Observation, Reporting, and Incident Documentation
What the domain covers
This domain tests whether you can separate fact from inference, record events accurately and write reports that survive scrutiny. Exam questions often present a short scenario and ask what belongs in the notebook or incident report.
Core rules and concepts
- Observation records what the senses detect: time, place, people, actions, words, objects and conditions. Inference is an interpretation, such as "nervous" or "suspicious". Report both, but label inference clearly.
- Use the 5W1H frame: what happened, who was involved, when, where, why it happened if known, and how it was handled.
- Write in chronological order, in blue or black ink, without gaps, erasures or back-dating. Correct errors with a single line, initials and time.
- An incident report should state facts, action taken, people informed, evidence preserved and follow-up needed. Do not write conclusions about guilt.
- Preserve evidence and maintain chain of custody: who found it, who held it, when and where it moved.
Worked example
At 22:10 a guard sees a man carrying a desktop CPU out of an office after hours. A weak entry says "suspicious man stealing computer". A strong entry says: "22:10, north stair exit, male, about 30 years, blue shirt, carrying one black CPU, no visible asset pass; asked for pass, he said none; informed supervisor; man left towards gate; police called at 22:16." Reasoning: the second version is testable and does not declare guilt.
Traps that cost marks
Avoid vague words such as "suspicious" without description. Do not overwrite, tear out or rewrite a log page. Do not touch or move evidence unless safety requires it, and never leave chain-of-custody blank.