Simulated Incident Response and After-Action Reporting

Objective. Students will respond to three instructor-facilitated scenario role-plays — a medical emergency, a criminal trespass, and a use-of-force decision — and produce a complete, factually accurate written incident report for each scenario that meets the documentation standards taught in Report Writing.

This lesson is the capstone practice event for your Integrated Security Operations Plan. You will move through three live scenarios — a medical emergency, a criminal trespass, and a use-of-force decision — and produce a professional incident report for each one. Everything you have studied in Report Writing, Defensive Tactics, Legal Authority, and Patrol Procedures comes together here.

Why Accurate Documentation Matters

A security incident report is a legal document. It may be read by your supervisor, by law enforcement, by attorneys, and by a court. Errors, omissions, or exaggerations can expose you and your employer to liability and can undermine a criminal prosecution. The standard is simple: write exactly what you observed, heard, and did, in the order it happened, using plain language. Never include opinion, speculation, or conclusions that go beyond the facts you personally witnessed.

Scene Safety First — Every Scenario

Before you take any action in any scenario, pause and assess scene safety. Ask: Is the area safe for me to enter? Are there additional threats? Do I need PPE? In a real medical emergency, approach only after confirming there is no ongoing hazard (traffic, chemical spill, downed power line, aggressive bystanders). In a trespass or use-of-force situation, be aware of your surroundings and position yourself where you can observe without being cornered. Scene safety is not a formality — it is the first step of every professional response and the first thing your report should document.

Scenario 1: Medical Emergency

When a person collapses and is unresponsive, your response sequence is: confirm scene safety, tap and shout to check responsiveness, call or direct someone to call EMS using your radio's standard format (unit identifier, location, nature of emergency, number of patients), begin CPR if the person is unresponsive and not breathing normally, and deploy the AED as soon as it is available. In this scenario your classmate acts as dispatcher; log every radio transmission with the exact time, what was said, and by whom. Your incident report must reflect this chronology precisely — the time you found the subject, the time you called EMS, the time CPR began, the time the AED was applied, and the time EMS arrived. The who-what-when-where-why-how framework keeps your narrative organized.

Scenario 2: Criminal Trespass and Your Legal Authority

As a private security officer you are not a sworn peace officer. You do not carry police powers of arrest in most states. You have the authority of a private person on the property you are assigned to protect. That means you may ask an unauthorized person to leave, and if they refuse, you may contact law enforcement. You may make a citizen's observation — sometimes called a citizen's detention or merchant's privilege depending on your state — only under very specific and limited circumstances defined by state law. Do not overstate your authority in your report or in your actions.

In this scenario, apply verbal de-escalation first: calm voice, non-threatening posture, clear simple instructions, give the person a way to comply without embarrassment. Document the exact words you used and the exact words the subject used. Record a complete physical description: sex, approximate age, height, weight, hair color, eye color, clothing from head to foot, and any distinguishing features. Note the disposition — did the subject leave voluntarily, was law enforcement contacted, did law enforcement respond?

Your report must explicitly note the limits of your detention authority. Writing "I detained the subject" when you are not legally authorized to do so is both inaccurate and potentially exposes you to a civil claim of false imprisonment.

Scenario 3: Use-of-Force Decision and Reporting

The use-of-force continuum is a framework that matches the level of force used to the level of threat presented. Common levels, from lowest to highest, include officer presence, verbal commands, soft empty-hand control, hard empty-hand control, intermediate weapons, and deadly force. Your job is to identify where the threat falls on the continuum and respond at the appropriate level — no higher than necessary to control the threat, and no lower than effective.

In this scenario you will demonstrate at least two empty-hand control techniques in controlled format without live contact on the role-player. You must verbally justify your force choice to the instructor in real time: state what behavior you observed, what threat level that behavior represented, and what continuum level you applied in response.

Your use-of-force report must include: a description of the subject's threatening behavior, the continuum level you identified, the specific technique or response you applied, your justification, and the outcome. This report also requires instructor sign-off confirming you correctly identified the continuum level. Use-of-force reports receive extra scrutiny because they document potential legal exposure. Be precise and factual.

After-Action Debrief

After all three scenarios, the class reviews every decision together. What legal standards governed each action? Where did the group apply force correctly or over-apply authority? What would a court or your supervisor look for in these reports? The debrief is not about assigning blame — it is a structured learning tool used by law enforcement agencies and security firms worldwide to improve future performance.

Report Writing Reminders

Use first person and active voice: "I observed," not "it was observed."
Use exact times, not approximations when avoidable.
Quote witnesses and subjects directly when their words are relevant.
Never write "I think" or "I believe" — write what you saw, heard, or did.
Spell all names correctly and verify them against identification when possible.
Sign and date every report before submission.

Key terms10

Use-of-force continuumA framework that organizes levels of subject resistance alongside corresponding levels of officer response, guiding security and law enforcement personnel to use only the force reasonably necessary to control a threat.

Citizen's observation (citizen's detention)The limited authority of a private person, including a private security officer, to briefly detain someone under specific legally defined circumstances — scope and conditions vary by state and must not be overstated.

Scene safety assessmentThe mandatory first step in any emergency response: evaluating the environment for hazards before approaching a subject or patient, to protect yourself and others.

Chronological narrativeAn incident report structure that records events in the exact order they occurred, with times noted, so that any reader can reconstruct what happened without inference.

Who-what-when-where-why-how (5W+H)A standard framework for organizing incident report narrative, ensuring all essential facts are captured and nothing critical is omitted.

AED (Automated External Defibrillator)A portable device that analyzes heart rhythm and, if appropriate, delivers an electrical shock to restore normal rhythm; used alongside CPR in cardiac emergencies.

Verbal de-escalationCommunication techniques — calm tone, clear language, active listening, offering compliance options — used to reduce the emotional intensity of a confrontation before physical intervention becomes necessary.

After-action review (AAR)A structured group debrief following a training scenario or real incident, examining what happened, why, and what should be done differently, used to improve future performance.

Radio logA written or electronic record of all radio transmissions, including time, sender, and content, which becomes part of the official incident documentation.

Use-of-force reportA specialized incident report documenting any application of physical force by a security officer, including the threat observed, continuum level applied, technique used, justification, and outcome; subject to heightened legal scrutiny.

In class: Scenario 1 (Medical Emergency): A role-player collapses with simulated unresponsiveness in the vehicle yard; students must assess scene safety, call for EMS using a standard radio format, initiate CPR with an AED trainer unit, and document the response chronologically in a narrative incident report using the who-what-when-where-why-how structure; a classmate acts as the dispatcher and provides radio traffic the student must log accurately. · Scenario 2 (Criminal Trespass): A role-player presents as an unauthorized individual in a restricted area who refuses initial verbal direction; students apply verbal de-escalation techniques, make a lawful citizen's observation consistent with their limited authority as a private security officer (non-sworn), contact simulated law enforcement via radio, and document the encounter including exact words used, subject description, and disposition, while correctly noting constitutional limits on their detention authority. · Scenario 3 (Use-of-Force Decision): A role-player presents an escalating threat requiring the student to articulate a use-of-force continuum response in real time, demonstrate at least two empty-hand control options taught in Defensive Tactics without live contact on the role-player (controlled demonstration format), justify the force level chosen verbally to the instructor, then complete a use-of-force report citing the continuum level, justification, and outcome; students debrief as a group reviewing what legal and procedural standards governed each decision.
Materials: AED trainer unit, CPR manikin, radio trainer handsets, scenario role-player instruction cards, incident report blank forms (same format used in Report Writing course), use-of-force continuum reference card, POST study guide (patrol and use-of-force sections), defensive tactics protective gear (if any contact is used in demonstration), scenario props (simulated access badge, warning signage for restricted area)
Check: Each of the three incident reports is scored on a 20-point rubric (accuracy of facts as observed in scenario, correct chronological narrative structure, professional language, absence of opinion or editorializing, correct identification of legal authority used); passing is 14 out of 20 per report. The use-of-force report requires an additional instructor sign-off confirming the student correctly identified the appropriate continuum level; any report scored below passing is rewritten once under instructor supervision before the portfolio is assembled.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.