From incident to decision: what the client does with the evidence

The foundation is well-written incidents: facts rather than opinions, with time, place and evidence. How to write one is covered in the guide to the incident report. This guide starts where the reports already exist.

OVIT frames it as a habit: every handover, every incident and every review should leave the next shift better informed. That only happens when the record leads to a change someone has taken on.

• Where: which entrance, which stretch of the perimeter, which floor.
• When: time of day, day of the week, shift change, delivery hours.
• What: attempted entry, open door, theft, damage, behaviour.
• Observations, not just incidents: what the guard found on patrol that did not become an incident, such as a light that is out or a door that will not close.

Example (hypothetical): within one month the loading-ramp door was found open three times, every time between 23:00 and 01:00. That is a pattern; three unrelated incidents at three different spots are not.

• Route: a new checkpoint where the pattern appears, or a shift in the patrol’s time window. The practicalities are in the guide to checkpoint patrols.
• Adding a post: when the problem needs someone there continuously, for example checking every entry, and a patrol always arrives too late.
• Removing or moving a post: when a spot stays quiet for months while the risk has shown up somewhere else. Guarding goes where the risk is.

The choice between a fixed post and patrols is explained in static guarding vs mobile patrols, and the arithmetic of positions and hours in how many security guards do I need.

• Lighting: incidents clustering in dark parts of the perimeter or the car park.
• Doors and locks: a door logged open again and again needs a repair or a door closer, not one more patrol pass.
• Cards and codes: cards belonging to former staff or contractors that were never cancelled, shared codes that never change.
• Flows and hours: a side entrance left open for no reason, visitors who are never logged.
• Cameras: before adding one, read what is allowed in the guide to CCTV and GDPR.

These decisions usually belong to the client, not the security company. If the guard has logged it and the repair has not happened, the open item sits on your side of the record.

• Signs: escalation done one way one night and another way the next, reports without evidence, the same mistake from people new to the site.
• If it is one person: coaching from the supervisor and a check on the next visit.
• If it is several: correct the post orders and brief every shift, not just the one that made the mistake.

In OVIT’s Guardly platform, training, performance reviews and site inspections sit in the same system as incidents, so a training decision can be tied to the pattern that prompted it.

1. Check previous decisions: was the change made? Did the pattern move or disappear?
2. This month’s new patterns: place, time, type, how often, with references to the incidents.
3. Cause: what the evidence points to — the site, the guarding, or the handling?
4. Options: route, post, lighting, access or training.
5. Decision: what, who (client or provider), by when.
6. Measure: what the record should show next month if the decision worked.

Keep a decision log with these columns. A decision review is not the same as a monthly KPI review: KPIs show whether the provider is doing what was agreed; the decision review shows whether the site needs something different. Both can happen in the same meeting. OVIT calls it reviewing what changed: the field and the client together, over patterns, exceptions and the next decision.