Security incident report: what to record, and how to write one that stands up

01

What a security incident report is, and the law behind it

A security incident report is a written account, made by the security officer involved or first on the scene, of one event out of the ordinary on a site: an intrusion, a theft, damage, an assault or threat, a person refused entry or removed, a medical emergency, an alarm activation or a hazard that put people at risk. It is separate from the running log of the shift. The occurrence book says that something happened at 22:40; the incident report explains it, in enough detail that someone who was not there can rely on it.

This guide is about security incidents on a physical site, reported by security officers and the security team. In an Australian Government department or agency the same words usually mean something else: reporting an incident involving official information or resources, including classified material and information security, under the Australian Government's Protective Security Policy Framework, which this guide does not cover.

Private security in Australia is licensed by each state and territory, so the rules around the report depend on where the site is. No Australian Act sets out a standard incident report form for guards. The format comes from the security company's procedures and from the site instructions agreed with the client, which say what counts as an incident, who is told, how quickly and in what form.

Some state law does reach into the record. Victoria's Private Security Act 2004 (version 027, in force from 19 June 2025) defines a security guard as "a person who is employed or retained to protect, watch or guard any property by any means", including by patrolling in person or by operating CCTV or other monitoring systems. Section 134 requires the holder of a private security business licence, and an individual operator licence holder who works for themselves, to "keep permanent records of the prescribed particulars" of the business or activity for at least five years, and to ensure the records are "accurate, legible and kept in good order". Other states have their own Acts, regulators and record rules, so a provider working across borders checks each one.

Crowd control is the clearest case of an incident record set by law. Under sections 139 to 142 of the Victorian Act, where crowd controllers work at a public place, a register must be available there each day, each crowd controller must enter their licence number, full name and details of the identification they are wearing, and it must include the prescribed details of any incident involving them. Section 142(3) defines incident as any action in which a crowd controller makes forcible physical contact with a member of the public, restrains a member of the public, or ejects a member of the public. The completed register is kept for five years (sections 139(3) and 140(3)), and under sections 143 to 145 a police officer or authorised person may enter to inspect it, copy it and, on reasonable grounds, seize it.

Work health and safety law adds a second layer, covered in section 04.

02

What counts as a security incident on an Australian site

The site instructions should list the incidents that need a full report rather than a line in the occurrence book. On an office tower, a shopping centre, a hospital, a university campus or a construction site, the list usually includes:

• Unauthorised entry or attempted entry: a forced door, a person found in a plant room, trespassers on a building site after hours.
• Theft, loss and suspected theft: from tenants, a loading dock or a car park, or shoplifting where the officer is involved.
• Criminal damage and graffiti: broken glass, damaged roller shutters, tagging.
• Aggression, threats and assaults: against the officer, staff, tenants or the public.
• Use of force: any time an officer or crowd controller makes physical contact, restrains or removes someone, which is exactly the kind of event a court or regulator will ask about.
• Medical emergencies and injuries: a fall on the stairs, a collapse in a food court, first aid given by the officer.
• Fire and alarm events: a fire alarm activation, an evacuation, an intruder alarm response, a duress alarm.
• Hazards found on patrol: a flooded basement, a fallen ceiling tile, a fire door that will not close.
• Suspicious items and behaviour: an unattended bag, a vehicle left in a loading bay, and anything involving the police.

The test is simple: if the client, the police or an insurer might later ask what happened, write an incident report.

03

What a security incident report should contain

Whatever the template, paper or digital, a good report should carry:

1. The date and time of the incident, and the time the report was written. Exact times beat approximate ones; take them from the same clock each time.
2. The precise location: the building, level, door, gate, car park bay or shop number, not just "the site".
3. The type of incident, using the categories in the site instructions so reports can be counted and compared.
4. A description in the order it happened, saying what the officer saw, heard and did at each step, with times.
5. The people involved: names and contact details of witnesses, staff and anyone injured, and a physical description where a name is not known – height, build, clothing, direction of travel.
6. Actions taken: who was called and when – the control room, the security supervisor, the client's building manager or centre manager, Triple Zero (000), the Police Assistance Line – and any first aid given.
7. Force used, if any: what was done, why, for how long, and whether anyone was hurt.
8. Evidence: photographs taken, which CCTV cameras cover the area and whether footage has been asked to be kept, items handed over and who now holds them, police event or reference numbers.
9. What is still open: a lock awaiting repair, a follow-up with police, a tenant to be told.
10. The officer's name, licence number and signature, and the name of anyone who helped.

Submit the report within the time the site instructions set. For anything serious, that means telling the control room or supervisor straight away by radio or phone, and finishing the written report before the end of the shift, not the next day.

04

When the incident is also a WHS matter

A security incident that injures a worker or a member of the public, or that creates a serious risk, may also have to be reported under work health and safety law. That duty sits with the business, not with the officer's incident report, and it has its own clock.

Every state and territory except Victoria has adopted the model Work Health and Safety Act. In Queensland's version, the Work Health and Safety Act 2011, section 38(1) says a person conducting a business or undertaking "must ensure that the regulator is notified immediately after becoming aware that a notifiable incident arising out of the conduct of the business or undertaking has occurred". A notifiable incident is a death, a serious injury or illness, or a dangerous incident. Section 36 defines serious injury or illness to include one requiring immediate treatment as an in-patient in a hospital, or immediate treatment for injuries such as a serious head injury, a serious burn, a spinal injury or serious lacerations. Section 38(7) requires the business to keep a record of each notifiable incident for at least five years, and section 39 requires the person with management or control of the workplace to ensure, so far as is reasonably practicable, that the site is not disturbed until an inspector arrives or directs, except to help an injured person, make the site safe or assist a police investigation.

In New South Wales, SafeWork NSW's incident notification page says incidents can be notified 24 hours a day, 7 days a week by calling 13 10 50, and that the scene must not be disturbed until an inspector arrives or gives direction. Victoria is different: it still has its own Occupational Health and Safety Act 2004. WorkSafe Victoria's guidance on notifiable incidents under the OHS Act 2004 says to notify WorkSafe on 13 23 60 immediately, provide written notification within 48 hours, preserve the site, and keep a copy of the written notification for at least five years.

On a shared site the security provider, the cleaning contractor and the building owner may each conduct a business at the workplace, so the site instructions should say who notifies the regulator and who keeps the scene. The officer's report is evidence for the notification, not the notification itself: the details the regulator asks for come from it, which is one more reason to write it accurately and at the time.

A separate guide covers work incident reports under WHS law in more detail, including the register of injuries.

05

How to write a report that stands up, and what happens next

A report may be read by a police investigator, an insurer or a magistrate a year later. The habits that make it reliable are well known:

• Write it as soon as you can. Notes made at the time beat a tidy account written from memory the next day.
• Facts, not conclusions. Write "the man was shouting, unsteady on his feet and smelled of alcohol", not "he was drunk". Record what people said in the words they used.
• Say how you know. If you arrived afterwards, say so, and say who told you what.
• Be specific. "Roller shutter 4 at the loading dock found 40 cm open" can be acted on; "dock not secure" cannot.
• Never rewrite it. If something needs correcting, add a dated note. A report that has been changed after the event invites questions in any hearing.
• Check times, names and locations once before it is submitted.

Incident reports usually hold personal information: names, descriptions, sometimes health details and CCTV stills. Where the business is covered by the Privacy Act 1988, the Australian Privacy Principles apply: APP 11 says an APP entity "must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure". Share reports with the people who need them and store them securely.

A report nobody reads improves nothing. The security supervisor should read each one, check it is complete, and make sure what follows happens:

• The client is told within the time the site instructions set, with serious matters passed on at once.
• Crime goes to the police. Victoria Police's Police Assistance Line and online reporting page takes non-urgent crimes on 131 444 or online, and says not to use it in an emergency, including when a crime is in progress or someone has been injured: in an emergency, always call Triple Zero (000). Other states have their own non-urgent lines.
• Faults go to whoever fixes them – a broken lock, a failed light, a camera out – and the report records who was told and when.
• CCTV is saved in time. Recorders overwrite on a cycle, so ask for footage to be kept the same day.
• Patterns are looked for: repeated incidents at one gate or one time of night point to a change in patrols, lighting or access.
• The site instructions are updated when an incident shows they were unclear or out of date.

06

Where incident reporting fails, and where SiteClara fits

The incident report is usually the strongest record on a site. What fails is everything around it. The fault the report mentions is emailed to a maintenance inbox and never closed. The same fire stair door is reported as unlatched three nights running, each time by a different officer, and nobody connects the three. The patrols between incidents are logged as "all secure" in a block at 5am, so when the client asks whether anyone checked the dock before the break-in, the answer is an assurance rather than a record.

SiteClara is built for that routine part. A printed QR poster, with an optional NFC tag behind it, sits at each point that matters on the round: a loading dock, a fire stair door, a plant room, a car park level, the perimeter gate of a building site. The officer scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or says what stopped them. The time and the named officer are recorded as it happens, with a photo when one is asked for. A problem found on the round – a door that will not latch, a light out, a leak – is reported at that location and goes onto the team's list of open jobs until someone closes it, and a supervisor can escalate a job to the building manager, who can answer it.

The security supervisor sees what was due, done and missed, and can record why a check was missed. At the end of the day the supervisor reviews the totals and photos, adds a note and approves the daily report, which goes to nominated management or client contacts at 8am the next morning, showing what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What is an incident report in security?

It is the officer's written account of one event on a site, such as an intrusion, a theft, an assault, a person removed, an alarm or an injury, detailed enough that someone who was not there can rely on it. No Australian Act sets a standard form for guards, but the law does expect incidents to be recorded in some settings: under section 142(1) of Victoria's Private Security Act 2004, a crowd controller's entry in the register must include, "in relation to any incident involving the crowd controller, the prescribed details relating to the incident".

Which are examples of a security incident?

On most sites the list includes unauthorised entry, theft and loss, criminal damage, threats and assaults, medical emergencies, alarm activations and suspicious items. The law defines one kind precisely. Section 142(3) of Victoria's Private Security Act 2004 says an incident is any action in which a crowd controller "makes forcible physical contact with a member of the public", restrains a member of the public, or "ejects a member of the public from the place where the crowd controller is so acting".

How do you write an incident report for security?

Write it as soon as you can, in the order things happened, with exact times, the precise location, the people involved, the actions taken, any force used and the evidence, and stick to what you saw and heard rather than conclusions. Keep the record to the standard the law sets for security businesses: section 134 of Victoria's Private Security Act 2004 requires licence holders to keep permanent records of the prescribed particulars for at least five years and to "ensure that the records are accurate, legible and kept in good order".

How do you write a safety incident report?

If someone is killed or seriously hurt, or there is a dangerous incident, the business must tell the regulator at once by phone, and then in writing. WorkSafe Victoria's guidance on notifiable incidents under the OHS Act 2004 says to notify WorkSafe on 13 23 60 immediately, "provide written notification to WorkSafe within 48 hours" using its Incident Notification Form, and keep a copy for at least five years. SafeWork NSW's incident notification page says to record the incident in the register of injuries and to notify your insurer within 48 hours.

08

Further reading, and a list to take away

In Victoria, the Licensing and Regulation Division of Victoria Police regulates private security, and its private security pages include the public register of licence holders. Other states' regulators publish their own rules. For notifiable incidents, read the WHS or OHS Act of the state the site is in and its regulator's guidance.

Before the next shift, check that:

• the site instructions list which incidents need a full report, who is told and how quickly;
• the report template asks for exact times, precise locations, people, actions, force used and evidence;
• everyone knows when to call Triple Zero (000) and when to use the non-urgent police line;
• the site instructions say who notifies the WHS regulator and who keeps the scene;
• crowd controllers at a public place in Victoria have the register available and complete it each day;
• someone reads every incident report, tells the client and follows up faults until they are fixed;
• reports are stored securely and kept for a set period, at least as long as the law and the contract require.