Incident Report Sample for Security Guard Philippines

Standard Operating Procedure: incident report sample for security guard philippines

1. Document Control & Revision History

2. Executive Summary & Scope

This Standard Operating Procedure (SOP) outlines the rigorous institutional process for security personnel operating within the Republic of the Philippines to accurately and promptly generate incident reports. The objective is to standardize reporting practices, ensure comprehensive data capture, facilitate timely incident response, support legal and regulatory compliance (e.g., Republic Act No. 5487 - The Private Security Agency Law, Republic Act No. 10173 - Data Privacy Act of 2012, and local ordinances), and provide actionable intelligence for risk mitigation and continuous operational improvement.

This SOP is applicable to all security guards, supervisors, and management personnel involved in the discovery, reporting, investigation, and review of incidents occurring within guarded premises or under their jurisdiction across all client engagements in the Philippines. It encompasses incidents ranging from minor disturbances to major security breaches, personnel infractions, and significant property damage. Exclusions include highly specialized investigative procedures requiring law enforcement or external forensic experts, beyond the initial reporting phase.

3. Prerequisites & Tool Requirements

Personnel Certification & Training:

• Valid Philippine National Police – Supervisory Office for Security and Investigation Agencies (PNP-SOSIA) Security Guard License.
• Certified completion of internal Incident Reporting Protocol training.
• Basic First Aid and Emergency Response certification (preferred).

Equipment & Materials:

• • Standard-issue security uniform and personal protective equipment (PPE), including face mask, gloves (for evidence handling), and whistle.
• • Operational Two-way Radio or company-issued Mobile Communication Device.
• • Working Flashlight with spare batteries.
• • Incident Report Forms (hard copy, company-approved template).
• • Pen and notepad for preliminary notes.
• • Digital Camera or smartphone with functional camera for photographic evidence capture.
• • Access to First Aid Kit and fire extinguisher (if applicable to incident type).

Software & Access:

• • Access to the company's designated Incident Management System (IMS) or digital reporting portal (if applicable).
• • Valid company email account for digital report submission and communication.
• • Access to cloud storage or secure network drives for evidence submission (if applicable).

4. Roles & Responsibilities (RACI Matrix Table)

Legend:

• R (Responsible): Performs the task.
• A (Accountable): Ultimately answerable for the correct and thorough completion of the deliverable or task.
• C (Consulted): Provides input and expertise.
• I (Informed): Kept up-to-date on progress.

5. Step-by-Step Operational Procedure

Phase 1: Incident Discovery & Initial Response

• • Step 1.1: Observe & Identify Incident.
  • • Recognize deviations from normal operations or security protocols.
  • • Note exact time and location of discovery.
• • Step 1.2: Initial Assessment & Safety First.
  • • Prioritize personal safety and the safety of others.
  • • Assess immediate threat level and secure the area if safe to do so.
  • • Administer first aid if required and qualified, or call for emergency medical services (EMS).
• • Step 1.3: Initial Notification.
  • • Immediately notify On-Duty Supervisor via radio or primary communication channel.
  • • Provide concise details: "Incident Type, Location, Time, Immediate Action Taken."
  • • Request backup or specialized assistance (e.g., police, fire department, EMS) if necessary.
• • Step 1.4: Secure the Scene (if safe & feasible).
  • • Isolate the incident area to preserve potential evidence.
  • • Use ropes, tape, or physical presence to deter unauthorized access.

Phase 2: Information Gathering & Documentation

• • Step 2.1: Commence Preliminary Documentation.
  • • Utilize notepad to record initial observations, actions, and key details as they unfold.
  • • Record names and contact information of all involved parties and witnesses.
• • Step 2.2: Gather Witness Statements.
  • • Approach witnesses calmly and explain the need for their account.
  • • Record statements verbatim where possible, or summarize accurately.
  • • Obtain signature if witness is willing and the situation allows.
  • • Document refusal to provide a statement.
• • Step 2.3: Collect Physical Evidence.
  • • Identify and photograph/video tangible evidence (e.g., damaged property, forced entry points, suspicious objects).
  • • Do NOT handle evidence unless absolutely necessary for preservation or safety, and only with appropriate PPE (gloves).
  • • Clearly label and log all collected evidence with date, time, location, and collector's name. Maintain Chain of Custody.
• • Step 2.4: Log Security Camera Footage (if available).
  • • Note existence of CCTV coverage.
  • • Record camera ID, specific date/time range, and relevant angles.
  • • Request retention/download of footage from the responsible party.

Phase 3: Incident Report Generation

• • Step 3.1: Retrieve Incident Report Form.
  • • Obtain a blank, company-approved hard copy or access the digital IMS form.
• • Step 3.2: Complete Header Information.
  • • Date & Time of Report: [ ] YYYY-MM-DD HH:MM (Time of filling out the report)
  • • Report Number: [ ] (Automatically generated by IMS or sequentially assigned)
  • • Reporting Officer: [ ] (Full Name, Rank, Guard License No.)
  • • Shift: [ ] (e.g., Day, Night, Mid)
  • • Location of Incident: [ ] (Specific address/area within premises)
• • Step 3.3: Detail Incident Overview.
  • • Date & Time of Incident: [ ] (Exact Start/End if known, or Discovery Time)
  • • Type of Incident: [ ] (e.g., Theft, Vandalism, Trespassing, Assault, Fire, Medical Emergency, Personnel Violation, Disturbance)
  • • Nature of Incident: [ ] (Brief, factual summary - e.g., "Discovery of forced entry to main office door.")
  • • Severity Level: [ ] (e.g., Minor, Moderate, Major, Critical - based on established criteria)
• • Step 3.4: List Involved Parties.
  • • Victims: [ ] (Name, Contact, Address, Injuries - if applicable)
  • • Suspects/Perpetrators: [ ] (Name/Description, Actions, Status - e.g., apprehended, at large)
  • • Witnesses: [ ] (Name, Contact, Relationship to Incident)
  • • Responding Agencies: [ ] (e.g., PNP, BFP, EMS - Agency Name, Unit No., Officer Name/Badge No., Time Arrived)
• • Step 3.5: Construct Factual Narrative.
  • • Write a clear, concise, objective, and chronological account of events.
  • • Use first-person perspective (e.g., "I observed...", "I proceeded to...").
  • • Include all relevant details: Who, What, When, Where, Why (if known), How.
  • • Avoid speculation, opinions, or emotional language.
  • • Document all actions taken by the reporting officer, including notifications, attempts to resolve, and evidence collection.
• • Step 3.6: Attach Supporting Documentation.
  • • Number and list all attachments (e.g., photos, videos, witness statements, CCTV logs, evidence tags).
  • • For hard copies, ensure physical attachments are securely fastened.
  • • For digital, ensure files are correctly uploaded and linked within the IMS.
• • Step 3.7: Recommend Corrective Actions (Optional, but encouraged for systemic issues).
  • • Propose measures to prevent recurrence or mitigate future risks (e.g., "Suggest increased patrol frequency in Sector B," "Recommend repair of faulty lighting").

Phase 4: Submission & Escalation

• • Step 4.1: Review for Completeness & Accuracy.
  • • Prior to submission, thoroughly review all sections for factual errors, omissions, and grammatical correctness.
  • • Ensure all mandatory fields are completed.
• • Step 4.2: Submit Report.
  • • Hard Copy: Deliver the completed, signed report to the On-Duty Supervisor.
  • • Digital: Upload the report and attachments to the IMS or email to designated recipients.
• • Step 4.3: Urgent Notification.
  • • For incidents classified as Major or Critical, immediate verbal notification to the On-Duty Supervisor and Operations Manager MUST be followed by the written report within 30 minutes of incident resolution or securing the scene.
  • • For incidents requiring client notification, the On-Duty Supervisor or Operations Manager will coordinate.

Phase 5: Review & Archiving

• • Step 5.1: Supervisor Review.
  • • On-Duty Supervisor critically reviews the submitted report for adherence to SOP, accuracy, completeness, and clarity.
  • • Provide constructive feedback and request corrections from the reporting officer if necessary.
• • Step 5.2: Finalization & Approval.
  • • Once satisfactory, the On-Duty Supervisor signs/approves the report, indicating completion and readiness for further action.
  • • Operations Manager performs final review and approval for critical incidents or reports requiring their attention.
• • Step 5.3: Distribution & Archiving.
  • • Distribute the final report to relevant internal stakeholders (e.g., Operations Manager, Client Liaison).
  • • Securely archive the report (physical copies in locked cabinet, digital copies in IMS/secure server) in accordance with data retention policies and regulatory requirements (e.g., Data Privacy Act).

6. Quality Assurance & Verification Criteria

Audit Checklist:

• • Completeness: Are all mandatory fields (Date/Time, Reporting Officer, Type, Location, Narrative) filled?
• • Accuracy: Do facts align with available evidence (e.g., CCTV, witness statements)? Are names, dates, and times correct?
• • Timeliness: Was the initial notification made within 5 minutes of discovery? Was the full report submitted within 2 hours of incident resolution/scene securing? (Adjust based on incident severity).
• • Clarity & Objectivity: Is the narrative free of jargon, opinions, and emotional language? Is it easily understood by an external reader?
• • Adherence to Format: Does the report follow the prescribed company template and section order?
• • Evidence Attachment: Are all referenced attachments present, clearly labeled, and properly linked/secured?
• • Signature/Approval: Is the report signed/approved by the reporting officer and the reviewing supervisor?

Tolerance Thresholds:

• Initial Notification: Must occur within 5 minutes of incident discovery for all critical incidents. Failure to meet this is a critical non-conformance.
• Report Submission: Must be submitted within 2 hours of incident resolution or scene securing for major incidents, and within 4 hours for minor incidents. Delays exceeding 1 hour beyond this threshold require a documented justification.
• Error Rate: Maximum 5% error rate on factual details per report. Exceeding this triggers a re-training requirement for the reporting officer.

Acceptance Benchmarks:

• All reports must provide sufficient detail for an independent party to understand the sequence of events and the actions taken.
• Reports must support potential legal proceedings or internal investigations without requiring significant clarification from the original reporting officer.
• The report contributes actionable intelligence, allowing for informed decision-making regarding security enhancements or policy adjustments.

7. Practical Troubleshooting Scenarios

Scenario 1: Critical Information (e.g., Witness Identity, Key Detail) is Unavailable or Refused.

• Problem: During information gathering, a crucial witness refuses to provide details or vanishes, or a critical piece of information (e.g., exact time of theft) cannot be ascertained.
• Immediate Corrective Action Protocol:
  1. Document the Gap: Explicitly state in the incident report narrative that the information is "unavailable" or "refused," along with the efforts made to obtain it (e.g., "Witness C, described as male, 30s, refused to provide name or statement and departed the scene despite requests.").
  2. Seek Alternatives: Intensify efforts to find alternative sources (e.g., review additional CCTV footage, canvass other potential witnesses, check access logs).
  3. Supervisor Consultation: Immediately inform the On-Duty Supervisor of the information gap. The Supervisor will determine if further investigation steps are necessary or if the report can proceed with the current limitations, noting the attempts made to gather full details.
  4. Avoid Speculation: Do NOT fabricate or speculate on missing information. Maintain objectivity.

Scenario 2: Security Guard Feels Threatened or Unable to Complete Report On-Site.

• Problem: The incident scene remains volatile, or the security guard feels physically threatened, making it unsafe or impractical to complete the detailed report directly at the location.
• Immediate Corrective Action Protocol:
  1. Prioritize Safety: Immediately withdraw to a safe location. If necessary, call for law enforcement backup before withdrawing.
  2. Initial Notification: From the safe location, make an immediate, concise verbal report to the On-Duty Supervisor, emphasizing the safety concern and the inability to complete the full report on-site.
  3. Preliminary Notes: As soon as safely possible, record preliminary notes on a notepad or mobile device, focusing on critical details observed and actions taken before withdrawing.
  4. Relocate for Reporting: The On-Duty Supervisor will direct the guard to a secure, designated area (e.g., security office, patrol vehicle) to complete the incident report. Provide a secure environment and necessary tools.
  5. Follow-Up: The Supervisor or Operations Manager will assess the safety protocols and incident response for potential improvements.

Scenario 3: Digital Incident Management System (IMS) Failure/Connectivity Loss.

• Problem: The primary digital IMS is inaccessible due to network issues, power outage, or system malfunction, preventing digital report submission.
• Immediate Corrective Action Protocol:
  1. Verify System Status: Attempt to access the IMS from a different device or verify with IT support/On-Duty Supervisor if it's a widespread outage.
  2. Revert to Hard Copy: Immediately switch to the company's designated hard-copy Incident Report Forms. Ensure all details are meticulously recorded as per SOP.
  3. Inform Supervisor: Notify the On-Duty Supervisor about the IMS failure and the switch to manual reporting.
  4. Temporary Archiving: The completed hard copy report is submitted to the On-Duty Supervisor. It will be temporarily stored securely until IMS functionality is restored.
  5. Data Entry Post-Recovery: Once the IMS is operational, the On-Duty Supervisor or a designated clerk will be Responsible for accurately transcribing the hard-copy report data into the IMS, attaching scanned copies of the original hard report and any physical evidence logs. The original hard copy will be retained as per archiving policy.