6.2 Incident Report Writing, the Six Basic Questions & Objective Language

Incident Report Writing, the Six Basic Questions & Objective Language

Core Principle: An incident report is an enduring legal document that speaks for the security guard when they are not present. In Ontario courts, regulatory hearings, and corporate arbitrations, a poorly written report filled with subjective assumptions can lead to dismissed charges, civil liability, or licence revocation. A factual, objective, and chronological report provides an unassailable foundation for justice.

---

Primary Purposes of Incident Reports

An Incident Report (IR) is a formal, permanent administrative and legal record generated whenever an unusual, hazardous, unlawful, or policy-violating occurrence takes place on client property. Unlike routine daily occurrence logs, an incident report focuses on a single specific event, providing comprehensive documentation for diverse stakeholders:

1. Legal Proceedings and Court Evidence

Under Section 35 of the Ontario Evidence Act and Section 30 of the Canada Evidence Act, business records created in the normal course of security duties are admissible in court. In criminal prosecutions (e.g., theft, assault, break and enter) and civil litigation (e.g., slip-and-fall claims, occupiers' liability, wrongful detention, or excessive force allegations), the incident report serves as primary documentary evidence. A complete report protects the security guard and employer against civil liability.

2. Law Enforcement Handover

When police officers (such as the Ontario Provincial Police, Toronto Police Service, or regional municipal police) arrive on scene, the security guard's initial report provides vital operational intelligence. Investigating officers rely on the guard's documented suspect descriptions, witness contact details, physical evidence locations, and exact timelines to secure arrest warrants, lay charges, and establish reasonable grounds.

3. Corporate Risk Management and Client Notification

Property managers, facility directors, and corporate legal departments review incident reports to identify physical security vulnerabilities, evaluate tenant compliance, assess staff response protocols, and implement corrective measures (such as repairing damaged gates, adjusting lighting, or upgrading lock systems).

4. Insurance Claims and Financial Recovery

Insurance underwriters and claim adjusters scrutinize incident reports to determine liability, negligence, and the financial quantum of property damage, vandalism, fire losses, or personal injury. Incomplete or ambiguous reports can result in denied insurance payouts or protracted litigation.

---

The Six Basic Questions (5W1H) Framework

To ensure complete evidentiary coverage without informational gaps, every incident report must be structured around the Six Basic Questions: Who, What, Where, When, Why, and How.

1. WHO (Parties Involved)

Identify every individual connected to the incident by categorizing their role:

• Victim / Complainant: Full legal name, date of birth, contact telephone number, residential address, employer, and relationship to the property.
• Suspect / Subject: Full name (if known) or comprehensive physical description; aliases; last known address; status on property (trespasser, unauthorized visitor, terminated employee).
• Witnesses: Independent observers, tenants, patrons, or employees who saw or heard the event. Record full contact information immediately before they leave the scene.
• Security Personnel: Names, PSISA licence numbers, job titles, and employers of all responding guards and dispatchers.
• Emergency Services: Responding police, EMS, or fire personnel, including full names, badge/identification numbers, service divisions, vehicle/unit numbers, and the official police event/occurrence number.

2. WHAT (The Occurrence & Evidence)

Document the exact factual nature of what occurred:

• The specific event type (e.g., trespassing under Section 2(1) of the Trespass to Property Act, commercial shoplifting, medical collapse, water pipe rupture, or fire alarm activation);
• Exactly what the suspect did and said;
• What physical property was damaged, contaminated, stolen, or recovered (including serial numbers, value, brand, and condition);
• What physical evidence was discovered (e.g., pry tools, discarded clothing, weapon, shattered glass) and how it was secured or preserved without contaminating the chain of custody.

3. WHERE (Exact Geographic & Physical Location)

Provide precise spatial documentation:

• Municipal street address and property facility name;
• Exact building, floor, room number, hallway quadrant, or parking bay (e.g., "Level P2, North-West Stairwell B, adjacent to pillar 42");
• Specific environmental context: lighting intensity (fluorescent, natural sunlight, total darkness), line of sight, surveillance camera coverage zones, surface conditions, and proximity to emergency exits.

4. WHEN (Chronological Timestamps)

Record all time elements in standardized 24-hour military format (0000 to 2359):

• Exact time incident occurred (or estimated window if undiscovered);
• Time incident was discovered or dispatched to security;
• Time guard arrived on scene;
• Time 911 or emergency services were contacted;
• Time emergency services (police, paramedics, fire) arrived on site;
• Time scene was handed over, cleared, or normal operations resumed.

5. WHY (Causal Factors)

Document observable, verifiable factors that contributed to the occurrence:

• Physical causes: a burned-out light fixture, a broken magnetic door latch, icy pavement lacking salt, an accumulation of combustible cardboard;
• Preceding triggers: a verbal dispute over retail merchandise, an individual being refused alcohol service under the Liquor Licence and Control Act, 2019;
• Critical Rule: Never speculate on psychological motivation or internal intent. Record only visible, factual causal factors. If the suspect stated their motive, record their exact words in quotation marks.

6. HOW (Mechanics & Resolution)

Detail the operational mechanism of how the event unfolded:

• How entry or access was gained (e.g., "propped open fire exit door," "smashed window," "piggybacked behind an authorized tenant");
• How the offence was executed or how the hazard developed;
• How the security guard responded, including verbal de-escalation scripts used, tactical positioning, and emergency equipment deployed;
• How the incident was brought to a conclusion (e.g., voluntary departure, arrest under Criminal Code Section 494, transport by EMS to hospital).

---

Distinguishing Objective Facts, Subjective Opinions, and Inferences

The integrity of an incident report hinges on the security guard's ability to separate objective facts from subjective opinions and unverified inferences.

1. Objective Facts

An objective fact is a statement that can be proven true or false through direct sensory verification—what the guard personally saw, heard, smelled, or measured. Facts are neutral, indisputable, and free from emotional bias.

Factual Example: "The patron was swaying from side to side, slurred their words when speaking, smelled strongly of an alcoholic beverage, and held onto the doorframe for balance."

2. Subjective Opinions

A subjective opinion is an individual's personal belief, emotional reaction, or value judgment that cannot be objectively measured. Opinions reflect feelings rather than evidence and have no place in security reports.

Unacceptable Opinion: "The patron was completely wasted, acting like an obnoxious idiot, and looking for trouble."

3. Inferences

An inference is a deduction or logical conclusion drawn from observed facts. While inferences may seem reasonable, they represent assumptions rather than verified reality. An incident report must state the observed indicators, not the inferred conclusion.

Inference: "The intruder broke the window to steal the laptop." Factual Correction: "The window glass was shattered outward onto the grass. The desk drawer was forced open with pry marks on the lock, and the laptop computer listed on the asset manifest was not present."

Handling Statements and Verbatim Quotes

When documenting conversations, interviews, or verbal confrontations, the guard must never paraphrase in a manner that distorts meaning. If a party or witness makes a statement:

• Use direct quotation marks ("...") for the exact words spoken;
• Attribute the statement clearly to the specific speaker;
• Record profanity or threatening language exactly as uttered without censoring or editing, as specific phrasing constitutes essential evidence in criminal harassment and assault charges.

---

Descriptive Precision: Persons (Head-to-Toe) and Vehicles (CYMBAL)

1. Person Descriptions: The Head-to-Toe Standard

When documenting unidentified suspects, missing persons, or witnesses, security guards must follow a disciplined Head-to-Toe sequence to avoid omitting critical physical details:

1. General Identifiers: Apparent biological sex, estimated age range (e.g., 25-30 years), estimated height (e.g., 5'10" - 6'0"), estimated build (e.g., slender, medium, heavy, athletic), skin tone/complexion.
2. Head & Hair: Hair color, style (buzz cut, long wavy, dreadlocks, receding), length; facial hair (clean-shaven, full beard, goatee, five o'clock shadow).
3. Facial Features & Distinguishing Marks: Eyeglasses/sunglasses, shape of face, scars, visible tattoos (location and design, e.g., "tribal band on right forearm"), piercings (nose, eyebrow, lip), birthmarks, physical deformities or limps.
4. Upper Body Clothing: Outermost layer first: jacket, coat, hoodie (brand logos, colors, zip vs. pullover), followed by inner shirt, collar style, and patterns.
5. Lower Body Clothing: Pants, jeans, athletic trousers, shorts, or skirt (color, material, tears, fit), belt style and buckle.
6. Footwear: Type of shoes (running shoes, steel-toed work boots, dress shoes), brand, primary color, accent trim, laces.
7. Accessories & Carried Objects: Backpack, messenger bag, tools, flashlights, weapons (knife, firearm, club), umbrellas, jewelry.
8. Direction of Flight / Travel: Exact compass direction, street names, and mode of travel (e.g., "running eastbound on King Street West toward Simcoe Street").

2. Vehicle Descriptions: The CYMBAL Standard

When identifying vehicles involved in trespassing, thefts, hit-and-runs, or suspicious parking lot activity, security personnel must use the universal law enforcement acronym CYMBAL:

---

Narrative Structure: Chronological Sequencing & Active Voice

The heart of an incident report is the narrative. A professionally written narrative follows three non-negotiable rules:

1. Strict Chronological Order

The narrative must recount events in the exact sequence in which they happened—from initial dispatch or observation to final resolution and handover. Jumping backward and forward in time confuses readers and creates apparent contradictions that opposing counsel will exploit.

• Beginning: How the incident was initiated, received, or detected, and initial conditions upon arrival;
• Middle: Step-by-step documentation of all actions, interactions, verbal dialogues, physical movements, and evidence collected;
• End: Arrival of emergency services, handover of custody or scene, medical outcomes, trespass notices served, and final site disposition.

2. First-Person Active Voice

Security guards must write in the first-person active voice ("I observed," "I requested," "I secured") rather than archaic, awkward third-person phrasing ("this writer," "the security officer," "the undersigned"). Active voice ensures absolute clarity regarding who performed each action.

CONFUSING PASSIVE VOICE:
"The male was instructed to leave the premises. Upon refusal, the police were contacted."
(Who instructed the male? Who contacted police? Was it the guard, the property manager, or a tenant?)

CLEAR FIRST-PERSON ACTIVE VOICE:
"I instructed the male to leave the property. When the male refused, I phoned 911 dispatch from my mobile phone."

3. Professional Vocabulary and Elimination of Slang

• NO Radio 10-Codes: Never write "I 10-4'd the 10-33 and went 10-7." In court, codes sound obscure and unprofessional. Write: "I acknowledged the emergency transmission and placed myself on meal break."
• NO Colloquial Slang: Do not use informal terms like "perp," "skate," "cops," "bouncing," or "busted." Use professional terminology: "individual," "trespasser," "police officers," "escorted from premises," or "arrested under Section 494."
• Completeness and Conciseness: Include every material fact while excluding irrelevant filler. Every sentence must contribute directly to the factual record.