7.3 Incident Documentation, Report Writing, & Evidence Preservation

7.3 Incident Documentation, Report Writing, & Evidence Preservation

Core Evidentiary Mandate: SORA rules require every licensed security company to keep work records for each officer, including brief summaries of noteworthy incidents, especially those requiring police or other emergency responders (N.J.A.C. 13:55A-6.3(b)). The records must be kept for the length of employment plus five years (N.J.A.C. 13:55A-6.4) and are open to NJSP inspection without notice. Those records and your notes can be subpoenaed in Municipal and Superior Courts. Every log entry, field note, and incident narrative must adhere to rigorous standards of factual objectivity, contemporaneous recording, and evidentiary integrity.

In the legal arena, the professional maxim is absolute: "If it was not written down, it did not happen." Months or years after an incident, an officer's memory will fade, but contemporaneous written reports remain permanent. Whether supporting the criminal prosecution of a commercial burglar, defending a client against a multi-million dollar negligent security lawsuit, or facilitating an insurance claim, a security officer's documentation is vital to the administration of justice.

---

1. Legal Weight & Admissibility of Security Records

Private security documentation does not exist solely for internal client tracking; it possesses substantial legal standing across federal, state, and regulatory legal forums.

The Business Records Exception: N.J.R.E. 803(c)(6)

In judicial proceedings, out-of-court statements are generally excluded as hearsay because the opposing party cannot cross-examine the declarant at the time the statement was made. However, under the New Jersey Rules of Evidence (N.J.R.E. 803(c)(6))—the Records of Regularly Conducted Activity (Business Records Exception)—security logs and incident reports are admissible as competent evidence to prove the truth of the matters asserted, provided:

1. The record was made in the regular course of business operations.
2. It was the regular practice of the business to create such records.
3. The entries were recorded contemporaneously (at or near the time of the event) by an officer with personal knowledge of the facts, or from information transmitted by a person with personal knowledge who had a business duty to report.
4. The sources of information and method of preparation exhibit trustworthiness.

Judicial and Regulatory Impact

• Criminal Prosecution: Security incident reports frequently establish the initial factual foundation for criminal complaints filed by municipal police departments and county prosecutor offices. They document suspect descriptions, observed criminal acts, timelines, and physical evidence recovery.
• Civil Litigation: In premises liability lawsuits (e.g., slip-and-fall injuries, assaults occurring in commercial parking decks, or wrongful detentions), security documentation is examined during pre-trial discovery and depositions to determine whether security personnel acted reasonably or negligently.
• Insurance Adjustments: Corporate insurers rely on factual security narratives to substantiate structural property damage, fire loss origins, internal cargo theft, and worker's compensation claims.
• NJSP Regulatory Audits: The NJSP may inspect company premises and worksites and examine or impound records at any time without notification (N.J.A.C. 13:55A-6.5; N.J.S.A. 45:19A-9), so sloppy or false logs become regulatory problems as well as courtroom problems.

---

2. Daily Activity Logs (DAL) vs Incident Reports

Security officers manage two distinct tiers of documentation: ongoing administrative records and specialized investigative reports.

                     COMPARISON OF SECURITY DOCUMENTATION

     DAILY ACTIVITY LOG (DAL)                     INCIDENT REPORT
  +-----------------------------+          +-----------------------------+
  | - Continuous chronological  |          | - Standalone formal record  |
  |   shift blotter             |          | - Dedicated incident number |
  | - Documents routine events  |          | - Investigates exceptional  |
  |   (patrols, post relief,    |          |   events (crimes, injuries, |
  |   doors secured, lights)    |          |   fires, force, spills)     |
  | - Maintains operational     |          | - Comprehensive narrative   |
  |   audit trail of shift      |          |   using the 5 Ws and How    |
  +-----------------------------+          +-----------------------------+
                 \                               / 
                  \                             /  
                   +---------------------------+   
                   | CROSS-REFERENCE RULE:     |   
                   | The DAL records the brief |   
                   | event timestamp and notes |   
                   | "See Incident Report #..."|   
                   +---------------------------+   

Daily Activity Log (DAL / Shift Blotter)

The Daily Activity Log is a continuous, running chronological record of an officer's entire shift. It establishes that the security officer was awake, alert, on post, and actively performing assigned duties. Essential DAL entries include:

• Shift changeover and relief verification (confirming oncoming officer identity).
• Equipment accountability (radios, flashlights, keys, smartphones, patrol vehicles).
• Scheduled patrol commencement and completion times, noting specific zones checked.
• Security anomalies noted and resolved (e.g., "21:42 - Checked exterior Door 4; found propped open with wedge; removed wedge, secured door, and tested latch.").
• Routine lighting inspections, contractor arrivals, and property manager communications.

Formal Incident Reports

An Incident Report is a formal, standalone legal document initiated whenever an unusual, extraordinary, or disruptive event occurs on property. Incidents requiring formal reports include:

• Criminal offenses (burglary, theft, trespass, assault, vandalism, harassment).
• Medical emergencies, slips, trips, falls, and workplace injuries.
• Property damage, vehicular collisions, pipe bursts, or electrical failures.
• Fire alarm activations and hazardous material leaks.
• Any situation involving the use of physical force, detention, or citizen's arrest.
• Rule of Cross-Referencing: When an incident occurs, the officer records the initial timestamp in the running DAL, summarizing the event in one sentence and writing: "See Incident Report #2026-0928-01 for full narrative."

---

3. The Five Ws and How of Professional Reporting

An incident report must answer six fundamental investigative questions with absolute factual completeness. An omission in any of these areas creates doubt in court.

                       THE FIVE WS AND HOW FRAMEWORK

       [WHO]   --> Complete identification of all parties involved
       [WHAT]  --> Precise objective facts, property details, and actions
       [WHEN]  --> Exact chronological timestamps (date, hour, minute)
       [WHERE] --> Pinpoint geographic and physical facility locations
       [WHY]   --> Stated motives or observable causes (NO speculation)
       [HOW]   --> Mechanics of occurrence, tools used, sequence of events

1. Who

Identify every human being connected to the event. Avoid ambiguous terms like "someone" or "a guy." Document:

• Victims and Complainants: Full legal name, date of birth, home address, personal phone number, employer, and title.
• Suspects and Perpetrators: Full legal name and contact details if identified. If unidentified, compile an exhaustive physical description: sex, race, estimated age, height, weight, hair color/style, facial hair, eye color, skin tone, tattoos, scars, piercings, speech characteristics, and clothing (headwear, outer garments, footwear, logos).
• Witnesses: Complete contact information and specific physical location when observing the event.
• Security Personnel: Names, badge numbers, and specific roles of all responding security guards.
• First Responders: Responding municipal police officers (names, badge numbers, department, patrol vehicle numbers, police case/CAD numbers), fire apparatus, and EMS squad identifiers.

2. What

Detail the exact nature of the event: what occurred, what was heard, what was smelled, what property was targeted, and what actions were taken. Describe property using make, model, color, serial numbers, unique identifiers, and estimated monetary value.

3. When

Document exact dates and precise timestamps using 24-hour military time (e.g., 03:45 or 15:45) or standardized 12-hour AM/PM time with minutes. Never use vague generalities such as "a while later" or "in the afternoon." Document: time incident occurred, time discovered, time security arrived on scene, time 911 was notified, time police/EMS arrived, and time scene was cleared.

4. Where

Specify the exact physical location. Avoid broad statements like "in the parking lot." Record: property address, building identifier, floor number, room/suite number, stairwell letter, and exact spatial relationships (e.g., "Building C, 3rd Floor, West Hallway, directly adjacent to Room 314, approximately 15 feet south of Fire Exit 3B").

5. Why

Document motives or causes only when directly stated by participants or objectively verified. If a shoplifter states, "I stole the baby formula because I lost my job," document the exact quote. If the motive is unknown, state honestly: "Motive unknown at this time." Never speculate, guess, or invent psychological theories.

6. How

Describe the physical mechanics of the incident: how entry was gained (e.g., "pry marks measuring 1.5 inches wide observed on the aluminum latch plate of exterior Door 2"), how property was concealed, how an altercation escalated, or how an accidental fire ignited.

---

4. Professional Writing Standards: Objectivity, Active Voice, & Precision

Factual Objectivity vs Subjective Opinions

The most critical rule of legal documentation is the absolute separation of facts from opinions.

• Facts are objective, verifiable truths observed directly through human senses (seen, heard, smelled, felt) or proven by physical evidence.
• Opinions, Inferences, and Conclusions are subjective interpretations, personal judgments, or assumptions made about an event.

Grammatical & Structural Rules

• Chronological Narrative Order: Organize the body of the report chronologically from the initial observation to the final departure of emergency services. A sequential timeline ensures clarity and enables prosecuting attorneys to present a coherent narrative at trial.
• Active Voice: Write in the active voice rather than the passive voice. Active voice identifies the actor immediately, eliminating ambiguity:
  • Active: "Officer Washington escorted the visitor off the property." (Clear who acted)
  • Passive: "The visitor was escorted off the property by Officer Washington." (Weak, wordy)
• First-Person Professional Pronouns: Write from the first-person perspective: "I arrived on scene at 14:15..." or "Officer Davis and I inspected the loading dock." Do not refer to yourself impersonally as "this officer" or "the undersigned writer."
• Verbatim Quotations: When recording verbal threats, admissions, or crucial witness statements, record the exact words spoken enclosed within quotation marks: e.g., The subject shouted, "If you touch me, I will kill you!" Do not paraphrase, censor profanity, or clean up coarse language; offensive language often substantiates criminal harassment or terroristic threats under New Jersey law.

---

5. Field Notebooks: Maintenance & Evidentiary Rules

An officer's field notebook is the original, contemporaneous record from which formal incident reports are subsequently drafted. In court, defense attorneys will issue a subpoena demanding the production of the officer's original field notebook to cross-examine the officer on discrepancies.

                  FIELD NOTEBOOK EVIDENTIARY PROTOCOLS
  +-------------------------------------------------------------------------+
  | 1. PERMANENT BINDING: Must have sewn or glued binding. Loose-leaf or    |
  |    spiral notebooks with tear-out pages are legally suspect.            |
  +-------------------------------------------------------------------------+
  | 2. SEQUENTIALLY NUMBERED PAGES: Pages must be pre-numbered. NEVER tear   |
  |    or remove any page from a field notebook for any reason.             |
  +-------------------------------------------------------------------------+
  | 3. INDELIBLE BLACK INK: Write exclusively in black ballpoint ink.       |
  |    Do not use pencil or erasable ink.       |
  +-------------------------------------------------------------------------+
  | 4. STRICT ERROR CORRECTION: Draw a single horizontal line through the   |
  |    error, write correction adjacent, and initial/date. NO WHITE-OUT.    |
  +-------------------------------------------------------------------------+

Consequences of Improper Notebook Maintenance

If an officer tears pages out of a notebook, uses correction fluid (white-out), or heavily scribbles out words until illegible, defense attorneys will argue spoliation of evidence and allege that the security guard destroyed exculpatory evidence or fabricated notes. A single altered page can badly damage the officer's credibility and weaken both the criminal case and the security firm's defense in a civil lawsuit.

---

6. Crime Scene Preservation: Perimeters & Contamination Control

When a serious crime occurs on property—such as a commercial burglary, aggravated assault, robbery, homicide, or sexual offense—the security officer's role transitions immediately from patrolman to scene custodian.

The Cardinal Rule of Crime Scene Evidence

DO NOT TOUCH · DO NOT MOVE · DO NOT ALTER · DO NOT COLLECT

Private security officers are never forensic technicians. Officers must never pick up spent shell casings, touch discarded weapons, dust for fingerprints, or collect physical items. The sole exception occurs when physical evidence faces imminent, irreversible destruction (e.g., a blood-stained note lying in an outdoor alley about to be washed away by a torrential downpour, or an unexploded device in the path of a spreading fire). In that rare circumstance, photograph the evidence in place, record exact measurements, handle minimally with clean latex gloves by the edges, package in clean paper, and document the intervention completely.

Establishing Scene Perimeters

1. Establish a Wide Initial Perimeter: Deploy yellow crime scene barrier tape, ropes, stanchions, or physical security staff to isolate the entire area. Always establish a larger perimeter than initially thought necessary. A perimeter can easily be contracted later by arriving police detectives; however, once an undersized perimeter is contaminated by bystanders, forensic integrity can never be restored.
2. Establish a Dual-Perimeter System:
   • Inner Scene (The Hot Zone): The actual physical location where the crime transpired and where latent fingerprints, DNA, footprints, and ballistic evidence reside. Nobody enters this zone except certified law enforcement forensic crime scene investigators.
   • Outer Perimeter (The Warm/Buffer Zone): Surrounds the inner scene; serves as the command post, evidence staging area, and first responder briefing point.

Crime Scene In/Out Entry Log

Security personnel must establish a single, designated entry/exit point through the outer perimeter tape and maintain a strict, contemporaneous Crime Scene In/Out Log:

                          CRIME SCENE IN/OUT ENTRY LOG
  Facility: 100 Corporate Blvd, Edison, NJ       Date: September 28, 2026
  Incident: Burglary & Safe Breach (Suite 204)    Logging Officer: Officer R. Vance (#418)
  +--------------------+--------------------+--------+---------+---------------------+
  | Name & Title       | Agency / Badge #   | In     | Out     | Reason for Entry    |
  +--------------------+--------------------+--------+---------+---------------------+
  | Det. M. Alvarez    | Edison PD #142     | 08:14  | 09:42   | Primary Lead Det.   |
  | Off. T. Jenkins    | Edison PD #209     | 08:15  | 08:50   | Scene Escort        |
  | CSI Spec. K. Myers | NJSP Forensic Unit | 08:32  | 10:15   | Latent Prints & DNA |
  +--------------------+--------------------+--------+---------+---------------------+

• Strict Access Control: Deny entry to curious bystanders, office managers, corporate executives, and uninvolved coworkers. Even property owners must be barred from entering a secured crime scene until released by law enforcement.
• Contamination Prevention: Within the secured perimeter, officers must strictly prohibit smoking, eating, drinking, chewing gum, using restrooms, or touching telephones, door handles, or light switches. Contaminants deposited by security guards ruin forensic DNA and chemical tests.

---

7. Chain of Custody & Courtroom Testimony

Chain of Custody Fundamentals

The Chain of Custody is the unbroken chronological paper trail demonstrating that physical evidence presented in court is the exact item seized at the scene and that it has remained completely unaltered, uncontaminated, and untampered with since its discovery.

• Evidence Transfers: Every transfer of custody must be documented on an official Evidence Property Receipt, recording: date, military time, item description, unique evidence tracking number, name and badge number of the transferring officer, name and badge number of the receiving detective, and the receiving law enforcement agency case number.
• Consequences of a Broken Chain: If evidence is stored in an unlocked desk drawer or left unattended on a security console where multiple people had access, defense counsel will challenge the chain of custody. The judge may rule the evidence inadmissible, potentially destroying the criminal prosecution.

Courtroom Testimony Demeanor & Standards

Security officers are frequently subpoenaed to provide sworn testimony in Municipal Court, Superior Court trials, and civil depositions.

• Pre-Trial Preparation: Review your original bound field notebook and formal incident report thoroughly prior to taking the stand. You may request permission from the judge to refresh your memory using your contemporaneous notes while testifying.
• Professional Courtroom Bearing: Arrive early, dressed in a spotless, complete security uniform or conservative professional business attire. Maintain an upright, dignified posture; look directly at the jury (or judge in a bench trial) when answering questions.
• Answering Guidelines:
  • Listen carefully to the entire question before speaking.
  • Answer only what was asked; do not volunteer unprompted information or wander into narrative tangents.
  • If you do not know an answer or cannot recall a detail, state clearly and honestly: "I do not know" or "I do not recall." Never guess, speculate, or fabricate testimony.
  • Maintain composure under cross-examination: Defense counsel may ask rapid-fire, leading, or hostile questions to provoke an emotional outburst. Pause for 2 to 3 seconds before responding to allow the prosecuting attorney time to lodge objections, and remain calm, polite, and respectful at all times.