How should incidents be reported and documented?

• A. Wait for a formal criminal investigation to begin before noting anything.
• B. File a generic note without details.
• C. Report only to supervisor verbally, no records.
• D. Follow formal incident reporting procedures, record details, witnesses, and actions taken; preserve evidence.

Answer: (D)

Incidents should be reported and documented using formal incident reporting procedures that capture what happened, where and when it occurred, who was involved, what was observed, and what actions were taken. A complete record helps security teams understand the incident, supports investigations, and provides a clear timeline for decisions and accountability. Recording witnesses’ names and statements, along with the sequence of events, ensures information is verifiable and usable by others who may review the case. Preserving evidence and maintaining a proper chain of custody is essential to retain integrity of physical or digital items, which may be needed for investigations, insurance, or court processes. Documentation should be done promptly and stored securely in the appropriate system to ensure it remains accessible and reliable over time.

Delaying notes until a formal investigation begins can cause important details to be forgotten or overlooked, a generic note lacks the specifics needed for assessment, and reporting only verbally to a supervisor leaves no durable record and may violate policy or compliance requirements.