Incident reports that still make sense six months later
An incident report has an unusual property: it is written quickly, by someone tired, and read carefully, by someone with time and a reason to scrutinise it. That asymmetry is the whole design problem.
What makes a report fail later
- Time recorded vaguely — "during the night" rather than a time
- Conclusions written instead of observations — "he was aggressive" rather than what was said and done
- Missing sequence — outcomes recorded without the steps that led to them
- No record of who else was present, so accounts cannot be corroborated
- Photographs taken on a personal phone and never attached to anything
None of these are failures of honesty. They are failures of structure — an officer given a blank box will write a summary, because a blank box invites one.
Structure does the remembering
A form that asks specific questions gets specific answers. Asking for a time, a location, who was present and what was observed produces a materially different record from a free-text field headed "details".
- Capture on shift, while the detail is still available
- Separate observation from interpretation, and ask for both
- Attach photographs to the record at the point of capture, not later
- Track the report through to close-out, so outcomes are on the same record
The client's copy
Clients usually want a version of the same event. Writing it twice invites the two versions to disagree, which is worse than either version alone. Generate the client's copy from the same record. See what to send a client, and how often.
Key takeaways
- Reports are written fast and read slowly — structure has to carry the difference
- Ask for observations and interpretation separately
- Attach evidence at the point of capture
- Never write the client's version separately from the operational record
The SecureOptix team
Written by people who work daily with security contractors on SIA licensing, screening and the records that hold up under an inspection.