Security report writing: what a guard's report needs, and how to make it stand up

01

What a security report is, and what the law says about it

A security report is a written account, made by the guard on duty, of something seen, done or found during a shift. Across the Canadian security industry it goes by several names: incident report, occurrence report, daily activity report (DAR), use-of-force report. Whatever the name, it is read by people who were not there: the security supervisor, the client, the property manager or building operator, an insurer, the police and sometimes a court or tribunal. Good security report writing is what lets them rely on it.

Security guards are licensed by the provinces, so the rules come from the province where the guard works. In Ontario, the Private Security and Investigative Services Act, 2005 (PSISA) licenses guards and the businesses that employ them, and the ministry's Training Syllabus for Security Guards, Section 4: Report Writing sets out what every new guard is taught. It covers "the importance of using a notebook and the rules and format for taking accurate notes", the "different types of reports depending on the situation (e.g. incident, use of force, witness statements)", and the fact that reports are "necessary for audits or evidence in court". Reports are to answer who, what, when, where, why and how.

Ontario's O. Reg. 363/07, Code of Conduct applies to every report a licensed guard writes. Section 2 requires a guard, while working, to "act with honesty and integrity" and to treat information received at work as confidential, "except where disclosure is required as part of such work or by law". A report that is padded, back-dated or written to cover a missed patrol is a conduct problem, not only a paperwork one.

Other provinces go further on specific reports:

• British Columbia. Section 7 of the Security Services Regulation (B.C. Reg. 207/2008) requires a security business to keep "use-of-force reports, detailing incidents when" a security worker "used any type of force against another person", and to retain its prescribed records "for at least 2 calendar years".
• Alberta. Section 19 of the Security Services and Investigators Act requires a business licensee to report in writing to the Registrar matters including the use of a weapon by a licensee, an allegation that a licensee has committed a criminal offence, an alleged breach of the code of conduct, and serious injury or death. Under section 4 of the Security Services and Investigators Regulation (Alta. Reg. 52/2010) that report is due "within 24 hours of the incident becoming known to the business licensee", and under section 12 records relating to incidents involving material use of force are kept for at least two years.

Those duties fall on the security company, but they are built from what the guard wrote on shift. Quebec and the other provinces and territories set their own rules, so check the province before relying on any of the above. No Canadian law prescribes one standard report form. The form comes from the employer's procedures and the site's post orders, which say what must be reported, to whom and how quickly.

02

The reports a guard writes on a Canadian site

Confusing one report with another is where many records go wrong. The usual set on a guarded site is:

• The notebook: the guard's own running record, in time order, made as things happen. Everything else is written from it.
• The daily activity report (DAR): a summary of the shift for the supervisor or client, covering patrols, visitors, deliveries, alarms, keys, and anything out of the ordinary.
• The incident or occurrence report: a formal record of one event, written separately and in detail. Examples are a trespasser, a theft, mischief to property, a disturbance, a medical call, a fire alarm, a flood.
• The use-of-force report: required by the employer's policy everywhere, and a prescribed record in British Columbia and Alberta.
• The witness statement: another person's account in their own words, signed by them, kept separate from the guard's report.
• The patrol report: which areas were checked, when, and what was found, such as an unlatched exit door, a burnt-out stairwell light or water on a parkade ramp.
• The pass-down or shift turnover log: what the next guard needs to know, such as open issues, keys out, contractors still on site, and systems in trouble.
• The injury or hazard report: the facts the employer needs for its own workplace safety duties, including the notices covered below.

The notebook and the DAR record that something happened; the incident report explains it. A notebook line such as "23:10 two persons at P1 ramp door, trespass notice given, left 23:18, see incident report" is how the two connect.

03

What a security incident report should contain

Whatever the company's form looks like, a good incident report answers the same questions. The Ontario syllabus lists "date, time, location, actions/behaviours, description of individuals, observations, time of completion". In practice each report should carry:

1. The date and time of the incident, and the time the report was completed. Exact times matter more than approximate ones.
2. The exact location: building, floor, door, parkade level or gate, not "the property".
3. The type of incident: trespass, theft, mischief, disturbance, medical, alarm, a building system fault, and so on.
4. What happened, in order, as the guard saw and heard it, with times against each step.
5. Everyone involved, including suspects: names and contact details of witnesses, staff and anyone injured, and descriptions where names are not known.
6. What the guard did, and who was called and when: the supervisor, the dispatch or monitoring centre, police, fire or paramedics, the property manager.
7. Evidence: photographs, which cameras cover the area and whether footage exists, access control records, items retained and who now holds them.
8. What is still open, such as a damaged lock waiting for repair or a police occurrence number to follow up.
9. The guard's name, licence number and signature.

Submit it within the time the post orders set, counted from when the incident occurs. For anything serious that means before the end of the shift, with the supervisor told straight away by radio or phone rather than waiting for the paperwork.

04

How to write a security report that stands up

A report is read by people who were not there, sometimes months later, and sometimes by a lawyer looking for its weak points. The Ontario syllabus puts the standard in one line, listing what an objective report does: "focus on factual information, written in third person, avoids use of emotional terms, avoids introspection, presents the information in a clear and concise manner". The habits that follow from it are:

• Write it at the time, or as close to it as you can. Notes made in the notebook as events unfold are worth more than a polished account written the next day.
• Facts, not conclusions. Write "the man was unsteady on his feet, his speech was slurred and he smelled of alcohol", not "he was drunk". Record what was said in the words used.
• Keep to the order of events, with a time against each step.
• Be specific. "Stairwell B exit door on P2 not latching" can be acted on; "doors insecure" cannot.
• Say what you did not see. If you arrived afterwards, say so, and say who told you what happened.
• Keep witnesses apart. The Canadian Centre for Occupational Health and Safety's guidance on incident investigation advises that witnesses "should be kept apart and interviewed as soon as possible after the incident", and suggests taking photographs "before anything is moved".
• Never rewrite it. If something needs correcting, add a dated, initialled note. An altered report invites questions about everything else in it.
• Check it once for times, names, licence numbers and locations, and for grammar and punctuation, before it is submitted.

A handwritten report is fine if it is legible, complete and kept safely. An electronic reporting system helps with legibility and speed, but the rules above apply to all written reports, on paper or on screen.

05

What happens after a report is submitted

A report that nobody reads improves nothing. On a well-run contract the security supervisor or account manager reviews each incident report, checks it is complete, and decides what follows:

• The client is told, in the way and within the time the post orders set, with serious matters passed on at once.
• The regulator is told where the law requires it. In Alberta the security company has 24 hours from learning of a reportable incident to report it in writing to the Registrar.
• The employer's safety duties are met. Under Ontario's Occupational Health and Safety Act, section 51 requires the employer to notify an inspector, the joint health and safety committee or representative and any union "immediately" when a person is killed or critically injured at a workplace, followed by a written report within 48 hours, and section 52 requires written notice within four days when someone is disabled from their usual work or needs medical attention because of an accident, explosion, fire or incident of workplace violence. Section 32.0.2 requires an employer's workplace violence program to include "measures and procedures for workers to report incidents of workplace violence". The guard's report is often the first account these rely on.
• Faults go to whoever fixes them: a lock, a light, a leak, a camera out of service. The report should say who the fault was passed to, and when.
• Evidence is kept. Camera systems overwrite on a cycle, so footage the police or an insurer may want has to be saved quickly.
• Patterns are spotted. Repeated incidents at one door, one time of night or one part of the parkade point to a change in patrol routes, lighting or access control.

The same reports feed the regular review with the client, where the security company shows what the guards dealt with. That conversation is much easier when every report says what was done, where and when.

06

Where security reports fail, and where SiteClara fits

The incident report is usually the strongest record on a site, because something happened and someone had to write it down. The weak records are the routine ones. A DAR that reads "patrols completed, all secure" every two hours for a month tells the client nothing about which doors were tried. A fault written in the notebook at 03:00 may never reach the building operator. When a property manager asks whether a guard actually went down to P3 last night, the answer is an assurance rather than a record.

SiteClara is a way to record the routine part. A printed QR poster, with an optional NFC tag behind it, is placed at each checkpoint that matters: an exit door, a loading dock, a parkade level, a roof hatch, a mechanical room. The guard scans the code or taps the tag on their own phone, with no app to install, sees the checks due there and marks them done, or says what stopped them, such as a locked room. The time and the named guard are recorded as it happens, with a photo when the check asks for one. A problem found on the round, such as a door that will not latch, a light out or a leak, is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, and records the reason a check was missed. At the end of the day the supervisor reviews it, adds a note and approves the daily report, which goes to nominated management or client contacts at 8 a.m. the next morning, showing how the scheduled checks went, what was reported and what is still open.

07

Questions people ask

What are the key elements of a security report?

Ontario's Training Syllabus for Security Guards, Section 4: Report Writing gives the basic elements of report writing as including "date, time, location, actions/behaviours, description of individuals, observations, time of completion". Those seven are given as examples, and the syllabus adds that a report should answer who, what, where, when, why and how.

What are the two types of security reports?

No Canadian law divides security reports into two types. The Ontario Training Syllabus for Security Guards, Section 4 teaches "different types of reports depending on the situation (e.g. incident, use of force, witness statements)". In practice the useful split is between routine reports, such as the daily activity report, and reports of one event, such as an incident or use-of-force report.

How do you write a security report?

Write it from your notebook, as soon after the event as you can, and keep to the facts. The Ontario Training Syllabus for Security Guards, Section 4 says an objective report focuses on "factual information", is "written in third person, avoids use of emotional terms, avoids introspection, presents the information in a clear and concise manner". Give the time against each step and the exact location, and say what you did and who you told.

What is the proper format for a daily security report?

No Canadian law prescribes one form, so the format comes from the employer's procedures and the site's post orders. The Ontario Training Syllabus for Security Guards, Section 4 says reports must be "written in a clear, standardized format to ensure information is conveyed accurately and without bias". A daily activity report usually lists the shift's patrols, visitors, deliveries, alarms and keys in time order, with anything out of the ordinary written up as a separate incident report.

08

Further reading, and a list to take away

In Ontario, start with the Training Syllabus for Security Guards, whose Section 4 covers report writing, and the Code of Conduct in O. Reg. 363/07. In British Columbia the Security Services Regulation lists the records a security business must keep; in Alberta the Security Services and Investigators Act and Regulation set out what must be reported to the Registrar and how quickly. Nationally, the Canadian General Standards Board publishes CAN/CGSB-133.1-2017, Security officers and security officer supervisors (reaffirmed 2022), a voluntary National Standard of Canada that sets minimum requirements for selecting guards and supervisors and includes pre-assignment training programs for both. For injuries and violence, read your province's occupational health and safety law; CCOHS explains incident investigation in plain language, and the Office of the Privacy Commissioner of Canada covers personal information and camera footage.

Before the next shift, check that:

• the post orders say which incidents must be reported, to whom and how quickly;
• guards know the difference between a notebook entry, a DAR and an incident report;
• the incident report form asks for exact times, precise locations, actions taken and the guard's licence number;
• guards write facts in plain terms and never rewrite a report;
• someone reviews each incident report, tells the client, and knows which incidents go to the Registrar in your province;
• anything that triggers the employer's injury or workplace violence duties reaches the employer the same day;
• faults found on patrol go to someone who will fix them, and the report says who;
• reports and footage are stored securely and kept for a set period, at least as long as provincial law requires.