Incident reports: how to write one that holds up

• Immediate: written while memory is fresh, not at the end of the week.
• Specific: “at 02:14 loading door B was open 30 cm” rather than “a door was found open”.
• Complete: it includes what did not go well — a delay, a mistake.
• Unaltered: corrections are dated additions, never deletions of the original text.
• Signed: with the author’s name and the date and time it was written.

• “He was drunk” → “he smelled of alcohol, was unsteady on his feet, his speech was slurred”.
• “She was aggressive” → “she shouted, struck the counter with her fist, said: …”.
• “He tried to steal” → “he put two packs in his bag and walked towards the exit without going through the till”.
• “Suspicious person” → “man aged about 30, black jacket, stood for 20 minutes next to gate 2 looking at the camera”.

If you must record a judgement, label it clearly: “In my assessment…” or “The witness said that…”. Never write it as fact.

1. Details: report number, site, post, author, date and time of writing.
2. When: time of detection, time of each key development, time it ended.
3. Where: the exact spot (floor, door, corridor), not just “in the building”.
4. Who: people involved, witnesses, who was informed — with a description where there is no name.
5. What: what was observed, in time order.
6. How: how the incident was detected (patrol, camera, alarm, a report from someone else).
7. Actions: what the guard did and whom they informed, with times.
8. Evidence: photos, CCTV footage, objects — and where they are kept.
9. Open items: what remains to be done, and by whom.

• Witnesses: ask them to say what they saw in their own words, without leading questions (“What did you see?” rather than “Did you see him take it?”).
• Separately: do not gather witnesses in one place to talk it over before they are recorded.
• Photos: before anyone touches anything, with time and location, from a distance and close up.
• Objects: if they must be moved, record who moved them, when, where they were stored, and every later handover.

Recording the chain of custody — who held each item and when — is good practice so the item can be trusted later. Whether and how it is used as evidence is for the competent authorities to decide, not the report.

The Hellenic Data Protection Authority states that Directive 1/2011 still applies alongside the GDPR and Law 4624/2019. Article 8 of the Directive sets out:

• No incident: deletion within 15 working days at most.
• Incident against the controller: the relevant footage may be kept for up to 30 days.
• Incident concerning a third party: up to 3 months.

1. Note in the report which cameras covered the spot and the time span that matters.
2. Ask whoever runs the system to export only the relevant clip before automatic deletion.
3. Record who exported it, when, and where it is stored.
4. Check whether the system clock matches real time and note any difference.
5. Note the date on which the retention period ends.

Who the controller is and who decides on exporting footage should be written down in advance, in the guarding contract or the post orders — not debated in the middle of an incident.

1. Note the time of the call, the time officers arrived and the details of the officers who attended.
2. If you are given a case or reference number, write it in the report.
3. Log every item or video clip handed over: what, to whom, when.
4. Do not change the report after handover; any new information goes in as a dated supplement.
5. Inform the client and the supervisor of what was handed over.

The guard describes and secures; the guard does not investigate. For shop theft specifically, see the guide to retail loss prevention. OVIT brings patrols, incidents and reports together in the Guardly platform, so every incident carries its times, actions and owner in the same live picture for the operations team and the client.