Security daily activity report: what to include, and how to write one that holds up

01

What a security daily activity report is

A daily activity report is a time-ordered record of everything significant that happens on a security post during a shift. Every officer on the post writes one, or adds to a shared one, from the start of the shift to the end. Companies and clients use different names for it: daily activity log, daily log, shift report, officer activity report or simply the DAR. Some sites keep it as a bound log at the console; most contract security companies now have officers complete it on a phone or tablet and submit it at the end of the shift.

Writing it is part of the job description. The Bureau of Labor Statistics' Occupational Outlook Handbook entry for security guards lists, among the things guards typically do, that they "write reports on what they observed while on duty", alongside patrolling property, monitoring alarms and video surveillance, and controlling access.

No federal law requires a security company to keep a DAR, and no state law we know of prescribes its format. What sets the requirement is the contract with the client and the post orders for the site, which normally say when the report is completed, what goes in it and who receives it. State licensing rules come in through training. In California, officers must complete 32 hours of training in security officer skills within six months of their registration being issued, 16 of them within 30 days, under Business and Professions Code section 7583.6, and the Bureau of Security and Investigative Services' security guard training requirements make "Observation & Documentation" one of the four mandatory four-hour courses, covering report writing and observation and patrol techniques. In New York, the Department of State's security guard training requirements under General Business Law section 89-n include a 16-hour on-the-job course "relevant to the duties of guards, requirements of the work site, and the needs of the employer". Check the licensing board in your own state.

02

What goes in a daily activity report

The post orders should say what goes in the DAR on each site. A typical report records:

• The header: the site and post, the date, the officer's name and guard card or license number where the state issues one, and the scheduled and actual start and end of the shift.
• Relief and pass-down: who was relieved, what was handed over, including keys, radios and other equipment, and anything open, with a reference to the pass-down log if the site keeps one.
• Patrols: when each round started and finished, the route or checkpoints covered, and anything found, including doors found unlocked and what was done about them.
• Access control: after-hours visitors, contractors and deliveries, or a reference to the visitor log; badge or key issues; doors propped or reported as held open.
• Alarms and systems: intrusion, fire and door alarms, camera outages and system faults, with the cause, who was notified and the time it was cleared.
• Maintenance and safety hazards: leaks, lighting failures, broken locks, blocked exits, slip hazards, elevator problems, and who they were reported to, with any work order number.
• Incidents: a one or two line summary with the time and a reference to the separate incident report.
• Calls and instructions: contact with dispatch, the client, the property manager or the supervisor, including any change to instructions.
• Police, fire and EMS: when they were called and arrived, the responding agency and any case or report number given.
• Supervisor visits and inspections: the time, and what the supervisor checked.
• Routine duties the post orders require: unlocking and lockup, flag detail, parking checks, meter or temperature readings, camera reviews.

The test is simple. Could an officer who was not there read the report and know what happened on the post, in what order, and what is still open? That is the report's everyday purpose, long before anyone reads it as evidence.

03

How to write DAR entries that hold up

DARs are read closely when something has gone wrong, often by someone looking for a gap. The reason the conventions matter can be seen in the federal courts' hearsay rules. Under Federal Rule of Evidence 803(6), as amended to December 1, 2024, a business record can be admitted if it was made at or near the time by someone with knowledge, or from information they passed on, was kept in the course of a regularly conducted activity, and making it was a regular practice, unless the other side shows that "the method or circumstances of preparation indicate a lack of trustworthiness." Rule 803(7) goes further: where a record is regularly kept, the fact that something is not in it can be offered to prove it did not happen. State courts apply their own rules of evidence, and this is not legal advice, but the lesson for the officer is the same: write it at the time, write it every shift, and write it the same way.

1. Write entries as things happen, or as soon as you can from your notes. An entry made at the time carries weight; a shift reconstructed at the end does not.
2. Put a time against every entry. Many companies use the 24-hour clock (military time) to remove any doubt about a.m. and p.m.
3. Keep it in order. If something was missed, add it as a late entry that says when it was written, rather than squeezing it in.
4. Record facts, not opinions. Write what you saw, heard and did: "Found east stairwell door propped with a wedge, removed it, door latched", not "door security poor".
5. Describe behavior, not appearance. The Department of Homeland Security's Recognize Suspicious Activity page, from the If You See Something, Say Something campaign, is plain that "race, ethnicity, sex, national origin, religion, or disability are not suspicious". A DAR entry should say what the person did.
6. Be specific about location. Use the names in the post orders: "Level P2, northeast corner", not "the garage".
7. Never erase. On paper, correct a mistake with a single line through it, initial it, and never tear out a page. On a device, the system should keep the original and the edit, with who made it and when.
8. Sign off. End the shift with your name, and have the report reviewed by a supervisor.

04

DAR, incident report and the logs a statute requires

The DAR is one record among several on a post, and it works best when it points to the others rather than trying to replace them.

• The daily activity report is the running account of the whole shift. Most entries are routine; its job is to show what happened and when.
• An incident report is a full, separate account of one event: an injury, a crime, a disturbance, a use of force, serious damage. It records the people involved, witnesses, actions taken and evidence. The DAR gives the time, a short summary and the report number.
• A pass-down log carries open items from one shift to the next. Some sites fold it into the DAR; others keep it separately at the console.
• A report the company must make to its regulator. In California, Business and Professions Code section 7583.2 makes it a violation for a private patrol operator to fail to deliver to the Director of Consumer Affairs, within seven business days, a written report on any discharge of a firearm by the licensee or an employee on duty. The same applies to a physical altercation with a member of the public on duty that leads to a security guard's arrest, a police report filed by a member of the public, first aid or other medical attention for a member of the public, a guard's discharge, suspension or reprimand by their employer, or any physical use of force or violence on any person. The DAR entry is where that event is first noted; it is not the report.

Some records are required by statute, and the DAR is not one of them, though it is often where the information first appears:

• California's violent incident log. Since July 1, 2024, Labor Code section 6401.9 requires most California employers to record every workplace violence incident in a violent incident log, omitting personal identifying information such as names, and to keep it for at least five years. See the guide to California workplace violence prevention.
• The Clery daily crime log. Colleges and universities with a campus police or security department keep a daily crime log under the Clery Act regulations; campus officers' DARs are one of its sources. See the guide to the Clery daily crime log.
• OSHA injury records. Where an employee is hurt at work, the employer's OSHA recordkeeping duties apply. Under 29 CFR 1904.29, an employer covered by the recordkeeping rule must enter each recordable injury or illness on the OSHA 300 Log and a 301 Incident Report, or an equivalent form, "within seven (7) calendar days of receiving information" that it occurred. The officer's DAR note is part of how that information arrives.

Read over several weeks, daily activity reports also show patterns: the same door alarm every night, the same leak reported three times, visitors arriving at the same odd hour. Those patterns are often worth more to clients than any single entry.

05

Reviewing, keeping and moving the DAR off paper

A DAR that nobody reads is a diary. The security supervisor should read every report, ideally the same day: checking that the rounds in the post orders were walked, that hazards were passed to someone who will fix them, that incidents have their incident reports, and that the language is factual. The exceptions are what need following up: a missed round, a hazard nobody has picked up, an incident with no report. Many contracts also require a summary to the client each day or week, and a regular account review where the DARs are the evidence of the service delivered.

There is no general federal retention period for DARs. Keep them for as long as the contract, your company's records policy, your insurer and any state licensing rules require, and long enough to answer a complaint or a claim; premises liability claims can arrive long after the shift. When a claim or lawsuit is expected, your attorney may tell you to preserve the relevant reports, so make sure nothing is deleted on a routine schedule while that is in force. DARs contain names, license plates and descriptions of people, so keep them where only authorized people can read them.

Paper or electronic? A paper DAR costs nothing, needs no signal or battery, and every officer knows how to fill it in. Its weaknesses are that it stays on the post, can be hard to read and is rarely reviewed until something goes wrong. An electronic DAR time-stamps each entry, keeps an audit trail of changes, can include photos and lets a supervisor or client read it the same day from anywhere. It only works if officers use it the way they would the paper form, at the time and in full, and if the system keeps a trustworthy record of who wrote what and when.

06

Where the daily activity report fails, and where SiteClara fits

The DAR is good at recording what the officer chose to write. It is weak at proving the routine. "0200 patrol completed, all secure" reads the same whether the officer tried every door or wrote it from the console, and a month of identical lines tells the client nothing about which doors were tried. A light out on a parking level noted at 03:10 stays in the report unless someone passes it on. And the client often sees the DAR only as a weekly summary, when the week is already history.

SiteClara records the routine part of the shift where it happens. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint the post orders name: a stairwell door, a loading dock, a roof access, a parking level. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them. The time and the named officer are recorded as it happens, with a photo when one is asked for. A problem found on the round is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, with the reason where one was given, and a job that needs the building manager can be escalated to them to answer. Each day the supervisor reviews the totals and photos, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing what was reported, what was completed, what is still open and how the scheduled checks went.

07

Questions people ask

What do you put on a DAR report?

What goes on a DAR is set by the post orders and the client contract, not by statute, but safety duties many posts share are named in California's Powers to Arrest and Appropriate Use of Force Training Manual (Bureau of Security and Investigative Services, July 2023), which lists monitoring safety standards and "reporting hazards, blocked exits, fire safety, slippery floors" among the company rules a security employee may be responsible for. Add to those the times of the shift, each patrol, alarms, visitors, calls and a reference to any incident report.

How do you write a daily activity report?

Write each entry at the time, with the time against it, as a regular part of every shift. Those are the conditions under which Federal Rule of Evidence 803(6) lets a business record be admitted: it was made at or near the time by someone with knowledge, or from information they passed on, and kept in the course of a regularly conducted activity, where making it was a regular practice.

How do you write a security report, with an example?

Report facts, not conclusions. The BSIS Powers to Arrest and Appropriate Use of Force Training Manual gives the example of a fact, "I saw two men kneeling at the door. One was holding a crowbar. The door had markings around the lock", against the conclusion "The men are burglars", and tells officers to include six facts: who, a detailed account of what happened, where, when, how the people involved behaved, and the names of witnesses with contact information if possible.

What is a good daily activity report for security?

One that is complete every shift, because a gap can count against you. Under Federal Rule of Evidence 803(7), where a record is regularly kept for a matter of that kind, the fact that a matter is not in it can be admitted to prove that it did not occur. A round, a hazard or a call left out of a regularly kept DAR may be taken as never having happened.

08

Further reading, and a list to take away

Start with the licensing board in the state where the post is: its training requirements say what officers are taught about observation and report writing, and its rules say which incidents the company must report to it. The Federal Rules of Evidence, published by the U.S. Courts, explain why a record made at the time and as a regular practice carries weight. OSHA's recordkeeping rule, 29 CFR Part 1904, covers the employer's duties when someone is hurt, and California employers should read Labor Code section 6401.9.

Before the next shift starts, check that:

• the post orders say what goes in the DAR, when it is submitted and who reads it;
• every officer knows how to write, correct and sign off an entry;
• entries are made at the time, in order, with a time against each;
• patrol entries name the checkpoints, not just "all secure";
• incidents in the DAR refer to a separate incident report;
• hazards and faults are passed to someone who will fix them, with a work order number;
• a supervisor reads every report and follows up on open items;
• completed reports are stored securely, and you know how long they are kept.