6.2 Professional Incident Reporting & Notebook Maintenance
Key Takeaways
- Daily Activity Logs (DAL) record routine operational events, whereas Incident Reports document non-routine events, crimes, and emergencies.
- Complete security documentation requires addressing all 6 Ws: Who, What, When, Where, Why, and How.
- Field notebooks must be bound, maintained chronologically in black ink, and kept free of torn pages, white-out, or erased entries.
- Correcting errors in an official field notebook requires drawing a single horizontal line through the error and placing the officer's initials and date next to it.
- Contemporaneous field notebook entries and formal incident reports serve as key legal evidence in administrative hearings, insurance claims, and court trials.
6.2 Professional Incident Reporting & Notebook Maintenance
Documentation is one of the most critical responsibilities of a licensed security guard in New York State. In legal and corporate environments, the fundamental rule of security operations is: "If it was not written down, it did not happen."
Written records preserve operational history, document security compliance, establish facts during criminal investigations, shield property owners from civil liability, and serve as legal evidence in court proceedings. A security officer's written reports directly reflect their professionalism, competence, and credibility.
Daily Activity Log (DAL) vs. Incident Reports
Security officers utilize two primary types of documentation: the Daily Activity Log (DAL) and the formal Incident Report. Understanding the operational distinction between these two documents is essential.
Daily Activity Log (DAL)
The Daily Activity Log (also known as a Shift Log, Daily Report, or Master Log) is a continuous, chronological record of routine events occurring throughout a security shift.
- Purpose: Tracks standard site operations, verifies contract compliance, and provides seamless continuity between incoming and outgoing shifts.
- Routine Entries:
- Shift start and end times, including guard arrival and relief times.
- Inspection rounds, patrol checkpoints, and lock/unlock verification times.
- Visitor, contractor, and delivery truck sign-ins and sign-outs.
- Key handoffs, equipment issuance (radios, keys, flashlights), and master key audits.
- Facility anomalies (e.g., burnt-out lights, propped doors, minor maintenance hazards).
- Weather conditions, shift handovers, and supervisor visits.
Incident Reports
An Incident Report is an official, standalone document completed whenever an unexpected, non-routine, emergency, or unlawful event occurs on the property.
- Purpose: Creates an exhaustive, detailed factual record of a specific event for property management, corporate legal counsel, insurance adjusters, and law enforcement agencies.
- Reportable Events:
- Criminal activity (burglary, theft, trespass, vandalism, robbery, assault).
- Property damage, equipment failure, water leaks, or power outages.
- Personal injuries, medical emergencies, or slip-and-fall accidents.
- Fires, hazardous material spills, or building evacuations.
- Use of force by security personnel or detention of suspects.
- Responses by police, fire departments, or emergency medical services (EMS).
The 6 Essential Questions (The 6 Ws)
Every professional incident report must thoroughly answer the 6 Ws. Leaving out any of these core elements creates gaps that defense attorneys, insurance investigators, or opposing parties can exploit in legal proceedings.
1. WHO
Record complete identification for every individual involved or present:
- Reporting Guard: Full name, license number, title, and employer.
- Victims & Complainants: Full names, home/work addresses, telephone numbers, employer, and role.
- Witnesses: Complete contact details, statement summaries, and exact locations during the event.
- Suspects: If known, full details. If unknown, record detailed physical descriptions: height, weight, build, skin tone, hair color/style, eye color, facial hair, clothing (top, bottoms, footwear, headwear), tattoos, scars, speech characteristics, and direction of travel upon leaving.
- Emergency Responders: Names, agency (NYPD, NYFD, State Police), shield numbers, precinct/unit, and police incident report/cad numbers.
2. WHAT
Describe the exact physical facts of what transpired:
- Specific nature of the event (e.g., commercial burglary, slip-and-fall, verbal dispute).
- Actions taken by all parties involved step-by-step.
- Precise property damage or physical injuries observed (e.g., "3-inch laceration on left forearm" rather than "person was injured").
- Property stolen or damaged, including exact descriptions, brand names, serial numbers, and estimated monetary values.
3. WHEN
Record precise time markers for every phase of the event:
- Date and exact time the incident occurred (or estimated timeframe).
- Date and time the incident was discovered or reported to security.
- Time security officers arrived on scene.
- Time emergency services (Police/Fire/EMS) were dispatched and arrived.
- Time property management was notified.
- Time the scene was cleared and normal operations resumed.
4. WHERE
Specify the exact physical location of the event:
- Property street address and facility designation (e.g., "100 Main St, Tower B").
- Exact floor, room number, hallway, stairwell, or parking lot zone.
- Precise landmarks (e.g., "5 feet north of the East Elevators on the 3rd floor").
- Environmental conditions: lighting quality (bright, dim, dark), floor surface conditions (wet, icy, carpeted), weather, and visibility.
5. WHY
Document known motives, arguments, or triggering factors if clearly established:
- Record statements made by participants explaining the cause (e.g., "Suspect stated he was looking for warm shelter").
- CRITICAL RULE: Never speculate, guess, or invent a "Why." If the underlying cause or motive is unknown, state clearly: "Motive unknown at time of report."
6. HOW
Describe the method of operation (modus operandi) or physical cause:
- How entry was gained (e.g., "glass window smashed with a concrete brick").
- How the injury occurred (e.g., "flooring tile was wet due to a leaking overhead pipe").
- Tools, weapons, or vehicles utilized (including make, model, color, and license plate number).
Field Notebook Rules & Standards
The field notebook is the security officer's primary memory aid and the foundation from which formal Incident Reports and court testimony are constructed. In New York legal proceedings, a guard's field notebook is subject to legal subpoena and cross-examination.
+-------------------------------------------------------------------+
| FIELD NOTEBOOK STANDARDS & RULES |
+-------------------------------------------------------------------+
| 1. BOUND NOTEBOOK ONLY | Spiral or stitch-bound; no loose-leaf. |
| 2. BLACK INK MANDATORY | Permanent black/dark blue ink only. |
| 3. CHRONOLOGICAL ORDER | Entries recorded sequentially in time. |
| 4. SINGLE LINE STRIKE | Line through errors with initials. |
| 5. NO ERASURES / TAPE | Zero White-Out, erasers, or torn pages|
| 6. NO BLANK SPACES | Draw diagonal lines through blank area.|
+-------------------------------------------------------------------+
Protocol Requirements for Field Notebooks
- Permanently Bound: Officers must use stitch-bound or spiral-bound notebooks. Loose-leaf binders, notepad scraps, or electronic sticky notes are prohibited because pages can be easily removed or inserted, destroying legal credibility.
- Indelible Ink: All notes must be written in permanent black or dark blue ink. Pencil, colored markers, or erasable pens are forbidden.
- No Torn Pages: Pages must never be torn out of a field notebook. Missing page numbers create a presumption in court that evidence was deliberately destroyed.
- Error Correction Protocol: Never use liquid correction fluid (White-Out), correction tape, or rubber erasers. Never scribble out text until unreadable. If an error is made:
- Draw a single horizontal line through the incorrect word(s).
- Write the correct information immediately next to it.
- Place your initials and date above the strike-through (
e.g., 1400 hrs 1415 hrs [J.D. 07/22/26]).
- No Blank Lines: Maintain continuous text. If blank space remains at the bottom of a page or between entries, draw a single diagonal line through the empty space and sign across it to prevent unauthorized retroactive additions.
Legal Admissibility & Courtroom Standards
Field notebooks and formal incident reports are official legal documents. Under New York Rules of Evidence, contemporaneously recorded business records can be admitted into court under the Business Records Exception to the Hearsay Rule.
Fact vs. Opinion
To maintain legal integrity, guard reports must be strictly objective and factual. Avoid subjective opinions, conclusions, or emotional labels.
| Subjective / Improper Statement | Objective / Proper Legal Standard |
|---|---|
| "The driver was drunk." | "Driver had slurred speech, bloodshot eyes, unsteady balance, and a strong odor of alcohol." |
| "The suspect acted maliciously." | "Suspect kicked the glass door three times until the glass cracked." |
| "The floor was dangerously slippery." | "A clear liquid puddle measuring 2 ft by 3 ft was observed on the linoleum floor." |
| "I think he stole the laptop." | "Witness A stated she saw the individual place the laptop into his black backpack." |
Sample Incident Report Structure
| Report Section | Required Information | Sample Text Entry |
|---|---|---|
| Header Data | Date, Time, Location, Incident Type, Report # | Date: 2026-07-22 | Time: 14:15 | Loc: 450 Broadway, Lobby | Type: Property Damage |
| Persons Involved | Names, Titles, Contact Info, Roles | Reporting Guard: Officer J. Doe (Lic #123456) | Witness: M. Smith (555-0199) |
| Incident Narrative | Chronological 6 Ws Account | At 14:10 hrs, while on foot patrol in the main lobby, Officer Doe observed... |
| Police / EMS Data | Responding Agency, Officers, Badge #, Case # | NYPD 1st Pct, Officer Johnson #4412 arrived at 14:30 hrs. Police Report #2026-889 |
| Disposition & Follow-up | Actions taken, notifications, report status | Area cordoned off with caution tape. Property Manager R. Davis notified at 14:35. |
What is the mandatory legal procedure for correcting an error in an official security field notebook?
Which documentation tool is used to record routine, shift-long operational events such as property patrols, key exchanges, and visitor arrivals?
Which set of core questions must every complete security incident report address?