9.2 Incident Report Structure

Incident Report Structure

Quick Answer: A BC incident report is built on 5W1H + 1 — Who, What, When, Where, Why, How, plus the Action Taken. It has three parts: an introduction, a chronological body of observed facts, and a conclusion recording what you did and who you notified. Document people with full names and descriptors, property with serial numbers and value, and use direct quotes — never speculation.

The incident report is the formal, written record of a significant event — a theft, assault, arrest, injury, use of force, or substantial property damage. It is what a police investigator, a Crown counsel, an insurance adjuster, or a Security Programs Division investigator will read. The BST exam tests whether you can structure one correctly, because a report that is missing a time, a name, or the action taken is a report that fails the reader — and fails the guard in court.

The 5W1H + 1 Framework

Every incident report answers seven questions:

1. Who — full names of subjects, victims, witnesses; if a name is unknown, descriptors (sex, approximate age, height, build, clothing, distinguishing marks).
2. What — what happened, in observed facts only ('I observed the male strike the female on the shoulder with his fist').
3. When — date and time, to the minute where possible ('14 Aug 2026, 2237 h').
4. Where — specific location ('north loading bay, 1200 West Georgia St, Vancouver, BC').
5. Why — the apparent reason for the guard's involvement, framed factually ('called by staff regarding a disturbance at the front till') — not a conclusion about motive.
6. How — how the event occurred, step by step.
7. Action Taken (+1) — what the guard did, who was notified, what follow-up is required.

The Three-Part Structure

1. Introduction (Header)

The introduction fixes the administrative frame of the report:

2. Body — Objective, Chronological Narrative

The body is a chronological sequence of observed facts, written in the first person and past tense. Start with the call or observation that began your involvement and move forward in time. Each event should carry its own time stamp where possible. Do not skip ahead, and do not editorialize.

A well-structured body:

• Opens with what brought you to the scene ('At 2237 h I was dispatched by control to the north loading bay regarding a reported disturbance.').
• Records what you saw and heard as you arrived ('On arrival at 2240 h I observed a male, later identified as John Doe, standing approximately 1 m from a female, later identified as Mary Lee, and shouting.').
• Records what you did ('I identified myself as a security guard and asked both parties to step back.').
• Records what the subjects did and said, using direct quotes where relevant ('Mr. Doe said, "She took my phone."').
• Records any force used and why it was justified, with a cross-reference to the use-of-force report.
• Continues through to the point the scene was stabilized and persons were handed over or released.

3. Conclusion — Action Taken, Persons Notified, Follow-Up

The conclusion records the guard's action and the handoff:

• Action taken — 'I separated the parties, requested VPD attendance, and stayed with Ms. Lee until police arrived.'
• Persons notified — 'Vancouver Police (non-emergency line, file 26-12345), site supervisor R. Chen by phone at 2310 h, ABC Security operations manager by email at 2330 h.'
• Evidence/items — 'One Samsung phone recovered, photographed in place, given to Ms. Lee; CCTV footage request submitted to site control.'
• Follow-up required — 'VPD to review CCTV; ABC Security to contact Ms. Lee's employer re: safety plan.'

Sample Incident Report Template

INCIDENT REPORT — ABC SECURITY LTD.
Report #: 2026-0814-01
Report date/time: 14 Aug 2026 / 2315 h
Incident date/time: 14 Aug 2026 / 2237 h
Location: North loading bay, 1200 West Georgia St, Vancouver, BC
Reporter: J. Singh, SW-BC-12345, ABC Security Ltd.
Incident type: Assault / Use of force
Persons: Subject — Doe, John, M, ~30 yrs, 6'0", slim, black jacket; Victim — Lee, Mary, F, 28 yrs, 110-1234 Abbott St; Witness — Patel, A., M, 45 yrs, site employee

NARRATIVE:
At 2237 h I was dispatched by control to the north loading bay regarding a reported disturbance. I arrived at 2240 h and observed a male (later identified as John Doe) standing approximately 1 m from a female (later identified as Mary Lee) and shouting. I identified myself as a security guard and asked both parties to step back. Mr. Doe said, "She took my phone." Ms. Lee said, "It's not yours." I asked Ms. Lee to show the phone; she produced a Samsung S23, black case, serial #SN-4567. Mr. Doe produced a receipt showing the same serial number. At 2250 h Mr. Doe advanced toward Ms. Lee and raised his hand. I stepped between them, placed my left hand on Mr. Doe's upper arm, and said, "Sir, step back." Mr. Doe pulled away; I maintained the hold and guided him two steps back, then released. (Use-of-force report filed separately, #UOF-2026-0814-01.)

ACTION TAKEN / PERSONS NOTIFIED:
Vancouver Police notified via non-emergency line at 2255 h, file 26-12345; VPD members Cst. Brown #4567 attended at 2310 h and took statements. Site supervisor R. Chen notified at 2310 h. ABC Security ops manager notified at 2330 h.

EVIDENCE / FOLLOW-UP:
Samsung S23 photographed in place and returned to Mr. Doe on VPD instruction. CCTV footage request submitted to site control, cam 14-NB-03 retained. No injuries observed; Ms. Lee declined medical aid. Follow-up: VPD file review, employer safety plan for Ms. Lee.

Documenting People and Property

People: Capture full legal name (ask for ID where lawful), sex, approximate age, height, build, clothing, and distinguishing features. For witnesses and victims, also capture a phone number and address where possible. If a subject refuses to identify themselves, record the refusal and the descriptors you observed.

Property: For stolen, damaged, or recovered items, record the make, model, colour, serial number, and estimated value (state the source of the estimate — 'retail value per loss-prevention officer A. Jones: $80'). Serial numbers are what allow police to enter an item in CPIC and prove recovery; without them the report is far less useful.

Direct Quotes vs. Paraphrase

Use direct quotation marks for anything said that is significant to the incident — a threat, an admission, a refusal, a request for police. 'The male said, "I'm going to come back with a knife."' is far stronger evidence than 'The male made a threat.' Never put words in someone's mouth; if you did not hear it exactly, do not quote it.

Avoiding Speculation, Opinions, and Conclusions

The body of the report is for what you observed, not for what you believe. Do not write 'Mr. Doe was angry and about to attack Ms. Lee' — write what you saw ('Mr. Doe raised his voice and advanced one step toward Ms. Lee; his fist was clenched.'). The reader — not you — decides whether that amounts to anger or an imminent attack.

Complete Reports Promptly

Write the incident report as soon as practicable after the event, while memory is fresh. The longer the delay, the more detail fades and the more vulnerable the report is to cross-examination about why it was not written promptly. Use-of-force reports are mandatory as a licence condition under SPD policy 3.7.2.1 (see section 9.3), and although the policy sets no deadline, the working standard is before the shift ends; incident reports should follow the same discipline wherever feasible.

Takeaways

• Use 5W1H + 1 — Who, What, When, Where, Why, How, and Action Taken.
• Structure the report in three parts: introduction, chronological body, conclusion.
• Document people with full names and descriptors, property with serial numbers and value.
• Use direct quotes for significant statements; never speculate about motive or intent.
• Write promptly — memory fades and prompt reports carry more weight.