13.3 Concise Incident Writing

Key Takeaways

  • A usable checkpoint note keeps five facts: who was involved, what item or event was observed, when it happened, where it happened (lane, bag, bin, or table), and what action was taken plus the outcome.
  • Cut empty phrases such as at this point in time, due to the fact that, and it should be noted that; they add words without adding time, lane, item, action, or outcome.
  • Write observable facts, not accusations: a stun device was found inside a hair-dryer case is a fact; the traveler was trying to smuggle a weapon is speculation.
  • If a fact cannot be confirmed, hedge the observation (appeared to be a stun device until identified) rather than accusing motive; the gold standard is still a named, observed item.
  • English proficiency is a USAJOBS TSO employment condition, and concise writing is daily TSO work; it is not a published TAB domain, and TSA does not currently publish English item counts.
Last updated: August 2026

13.3 Concise Incident Writing

Quick answer: A checkpoint incident note is a fact record, not a story. Keep who, what, when, where, action, and outcome. Cut empty phrases. Do not accuse a traveler of motive. "A 4-inch folding knife was found in the interior pocket of a black backpack at 14:22 in Lane 3 during a bag search after an X-ray alarm. The traveler exited with the item. STSO notified at 14:25" is usable. "It should be noted that at this point in time the passenger was obviously trying to hide a weapon" is not. English proficiency is a USAJOBS condition of employment. Concise writing is how that condition shows up after an alarm. It is not a published TAB blueprint domain, and TSA does not currently publish English item counts.

TSO duties include interacting with the public, giving directions, and retaining SOPs. When those duties produce a record — a bag-search note, a property handoff, a traveler who exits with a prohibited item, an unattended bag — the writing has to survive a shift change. The next officer was not on your belt. The STSO was not watching your screen. The note is the screening result in English.

The elements of a usable note

Write every incident as if someone will have to act on it without calling you. The skeleton is always the same:

ElementWhat to recordCheckpoint example
WhoOfficer, traveler, witness — as known, without extra biographyOfficer Patel; adult traveler at Lane 3; STSO Chen notified
WhatItem, alarm, or statement actually observed4-inch folding knife in the interior pocket; X-ray alarm; traveler stated "it is for camping"
WhenClock time of the observation and of later steps14:22 found; 14:25 STSO notified
WhereLane, checkpoint, bag, bin, or tableLane 3, black backpack, search table
ActionScreening step takenBag search after X-ray alarm
OutcomeWhat happened next, without a theory of motiveTraveler exited the checkpoint with the item

If any one of those is missing, the note is incomplete. "Knife. Bad. Lane 3." has a where-ish word and an item-ish word and nothing else. "The passenger was clearly a threat" has a theory and no time, no item description, no action, and no outcome.

Quoted statements belong in what, not in who. "The traveler stated, 'It is for camping'" is an observed utterance. "The traveler admitted trying to sneak a knife onto the plane" is an interpretation of that utterance. Write the words. Let the STSO decide what they mean.

Cut empty phrases; keep facts

Empty phrases feel professional and do no work. They delay the time, the lane, and the item.

Cut thisWhy it is emptyKeep this
At this point in timeAt 14:22 is a time; this phrase is notAt 14:22
Due to the fact thatBecause or a cause-and-effect factAfter an X-ray alarm
It should be noted thatIf it should be noted, just write itStart with the fact
For all intents and purposesAdds no item, lane, or actionDelete
In order toUsually replaceable by toTo notify the STSO
Proceeded to searchSearched is the verbSearched the backpack
A number of itemsCount them or name themThree 3-1-1 bottles
The passenger in questionThe traveler plus a locatorThe traveler at Lane 3

Bloated: "At this point in time it should be noted that due to the fact that there was an alarm, I proceeded to search the bag and a number of items were found."

Usable: "At 14:22 in Lane 3, a bag search after an X-ray alarm found a 4-inch folding knife in the interior pocket of a black backpack."

Concise does not mean vague. A short note that names the item, the location in the bag, the lane, and the clock is more informative than a long note that never does. If you need two sentences for two times, write two sentences. Length is not the enemy. Emptiness is.

SOP restatements follow the same diet. Restate the public rule in the fewest accurate words. "In a standard lane, travelers remove laptops and other specified electronics and remove the quart bag of 3-1-1 liquids." Do not write "In order to facilitate the screening process, travelers should, at this point in time, be advised that they need to go ahead and take out electronics." The second sentence cannot be retained as an SOP because it does not say which electronics or which liquids rule.

Passenger directions are the shortest writing you will do. Imperative. One action per sentence. "Remove the laptop. Place it in the bin with nothing on or under it. Wait at the scanner." Courtesy can be a word ("please") without becoming a paragraph. Courtesy is not a reason to bury the action.

Facts vs speculation vs accusation

The most common writing failure after an alarm is not a missing comma. It is a theory about the traveler. Theories do not survive contact with a complaint, a supervisor review, or a later interview. Facts do.

Fact: A stun device was found inside a hair-dryer case in the black carry-on at Lane 5 after the X-ray operator called for a bag search.

Hedge when the identification is not yet confirmed: The object inside the hair-dryer case appeared to be a stun device pending identification. Use appeared to be for an observation you cannot yet name, not as a polite synonym for guilt.

Accusation: The traveler was trying to conceal a stun device in a hair-dryer case. Accusation: The traveler obviously knew the device was prohibited. Accusation: The traveler appeared to be a smuggler based on nervous behavior.

Nervous behavior is not an item. Late-for-a-flight is not an item. Sweating is not an item. If you observed a behavior that the SOP requires you to report, describe the behavior: "The traveler walked toward the sterile area while the unresolved bag was still on the belt." That is an access-control fact. "The traveler was acting guilty" is not.

Appeared to be is safer than was hiding or was smuggling when you are describing an object you have not finished identifying. It is not a license to diagnose motive. "The traveler appeared to be hiding something" is still speculation. "A dense object inside a hair-dryer housing could not be resolved on the image; a bag search found a stun device" is a fact chain.

Do not write SSI, unpublished alarm-box language, or screening vulnerabilities into a note. You do not need them. Time, lane, item, action, and outcome are public-facing facts you can stand on. Official training after hire covers what belongs in protected channels. This study guide will not invent those channels.

Error / correction table: incident notes

Unusable sentenceUsable sentenceWhat changed
It should be noted that at this point in time I proceeded to search the bag.At 14:22 in Lane 3, the backpack was searched after an X-ray alarm.Empty phrases replaced by time, lane, and action.
The passenger was obviously trying to hide a knife.A 4-inch folding knife was found in the interior pocket of a black backpack.Accusation replaced by item and location.
The traveler appeared to be a smuggler.A stun device was found inside a hair-dryer case in the black carry-on.Motive replaced by the observed item.
Knife. Bad. Lane 3.At 14:22 in Lane 3, a 4-inch folding knife was found during a bag search. The traveler exited with the item.Missing who/when/action/outcome restored.
Due to the fact that the traveler was nervous, additional screening was conducted.Unpredictable additional screening was conducted at Lane 3 at 14:22. (If the SOP trigger was an alarm or a published measure, name that trigger instead of mood.)Speculation about nerves deleted.
The traveler admitted everything and wanted to take a weapon on the plane.The traveler stated, "It is for camping." The traveler exited the checkpoint with the folding knife.Quoted words and outcome; no mind-reading.
I think it might have maybe been some kind of prohibited thing.The object was identified as a stun device at the search table.Hedge-stack replaced by identification.
In order to be in compliance with procedures, the team proceeded to notify.Officer Patel notified STSO Chen at 14:25.Who, action, time.

Worked rewrite

Draft a TSO might be tempted to write:

"At this point in time it should be noted that due to the fact that the X-ray had an issue, I proceeded to search the passenger's bag because he was acting nervous and it seemed like he was trying to hide something in a hair dryer, and he was obviously well aware that stun guns are not allowed, so we took care of it."

Problems: no clock time, no lane, no confirmed item until the word stun guns appears as an accusation, empty phrases, motive-reading, and an outcome that says nothing ("we took care of it").

Rewrite:

"At 16:07 in Lane 5, the X-ray operator called for a bag search of a black carry-on. A stun device was found inside a hair-dryer case. The traveler stated, 'It is just a hair dryer.' The traveler exited the checkpoint with the item at 16:14. STSO Chen notified at 16:15."

The rewrite is shorter and more complete. It can be handed to the next person on the shift. It does not claim to know what the traveler was trying to do. It does not invent an unpublished SOP code. It keeps English in the service of screening: a named item, a named location, a named time, a named action, a named outcome.

If the object had not yet been identified, the honest hedge would be: "An object inside a hair-dryer case appeared to be a stun device and was identified as a stun device at the search table." Appeared to be bridges the seconds before identification. It does not replace identification, and it does not accuse.

Legacy CBT English items often ask you to pick the clearest sentence or the sentence that is not wordy. Treat those items as practice for this rewrite, not as a published TAB domain. TSA does not currently publish how many such items you will see. The STSO will still have to read whatever you write after the alarm.

Loading diagram...
Checkpoint incident-note elements
Test Your Knowledge

Which bag-search note is the most concise and complete?

A
B
C
D
Test Your Knowledge

Which sentence avoids speculation in a Lane 5 bag-search note?

A
B
C
D
Test Your Knowledge

Which set of elements belongs in a concise checkpoint incident note?

A
B
C
D