Objective. Students will produce a written incident account for a simulated event that includes observed facts, direct quotations, physical evidence descriptions, and a chronological sequence that meets the standards of a contemporaneous record admissible in a legal proceeding.
This lesson, its worked examples and its practice questions has not yet been verified by a licensed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.
VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.
In law enforcement and security work, your written record of an incident is often the most important piece of evidence in a legal proceeding. A well-written incident account can support an arrest, protect you against a false complaint, and give prosecutors or defense attorneys the facts they need. A poorly written or fabricated report can destroy a case, end a career, and expose you to criminal liability. Documentation is not paperwork—it is a legal instrument.
Courts and legal proceedings recognize four main categories of evidence.
Testimonial evidence is spoken or written statements made under oath by a person who has direct knowledge of events. Your incident report, if you testify to its accuracy in court, supports your testimony.
Physical evidence is any tangible object connected to the incident—a forged ID, a weapon, contraband, a broken lock. You must describe physical evidence precisely: the object's type, size, color, condition, markings, and exact location when found.
Documentary evidence includes written records, forms, photographs, and video footage. Surveillance video, sign-in logs, and your own written report are all documentary evidence.
Digital evidence covers data stored or transmitted electronically—text messages, access-card logs, social-media posts, and recorded audio. Digital evidence must be handled carefully to preserve its integrity.
Hearsay is a statement made outside of court that is offered in court to prove the truth of what it says. Courts generally exclude hearsay because the person who made the statement cannot be cross-examined. As a security officer or officer candidate, you must understand one practical consequence: write what you personally observed, not what someone told you they observed. If a bystander says, "I saw him take the wallet," that is hearsay if you repeat it as fact. Instead, write: "Witness Jane Doe stated to me that she observed the subject take the wallet." You are documenting that the statement was made—not adopting it as your own observation.
For a security or law-enforcement report to be admitted and trusted in a legal proceeding, it must meet four standards.
Contemporaneity means the report is written as close to the event as possible—ideally within the same shift. Memory fades quickly. Courts favor reports written while details are fresh. Never wait days before documenting an incident.
Accuracy means every fact, number, name, time, and description is correct to the best of your direct knowledge. Do not guess. If you are uncertain of a detail, say so: "Subject appeared to be in his mid-twenties" is acceptable; writing a specific false age is not.
Completeness means the report answers the six journalism questions: who, what, when, where, how, and (if known) why. Missing any of these creates gaps that opposing counsel will exploit.
Objectivity means you record what you observed with your senses—sight, sound, smell, feel—not your interpretation or opinion. "Subject's speech was slurred and he smelled of alcohol" is objective. "Subject was drunk" is a conclusion. Let the facts speak.
A strong incident account moves forward in time. Begin with the exact date and time you became aware of the incident. Each action or statement is recorded in the order it occurred. Use precise clock times where possible ("At approximately 14:23 I observed…"). Avoid jumping back and forth in time, which creates confusion and signals a disorganized or reconstructed memory.
When a subject or witness speaks words that are significant, record the exact words in quotation marks. Do not paraphrase if the exact words matter. Example: Subject stated, "This isn't mine, I found it." — not "Subject said the ID wasn't his."
When describing physical evidence, use neutral, precise language. Include: what the object is, its dimensions or size if relevant, color, condition (new, worn, damaged), any writing or markings, and exactly where it was located. Example: "One laminated card, approximately 3.5 inches by 2.25 inches, resembling a state driver license, with the name 'Michael T. Harris' printed on the front; the hologram was absent from the upper-right corner; located on the table in front of Subject's seat."
Fabricating or altering any detail in an official report is a crime in every US jurisdiction and an automatic disqualifier in this program. It is also the single fastest way to lose a security license or a law-enforcement career. If you did not observe it, do not write it as if you did. If you made an error, correct it by drawing a single line through the error, initialing it, and writing the correction—never use correction fluid on an official report.
During staged lab exercises, prop items (such as facsimile documents) are training materials only. Treat them as you would real evidence: do not alter them, do not add markings not already present, and handle them minimally to practice proper evidence preservation habits. These habits carry over directly to real scenes where evidence integrity is legally required.
Answer each question, then check it. Nothing is recorded; this is your own practice.
A free tech program — complimentary, as our commitment to get America working. Help us build VoTechWorks. Tell us what works, what doesn’t, and what you want to learn.