Security occurrence book: what to record, and how to keep one that holds up

01

What a security occurrence book is, and where it comes from

A security occurrence book, often shortened to OB, is a chronological record of everything significant that happens on a security post during each shift. It is kept on site, at the gatehouse, the concierge desk, the loading dock office or the security control room, and every officer on duty writes in it. The same record goes by other names across Australian sites: occurrence log, daily occurrence book, site log, security log book or shift log. They are the same thing; "log" is more often used when the record is kept on a device.

No Australian Act requires a security occurrence book by that name. It is established practice in the industry, and it is the contract, the site instructions and the provider's own management system that make it compulsory on a given site. Guarding companies that work to AS 4421:2023 Guard and patrol security services, which sets minimum requirements for the operation and management of an organisation providing protective security services and includes clauses on business records, operational records and assignment instructions, keep records as part of their management system, and most site instructions name the occurrence book as the place the shift's records go.

The law comes in around the book rather than through it. Private security is licensed by each state and territory, and the licensing laws require particular records and registers, which the next sections set out. The Security Services Industry Award 2020 lists among the indicative tasks of a Level 2 security officer to "record or report security incidents or matters on a computer based system", so writing up the shift is recognised as part of the job, whether on paper or on a screen.

The book's value is evidential. An account written at the time, in order, by a named and licensed officer is far more credible than one pieced together afterwards. Supervisors run the site from it, clients see what the contract delivers, and insurers and police rely on it after a claim, a complaint or a crime.

02

What goes in a security occurrence book

The site instructions should say what goes in the book on each site. A typical list of entries on an Australian post includes:

• Start and end of each shift: the officer's name, security licence number and the time they signed on and signed off.
• Handover: what was passed on – open issues, keys out, contractors still on site, systems in fault, anything the client has asked to be watched.
• Patrols: the time each patrol started and finished, the route or the areas covered, and anything found.
• Lock-up and unlock: the time each building, floor, gate or roller door was secured or opened, and anything found open, unlocked or unsecured.
• Keys and access cards: keys and cards issued and returned, unless the site keeps a separate key register.
• Visitors, contractors and deliveries out of hours, or a reference to the sign-in register.
• Alarms: intruder alarm activations, fire indicator panel alarms and faults, door-forced and door-held alerts, with the cause, who attended and what was done.
• Faults and hazards: failed lighting, leaks, broken locks, a blocked exit or fire door wedged open, and who they were reported to.
• Incidents: a short summary with the time, and the reference of the separate incident report.
• Calls and instructions: contact with the control room, the client's building manager or the supervisor – changed instructions and anything escalated.
• Emergency services: when triple zero was called, when police, ambulance or fire crews arrived and left, and any event or job number given.
• Supervisor and client visits: the time, and the supervisor's signature.
• Routine tasks the site requires: CCTV checks, plant room readings, car park closures.

The test is simple: could an officer who was not on shift read the entries and know what happened on the site, in what order, and what is still outstanding? That is the book's everyday purpose, long before anyone needs it as evidence.

03

How to write occurrence book entries that hold up

Occurrence books are read by people looking for gaps. The conventions for a handwritten book grew up to make entries hard to alter and easy to follow, and the same principles apply to an electronic log:

1. Write entries at the time, or as soon as possible after. A contemporaneous entry carries weight; a summary written at the end of the shift does not.
2. Use the 24-hour clock, and put the time against every entry.
3. Keep it in order. Never leave a gap to fill in later; if something was missed, add it as a late entry with the time it was written.
4. Use a bound book with numbered pages, usually A4 with a hard cover, and never tear a page out.
5. Write in pen, legibly, and never use correction fluid or tape. Correct a mistake with a single line through it, so it can still be read, and initial it.
6. Rule off blank space at the end of an entry or shift so nothing can be added.
7. Record facts, not opinions. Write what was seen, heard and done, and who by.
8. Sign off each shift with the officer's name and licence number.
9. Have it checked: the supervisor reads, signs and dates the book on each visit.

04

The registers and records the law does require

The occurrence book is practice; some of the records around it are law. Which ones apply depends on the state or territory, the licence and the kind of work, so a provider with sites in more than one state checks each one. Two examples show the pattern.

• Victoria. Under section 134 of the Private Security Act 2004 (version 027, in force from 19 June 2025), the holder of a private security business licence, and a self-employed individual operator, must keep permanent records of the prescribed particulars of the business or activity "for a period of at least 5 years" and ensure they are "accurate, legible and kept in good order". Where crowd controllers work at a public place, sections 139 to 142 require the activity manager to have a register available there each day, in which each crowd controller enters the date, their licence number and full name, their employer's details, the identification they wear and the prescribed details of any incident in which they made forcible physical contact with, restrained or ejected a member of the public. The register is kept for 5 years (at the public place, or at the manager's usual place of business for a temporary activity), and a copy by the crowd controller business licence holder, and under section 143 police or an authorised person may enter to inspect it.
• Queensland. The Queensland Government's page on employment registers for the security industry explains that a security firm keeps an employment register of the security providers it employs or hires. Whoever hires licensed crowd controllers keeps a crowd control register (a liquor licensee keeps it on the premises, otherwise the security firm keeps it), and it includes incident reports for any incident that ends in injury or someone's removal from a public place: when and where it happened, who was involved, what happened and the outcome, and how a crowd controller or other staff member responded. Registers are kept for 7 years from the last entry, and inspectors and police may see them.
• New South Wales and the other states and territories license security under their own Acts, with their own conditions on records and registers. Check the conditions of your licence with the state regulator before relying on any general guide, this one included.

The work health and safety law adds another record. In Queensland, section 38(7) of the Work Health and Safety Act 2011 says a person conducting a business or undertaking "must keep a record of each notifiable incident for at least 5 years from the day that notice of the incident is given to the regulator". The other jurisdictions that have adopted the model WHS laws carry an equivalent duty, and Victoria has its own Occupational Health and Safety Act 2004 with its own rules; check the law where the site is. An occurrence book entry that mentions a serious injury is not that record, but it is often where the record starts.

None of these registers is the occurrence book, and none can be replaced by it. The sensible arrangement is for the book to refer to them: "23:40 patron ejected at main door, entered in crowd control register", "02:15 contractor injured in plant room, see incident report and supervisor notified", so the running record and the statutory ones point to each other.

05

Occurrence book or incident report, and how the book is reviewed

The two are often confused, and the difference matters when a record is questioned.

• The occurrence book is a running account of the whole shift, in time order. Its job is to show what happened and when.
• An incident report is a separate, detailed account of one event: an injury, a theft, an assault, damage, a serious fault. It records the people involved, witnesses, actions taken and evidence, and goes to the supervisor and the client.
• A daily activity report or shift report is a summary of the book's entries sent to the client or the provider's office, so they do not have to come to site to read the book.
• Other registers such as the key register, the visitor sign-in book, the crowd control register and the fire logbook each have their own purpose, and the occurrence book refers to them rather than copying them.

An occurrence book entry becomes an incident report when the event needs more than a line or two, involves injury, crime, damage or the emergency services, might lead to a complaint, a claim or disciplinary action, or when the site instructions say so. The book then records the time and a summary with the report's reference.

A book nobody reads is a diary. Supervisors should read entries on every site visit, and at least weekly from a distance: checking that patrols and lock-ups happened as the site instructions require, that faults were passed on and closed, and that incidents were reported. Read over a few weeks, it shows patterns – the same door alarm every night, the same light out for a fortnight – that are often worth more to the client than any single entry.

Keep completed books for as long as the contract, the provider's own policy, the insurer and the licensing law require, and long enough to answer a complaint or a claim, then dispose of them securely. Write the date range on the cover and store them off the desk.

06

Where the occurrence book fails, and where SiteClara fits

The book is good at recording what the officer chose to write. It is weak at proving the routine: "22:00 patrol completed, all secure" reads the same whether the officer walked every level of the car park or wrote it from the gatehouse. A fault written up at 03:00 stays in the book unless someone passes it on. The client sees the book only when they visit, and by then the week is history.

SiteClara records the routine part of the shift where it happens. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: a fire exit, a gate, a plant room, a car park level. The officer scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or says what stopped them. The time and the named officer are recorded as it happens. A fault or incident found on the round can be reported there with a photo, and it goes onto the team's list of jobs until someone closes it.

The supervisor sees what was due, done and missed, and can record the reason a check was missed. At the end of the day the supervisor reviews the totals and photos, adds a note, records who was told and approves the daily report, which goes by email to nominated management or client contacts at 8am the next morning: what was reported, what was completed, what is still open and how the scheduled checks went.

07

Questions people ask

What is a security logbook?

Another name for the security occurrence book: the running record of each shift on a security post, in time order, more often called a log when it is kept on a device. The Security Services Industry Award 2020 lists "record or report security incidents or matters on a computer based system" among the indicative tasks of a Level 2 security officer, and clause 13.2 counts time spent "making any other record" as ordinary working time that must be paid for.

What do you write in an occurrence book?

Whatever the site instructions list: usually each shift's sign-on and sign-off, the handover, patrols, lock-ups, alarms, faults, visitors and a short summary of each incident, with the time against every entry. No Australian law sets what goes in the book, but for an incident the Queensland Government's page on employment registers for the security industry is a good model: an incident report in the crowd control register records when the incident happened, where on the premises, who was involved, what happened and the outcome, and how staff responded.

08

Further reading, and a list to take away

Start with the security licensing law and the licensing regulator in each state or territory where you work: in Victoria the Victoria Police private security pages, in Queensland the Queensland Government's security industry regulation pages, and in New South Wales the NSW Police Security Licensing and Enforcement Directorate. The OAIC's guidance on personal information applies to occurrence books as much as to any other record.

Before the next book is opened on site, check that:

• the site instructions say what goes in the occurrence book and what goes in separate registers;
• you know which registers and records your licence and the WHS law require, and where they are kept;
• every officer knows how to write, correct and sign off an entry;
• entries are made at the time, in order, with the 24-hour time against each;
• incidents in the book point to a separate incident report;
• faults recorded are passed to someone who will fix them;
• a supervisor reads and signs the book regularly;
• completed books are stored securely, and you know how long they are kept.