Security Observation Notes: Separate Facts, Reports and Inferences

An incident note becomes less useful when the writer mixes what they saw with what they were told. “The visitor forced the door” means something different from “I found the door open; a tenant said a visitor had pushed it.” A manager reviewing the record later needs to know which statement the officer can personally support.

This guide proposes a writing discipline for property and hotel security teams. It does not authorize interviews, searches or investigations beyond the officer's assigned role. Start with immediate safety and the site's response procedures. Connect notes to the incident-record handoff playbook, rather than circulating them as an informal group-chat narrative.

Give each statement a source

Use three plain categories while composing notes: directly observed, reported by another person, and not yet established. The categories can be a drafting aid rather than a new software field. They help a supervisor find unsupported transitions in a report.

For an observation, describe the action or condition and where you were positioned. For a reported statement, attribute it accurately and record when it was received. If the person's identity has not been verified, say how they identified themselves without presenting that identity as confirmed. Keep contact details in the approved restricted location instead of repeating them in every narrative.

Keep observations distinct from inference: Observe — What was seen, or heard directly; Locate — Position, distance, and conditions; Qualify — Uncertainty and, limits of recall; Review — Witness checks, their own account. — Give each statement a source

Describe behavior without assigning a motive

Use specific actions: a person raised their voice, struck a surface, walked through a doorway, or declined a stated request. Avoid diagnoses, character labels and speculative intentions. A description can be direct without deciding why someone acted that way.

These fictional editing examples illustrate the distinction:

Replace “He was casing the lobby” with the actual observed movements and duration, if known.
Replace “She was intoxicated” with relevant observations, without offering a medical conclusion.
Replace “The delivery person stole the item” with what was seen, what is missing, and the source of each fact.
Replace “Everyone heard the threat” with the names or roles of people who separately reported hearing it.

An absence of observed behavior is also limited: “I did not see anyone enter during my observation” is not proof that no one entered before the officer arrived.

Context makes an observation usable: Position (Where were they?), Conditions (Light, noise, obstructions), Time (Known or estimated?), Source (Direct or reported?). — Describe behavior without assigning a motive

Preserve the difference between quotation and summary

Use quotation marks only when you can accurately record the words. Otherwise label the account as a summary. Do not polish a person's language into a stronger accusation, combine multiple people's accounts into one voice, or fill in a missing word from expectation.

If someone volunteers information, record it under the site's procedure. Do not pressure them to agree with an existing account or show them another person's narrative to make the stories match. Where formal questioning is needed, route the matter to the designated investigator or responding authorities.

Distinguish the source of each statement: Direct account — Observed action: What the person saw; Heard words: Quote only if recalled; Personal limits: What they could not tell. Other information — Reported account: Identify who told them; Interpretation: Label it as an inference; Later knowledge: Keep it separate. — Preserve the difference between quotation and summary

Record timing with the same discipline

Separate the event time from the time you wrote the note. If the event time is estimated, label it. Record the clock or source when that distinction matters. If a later camera review changes the timeline, add a documented correction rather than rewriting the original account to appear contemporaneous.

Use the timeline and corrections guide to connect late information to its source. Keep personal notes and submitted records according to the organization's retention and preservation instructions; do not discard them merely because a supervisor has produced a polished summary.

The NIJ guides stress methodical work and adherence to agency policy in their law-enforcement context. The narrow lesson here is to respect role boundaries and preserve source distinctions, not to turn a private guard into a crime-scene investigator.

A correction should remain traceable: Initial record — Capture account — Keep the original version; Review — Identify change — Clarify wording or facts; Addendum — Explain correction — Record author and date. — Record timing with the same discipline

Review clarity without changing the witness

A supervisor can ask the writer to identify an unclear location, explain an abbreviation or distinguish a reported statement from an observation. Any amendment should remain attributable to its author. The reviewer should not insert their own theory into the officer's account.

Before handoff, check five questions:

Can a reader identify who observed each important fact?
Are exact words distinguished from summaries?
Are uncertain times and identities labeled?
Are actions described without unsupported motives or diagnoses?
Are additions dated and linked to the original record?

For supporting pictures, use the photo handling guide. A photograph may add context, but it does not automatically establish the writer's explanation for the scene.