Incident Reporting, Documentation, and Evidence Handling
This domain tests whether your report can survive cross-examination. A report is not a story; it is a sequence of observable facts, times, and names.
Principles of a good entry
Contemporaneous, factual, chronological, complete, and legible. Write in ink, never erase, and initial any correction with date and time. Record only what you saw, heard, or did - not what you concluded. Compare 'the man was shouting and smelled of liquor' with 'the man was drunk'. The first is evidence; the second is opinion you will be asked to defend.
The 5W1H structure
Who (names, descriptions, identification numbers), what (the act, the item), when (24-hour clock), where (specific location, not 'the area'), why (context you observed), how (sequence of actions). Include what you did, whom you called, and the time of each step.
Report types
- Duty log / post diary - continuous entries during the shift.
- Spot report - immediate initial notification.
- Incident report - full narrative after the event.
- Progress and after-operation reports - follow-up and closure.
Evidence discipline
Preserve, label, seal, and log. Every transfer records from whom, to whom, date and time, and reason. Photograph the item in place before moving it, then with a scale after. For digital evidence such as CCTV, export a copy, record the hash or at least size and time range, keep the source untouched, and hand over a copy with a receipt.
Worked example
A guard finds a broken padlock and a cut chain at the rear gate. The log records the time of discovery, exact location, that the gate was still locked and nothing was missing, photographs of the cut link, the officer notified, and the time the police arrived. The report is useful because it fixes the timeline and preserves the physical evidence.
Traps that cost marks
Late entries backdated to look timely; vague locations; conclusions and labels; writing on a log page from a different shift; releasing an original to anyone without a receipt.