1. Incident identification
- Incident type and severity
- Exact date, time and location
- Reporting officer name or ID
- People involved and witnesses
Free resource
Security incident report template.
A useful incident report should separate direct observations from assumptions and show what remains unknown before approval.
2. Factual chronology
Record events in time order. Use observable actions and exact words where relevant. Do not replace facts with labels such as “aggressive,” “suspicious” or “negligent” without describing the behavior that supports the label.
3. Actions and escalation
- Immediate safety or security action
- Person notified and notification time
- Police, emergency or maintenance reference
- Temporary controls and final status
4. Evidence
- Photograph references
- CCTV availability and review status
- Witness statements
- Relevant documents or access records
5. Manager review
- Missing information resolved
- Assumptions clearly marked
- Cause supported by evidence
- Corrective and preventive actions
- Approval name, date and version