The incident report template
Copy this form into Word or Google Docs and save it as your firm’s standard. It fits on two pages, and every section is there for a reason: the questions a police officer, an insurer or a client’s lawyer will ask months later.
Keep the section numbers even when a section is empty. A report that says “none” under injuries is more useful than one that leaves the reader wondering.
SECURITY INCIDENT REPORT Report no. ________ Company: ____________________ Client / site: ____________________ 1. WHO IS REPORTING Name: ______________________ Licence no. / province: ____________ Post: ______________________ Shift: __:__ – __:__ Phone: ________ 2. WHEN AND WHERE Date of incident: __________ Time it started: __:__ Time it ended: __:__ Exact location (building, floor, door, checkpoint): ______________________ Report written on: __________ at __:__ 3. TYPE (tick all that apply) [ ] Trespass [ ] Theft / attempted theft [ ] Property damage [ ] Injury / medical [ ] Fire / alarm [ ] Hazard (water, gas, electrical) [ ] Disturbance [ ] Arrest or detention [ ] Use of force [ ] Vehicle [ ] Complaint about staff [ ] Other: ____________ 4. WHAT HAPPENED (facts in time order, first person, 24-hour clock) __:__ ______________________________________________________________ __:__ ______________________________________________________________ __:__ ______________________________________________________________ 5. PEOPLE INVOLVED Name / description Role (subject, victim, witness) Source of ID __________________________ ______________________________ ___________ __________________________ ______________________________ ___________ (Contact details and any health information go in the RESTRICTED section at the end, not here, so this report can be shared without them.) 6. ACTIONS TAKEN ______________________________________________________________________ 7. NOTIFICATIONS Police called at __:__ Arrived __:__ Officer / badge: ________ File no. ________ Fire / EMS called at __:__ Arrived __:__ Supervisor notified at __:__ (name) ________ Client notified at __:__ (name) ________ 8. INJURIES AND DAMAGE Injuries (who, what, treatment): _____________________________________ Damage (what, estimated extent): _____________________________________ 9. EVIDENCE Photos: __ (taken by ________ at __:__) Video: __ CCTV requested from client: [ ] yes, camera(s) ________ Items kept or handed to police: _______________________________________ 10. SUPPLEMENTS ATTACHED [ ] Use-of-force supplement [ ] Witness statement(s): __ [ ] Other: ________ Signature: ______________________ Date: __________ Reviewed by (supervisor): __________ Date: __________ Status: [ ] submitted [ ] returned for clarification [ ] reviewed [ ] closed 11. AMENDMENTS (never change the original; add a line here) Date/time By What changed and why __________ __________ ______________________________________________ RESTRICTED · supervisor and client security contact only Contact details of people involved and witnesses: _____________________ Health information reported or observed: ______________________________
Download the Word version
The same forms as fillable Word pages: the incident report, the use-of-force and detention supplement, and a witness statement, ready to print or adapt with your logo.
- WordIncident report pack3 forms, 6 pages · 17 KB
Incident report or daily activity report?
The daily activity report records the shift: coverage, patrols, routine log entries. An incident report records one event that someone may ask about later. The test is simple: if a client, an insurer or the police might want the details in a month, it gets its own incident report, and the daily report mentions it with the report number.
- Always write one for: injuries and medical calls, property damage, theft or attempted theft, trespass, any arrest or detention, any use of force, fire, alarms with findings, and any time police, fire or paramedics attend.
- Usually write one for: hazards that need follow-up (leaks, broken locks, failed lights on a fire route), complaints about a guard, and threats made to staff.
- Log it in the daily report instead: routine events that need no follow-up, such as a door found unlocked and locked, or a contractor arriving late.
See also: How to write a daily activity report clients actually read
The ten fields a defensible report needs
Most weak reports fail on the same few points. Check every report against this list before it leaves the site.
- 1A unique report number, so the daily report, the client email and the police file can all point to the same document.
- 2Who wrote it, with their licence number, and the post and shift they were working.
- 3Three times: when it started, when it ended, and when the report was written. A report written two days later carries less weight.
- 4The exact location, down to the door, floor or checkpoint. “The parking lot” is not a location.
- 5A timeline of facts, in the order they happened, in the first person: what you saw, heard and did.
- 6Everyone involved, with their role and how to reach them. Describe people you can’t name: clothing, height, direction they left in.
- 7Actions taken, including first aid, areas cordoned, doors secured, items seized.
- 8Notifications with times, and the police file number and officer’s name and badge number when police attend.
- 9An evidence list: how many photos, who took them, when, and whether CCTV was requested from the client.
- 10Signature and supervisor review, with any later correction added as a dated addendum, never by changing the original.
Arrests, detentions and use of force in Canada
Security guards in Canada have the same arrest powers as any citizen, set out in section 494 of the Criminal Code. Anyone may arrest a person they find committing an indictable offence. The owner or person in lawful possession of property, or someone they authorize, such as a contracted guard, may arrest a person found committing a criminal offence on or in relation to that property, at the time or within a reasonable time afterwards if they believe on reasonable grounds that a police officer can’t make the arrest. In every case the person must be delivered to a peace officer forthwith.
Force used in a lawful arrest must be no more than necessary. That is exactly what a court will examine, so the report has to show the grounds, the words used, the force, why it was needed and when police took over. Put those details in a separate use-of-force supplement so they are complete and easy to find.
Provinces add their own rules on top: conduct codes for licensees, restrictions on equipment such as batons and handcuffs, and record-keeping duties. In Ontario, Regulation 434/07 requires a licensed security business to keep a use-of-force report, on the form approved by the Registrar, every time a guard uses force, handcuffs, a baton, a firearm or another weapon, or a dog attacks someone, and to keep it for two years. Check what your province requires. In the United States, citizen’s-arrest and merchant’s-privilege rules vary by state.
USE-OF-FORCE AND DETENTION SUPPLEMENT Attached to report no. ________ GROUNDS What did you personally see the person do? ______________________________ Offence you believed was being committed: _______________________________ Were you the owner, or authorized by the owner / person in lawful possession? [ ] yes [ ] no THE DETENTION OR ARREST Time you told the person they were under arrest / detained: __:__ Words used: "_________________________________________________________" Was it at the time of the offence, or later? If later, why couldn't police make the arrest? ________ FORCE Force used (none / escort hold / restraint / handcuffs / other): __________ Why that level of force was necessary: ________________________________ How long force was applied: ________ Who else took part: ______________ AFTER Injuries to the person / to staff: _____________________________________ First aid given by / at: ______________________________________________ Police called at __:__ Person handed to Officer ________ (badge ____) at __:__ Signature: ______________________ Supervisor review: ______________________
Report 2026-0412 · Riverside Plaza, rear loading dock · Oct 3, 2026
Type: Trespass, arrest or detention, use of force (escort hold)
01:52 On tour 3, saw a man at the rear loading dock prying at the lock of
door D2 with a metal bar. I was 15 m away, on the ramp.
01:53 Said "Security. Stop and step away from the door." He dropped the bar
and walked towards the fence.
01:53 Said "You are under arrest for attempted break and enter. Police are
on their way." Held his left arm (escort hold) when he tried to climb
the fence. He stopped resisting after about 10 seconds.
01:54 Called 911. Notified supervisor J. Lee by radio.
02:07 Police arrived. Handed the man to Cst. R. Patel (badge 4471).
File no. 26-118204.
02:15 Photographed the door (scratches around the lock, 4 photos) and the
bar where it fell (2 photos). Bar given to Cst. Patel.
02:30 Client contact M. Bouchard emailed. CCTV camera 7 requested.
Injuries: none. Damage: scratches to door D2 lock plate.
Supplements: use-of-force supplement attached.
Photos and video that keep their value
A photo is only as good as what you can prove about it: when it was taken, by whom, and that it hasn’t been changed.
- Photograph before you touch anything, unless someone’s safety comes first.
- Wide, medium, close. One photo that shows where you are, one that shows the area, one that shows the detail.
- Never edit the original. No crops, filters or annotations on the file you keep. Make a marked-up copy if you need one.
- Note every photo in the report: how many, who took them and when.
- Ask the client to preserve CCTV the same night. Many systems overwrite footage within days. Note the camera number and time range.
- Keep incident media off personal chats and social media. Photos of people are personal information under PIPEDA and the provincial privacy laws, including Québec’s Law 25. Store them where access is controlled and logged.
Writing rules for guards
- Facts, not conclusions. “He put two bottles in his jacket and walked past the tills” is evidence. “He was shoplifting” is an opinion.
- Quote what people said, in quotation marks, especially threats and anything said during an arrest, but only when you remember the exact words. Otherwise write “he said, in substance, that…”.
- Say where each fact came from. “I saw him break the window” and “the receptionist told me he broke the window” are different evidence. So is “I found the window broken”.
- Don’t diagnose or assign fault. Write “she said her wrist hurt”, not “she sprained her wrist”; “the mat was wet”, not “the cleaners caused the fall”.
- Write it before the end of the shift. Memory fades within hours, and a report written days later is easy to challenge.
- Use the 24-hour clock and no abbreviations that only your site understands.
- Don’t guess. If you didn’t see it, write that you didn’t see it, and who told you.
- Correct with an addendum, dated and signed, never by rewriting the report.
Three completed examples
The same structure, filled in for three common incidents. Names and numbers are invented. Notice what each one leaves out: no guesses about who did it, no diagnosis, no conclusion the guard can’t support.
Report 2026-0412 · Harbourview Offices, north lobby · Oct 6, 2026
Type: Access control
21:12 At the north reception desk, saw a man I did not recognize follow an
employee through the staff-only door to the east corridor before it
closed. The door has an "Authorized personnel only" sign.
21:13 Followed and asked if he had an appointment or an access card.
He said "I'm waiting for someone" and did not give a name when asked.
21:14 Explained that visitors wait in the public reception area and asked
him to come back with me. He walked back to reception with me.
21:16 He said "I'll wait outside" and left through the north doors.
No physical contact.
21:19 Notified supervisor J. Lee. Requested that the client preserve
north lobby camera 3, 21:05-21:20.
Not established: who he was or why he entered the corridor.
Follow-up: client asked to remind staff not to let people tail through
the staff door (handover item H-118).
Report 2026-0415 · Meridian Office Campus, Building B, level B1 · Oct 6, 2026
Type: Hazard (water), property damage
22:40 On tour 2, found about 2 cm of water on the B1 corridor floor east of
the electrical room, spreading from under the janitor room door.
22:41 Did not enter the water. Placed wet-floor signs at both ends of the
corridor. Called supervisor J. Lee.
22:44 Called building engineer on call (D. Roy) per post orders, section 4.
22:58 Engineer arrived, shut the water supply to the janitor sink.
23:05 Photos of the corridor and the electrical room door taken (6).
Damage: water under the electrical room door, depth unknown. Engineer to
inspect in the morning. Area cordoned until 23:40, when the floor was dry.
Client notified by email at 23:15.
Report 2026-0419 · Central Library, main lobby · Oct 9, 2026
Type: Injury / medical
16:12 A visitor (woman, about 70) slipped on the wet entrance mat and fell
on her right side. I was at the front desk, 8 m away.
16:12 Went to her. She was conscious and talking, said her right wrist hurt.
Did not move her. Asked another staff member to keep people back.
16:13 Called 911 at her request. Gave first aid: kept her still and warm.
16:24 Paramedics arrived. She left by ambulance at 16:38.
16:40 Photographed the mat and the floor (5 photos). Mat was wet; the
"wet floor" sign was not out. Placed the sign.
16:45 Witness statement taken from library employee S. Nair (attached).
Notified: supervisor 16:15, library manager 16:20.
No details of her condition or name were shared with anyone except the
library manager and paramedics.
Taking a witness statement
Take statements as soon as possible, one witness at a time, in their own words. Don’t suggest answers and don’t let witnesses compare stories first. If someone won’t give a written statement, note their name and contact details and what they told you.
WITNESS STATEMENT Attached to report no. ________ Name: ______________________ Phone / email: ______________________ Relationship to site (employee, tenant, visitor, passer-by): ____________ Where were you, and what could you see from there? __________________________ In your own words, what did you see and hear? (times if you know them) ______________________________________________________________________ ______________________________________________________________________ I confirm this statement is true to the best of my knowledge. Signature: ______________________ Date: __________ Time: __:__ Taken by (guard): __________________ Licence no.: ____________
How long to keep incident reports
There is no single Canadian rule. Set a written retention period with your lawyer and your insurer, and make sure it covers the time someone could still sue. The basic limitation period is two years in most common-law provinces, including Ontario, British Columbia and Alberta, and three years in Québec, and it can run much longer, for example when the injured person is a minor.
Your client contracts may also set a period, and so may your regulator: Ontario, for example, requires licensed businesses to keep use-of-force reports for at least two years. Whatever you choose, keep reports involving injury, arrest or use of force longer than routine ones, and keep the photos with the report.
How GuardDesk handles incident reports
In GuardDesk, guards fill in the incident form on their phone, with the same structure as above. It works without a signal: the report is kept on the phone and sent as soon as the connection returns. Photos are fingerprinted when they are captured and keep a chain of custody, so a supervisor can share a redacted copy with the client while the original stays sealed.
Supervisors review each report before the client sees it, and the published summary appears in the client’s daily report the next morning.
See also: The GuardDesk guard app · Security and data
Questions owners ask
What should be included in a security guard incident report?
A report number; who wrote it and their licence number; when the incident started and ended and when the report was written; the exact location; a timeline of facts in the first person; everyone involved; actions taken; notifications with times and any police file number; an evidence list; and a signature with supervisor review.
What is the difference between an incident report and a daily activity report?
The daily activity report summarizes the whole shift: coverage, patrols and routine entries. An incident report documents one event that someone may need to examine later, such as an injury, damage, a crime or any use of force. The daily report should list each incident report by number.
Do security guards need a separate report for use of force in Canada?
In Ontario, yes: Regulation 434/07 requires the licensed security business to keep a use-of-force report, on the Registrar’s approved form, every time force, handcuffs, a baton, a firearm or another weapon is used, and to keep it for two years. Other provinces set their own rules. Even where none applies, a separate supplement attached to the incident report is the clearest way to show why the force was necessary.
How long must a security company keep incident reports?
No single Canadian rule applies. Base your retention period on the limitation period for claims (generally two years in most provinces and three in Québec, longer in some cases), your client contracts, your insurer and your regulator, and keep serious incidents longer.
Can guards use their own phone camera for incident photos?
It is your policy decision. Photos taken inside a reporting app carry their time and source automatically; photos from a personal camera roll need the time and author noted, and leave copies on a personal device. Either way, keep the original file unedited and off personal chats.
Sources
General information for security firm owners and managers, not legal advice. Rules change: confirm with the regulator or your lawyer before relying on them. Checked October 14, 2026.
- Criminal Code, section 494 (arrest without warrant by any person)
- Criminal Code, section 25 (protection of persons acting under authority)
- Ontario Regulation 434/07: record-keeping for licensed business entities
- Office of the Privacy Commissioner of Canada: PIPEDA
- Commission d’accès à l’information du Québec: obligations of businesses (Law 25)
- Ontario Limitations Act, 2002
- Civil Code of Québec, article 2925