An incident record is not made useful by dramatic language. A manager should be able to understand what happened, who provided each piece of information and what remains unexplained. That distinction matters when a shift supervisor, an Ankara facility manager and a security provider rely on the same document. “There was suspicious behaviour” does not provide a sufficient basis for the next decision without further explanation.
Make the source of information visible
A record may contain three kinds of statement: what the officer directly saw or heard, information another person reported and an interpretation drawn from those accounts. They should not be presented as equally established facts.
Loftus's review of memory research examines how misleading information encountered after an event can affect recollection of that event. [1] This does not mean every witness remembers inaccurately. Our practical inference is to distinguish initial observations from later information, not to promise that a particular report format guarantees legal evidential value.
Make three statements more precise
The following examples are fictional, not accounts of client incidents.
Instead of “the visitor behaved aggressively”, describe the observed behaviour and relevant words in context. For example: “The visitor raised their voice and said to the officer, 'call the manager'.” Do not add a physical action that was not observed. If an assessment such as “aggressive” is necessary, keep it separate from the observation and explain its basis.
Instead of “that person broke the equipment”, record what is actually known: “The officer saw damage to the front panel. The officer did not see the damage occur. A member of the technical team reported hearing an impact earlier.” This account does not identify who caused the damage. It communicates the known information without converting it into unsupported certainty.
Instead of “the contact was notified immediately”, use a verifiable time and communication channel. State when a time is approximate. Sending, delivery and acknowledgement can occur at different times; knowing one does not establish the others.
Distinguish the event time from the writing time
If the report is prepared later, record the event time separately from the time of preparation. A telephone display, a camera-system timestamp and someone's recollection are different sources. Preserve uncertainty rather than retrospectively supplying an exact minute.
Later information should not be added by silently rewriting the original account. Under the organisation's approved record procedure, the addition's date, source and purpose should remain traceable. Where reported speech has been summarised, do not present that summary as an exact quotation. A correction is not automatically evidence of poor reporting; how it is recorded matters.
Initial recording and subsequent assessment have different jobs
HSE's incident-investigation guidance distinguishes gathering information from analysing it. [2] Our application is to avoid making the first record carry every conclusion about cause or responsibility. The guidance concerns occupational health and safety; it does not give private security investigative powers.
An authorised review may compare several sources. The initial writer's task is to communicate observations, actions and appropriately received reports clearly. Unnecessary personal details, rumours and unrelated historical judgments can enlarge a document while making its meaning harder to assess.
Read once before sending
Can the record answer these questions: Who observed this directly? Which information came later from someone else? What is the source of the time? Which notification or action took place? What is still unknown?
This final reading is intended to reduce the assumptions a reader must make, not to make the account more impressive. A clear record supports both the client's follow-up decisions and the provider's review of its own work.
