Security Incident Reporting Explained: What a Good Report Contains

Typical categories include:

• intrusion, attempted intrusion or trespass;
• theft, attempted theft and criminal damage;
• violence, threats or abuse toward staff, officers or visitors;
• alarm activations, whether genuine, false or unexplained;
• fire, flood, utility failures and other building emergencies;
• accidents and injuries on site;
• suspicious behaviour, items or vehicles;
• breaches of site rules, such as unauthorised access or tailgating;
• failures of security systems, such as CCTV outages or faulty doors.

Including near misses and suspicious activity is important. Many serious incidents are preceded by smaller signals that were noticed but not recorded.

Writing style

Reports should be written in plain, objective language. Officers should describe what they observed, not what they assume: “the man placed two bottles in his coat and left without paying” is more useful than “the man stole alcohol”. Times should be precise. Opinions, where included, should be identified as such. Reports should be completed as soon as practicable, while memory is fresh, and should not be altered later; corrections should be added as dated amendments.

A common structure uses severity levels:

The exact times are a matter for agreement between client and provider. What matters is that they are written down, realistic and measured. Escalation lists must be kept current; an out-of-date contact list is one of the most common reasons for delayed escalation.

Preserving CCTV

CCTV footage may be overwritten automatically, so the report should prompt someone to preserve relevant footage quickly. The ICO’s video surveillance guidance notes that longer retention may be justified for specific purposes, such as preserving footage at a law enforcement agency’s request during an active investigation. It also expects organisations that may use footage as evidence to keep an audit trail of how it was handled, to restrict who can copy it, to redact third parties where necessary and to deliver disclosed footage securely.

Physical evidence and scenes

If police are likely to investigate, officers should avoid disturbing the scene beyond what is needed for safety, restrict access to the area, and record who entered it. Physical items should not be handled unnecessarily. Where items must be moved for safety, the report should record what was moved, by whom and why.

Witness information

Record witness names and contact details, with their consent, and a brief note of what they saw. Statements for police are taken by the police; a security report should not try to replace them.

Data protection

Incident reports often contain personal data, including information about suspected offences. They should be stored securely, shared only with people who need them, retained for a defined period and handled in line with UK GDPR. Clients and providers should agree who is the controller for incident records and CCTV.

Under RIDDOR, an “accident” includes an act of non-consensual physical violence done to a person at work, so an assault on an officer or member of staff can be reportable if it results in a reportable injury.

HSE’s guidance sets out the main categories and timescales:

• Deaths and specified injuries to workers (such as most fractures, amputations and loss of consciousness from head injury) must be notified without delay, and the report must be received within 10 days of the incident.
• Over-seven-day injuries, where a worker is incapacitated for more than seven consecutive days (not counting the day of the accident), must be reported within 15 days of the incident.
• Injuries to non-workers, such as members of the public, are reportable where the accident arises from work activity and the person is taken directly from the scene to hospital for treatment.
• Dangerous occurrences and certain occupational diseases also have reporting duties.

Over-three-day injuries must be recorded but do not need to be reported. Security providers should report incidents affecting their own employees and make sure the client is informed so that it can meet any duties of its own. A security incident report is not a RIDDOR report, but it provides the facts needed to make one.

Monthly or quarterly reviews should look at:

• incident volumes by type, location and time of day;
• repeat locations, such as one boundary or door;
• false alarm rates by zone;
• incidents involving abuse or violence toward staff;
• outstanding actions from previous reports.

The outcome should be specific changes: moving a patrol time, repairing a fence, repositioning a camera, adjusting staffing or updating assignment instructions. For retail-specific reporting on abuse and theft, see retail security risk management.

1. the incident categories and severity levels;
2. escalation contacts and timescales for each level;
3. the report template and required fields;
4. the format and platform for reports;
5. evidence preservation responsibilities;
6. monthly reporting and review meetings;
7. KPIs for report timeliness and completeness.

Our guide to what to include in a security tender explains how to set these alongside the wider specification.

Reporting formats and escalation routes are agreed with each client during mobilisation. Read more on our technology and reporting page, explore our alarm response service, or request a quote.