9.1 Incident Report Writing & Field Notes

9.1 Incident Report Writing & Field Notes

Quick Answer: A security incident report is an official legal document that must be objective, factual, accurate, clear, complete, and written in chronological order using the first person and active voice. Under Pennsylvania Rule of Evidence 803(6), properly maintained incident reports qualify as business records admissible in court. Officers must record contemporaneous field notes in permanently bound notebooks without removing pages and describe observable behaviors (e.g., "subject emitted a strong odor of alcohol, slurred words, and staggered") rather than subjective conclusions (e.g., "subject was intoxicated").

---

The Vital Function of Documentation in Private Security

In the private security industry, documentation is not merely an administrative chore—it is a vital operational and legal safeguard. An incident that is not documented effectively never happened in the eyes of the law. Security officers regularly encounter volatile situations involving property damage, criminal trespass, retail theft, physical altercations, and uses of force. The written reports generated from these events serve several critical functions:

1. Civil Liability Defense: In civil tort lawsuits (such as claims of assault, battery, false imprisonment, or negligent security), an officer's report is the primary defense evidence. A detailed, contemporaneous report protects both the officer and the employer against multimillion-dollar civil judgments.
2. Criminal Prosecution Support: When a suspect is detained or arrested under Pennsylvania common law or the Merchant's Privilege (18 Pa.C.S. § 3929), the security incident report is forwarded to the District Attorney's office. It forms the factual basis for criminal complaints, preliminary hearings, and courtroom testimony.
3. Risk Management & Insurance Substantiation: Facility managers and insurance underwriters rely on security logs and reports to identify premises hazards, evaluate liability exposure, and process property loss claims.
4. Internal Accountability & Training: Accurate records provide security supervisors with objective data to evaluate guard performance, verify adherence to post orders, and identify training deficiencies.

---

Field Notebook Management & Best Practices

A professional incident report is only as reliable as the raw field notes from which it is compiled. The field notebook is an officer's immediate, on-scene recording tool and may be subpoenaed as evidence in court.

Rules for Field Notebook Maintenance

• Permanently Bound Notebooks Only: Officers must use bound notebooks with sewn or glued bindings. Loose-leaf binders and spiral-bound pads are strictly prohibited because pages can be torn out, inviting allegations of evidence tampering or spoliation.
• Sequential Chronological Entries: Every entry must begin with the date, shift, and time. Notes must be recorded in real time or as soon as safety permits, moving sequentially without blank lines between entries.
• Exact Environmental & Temporal Data: Record exact military or standard times, ambient lighting conditions (e.g., daylight, sodium-vapor parking lot lamps, pitch darkness), and weather factors (e.g., heavy rain, dense fog, icy pavement) that could affect visibility, perception, or physical traction.
• Verbatim Statements in Quotation Marks: When capturing statements from victims, suspects, or witnesses, record their exact words inside quotation marks (e.g., Subject stated, "I will break your neck if you touch me"). Never paraphrase or sanitize vulgar or threatening language, as exact phrasing demonstrates criminal intent (mens rea) or terroristic threats (18 Pa.C.S. § 2706).
• Prohibition of Erasures and Page Removal: Never tear out a page from a field notebook. If an error is made, draw a single neat line through the mistake, write the correction above or beside it, and place your initials and date next to the strike-through. Never use liquid correction fluid (white-out) or black marker obliterations.

---

The Six Essential Questions of Security Reports (5 W's and 1 H)

Every security incident report must answer six fundamental questions thoroughly. An omission of any of these elements leaves the report vulnerable during legal examination:

---

Standard Incident Report Structure

A professional security report must follow a logical, standardized framework that enables supervisors, corporate attorneys, and law enforcement detectives to extract information quickly.

┌───────────────────────────────────────────────────────────┐
│ 1. ADMINISTRATIVE HEADER                                  │
│    Case #, Date, Time, Location, Shift, Officer ID        │
├───────────────────────────────────────────────────────────┤
│ 2. SUMMARY / SYNOPSIS                                     │
│    Brief 2-3 sentence overview of the incident            │
├───────────────────────────────────────────────────────────┤
│ 3. INVOLVED PERSONS & PROPERTY                            │
│    Victims, Suspects, Witnesses, Property / Evidence Log  │
├───────────────────────────────────────────────────────────┤
│ 4. CHRONOLOGICAL NARRATIVE BODY                           │
│    Detailed step-by-step account from start to finish     │
├───────────────────────────────────────────────────────────┤
│ 5. OFFICER ACTIONS & USE OF FORCE                         │
│    Commands given, force level applied, first aid         │
├───────────────────────────────────────────────────────────┤
│ 6. DISPOSITION & POLICE HANDOFF                           │
│    Responding agency, officer name/badge, case number     │
└───────────────────────────────────────────────────────────┘

1. Administrative Header: Contains the unique report tracking number, date, time of report completion, exact post/facility location, client name, shift details, and authoring officer's name and badge number.
2. Executive Synopsis: A concise, 2-to-3 sentence introductory summary summarizing what occurred, who was involved, and the final outcome.
3. Involved Parties & Property Identification: Detailed itemization of all individuals (full names, contact info, statements) and property/evidence involved (make, model, serial numbers, estimated monetary value, physical damage).
4. Chronological Narrative: The core body of the report. It recounts events in strict chronological order—from initial observation or dispatch to conclusion—avoiding jumping forward or backward in time.
5. Officer Actions & Medical Response: Explicitly documents every command issued, de-escalation technique attempted, physical contact or force applied (including justification under Pennsylvania law), and first aid or CPR administered.
6. Disposition & Official Case References: Explains the resolution of the incident (e.g., suspect ejected, trespass notice issued, suspect transported by EMS) and records the responding law enforcement agency, primary officer's name, badge number, and police incident/master case number.

---

Rules of Objective Factual Writing vs. Subjective Opinions

The most frequent and damaging flaw in security reports is the inclusion of subjective opinions, assumptions, and emotional conclusions. Reports must be strictly objective and confined to sensory facts: what the officer saw, heard, smelled, touched, or directly performed.

Active Voice vs. Passive Voice

Reports should always be written in the first person, active voice. Active voice clearly establishes who performed each action, eliminating ambiguity in court:

• Weak / Passive: "The suspect was observed entering the broken window, and handcuffs were applied."
• Strong / Active: "I observed the suspect climb through the broken window. I ordered the suspect to halt, and Officer Miller applied handcuffs."

Objective Sensory Facts vs. Subjective Conclusions

---

Legal Status of Security Reports: Pa.R.E. 803(6) Business Records

Under general evidentiary rules, out-of-court written statements offered for the truth of the matter asserted are classified as hearsay and are generally inadmissible in court. However, security incident reports can be admitted into evidence under the Business Records Exception to the Hearsay Rule (Pennsylvania Rule of Evidence 803(6)).

To qualify under Pa.R.E. 803(6), four foundational requirements must be established:

1. Contemporaneous Creation: The report was made at or near the time of the incident by, or from information transmitted by, someone with firsthand knowledge.
2. Regular Course of Business: The record was kept in the regular course of an established business, organizational, or security activity.
3. Regular Practice: Making the incident report was a regular, mandatory practice of that business activity (mandated by post orders and company policy).
4. Trustworthiness: Neither the source of information nor the method or circumstances of preparation indicate a lack of trustworthiness.

If a report is riddled with subjective opinions, fabricated times, missing pages, or late revisions, the court will exclude it under Pa.R.E. 803(6), destroying its evidentiary value.

---

Scenario: The Subjective Narrative on Trial

Scenario: Security Officer Tyler responds to a disturbance at an office complex. In his incident report, Tyler writes: "At approximately 2200 hours, I encountered a crazy, drunk vagrant who was looking for trouble. The vagrant became aggressive, so I had to use physical force to subdue him and throw him off the property."

Six months later, the individual files a civil lawsuit against Tyler and the security agency for assault, battery, and false imprisonment. In the Court of Common Pleas, plaintiff's counsel cross-examines Tyler on his report.

Analysis: Tyler's report is catastrophic for his defense. The words "crazy," "drunk," "looking for trouble," and "subdue him and throw him off" are subjective characterizations and inflammatory conclusions. Plaintiff's counsel forces Tyler to admit he has no medical training to diagnose mental illness or intoxication, and that the report fails to document any specific aggressive physical acts by the plaintiff that justified force. Had Tyler recorded objective observations—e.g., "Subject had bloodshot eyes, smelled of alcohol, took a bladed fighting stance with raised clenched fists, and stated 'I'll punch you'"—the report would have decisively justified Tyler's lawful use of defensive physical force.

---

Exam Tip: Objective Language & Business Records Rule (Pa.R.E. 803(6))

• Fact vs. Conclusion Rule: On the exam, identify statements describing measurable, observable actions (speech cadence, physical stance, odors, exact quotes) as correct. Reject options containing diagnostic labels (e.g., "insane," "intoxicated") or emotional judgments.
• Pa.R.E. 803(6) Admissibility: Remember that security reports qualify as admissible business records only when written contemporaneously as a mandatory duty in the regular course of business without indications of untrustworthiness.
• First Person & Active Voice: Always select active voice ("I locked the perimeter gate") over passive voice ("The gate was locked").