6.3 Incident Reporting & the Six Interrogatives
Key Takeaways
- Every complete incident report answers the six interrogatives: who, what, when, where, why, and how.
- Reports must be factual and objective — observations, not opinions or unsupported conclusions.
- Handwritten errors are corrected with a single line strike-through and initials, never erased or covered.
- Direct statements are recorded in quotation marks as exact quotes, not paraphrased and presented as fact.
- Reports are legal documents that may be reviewed by supervisors, insurers, attorneys, or a court long after the incident.
6.3 Incident Reporting & the Six Interrogatives
Quick answer: Every incident report should answer the six interrogatives — who, what, when, where, why, how — in factual, objective language. Reports are legal documents that may be read by supervisors, clients, insurers, attorneys, or a court months or years later, so they must be accurate, complete, and free of opinion, speculation, or unsupported conclusions.
Why incident reports matter
A security officer's memory of an event fades, but a well-written report does not. Incident reports serve several audiences at once: the client relying on the officer to protect their property, company management reviewing performance and liability, insurance carriers evaluating a claim, and, in many cases, attorneys, judges, or licensing boards reviewing the officer's conduct long after the officer has forgotten the details. Because a report may be the only surviving account of what happened, its accuracy at the time of writing matters more than how the officer remembers the event afterward. A poorly written report can undermine an otherwise correct response, while a clear, factual report protects the officer, the company, and the client.
The six interrogatives
Every complete narrative answers six questions, and reports that skip one of them are incomplete regardless of length:
| Interrogative | What it captures |
|---|---|
| Who | Names, titles, roles, and contact information of everyone involved — subjects, witnesses, victims, other officers, responding agencies |
| What | The specific event: what actually happened, in the order it happened |
| When | Exact or best-estimate times — when the officer arrived, when the incident began, when it ended, when it was reported |
| Where | Precise location — building, floor, room, post number, or address, not just a general reference to the site |
| Why | The apparent cause or motive, stated as observation rather than a firm conclusion unless directly confirmed |
| How | The sequence of actions: how the incident occurred and how the officer responded |
Working through the six interrogatives in order, before writing the narrative, prevents the most common report failure: a paragraph that describes the ending clearly but never establishes the basic facts a reader needs to follow it.
Characteristics of a good report
Strong incident reports share the same core qualities regardless of the type of incident:
- Factual and objective — describe what was observed, not what the officer assumes or feels.
- Complete — covers all six interrogatives and any follow-up action taken.
- Chronological — events are presented in the order they occurred, which is easier to write and easier for a reader to follow.
- Concise and specific — short, plain sentences, with specific times, distances, and quantities instead of vague, unspecific language.
- Legible and professional — free of slang, jargon, or offensive language, and, for handwritten reports, readable by someone other than the writer.
- Timely — written as soon as possible after the incident, while details are fresh.
Fact versus opinion
The single most common error in security report writing is substituting a conclusion for an observation. Compare the two styles below describing the same event:
| Opinion (avoid) | Fact (use instead) |
|---|---|
| The subject was obviously drunk. | The subject had slurred speech, an odor of alcohol on his breath, and swayed while standing. |
| The visitor was being difficult. | The visitor refused three requests to leave and raised his voice, saying he was not going anywhere. |
| It looked like a break-in. | The rear door glass was broken and the door was standing open; nothing else inside appeared disturbed. |
The right-hand column gives a reader — a supervisor, an attorney, a judge — the evidence to reach their own conclusion. The left-hand column asks the reader to simply trust the officer's judgment, which is a weaker report and a weaker witness statement if the officer is later questioned about it.
Quoting and correcting
When a person involved makes a statement relevant to the incident, the exact words should be recorded in quotation marks as a direct quote rather than paraphrased and presented as fact, since paraphrasing can unintentionally change the meaning or make the officer's summary look like the actual statement. If a written report contains an error, it should never be erased, covered with correction fluid, or torn up; the correct method is a single line drawn through the mistake, with the officer's initials next to it, so the original entry remains legible. This preserves the integrity of the record and avoids any appearance that the report was altered after the fact.
Report structure and follow-through
A typical incident report opens with identifying information — date, time, location, reporting officer, post or shift — followed by a chronological narrative that answers the six interrogatives, a list of persons involved and how to contact them, and a closing section describing any action taken and any recommended follow-up, such as a maintenance request, a referral to management, or a referral to law enforcement. Reports should be submitted through the chain of command promptly and retained according to company policy, since a completed report is not finished until it has been reviewed and filed — a lost or unsubmitted report provides no protection to the officer, the client, or the company.
The six interrogatives used to structure an incident report are:
Which sentence is written in acceptable factual, objective report style?
If an officer makes a handwriting error on a paper incident report, the correct correction method is to:
A witness's exact words relevant to an incident should be recorded in the report: