9.1 Field Notes, Logs & Source Integrity

Key Takeaways

  • Contemporaneous notes record who, what, when, where, why or purpose, and how, while clearly identifying the source of every fact.
  • Official logs and reports must be chronological, legible, permanent, secure, and corrected transparently under policy—not erased, backdated, or prefilled.
  • A guard distinguishes personal observation, quoted statement, electronic record, measurement, and inference.
  • Notes and reports may become evidence, so unauthorized photos, personal-device storage, social posting, and casual disposal are improper.
Last updated: September 2026

Why notes matter

Memory changes rapidly under stress. Field notes made during or soon after an event preserve details for dispatch updates, an incident report, an employer investigation, licensing review, insurance claim, or court testimony. They are not a private scratch space that can be rewritten to improve the story. Treat every official notebook, log, photograph, recording, and electronic entry as a record that may later be examined.

Before patrol, record date, assignment, post, shift, weather when relevant, equipment issued, and briefing items. During events, record times from a consistent clock, exact locations, names and contact information under policy, descriptions, exact significant words, actions, notifications, instructions, evidence, injuries, care, and disposition. Write facts as they occur when safe; urgent life safety always comes first.

The six basic questions and source labels

Use who, what, when, where, why or purpose, and how as a completeness check. “Why” is dangerous when it becomes mind-reading. Record a stated purpose—“She said she entered to deliver medicine”—or an observed sequence, not an invented motive.

Label how each fact is known:

SourceExampleProper wording
Personal observationGuard sees a door open“I saw the east stair door standing open at 02:14.”
StatementWitness reports a sound“Lee stated, ‘I heard glass break.’”
Electronic recordAccess system shows a badge event“The access console displayed credential 184 at 02:12.”
MeasurementApproved sensor displays temperature“The panel displayed 98°F.”
InferenceGuard connects facts“The marks appeared fresh because exposed wood was dry while surrounding wood was wet.”

Do not write “I observed” for something learned by radio. Identify the speaker or channel. Exact quotations use the speaker's words; paraphrases should not be placed in quotation marks.

Chronology and precision

A useful log reconstructs the sequence: discovery, notification, response, change, handoff, and closure. Use specific times and locations rather than “later” and “over there.” Descriptions should cover clothing, build, distinguishing features, direction, vehicle, and behavior without unsupported identity labels. Record both action and result: “At 23:08 I pulled the west door; it remained secured,” not simply “door okay.”

Use recognized abbreviations only. Avoid profanity except in a necessary exact quote, jokes, insults, speculation, diagnostic labels, and legal conclusions. “Subject clenched both fists, stepped within two feet, and said…” is more useful than “Subject became aggressive.”

Integrity and correction

Never prefill patrol times, copy another guard's entries, backdate a record, erase an unfavorable fact, or sign a check not performed. In paper records, follow policy—commonly a single line through an error, corrected information, and initials or date so the original remains readable. Electronic systems may use an amendment or audit function. Do not delete the original entry unless the approved records procedure specifically does so while preserving integrity.

If new information changes an incident report after submission, make a supplemental report that identifies the earlier report and the source of the correction. A transparent correction strengthens credibility; concealment destroys it.

Security, retention, and handoff

Use issued systems. Do not store official photos or reports on a personal device, email them to a personal account, post them, or discuss them with friends. Protect notebooks and screens from public view. Turn records in and retain or dispose of them under employer policy and legal requirements.

At shift change, brief unresolved alarms, temporary credentials, people still onsite, hazards, police cases, missing items, evidence holds, and required follow-up. The incoming guard should be able to distinguish completed actions from pending tasks.

The note-quality test is accurate, attributed, chronological, complete, and protected. If a reader cannot tell what the guard personally perceived and what came from someone else, the record is not finished.

Photographs, sketches, and testimony

When policy authorizes official photographs, begin with overall orientation, then midrange relationships, then details, while avoiding needless movement. Preserve the original file, time information, photographer, and storage path. A simple sketch can show doors, direction, measurements, people, evidence, and north; label it not to scale unless measured. Never use a personal filter or edit the only image. Notes should explain who created each image or sketch and any unavoidable scene change.

Review genuine records when authorized before testimony, but do not memorize a preferred script. State what is independently remembered, what a contemporaneous record refreshes, and what is unknown. If a question contains a false assumption, correct it politely. Credibility comes from the preserved process, not certainty about every detail.

Test Your Knowledge

A witness tells a guard that she heard glass break. How should the guard record it?

A
B
C
D
Test Your Knowledge

What is the proper way to handle a material error discovered after an incident report was submitted?

A
B
C
D
Test Your Knowledge

Which note best distinguishes an electronic source from personal observation?

A
B
C
D