🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Agriculture, Environment & Public Service › Law Enforcement / Security › Criminal Law for Security and Law Enforcement › Lesson 6
AGR-LAW52-02 · Lesson 6 · 12 clock hours · lab

Evidence Basics and Legally Sound Documentation

Objective. Students will produce a written incident account for a simulated event that includes observed facts, direct quotations, physical evidence descriptions, and a chronological sequence that meets the standards of a contemporaneous record admissible in a legal proceeding.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a licensed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Documentation Is a Legal Tool

In law enforcement and security work, your written record of an incident is often the most important piece of evidence in a legal proceeding. A well-written incident account can support an arrest, protect you against a false complaint, and give prosecutors or defense attorneys the facts they need. A poorly written or fabricated report can destroy a case, end a career, and expose you to criminal liability. Documentation is not paperwork—it is a legal instrument.

Types of Evidence

Courts and legal proceedings recognize four main categories of evidence.

Testimonial evidence is spoken or written statements made under oath by a person who has direct knowledge of events. Your incident report, if you testify to its accuracy in court, supports your testimony.

Physical evidence is any tangible object connected to the incident—a forged ID, a weapon, contraband, a broken lock. You must describe physical evidence precisely: the object's type, size, color, condition, markings, and exact location when found.

Documentary evidence includes written records, forms, photographs, and video footage. Surveillance video, sign-in logs, and your own written report are all documentary evidence.

Digital evidence covers data stored or transmitted electronically—text messages, access-card logs, social-media posts, and recorded audio. Digital evidence must be handled carefully to preserve its integrity.

The Hearsay Rule in Plain Terms

Hearsay is a statement made outside of court that is offered in court to prove the truth of what it says. Courts generally exclude hearsay because the person who made the statement cannot be cross-examined. As a security officer or officer candidate, you must understand one practical consequence: write what you personally observed, not what someone told you they observed. If a bystander says, "I saw him take the wallet," that is hearsay if you repeat it as fact. Instead, write: "Witness Jane Doe stated to me that she observed the subject take the wallet." You are documenting that the statement was made—not adopting it as your own observation.

Four Legal Standards for a Usable Report

For a security or law-enforcement report to be admitted and trusted in a legal proceeding, it must meet four standards.

Contemporaneity means the report is written as close to the event as possible—ideally within the same shift. Memory fades quickly. Courts favor reports written while details are fresh. Never wait days before documenting an incident.

Accuracy means every fact, number, name, time, and description is correct to the best of your direct knowledge. Do not guess. If you are uncertain of a detail, say so: "Subject appeared to be in his mid-twenties" is acceptable; writing a specific false age is not.

Completeness means the report answers the six journalism questions: who, what, when, where, how, and (if known) why. Missing any of these creates gaps that opposing counsel will exploit.

Objectivity means you record what you observed with your senses—sight, sound, smell, feel—not your interpretation or opinion. "Subject's speech was slurred and he smelled of alcohol" is objective. "Subject was drunk" is a conclusion. Let the facts speak.

Writing a Chronological Account

A strong incident account moves forward in time. Begin with the exact date and time you became aware of the incident. Each action or statement is recorded in the order it occurred. Use precise clock times where possible ("At approximately 14:23 I observed…"). Avoid jumping back and forth in time, which creates confusion and signals a disorganized or reconstructed memory.

Direct Quotations and Physical Evidence Description

When a subject or witness speaks words that are significant, record the exact words in quotation marks. Do not paraphrase if the exact words matter. Example: Subject stated, "This isn't mine, I found it." — not "Subject said the ID wasn't his."

When describing physical evidence, use neutral, precise language. Include: what the object is, its dimensions or size if relevant, color, condition (new, worn, damaged), any writing or markings, and exactly where it was located. Example: "One laminated card, approximately 3.5 inches by 2.25 inches, resembling a state driver license, with the name 'Michael T. Harris' printed on the front; the hologram was absent from the upper-right corner; located on the table in front of Subject's seat."

Integrity: The Non-Negotiable Rule

Fabricating or altering any detail in an official report is a crime in every US jurisdiction and an automatic disqualifier in this program. It is also the single fastest way to lose a security license or a law-enforcement career. If you did not observe it, do not write it as if you did. If you made an error, correct it by drawing a single line through the error, initialing it, and writing the correction—never use correction fluid on an official report.

Safety Note

During staged lab exercises, prop items (such as facsimile documents) are training materials only. Treat them as you would real evidence: do not alter them, do not add markings not already present, and handle them minimally to practice proper evidence preservation habits. These habits carry over directly to real scenes where evidence integrity is legally required.

Key terms8

Contemporaneous recordA written account created at or very close to the time of the event it describes, valued in legal proceedings because memory is freshest and the risk of later fabrication is lower.
Testimonial evidenceEvidence provided by a person speaking or writing under oath about what they directly observed or know.
Physical evidenceAny tangible, material object connected to an incident, such as a weapon, forged document, or piece of property.
HearsayAn out-of-court statement offered to prove the truth of what it asserts; generally not admissible unless a recognized exception applies.
ObjectivityThe quality of recording only directly observed facts—what was seen, heard, smelled, or felt—without personal opinion or unsupported conclusions.
Chain of custodyThe documented, unbroken record of who collected, handled, transferred, and stored a piece of physical or digital evidence from discovery through legal proceeding.
Documentary evidenceWritten records, photographs, video footage, logs, and similar documents that are submitted as evidence in a legal proceeding.
FabricationDeliberately inventing or altering facts in an official report; a criminal act and an ethics violation that voids the report's legal value.
In class: Instructor lecture on the types of evidence (testimonial, physical, documentary, digital), the hearsay rule in plain terms, and the legal standards that make a security or officer report usable in court—contemporaneity, accuracy, completeness, and objectivity. · Lab exercise: instructor stages a brief mock incident in the classroom (e.g., a confederate student 'finds' a forged ID and attempts to leave the room); students must observe, then immediately write an incident account from memory using a structured report template. · Peer and instructor review: students exchange reports and use a provided legal-documentation checklist to identify missing elements (time, date, exact words spoken, physical evidence description, witness information); instructor provides final feedback and model report for comparison.
Materials: Incident report template, legal-documentation checklist, prop items for staged incident (forged document facsimile, envelope), instructor model report, whiteboard
Check: Completed incident account scored against the legal-documentation checklist (12 required elements); students must include at least 10 of 12 elements (83%) with no fabricated facts to pass; fabrication is an automatic failure.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Criminal Law / Report Writing
1. A security officer writes in her report: 'The suspect was obviously trying to steal merchandise.' Which legal standard for documentation does this violate most directly?
Criminal Law / Evidence
2. During a lab exercise, you hear a bystander say, 'He dropped the bag behind the counter.' How should you record this in your incident report?
Criminal Law / Evidence
3. Which of the following best describes the legal concept of hearsay?
Criminal Law / Report Writing
4. An officer finishes a shift and plans to write the incident report the following morning because he is tired. Which standard does this practice put most at risk?
Criminal Law / Evidence Handling
5. During a staged incident, you collect a prop forged ID. Before handing it to the instructor, you write your initials on it with a marker so you can identify it later. In real practice, this action would most likely:
Criminal Law / Report Writing
6. A student's incident report includes all factual observations but does not record the time or date of the incident. Which checklist element is missing?
Criminal Law / Report Writing
7. A student realizes she made an error in a written report. She should correct it by:
Criminal Law / Evidence
8. Which category of evidence would a security officer's shift-access log, showing which key cards entered a restricted area, fall under?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.