AGR-LAW52-06 · Lesson 6 · 12 clock hours · practice
Security Documentation, Report Writing, and Chain of Custody
Objective. Students will produce a complete, factually accurate, and legally sound incident report and evidence-custody log from a staged security event, meeting the five documentation standards required by most state licensing boards.
⚠ Pending professional review
This lesson, its worked examples and its practice questions has not yet been verified by a licensed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.
VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.
Why Documentation Is a Core Security Skill
Everything a security officer does in the field can end up in a courtroom. An arrest, a property recovery, a use of force—none of it matters if the written record is incomplete, inaccurate, or legally compromised. Most state licensing boards include documentation standards among the minimum competencies required for a security guard license. POST-recognized training programs treat report writing as a foundational skill because law enforcement and prosecutors rely on those records. A poorly written report can get evidence thrown out, expose your employer to liability, and put your license at risk.
The Five Documentation Standards
Most state licensing boards and POST-aligned programs evaluate incident reports against five core standards:
1. Factual accuracy — Write only what you directly observed, heard, or measured. Do not guess, assume, or include what someone else told you without identifying it as a secondhand account.
2. Completeness — Every report must capture the who, what, when, where, and how of the incident. Missing any element creates gaps that opposing attorneys will exploit.
3. Objectivity — Use neutral, descriptive language. "The subject walked rapidly toward the exit" is objective. "The suspect acted suspiciously" is an opinion and has no evidentiary value.
4. Legible and proper corrections — Errors must be corrected by drawing a single line through the mistake, initialing and dating the correction, and writing the correct information beside it. Never use correction fluid (white-out). Altered records raise questions of tampering.
5. Accurate time stamps — Every action, observation, and transfer must carry the exact time it occurred, recorded in the 24-hour clock or consistent AM/PM notation used by your agency. Vague entries such as "around noon" are not acceptable.
Writing the Incident Report
Begin writing as soon as the situation is safe and stable—memory degrades quickly. Use the blank template provided by your employer or agency. Work through each section in order:
Header block: Date, report number (if assigned), location, your name, badge number, and the names of any witnesses or other officers.
Narrative section: Write in the first person, past tense. Start from the moment you became aware of the incident and move forward in chronological order. Include exact times. Describe persons by observable characteristics (height estimate, clothing color, approximate age) rather than by subjective judgments.
Evidence and property: List every item collected, its condition at the time of collection, and where it was found. Cross-reference the chain-of-custody form.
Signature and date: Sign and date the completed report. Any supervisor review signature goes in the designated field, not over your entries.
Chain of Custody
Chain of custody is the documented, unbroken record of who had control of a piece of evidence, when, and in what condition. If any transfer is unrecorded, opposing counsel can argue the evidence was tampered with or misidentified. The chain is broken the moment a required field is left blank.
Each transfer entry on the form requires:
Name and title of the person releasing the item
Name and title of the person receiving the item
Date and time of transfer
Description of the item and its condition at transfer
Signatures of both parties
Property should remain in its original packaging or container whenever possible. If you must open packaging to verify contents, document that you did so, reseal the package, and note the resealing on the form.
Safety Considerations During Evidence Handling
Before touching any recovered item, visually assess it for hazards. Sharp objects, unknown liquids, and powders all require appropriate personal protective equipment (PPE) before handling. If you suspect a recovered item contains a controlled substance, biological material, or any hazardous content, do not open it. Seal it in place if possible, document its appearance externally, and notify law enforcement immediately. Your documentation must note that the item was not opened and why. This protects both the integrity of the evidence and your personal safety.
Common Errors That Create Legal Risk
Opinion language: Words like "nervous," "suspicious," or "acting weird" are conclusions, not observations. Replace them with the behavior you actually saw.
Missing times: A report that says an event happened "in the evening" cannot be correlated with surveillance footage timestamps.
Incomplete descriptions: "A man" tells a court nothing. "A male subject, approximately 5'10", wearing a red hooded sweatshirt and blue jeans" is useful.
White-out or overwriting: Treated as evidence tampering in many jurisdictions.
Unsigned transfers on custody forms: Creates a gap that nullifies the chain.
Connection to Your Credentials
State security guard licensing exams test whether candidates understand their legal documentation obligations. POST academy prep programs evaluate report-writing proficiency because officers who advance to law enforcement roles must produce reports that survive prosecutorial and defense scrutiny. The habits you build in this program—accuracy, objectivity, completeness—are transferable to every security and public safety role you hold.
Key terms8
Incident ReportA formal written record documenting the facts of a security-related event, including who was involved, what occurred, when and where it happened, and how it unfolded.
Chain of CustodyThe documented, unbroken record of every person who had control of a piece of evidence, the time and date of each transfer, and the condition of the item at each transfer.
Objective LanguageNeutral, descriptive wording based on directly observed facts, free from personal opinion, inference, or emotional characterization.
Time StampThe exact time, recorded consistently (24-hour or AM/PM), at which an observed event, action, or transfer occurred in a report or custody log.
Legible CorrectionThe accepted method of correcting a written error: drawing a single line through the mistake, then initialing and dating it, and writing the correct information alongside. Correction fluid is never acceptable.
Factual AccuracyThe requirement that every statement in a security report reflect only what the officer directly observed, heard, or measured, without embellishment or assumption.
POST (Peace Officer Standards and Training)A state commission that sets the minimum training and competency standards for peace officers; POST-aligned curricula are recognized by law enforcement employers across the state.
PPE (Personal Protective Equipment)Protective gear—such as gloves or eye protection—worn to prevent contact with hazardous substances or sharp objects, including during evidence handling.
In class: Documentation standards lecture and bad-report critique: instructor distributes two sample incident reports—one well-written, one with seven deliberate errors (opinion language, missing time stamps, incomplete descriptions, illegible corrections); students identify and annotate every error, then discuss why each error creates legal or evidentiary risk. · Staged incident documentation drill: instructor conducts a three-minute live scenario in the classroom (simulated shoplifting apprehension with recovered item); students independently write a full incident report from memory using only facts observed, then exchange reports with a partner for peer review against a documentation checklist. · Chain-of-custody form practice: using a prop item (sealed envelope labeled as 'recovered item'), students complete a chain-of-custody form through four transfers (officer to supervisor, supervisor to property room, property room to law enforcement), signing and dating each transfer and noting item condition; errors in any field are flagged for correction. Materials: Sample incident report forms (good and flawed versions), blank incident report templates, documentation standards checklist, chain-of-custody forms, prop 'recovered item' sealed envelope, pen and clipboard Check: Completed incident report scored against a ten-point documentation rubric (factual accuracy, completeness, time stamps, objective language, legible corrections, proper format); minimum score 8 out of 10 required; chain-of-custody form must have zero missing required fields.
Practice check8
Answer each question, then check it. Nothing is recorded; this is your own practice.
Security documentation and report writing
1. A security officer writes in a report: 'The subject seemed nervous and was acting suspiciously near the display case.' Which documentation standard does this sentence violate?
Security documentation and report writing
2. An officer makes a factual error in a handwritten incident report. Which correction method is legally acceptable?
Chain of custody and evidence handling
3. During a chain-of-custody transfer from the property room to a law enforcement officer, the property room clerk forgets to have the officer sign the form. What is the most significant consequence of this omission?
Safety and evidence handling
4. A security officer recovers a sealed envelope during a shoplifting apprehension. The officer suspects the envelope may contain an unknown powder. What is the correct immediate action?
Security documentation and report writing
5. Which of the following entries best meets the completeness standard for describing a person in an incident report?
Security documentation and report writing
6. Why must incident reports be completed as soon as the situation is safe and stable, rather than hours later?
Chain of custody and evidence handling
7. A chain-of-custody form requires four documented transfers. After completing the exercise, a student's form shows the correct signatures on transfers 1, 2, and 4, but transfer 3 is missing the releasing party's signature. According to the lesson's completion standard, what must happen?
Security documentation and report writing
8. A student's incident report receives the following peer-review notes: missing location, one opinion phrase, and no time stamps in the narrative. Applying the ten-point rubric where factual accuracy, completeness, time stamps, objective language, legible corrections, and proper format are each evaluated, approximately how many rubric areas are affected by these three errors?
Record this lesson on my transcript.Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
A free tech program — complimentary, as our commitment to get America working. Help us build VoTechWorks. Tell us what works, what doesn’t, and what you want to learn.