A guard at a retail property in Atlanta witnesses a shoplifting incident. He chases the suspect out of the building, returns to his post, and writes a report that says: “Saw a guy steal something from the store. He ran away.”
That report is useless. No description of the suspect. No description of what was stolen. No timestamp. No location within the property. No actions taken. No witness information.
When the client reads it, they question whether the guard was paying attention at all. When the police need details for their investigation, there is nothing to work with.
The difference between a professional security company and an amateur one often comes down to the quality of their incident reports. This guide gives you 7 ready-to-use templates for the most common incident types, plus a framework for writing reports that protect your company, satisfy your clients, and stand up in court.
Why Incident Reports Matter for Security Companies
Incident reports serve four critical purposes:
Client accountability. Clients pay for security. Reports prove your guards are observant, responsive, and professional. Companies with strong reporting retain clients longer.
Legal protection. If an incident leads to a lawsuit, the incident report is evidence. A detailed, timely report protects both the guard and the company. A missing or vague report creates liability.
Operational improvement. Patterns in incident reports reveal security gaps. If the same loading dock gets broken into every month, the problem is not the incident. It is the coverage plan.
Law enforcement cooperation. When police respond to an incident, they rely on the guard’s report as the first account. Detailed reports with descriptions, timestamps, and witness information make investigations faster.
What to Include in Every Security Incident Report
Regardless of the incident type, every report needs these core fields:
| Field | Description | Example |
|---|---|---|
| Report number | Unique identifier | INC-2026-0415 |
| Date and time | When the incident occurred | April 7, 2026, 02:35 AM |
| Location | Specific location within the site | Building B, 3rd floor stairwell |
| Reporting guard | Name and badge number | James Miller, Badge #1247 |
| Incident type | Category of incident | Trespassing |
| People involved | Names, descriptions, roles | Male, approx 30 years, 5’10”, blue jacket |
| Narrative | Detailed account of what happened | See template below |
| Actions taken | What the guard did in response | Contacted police, secured the area |
| Witnesses | Names and contact info of anyone who saw the incident | Sarah Chen, front desk, ext. 4102 |
| Evidence | Photos, video, damaged property | 3 photos attached |
| Injuries | Any injuries sustained | No injuries reported |
| Police involvement | Badge numbers, report numbers | Officer Davis, RPD Case #26-4821 |
| Follow-up required | Any pending actions | Client notified, maintenance requested for broken lock |
Now here are the 7 templates for specific incident types.
Template 1: General Incident Report
Use this for any incident that does not fit a specific category.
| Field | Description | Example |
|---|---|---|
| Report # | Auto-generated or sequential | INC-2026-0415 |
| Date/Time of incident | Exact time | April 7, 2026, 14:22 |
| Date/Time of report | When report was written | April 7, 2026, 14:45 |
| Site name | Property name | Westfield Commercial Plaza |
| Specific location | Where on the property | East parking lot, Row C |
| Incident type | General category | Disturbance |
| Description of incident | What happened, in chronological order | At 14:22, I observed two individuals engaged in a verbal altercation near the east parking lot entrance. The argument involved a parking dispute. I approached and asked both parties to separate. Individual 1 (male, approx 40, grey sedan plate ABC-1234) left the area. Individual 2 (female, approx 35, white SUV) remained and stated the other driver had taken her parking space aggressively. |
| Actions taken | Guard’s response | Separated the parties. Monitored the area for 15 minutes. No further incident. |
| Witnesses | Who else saw it | None identified |
| Photos/evidence | Attachments | 1 photo of vehicles involved |
| Injuries | Any injuries | None |
| Follow-up needed | Pending actions | None required |
Template 2: Theft/Property Crime Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0416 |
| Date/Time | When theft was discovered or witnessed | April 7, 2026, 09:15 |
| Site/Location | Specific area | Retail floor, electronics section |
| Suspect description | Physical details | Male, approx 25-30 years, 5’8”, thin build, wearing black hoodie and jeans, carrying a blue backpack |
| Direction of travel | Where suspect went | Exited through south entrance, turned left toward Main Street |
| Items stolen | What was taken | Two wireless speakers (est. value $180) |
| How theft occurred | Method used | Suspect removed items from shelf, placed in backpack, bypassed checkout |
| Witnesses | Who saw it | Store clerk Maria Lopez witnessed suspect leaving without paying |
| CCTV footage | Camera references | Camera 7 (electronics) and Camera 12 (south exit) captured footage |
| Police notified | Yes/No and details | Yes, Officer Chen, Case #26-4822, arrived at 09:40 |
| Evidence preserved | What was secured | CCTV footage saved, backpack strap found at exit |
| Store manager notified | Contact details | David Park, store manager, notified at 09:20 |
Template 3: Trespassing Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0417 |
| Date/Time | When trespasser was observed | April 7, 2026, 23:45 |
| Location | Where on property | Rear loading dock, behind Building A |
| Trespasser description | Physical details | Male, approx 50, 6’0”, grey beard, wearing camo jacket and boots |
| How they entered | Point of entry | Climbed over 6-foot chain link fence on east perimeter |
| Reason given (if any) | What they said | Individual stated he was looking for a place to sleep |
| Prior trespass warnings | Previous incidents | No prior incidents on record |
| Actions taken | Guard response | Issued verbal trespass warning. Escorted individual off property through main gate. |
| Trespass notice served | Formal warning | Written trespass notice issued, copy retained |
| Police involved | If applicable | Not required, individual complied |
| Perimeter check | Follow-up | Completed full perimeter check at 00:15, no additional individuals found |
| Fence damage | Property assessment | No damage to fence observed |
Template 4: Injury/Medical Incident Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0418 |
| Date/Time | When injury occurred | April 7, 2026, 11:30 |
| Location | Exact location | Building C lobby, near elevator bank |
| Injured person | Name, age, role | Patricia Gomez, 62, tenant (Suite 405) |
| Nature of injury | What happened | Slipped on wet floor, fell on left side, complaining of hip pain |
| Cause | What caused it | Recently mopped floor, wet floor sign was not visible |
| First aid given | What treatment | Ice pack applied to left hip, kept comfortable on floor per her request |
| EMS called | Yes/No, response time | Yes, 911 called at 11:32, EMS arrived at 11:41 |
| EMS unit/personnel | Who responded | Engine 14, Paramedic Rodriguez |
| Hospital transport | Where taken | Transported to Mercy General Hospital |
| Witnesses | Who saw it | Front desk receptionist Tom Nguyen, maintenance worker Bill Harris |
| Conditions | Environmental factors | Floor was wet from routine mopping, wet floor sign was present but partially obscured by a potted plant |
| Photos | Documentation | 4 photos: floor condition, sign placement, injury location, wide view of lobby |
| Property manager notified | Contact | Sarah Klein notified at 11:35, arrived at 11:50 |
Template 5: Fire/Safety Hazard Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0419 |
| Date/Time | When discovered | April 7, 2026, 03:20 |
| Location | Specific area | Electrical room, basement level, Building D |
| Type of hazard | Category | Electrical — burning smell from breaker panel |
| Description | Details | During routine patrol, detected strong burning odor coming from electrical room. Opened door, observed discoloration and slight smoke near Panel B-3. No visible flames. |
| Immediate actions | Guard response | Evacuated 2 overnight workers from basement. Contacted fire department. Secured the area with caution tape. |
| Fire dept called | Details | Called 911 at 03:22, Fire Engine 8 arrived at 03:31 |
| Evacuation performed | Details | 2 persons evacuated, accounted for at assembly point |
| Fire dept findings | What they determined | Overloaded circuit on Panel B-3. Power shut off to panel. Electrician required before restoring power. |
| Utilities affected | Impact | Power to suites 001-010 shut off |
| Property manager notified | Contact | Emergency line called at 03:25, facilities manager Mike Torres responded at 03:40 |
| Follow-up required | Pending actions | Licensed electrician needed. Panel B-3 remains off until inspected. |
Template 6: Vandalism/Property Damage Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0420 |
| Date/Time discovered | When found | April 7, 2026, 06:15 |
| Estimated time of damage | When it likely happened | Between 02:00-06:00 based on patrol logs |
| Location | Where | South wall of parking garage, Level 2 |
| Type of damage | What was done | Spray paint graffiti on concrete wall, approx 8ft x 4ft |
| Description of damage | Details | Large tag-style graffiti in red and black paint. Letters appear to read “KRW” or similar. Fresh paint, still slightly tacky. |
| Estimated repair cost | Rough estimate | $500-$800 for pressure washing and repainting |
| Evidence collected | What was gathered | 4 photos from multiple angles, checked CCTV (Camera 9 was offline, Camera 11 shows partial view at 03:47 of one individual) |
| Suspects | Any leads | CCTV shows one person, wearing dark clothing with hood, carrying a backpack. Unable to identify. |
| Police notified | Details | Yes, non-emergency line, Case #26-4825 |
| Property manager notified | Contact | Maintenance supervisor Carlos Reyes notified at 06:30 |
| Previous incidents | History | Third graffiti incident in this area in 60 days (see INC-0398, INC-0407) |
Template 7: Suspicious Activity Report
| Field | Description | Example |
|---|---|---|
| Report # | Sequential | INC-2026-0421 |
| Date/Time | When activity was observed | April 7, 2026, 21:50 |
| Location | Where observed | Visitor parking lot, near main entrance |
| Description of activity | What was suspicious | A dark blue sedan (4-door, possibly Honda Accord, partial plate: 7X-) has been parked in visitor lot for 3 consecutive days. Vehicle appears unoccupied. No visitor pass displayed. |
| Person description | If applicable | No person observed with vehicle during this shift |
| Duration | How long observed | Vehicle first noticed April 5, still present as of April 7 |
| Actions taken | Guard response | Photographed vehicle and plate. Checked with front desk: no tenant claims ownership. Left notice on windshield requesting removal within 24 hours. |
| Risk assessment | Guard’s evaluation | Low risk. Likely abandoned vehicle or long-term visitor who forgot to register. |
| Follow-up needed | Next steps | If vehicle remains after 24 hours, contact towing company and notify property manager |
| Previous reports | Related incidents | No previous suspicious vehicle reports in this area |
Common Mistakes Guards Make When Writing Reports
1. Being vague. “I saw a suspicious person” is useless. “I observed a male, approximately 30 years old, 5’10”, wearing a red cap and blue jeans, loitering near the north entrance for 20 minutes” is useful.
2. Including opinions. Write what you saw, not what you think. “The man appeared to be intoxicated” is an opinion. “The man was unsteady on his feet, slurred his speech, and smelled of alcohol” is an observation.
3. Waiting too long. Memory degrades rapidly. A report written 6 hours after an incident will miss critical details. Write the report within 30 minutes if possible.
4. Skipping timestamps. Every action in the narrative should have a time. “I called the police” is incomplete. “I called 911 at 03:22” is complete.
5. Illegible handwriting. This is the single biggest argument for switching to digital reports. If no one can read the report, it might as well not exist.
Paper vs Digital Incident Reports
| Feature | Paper Reports | Digital Reports |
|---|---|---|
| Automatic timestamp | ✗ | ✓ |
| GPS location attached | ✗ | ✓ |
| Photo attachments | ✗ | ✓ |
| Instant delivery to manager | ✗ | ✓ |
| Client portal access | ✗ | ✓ |
| Searchable archive | ✗ | ✓ |
| Legibility guaranteed | ✗ | ✓ |
| Custom report fields | ✗ | ✓ |
| Offline capability | ✓ | ✓ (with sync) |
| Cost | Low (paper/pens) | Software subscription |
| Professional appearance | Varies | Consistent |
Digital reporting is not just more convenient. It is more accurate, faster, and more professional. Clients who receive a formatted report with GPS location and photos view your company differently than clients who receive a scanned handwritten form.
How to Switch to Digital Incident Reporting
Switching from paper to digital does not have to be complicated.
Choose a platform with custom incident report forms that match your operation. You should be able to create different report types (theft, trespass, medical) with specific fields for each.
Set up your report templates. Use the 7 templates above as a starting point. Add or remove fields based on your clients’ requirements.
Train your guards. Most guards adapt to mobile reporting in 1-2 shifts. Show them how to fill out a report, attach photos, and submit. The key training point: write reports immediately, not at end of shift.
Test with one site first. Run digital reporting alongside paper at one site for a week. Compare the quality, speed, and completeness.
Roll out across all sites. Once confirmed, switch all sites to digital and retire paper forms.
Novagems includes customizable incident report forms with GPS tagging, photo attachments, and instant client delivery. Start your free 14-day trial and see how much more professional your reports become.
See Novagems in action
Join 500+ security & cleaning companies that replaced spreadsheets with Novagems.
✓ 14-day free trial · ✓ Free onboarding · ✓ Cancel anytime
