or a neighboring planning tool that helps you act on what you found.