Security incident report: what to record, and how to write one that holds up

01

What a security incident report is, and the rules behind it

A security incident report is the written account a security officer makes of one specific event on a site: a break-in, a theft, damage, a trespasser who would not leave, an assault or threat, a medical emergency, an alarm activation, a door found insecure. It is written by the person who dealt with it, as soon as they can, for people who were not there: the supervisor, the client's property manager, and sometimes the Police, an insurer or a court.

Private security work in New Zealand is regulated under the Private Security Personnel and Private Investigators Act 2010, administered by the Private Security Personnel Licensing Authority (PSPLA). The Authority issues licences and certificates of approval, keeps the public register, and disciplines holders. Its guidance Licence or certificate? explains the split: a company that provides security services for money needs a company licence, a sole trader needs an individual licence, and anyone "employed or contracted by a company providing private security services" needs a certificate of approval (COA). An employee working without one can be fined up to $20,000.

The Act does not prescribe an incident report form. The expectation that officers can write one comes from training. The PSPLA's Training and skills page sets the competency for property guards, personal guards and crowd controllers: three unit standards or skill standards adding up to 12 credits, or the New Zealand Certificate in Security (Foundation) (Level 3) or (Advanced) (Level 4). One of those units is NZQA unit standard 27364, Demonstrate knowledge of the security industry in the pre-employment context. Its Outcome 6 is about "receiving and reporting information in a security context": describing the reports officers use, identifying the information a report needs ("who, what, why, when, how, where"), using standard protocols such as the phonetic alphabet and the 24-hour clock, and completing a security report, which the range lists as "verbal, note book, log book, incident report".

The same unit standard covers the immediate response, taken before emergency services arrive: its Outcome 5 is the "first line response to emergencies and security incidents", including notifying fire, ambulance or Police and following the site's evacuation procedures.

The rest comes from the security company's procedures and the client's site instructions: what counts as an incident, who must be told, and how fast.

02

The reports an officer writes, and where the incident report fits

Officers on a New Zealand site usually keep several records, and the incident report only works if everyone knows which is which:

• The pocket notebook: the officer's own notes, made at the time, with times against each entry. It is often the first record of an incident and the one the formal report is written from.
• The occurrence book or daily log: the running record of the shift, entry by entry: start and finish, patrols, keys issued, contractors signed in, alarms, visitors, anything unusual.
• The patrol record: which areas were checked on each round, when, and what was found.
• The incident report: a separate, detailed account of one event, with its own reference number, cross-referenced from the log.
• The shift handover: what the next officer needs to know, such as an incident still open, a door that will not secure, or a contractor still on site.
• The PCBU's incident and near miss record: where someone was hurt or nearly hurt, the event also goes into the health and safety reporting system of the business that controls the workplace, as the guide to incident reporting explains.

The log says that something happened; the incident report explains it. A log line such as "23:10 two males climbing the rear fence by the loading dock, Police called on 111, see incident report 0412" is how a reader moves from one to the other.

Unit standard 27364 also recognises the verbal report: a radio call to the monitoring centre or a phone call to the supervisor. For anything urgent that comes first, and the written report follows.

03

What a security incident report should contain

Whatever form the security company uses, a good incident report answers the questions in unit standard 27364: who, what, why, when, how and where. In practice each report should carry:

1. A reference number, the site and the client, so the report can be found and cross-referenced from the occurrence book.
2. The date and the time of the incident in the 24-hour clock, and the time the report was written.
3. The exact location: building, level, door, gate or car park bay, not just "the site".
4. The type of incident: unauthorised entry, theft, wilful damage or graffiti, trespass, threatening behaviour or assault, medical event, alarm activation, fire alarm, hazard or fault.
5. What happened, in order, as the officer saw and heard it, with times against each step.
6. The people involved: names and contact details where they were given, and descriptions where they were not; witnesses; anyone injured and the help they received.
7. What the officer did: who was called and when (111, the monitoring centre, the supervisor, the client's after-hours contact), what was secured, any trespass notice given under the site instructions, and what was left for the next shift.
8. Evidence: photographs, which CCTV cameras cover the area and whether footage has been asked to be kept, access control records, items found and who now holds them.
9. External references: the reference Police gave for the report, an insurer's claim number, the WorkSafe notification if there was one.
10. The outcome and what is still open: a lock awaiting repair, a follow-up with Police, a question for the client.
11. The officer's name, COA number and signature, and the supervisor's review when it happens.

Submit the report within the time the site instructions set. For anything serious that usually means before the end of the shift, with the supervisor or monitoring centre already told by phone or radio.

04

How to write a report that holds up

A report may be read months later, by someone who did not know the site and who may be looking for its weak points. The habits that make it reliable are simple, and they are the ones security training teaches:

• Write it at the time, or as close to it as you can. A note made in the notebook as events happen is worth more than a polished account written the next morning.
• Write what you saw and heard, not what you concluded. "He was unsteady on his feet, slurring, and smelled of alcohol" is evidence; "he was drunk" is an opinion. Record what people said in their own words.
• Keep to the order of events, with a time against each step, using the 24-hour clock.
• Be precise about places. "Level 2 east stairwell door found wedged open" can be acted on; "doors insecure" cannot.
• Say how you know. If you arrived after the event, say who told you what happened.
• Never rewrite an entry. If something needs correcting, add a dated, signed note.
• Stay within your role. Report what you did under the site instructions and the powers your training covers, no more. Unit standard 27364 expects officers to know the legal limits of their authority, including trespass, detention, search and the use of force.

Paper or an electronic system both work, provided the report is legible, complete, stored securely and cannot quietly be changed.

05

What happens after the report: Police, WorkSafe, CCTV and the client

The report is the start of the follow-up, not the end of it. On a well-run contract the security supervisor reads every incident report, checks it is complete, and makes sure each of these has happened:

• The Police have been told, the right way. New Zealand Police's 105 non-emergency service is clear: "If it's happening now, or someone's in danger, call 111". Anything else can go to 105 by phone or online, which takes reports of theft, property damage and graffiti, trespass, and threats or assault. Record the reference in the incident report.
• WorkSafe has been told, if the event is notifiable. Where someone is killed, suffers a notifiable injury or illness, or there is a notifiable incident arising from work, WorkSafe's guidance What events need to be notified? sets out three steps under the Health and Safety at Work Act 2015: preserve the site, notify "by the fastest way possible in the circumstances", and keep a record for at least five years from the date WorkSafe was notified. It also stresses that "only serious events are intended to be notified". The officer's report often becomes the core of that record, but the duty to notify sits with the PCBU; see notifiable events.
• The other businesses on site know. A security company, a building owner, a property manager and a cleaning contractor often share duties for the same building. WorkSafe's Overlapping duties – quick guide says businesses "must so far as is reasonably practicable consult, cooperate and coordinate activities" with the others they share duties with. An incident should reach every business it touches (see overlapping duties).
• CCTV footage has been kept. Systems overwrite on a cycle, so ask for the footage to be held quickly. The Privacy Commissioner's guidance page CCTV expects the organisation running the cameras to decide before installing them how long footage is kept and who can access it; people can ask for footage of themselves under principle 6.
• A Police request for information is handled properly. The Commissioner's guidance Releasing information to Police and law enforcement agencies explains that a search warrant or production order must be complied with, that a voluntary request can be met where a principle 11 exception applies, and that the agency should record the request, the decision, the exception relied on and what was released.
• Faults go to someone who will fix them, and the report says who and when.
• Patterns are looked for: repeated incidents at one gate or one time of night point to a change in patrols, lighting or access control that could prevent the next one.

WorkSafe's July 2017 fact sheet How to manage work risks puts the principle plainly: "Encourage appropriate reporting. Avoid processes that may encourage under-reporting", and use investigations into incidents and near misses "to make sure the control measures in place are continually improved".

06

Where incident reporting fails, and where SiteClara fits

The incident report is often the best record on a site. What fails is everything around it. The occurrence book says "patrol complete, all secure" every two hours for a month, so when a fence is found cut nobody can say when it was last seen intact. A fault written in the log at 03:00 never reaches the property manager. The client asks whether the officer actually checked the loading dock that night and gets an assurance rather than a record.

SiteClara is a way to record the routine work that gives an incident report its context. A printed QR poster, with an optional NFC tag behind it, is placed at each location that matters: a gate, a loading dock door, a plant room, a fire exit, a car park level. The officer scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or says what stopped them. The named person and the time are recorded as it happens, with a photo where the check asks for one. An issue found on the round, such as a cut fence, a door that will not latch or a light out, is reported there and then, and it stays on the team's list of open jobs until someone closes it.

The supervisor sees what was due, what was done and what was missed, and can record why a check was missed. At the end of the day the supervisor reviews the totals and the photos, adds a note and approves the daily report, which goes to the nominated client or management contacts at 08:00 the next morning, showing what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What is an incident report in security?

It is the formal written report of one event, as distinct from the running log of a shift. NZQA unit standard 27364 gives the security reports an officer should be able to complete as including "verbal, note book, log book, incident report", and expects officers to describe the reports they use in terms of their functions and typical use.

How do you write an incident report for security?

Write it as soon as you can, in time order, recording what you saw and heard rather than what you concluded. NZQA unit standard 27364 sets out the information a security report needs as "who, what, why, when, how, where", and the standard protocols officers use, including the phonetic alphabet, brevity codes and the 24-hour clock. The example earlier in this guide shows the result.

What are some examples of security incidents?

NZQA unit standard 27364 names security incidents as including "security breach, criminal activity or suspicious behaviour, alarm activation". On a site that also means theft, property damage and graffiti, trespass, and people hurt or threatened, all of which New Zealand Police's 105 non-emergency service takes reports of when it is not happening now.

What are the 5 elements of a good incident report?

New Zealand security training lists six, not five. NZQA unit standard 27364 gives the information required in security reporting as including who, what, why, when, how and where. A good report also records what the officer did, the evidence and any Police or insurer reference, as the list above sets out.

08

Where to read the official guidance, and a list to take away

The PSPLA publishes who needs a licence or certificate of approval, the training each class of work requires, and how to complain. NZQA publishes unit standard 27364 and its replacement. WorkSafe explains notifiable events and overlapping duties under HSWA. The Privacy Commissioner publishes the privacy principles and guidance on CCTV and on releasing information to Police. New Zealand Police explain 111 and 105.

Before the next shift, check that:

• every officer on the site holds a current certificate of approval and wears their ID;
• the site instructions say what counts as an incident, who must be told, and how quickly;
• officers know the difference between a notebook entry, an occurrence book entry and an incident report, and cross-reference them;
• the report form asks for exact times, precise locations, actions taken, evidence and external references;
• a supervisor reads every incident report and passes it to the client and any other business on site that needs it;
• someone knows which events must be notified to WorkSafe, and who in the PCBU does it;
• CCTV footage is asked to be held the same night, and the request is recorded;
• faults found on patrol go to someone who will fix them, and the report says who;
• reports are stored securely and kept for a set period, then disposed of.