Resources
Security incident report template (Word & Excel): one form for the whole incident
A free incident report form for security officers, in printable, Word and Excel copies. It walks the writer from the first time stamp to the last signature, so the report answers the questions a manager, insurer or police officer will ask later.
Printable template
Who fills in an incident report, and when
An incident report is the officer’s written account of one event that broke from the normal shift: a car window smashed on the second level of a garage, a visitor who slipped on a wet lobby floor, a man who would not leave the loading dock, a side door found forced on an overnight round. The officer who saw the event, or who responded first, writes it. The right time is as soon as the scene is safe and before the shift ends, while times, names and details are still fresh.
Routine observations belong in the daily log. The incident report is for anything a property manager, an insurer, a tenant or the police may ask about next week. HALO patrol and incident reports include photos, so the written account and the pictures reach the property contact together. The printable and Word copies follow the order of this page, and the Excel copy suits teams that keep reports in a shared folder. The rate guides and checklists that go with it are on the security director resources page.
What each part of the form records, and why
Every block on the form answers a question someone will raise later. A blank block leaves the reader guessing.
- Header: site, post, officer, date, the time the incident happened and the time it was reported. The two times often differ, and the gap matters when a tenant says they called much earlier.
- Incident type: tick boxes for theft, trespass, damage, injury, medical call, alarm, disturbance, fire or hazard, so a stack of reports can be sorted by kind.
- People involved: name, role (tenant, employee, visitor, contractor or unknown), whether contact details were taken, and a description when nobody gave a name.
- Witnesses: who else saw it, how to reach them, and what each one says they saw.
- Narrative: the event in time order, in plain sentences.
- Actions taken: what the officer did, from first response until the area was clear.
- Notifications: police, fire or EMS, the client contact and the supervisor, each with the time of the call and any report number given.
- Evidence: photos taken, camera footage to request, and any items collected or left in place.
- Follow-up and signatures: what is still open, such as a repair or a callback, then the officer’s and supervisor’s signatures.
Writing the narrative: facts, times and plain words
The narrative is where most reports go wrong. A strong one reads like a timeline another person could follow without phoning the writer.
- Write it during the same shift, working from notes made at the scene
- Record what you saw and heard, not what you believe happened: “the side door stood open and the strike plate was bent,” rather than “someone broke in”
- Put a time on each step, and mark a time as approximate when it is
- Quote people’s own words when they explain events, and say who said them
- Leave out opinions, guesses about motive and labels for people
- Describe an unnamed person by clothing, build and direction of travel
- Correct an error with a single line through it and your initials, so the original stays readable
How property managers use incident reports
For a property or facility manager, incident reports are a record that builds over months, not paperwork for one bad night. Sorted by type and location, they show where trouble repeats: the same garage level, the same receiving door, the same hour after the building empties. That pattern is what moves a patrol checkpoint, adds a light to the repair list or shifts a post’s hours. Our guide to planning security coverage hours shows how that record shapes a schedule.
Reports also hand the manager what others will request: a dated account, the names involved and the photos. Read recent ones with the officer during a supervisor’s quality inspection, and gaps in the writing show up early.
Adapting the form to your property
Start with the incidents your site actually sees. A garage may add a vehicle line for plate, make and color. A store may add a line for items taken and their value. A residential building may add a unit number. Keep the blocks in the same order, because officers who cover more than one post learn the layout once.
Print the call list from your post orders on the back of the form so the notification block is filled in from the right names. Setting up coverage and want reports like these from the first shift? HALO on-site officers and mobile patrol file photo reports to the contacts you list, and the quote form is the place to start.
Resources
Related guides
A few useful answers
Common questions
Who should write a security incident report?
The officer who saw the event or responded first writes it, during the same shift. When two officers responded, each writes an account or the second adds a signed statement to the first officer’s report.
How is an incident report different from a daily activity report?
A daily activity report logs the whole shift in time order: rounds, visitors and routine checks. An incident report covers one event in depth, with the people, witnesses, notifications and evidence, and the daily log notes that it was written.
Should photos go with an incident report?
Yes, wherever it is safe to take them. Pictures of the scene, the damage or the hazard back up the written account, and HALO incident reports include photos. Note on the form how many were taken and where they are kept.
Can I change this incident report form for my site?
Yes. The Word and Excel copies are editable, so you can add lines for vehicles, unit numbers or stolen goods and drop incident types your property never sees. Keep the blocks in the same order so every officer finds them quickly.