A desk log, a telephone call and a camera export can each contain a different time for the same incident. A neat timeline is useful only if the reader can trace its entries back to those sources. Silently choosing the most convenient time makes a report look more certain than the underlying information.
This guide proposes a review method for NYC property and hotel managers. It is an administrative aid, not forensic certification or legal advice. Use it within the incident-record handoff playbook, after immediate response needs have been addressed.
Separate the clocks before sorting events
Create different fields for the claimed event time, the time a person reported it and the time the record was created. Include the date and time zone when relevant, especially for overnight incidents. Note whether a time came from direct observation, recollection, a system display or another record.
Do not assume a recorder, access-control system and desk computer share the same clock. If a qualified custodian identifies an offset, retain the original displayed time and separately document the interpretation. Avoid changing a live system clock to make old records line up. That technical decision belongs to the authorized system owner under the applicable procedure.
Build a chronology with source references
Use one row for a meaningful event or communication. Include the source reference and any uncertainty. A fictional example might read: “Approximately 22:10, tenant reported hearing a sound; account received at 22:24; source statement S-03.” A second row could contain the officer's later observation. The two rows should not be collapsed into “incident occurred at 22:10” unless the supporting evidence justifies that conclusion.
Useful columns are:
- Event or action, described neutrally.
- Stated time and time basis.
- Source item and author or custodian.
- Confirmed fact, reported account or unresolved question.
- Reviewer note and follow-up owner.
A chronology is a working synthesis. Keep it linked to the original records so a reviewer can test the interpretation. The CCTV request guide explains how to document a video time window without treating an estimate as exact.
Correct through an attributable amendment
When an officer notices an error, preserve the original and add an amendment using the organization's approved record system. State who made the correction, when, which entry it affects, what changed and why. If the system does not support an audit trail, ask management for an approved method that retains both versions.
Do not backdate the amendment or make a later observation appear to have been known at the time of the original note. A correction such as “the entrance was east, not west; corrected after reviewing the location with the reporting officer” is more useful than silently replacing the word.
Leave unresolved conflicts visible
Two accounts may disagree. Record the disagreement and the next reasonable verification step rather than averaging times or choosing the more senior person's account automatically. A supervisor can ask for clarification without pressuring a writer to adopt another person's recollection.
Keep firsthand observations and attributed statements distinct. If a photo's upload time is all that is known, do not label it as the capture time. If a camera did not cover the relevant location, say so rather than treating the absence of footage as proof that the event did not occur.
The NIST SP 800-86 publication explains the specialized nature and limits of digital forensic work. This property chronology is not a substitute for technical examination or legal review where those are required.
Approve the next version and preserve the handoff
Have the responsible reviewer identify the version being distributed and the unresolved items that remain. If a prior version was already shared, use the approved channel to communicate the correction to the same authorized recipients as appropriate; do not assume a new upload alerts them.
Before closing the review, check that every material assertion has a source, estimates are labeled, amendments remain visible and each open question has an owner. Record the transfer in the incident-record register. A completed chronology should make uncertainty easier to understand, not disguise it behind a polished sequence.