Security Incident Report Template for Hotels That Holds Up Later

A good security incident report template does one job. It gets the person on shift to record what happened while memory is fresh, in words a stranger can rely on. Months later an insurer, an owner's representative or a detective will read it without you in the room. These are the fields that matter and how to fill them in so the report still works then.

Who reads the report, and when

Reports are rarely read the day they are written. An incident is often not reported the day it happens, and a slip-and-fall claim, a disputed transaction or a theft can surface weeks later, according to a video-surveillance retention guide from Fora Soft. Guests check out first and call afterward. Injury lawyers tell guests to ask the hotel to complete an incident report and request a copy, per one California firm's guidance. Written reports can also be introduced as evidence in legal proceedings: in federal court, a record made at or near the time, by someone with knowledge, as a regular practice of the business can qualify under Federal Rule of Evidence 803(6), the exception for records of a regularly conducted activity. Many hotel injury claims are heard in state court under state evidence codes, which have their own versions of this rule, though, and a report can still be excluded if the circumstances suggest it isn't trustworthy, for example one written mainly with a lawsuit in mind. That is another reason to keep the report factual and routine.

So write for four readers who were not on shift: the insurance adjuster, the owner's asset manager, the police officer and the other side's lawyer. The test is whether a stranger could rebuild what happened, who was there and what you did, using only the page.

The fields every report needs

A short form that gets filled in every time beats a long one that gets skipped. Public hotel incident report templates cover much the same ground. For an independent property, use these fields in this order:

• Report number and four timestamps. Record when the incident happened, when it was discovered, when it was reported to you, and when you wrote the report. Discovery and occurrence are often hours apart, and a gap between them is a fact worth showing. A good report structure also includes the date and time the report was created, per HSE Watch.
• Exact location. Write "fourth-floor east corridor, outside 412," not "upstairs." For outdoor spots, name a fixed landmark such as the pool gate or the second row of the rear lot.
• Incident type. Choose from a short fixed list: theft, assault, trespass, disturbance, injury, vandalism, alarm activation, suspicious person, property damage. A fixed list makes later review by type possible.
• People involved. Give full name, role (guest, visitor, contractor, employee), room or reservation number, and a phone number or email. Note whether you checked ID. List each staff member who responded.
• Witnesses. For each one, record name, contact details, where they were standing and what they saw. Record each witness's account separately and review your notes with the witness to confirm accuracy, as Venngage's guide advises.
• Narrative. Use chronological, observed facts only (see the next section).
• Injuries and damage. Describe what you saw and what first aid was given. If there were none, write that explicitly. SafetyIQ suggests writing "No injuries were sustained" so a blank is never ambiguous.
• Actions taken, with times. List who was called and when: police, EMS, manager on duty, GM, insurer. Add the officer's name, badge and case number, and the unit that attended.
• Evidence. List photos taken, camera numbers and the time window saved, items held, and key or door-lock records pulled.
• Follow-up and owner. State what is still open (repair, claim, comp, barred-person decision), who owns it and by when.
• Signatures. The writer signs with printed name, date and time. The manager on duty reviews and signs, and so does the GM. A witness signs only their own statement, after reading it.

Write the narrative as fact, not conclusion

The narrative is where reports fail. The rule is to record what you saw, heard, measured and were told, and label which is which. Venngage puts it as describe only what was observed, not what you assume, feel, or infer.

• Conclusion: "Guest was drunk and aggressive."
• Fact: "Guest in 412 was shouting in the corridor at 11:42 p.m. Speech was slurred and an odor of alcohol was noted. He said, 'I'm not leaving until someone fixes this.'"

A few habits make the difference:

• Quote, don't paraphrase. HSE Watch advises using quotes from witnesses rather than paraphrase when possible.
• Mark what you don't know. Write "guest stated the bag was left at the front desk; desk log not yet checked" rather than filling the gap with a guess.
• Leave fault out. Do not write "our fault," "should have," or "careless." Liability is for the GM, the insurer and counsel to decide. Do not promise compensation in the report either.
• Never overwrite a signed report. If something changes, add a dated, signed addendum so the original stays intact.

A short sample narrative, in the voice of a night auditor:

At 1:15 a.m. the night auditor was told by a guest in 306 that a bicycle had been taken from the luggage room. The luggage room door was closed; the lock showed no visible damage. The auditor checked the storage log, which listed one bicycle, tagged 0412 at 4:40 p.m. The guest was shown the room; the bicycle was not there. Police were called at 1:28 a.m.; Officer [name, badge] arrived at 1:50 a.m. Camera 3 covers the corridor outside the room; footage from 4:30 p.m. to 1:30 a.m. was exported at 2:10 a.m. by the manager on duty.

Secure the evidence the form points to

The form is only part of the record. Video is the part most likely to disappear. Wired NM says most business cameras overwrite footage in 30 to 90 days, so check your own recorder's cycle. Export the relevant window on the same shift, with a margin before and after. Stop the overwrite for those dates.

Two points matter for the chief engineer or whoever manages the recorder:

• Camera clocks drift. An inconsistent timestamp shifts the burden onto whoever presents the footage and can trigger forensic authentication, as TrueScreen's overview of video timestamp admissibility explains, so record the offset between the recorder's clock and real time in the report.
• Maintenance can erase evidence. Firmware updates, storage resets and system replacements can all wipe footage. Tell your IT or camera vendor which date ranges are on hold before any work.

Once a claim is foreseeable, preserve everything. Once an incident makes litigation reasonably foreseeable, a common-law duty to preserve evidence attaches, as Judicature's analysis of amended Federal Rule of Civil Procedure 37(e) explains, and that calls for suspending routine deletion cycles right away. In practice, that means telling your insurer early and, for anything serious, talking to counsel before footage is shared widely.

For held property, log each handoff: who took it, who received it, when and where it is stored. For police, give them the facts and the case number, keep a copy of what you handed over, and record the officer's name. Ask your insurer and counsel how long to keep reports. Requirements vary by jurisdiction, and a legal hold overrides any normal disposal date.

Make filling it in the habit

A template only helps if people use it at 2 a.m. Some practices that work on a small property:

• Write before the shift ends. Route the report to the manager on duty and the GM within 24 hours.
• Train with one rehearsal. Give each new front desk, night and housekeeping hire a mock incident and have them write it up. Mark it with the narrative rules above. The approach in the hotel SOP guide works for this.
• Review monthly. The GM reads a sample of reports and checks for blank fields, opinions, missing times and missing signatures. Share the corrections with the team.
• Define "reportable." List the events that always need a report: any injury, any police contact, any theft claim, any barred guest, any use of force, any alarm with a cause. List them in writing so staff do not have to judge.

If you keep reports on paper, the weak points are signatures, loose attachments and retrieval months later. Altoreva's optional Altoreva Security add-on includes security incident reports with signature capture. It runs in the browser on the devices staff already carry. Evidence and held-property chain of custody, retention and legal holds, and security cases sit in the same module.

This article is general guidance for hotel operators, not legal, engineering or safety advice. Codes and regulations vary by jurisdiction and by edition, so confirm what applies to your property with your local authority and a qualified professional. Spot something wrong or out of date? Tell us and we'll correct it.
Last reviewed: 15 October 2026