Browse all questions

Human memory degrades sharply within hours of an event, with details — exact words, sequence, time, descriptions — eroding fastest. Contemporaneous notes (made during or shortly after the event) preserve those details while still fresh. Under Evidence Code §771 (writings used to refresh recollection) and §1235 (prior inconsistent statements), notes carry significant evidentiary weight and can be used in court. Notes do not replace the formal incident report (c) — they are the raw material for it. Notes taken later are admissible but carry less weight than contemporaneous notes (d). Breaks (b) are unrelated. Best practice: notepad always carried, key facts captured in real time.

Reports should be built on observable, verifiable facts: what the guard saw, heard, smelled, felt, did, and was told (and by whom). Subjective characterizations ('aggressive,' 'suspicious,' 'intoxicated') are opinions that should be supported by underlying facts ('slurred speech, swayed when standing, smelled of alcoholic beverage from a distance of two feet'). Subjective statements aren't always wrong (d), but unsupported conclusions weaken credibility and provide cross-examination targets. Tense (a) and length (b) are not the relevant distinction. Strong reports separate observation from inference and document the factual basis for any characterization.

The Five W's + H is the universal investigative and reporting framework: Who (identities — victim, suspect, witnesses, responders), What (the incident — facts in sequence), When (date and time of each material event), Where (precise location, including landmarks), Why (motive or apparent reason, where supportable by evidence), and How (means and manner). Each W answered with specific, verifiable detail produces a complete report. Reports missing one of these elements are vulnerable to attack at trial and undermine the merchant's or PPO's defense. Trained guards systematically work through the framework before closing the report.

Chronological structure is the standard for narrative incident reports because it tracks the natural flow of events, makes timelines unambiguous, simplifies cross-referencing with video and witness statements, and resists confusion during cross-examination. Each event paragraph should begin with a time stamp. Other organizational schemes (topical for complex multi-incident reports, summary-then-detail for executive cover memos) have niche uses but are not the default. Alphabetical (b), emotional (c), and severity-first (d) structures obscure the sequence and weaken the report's evidentiary value.

First-person, active-voice, past-tense reporting is the modern standard for police and security reports. It is direct ('I observed' rather than 'It was observed'), clearly identifies the actor (the writing guard), avoids hedging, and reads naturally on the witness stand. Passive voice (c) obscures the actor and invites cross-examination. Second person (a) is conversational and inappropriate. The artistic approach (b) is not a real standard. Some legacy PPOs still use third-person style (e.g., 'Officer Lee observed...'), but the trend strongly favors first-person, active voice for clarity and credibility.

Photography for legitimate incident documentation is a standard, defensible practice — incident scenes, evidence, injuries (where consented or in plain view), and observable conduct. California's constitutional privacy right (Cal. Const. Art I §1) and statutes like Civil Code §1708.8 caution against gratuitous photography of bystanders, focused capture of private areas like restrooms or dressing rooms (which can be actionable under PC §647(j) and §647(i)), and intrusive use of telephoto or enhancing devices to capture private activity. Reasonable judgment, employer policy, and respect for privacy norms govern lawful incident-scene photography.

Penal Code §632 prohibits intentional recording of a 'confidential communication' without the consent of all parties. A confidential communication is one carried on under circumstances reasonably indicating any party desires it to be confined to the parties. Civil remedies under §637.2 include the greater of $5,000 per violation or three times actual damages. For body-worn cameras, audio capture of private conversations (offices, vehicles, back-of-house areas) generally requires consent. Conversations on busy public sales floors or near visible 'audio recording in progress' signage may not qualify as 'confidential.' Federal one-party rule (b) does not displace stricter state law.

PC §647(j) criminalizes invasive surveillance — including peeping into rooms where a person has a reasonable expectation of privacy (changing rooms, restrooms, bedrooms, fitting rooms, tanning booths), photographing under or through clothing, and using devices to record private activity. Violations are misdemeanors with significant penalties; some forms also support civil claims under Civil Code §1708.8. Camera placement must respect privacy norms — covering restroom interiors or changing rooms with video is a felony-adjacent boundary. Cameras in genuinely public areas (a), retail floor surveillance (b), and office body-worn cameras (c) are not the §647(j) target.

A properly served subpoena under CCP §§1985-1987 is a court order — non-compliance can result in contempt sanctions (CCP §1991), monetary penalties, and bench warrants. The guard should immediately notify the employer's risk-management and legal team, preserve every relevant document (destruction during litigation is spoliation, with severe sanction consequences), and review materials before testimony to refresh recollection under Evidence Code §771. The PPO will often coordinate with counsel for the guard. Privacy objections (d) generally do not shield witness testimony about observed events. Ignoring the subpoena (a) and destroying records (c) are serious mistakes.

Open-ended questions ('Tell me what happened,' 'Describe the person you saw') allow witnesses to narrate without external suggestion, producing more accurate and complete information. Leading questions ('The man had a beard, right?') can contaminate memory and create false confidence in incorrect details — a documented problem in eyewitness research. The PEACE model (Preparation, Engage, Account, Closure, Evaluate) used in modern police training favors open questioning. After the free narrative, the interviewer drills into specifics with neutral clarifying questions. Guards should avoid leading questions, especially regarding suspect identification, to preserve evidentiary value.

A systematic head-to-toe descriptor minimizes omissions and produces a usable description for police, BOLO dispatch, and report consumers. The standard order: sex, race/ethnicity (as perceived), age estimate, height/weight, build, hair (color/length/style), eye color, facial hair, complexion, scars/marks/tattoos, accessories, clothing top-to-bottom (hat, shirt/jacket, pants, footwear, bags), then direction and mode of travel. Each element should be qualified ('approximately,' 'estimated') where precision is uncertain. General impressions (a), single features (c), and refusing descriptors (d) sacrifice operational utility. Profiling concerns are addressed by describing observed facts.

A complete vehicle descriptor — sometimes captured by CYMBALS (Color, Year, Make, Body, Additional, License, State) — supports rapid identification by responding police and database lookup. Include color (primary, secondary), estimated year, make and model, body style (sedan/SUV/pickup/van), license plate (state + characters), distinguishing features (damage, decals, aftermarket parts, broken lights), occupants observed, and direction of travel. Color and brand alone (a) is incomplete; plate alone (b) helps but may be obscured or stolen; subjective value (d) is irrelevant. Each detail multiplies the chance of identification when the plate is illegible or partial.

Suspicious-activity recognition is pattern-based, contextual, and probabilistic — never definitive on any single observation. Indicators include surveillance behavior (photographing entrances, cameras, security stations), repeated approach-and-retreat near sensitive points, unusual interest in operational details, atypical tool possession (bolt cutters in a department store), attempts to defeat access controls, and target-glancing combined with concealing an object. None justifies detention alone, but patterns trigger heightened observation and documentation. Normal shopping, tourists, and seasonal behavior (a, b, d) are not suspicious. The discipline avoids profiling and focuses on conduct.

Routine fixed-route patrols are easy to surveil — an adversary watching the site can chart the guard's pattern and plan the breach for the longest gap. Randomized patrol patterns vary route, timing, and direction, defeating that intelligence. Critical: randomization is not abandonment of coverage; the guard should still hit every required checkpoint within the shift, just in unpredictable order. Many sites use guard-tour systems (RFID/NFC checkpoints) that record visits — these support coverage verification without revealing the route. Randomization doesn't reduce training (b), guarantee cost savings (c), or substitute for legal compliance (d).

Cooper's Color Codes describe levels of awareness. White: unaware, relaxed, oblivious (never appropriate on duty). Yellow: relaxed but alert, generally aware of environment, recommended baseline for on-duty guards. Orange: aware of a specific potential threat, assessing options. Red: active threat engagement. Some versions add Black: physiological overload, decision paralysis. The framework pairs with John Boyd's OODA loop (Observe, Orient, Decide, Act). Yellow allows the guard to detect anomalies early and shift to Orange before a crisis develops. White on duty is dangerous; Red as baseline is unsustainable and creates false-alarm risk.

A guard who knows the site cold can respond in seconds rather than wandering, dispatch precise locations to police and EMS ('south entry, west of receiving'), guide evacuations confidently, identify and mitigate hazards proactively, and write reports with specific location descriptors that resist cross-examination. Familiarization includes entrances/exits, restrooms, electrical and water shutoffs, fire panels and extinguishers, AED locations, blind spots, camera fields of view, and adjacent properties. New-post training should explicitly cover the geography. Federal mandate (a) and skip patrols (c) are wrong; customer service (d) is one minor benefit but undersells the value.

Effective crowd observation is baseline-and-anomaly: first, internalize the normal pattern of movement, density, sound, and behavior at the venue and time; then attend to deviations — a person stationary while others flow, lingering and scanning, repeated visits to sensitive locations, atypical clothing for weather, tension or avoidance behaviors, or hand-near-waistband adjustments. Single observations rarely justify action; clusters of indicators trigger heightened attention and possibly engagement. Profiling by appearance (a) is unlawful and operationally weak. Continuous counting (b) is impossible and not useful. Entrance-only monitoring (d) ignores threats already inside.

An incident report is the guard's or PPO's internal factual narrative of what occurred — observations, actions, identifications, evidence, and witnesses. The criminal complaint is a charging document filed by the District Attorney (or the People) in court, initiating a criminal case. The incident report and any police report it generates are evidence supporting the complaint and the DA's charging decision but are not themselves charges. Civil complaints are similar — filed by plaintiffs (typically by counsel) in superior court. A well-written incident report can be the foundation of both criminal prosecution and the merchant's civil defense, but neither is automatic from the report itself.

The Daily Activity Log (DAL) is the routine shift chronicle: time of post-up, patrol times and routes, checkpoint visits, visitor sign-ins, deliveries, key issues, general observations, and shift handoff notes. The incident report is triggered by a specific notable event and contains a detailed narrative with Five W's + H, statements, evidence, and follow-up. Both are important: DALs establish baseline activity and can corroborate timelines for later incidents; incident reports are the deep documentation for specific events. Attorneys do not write DALs (c); incident reports cover civil, medical, and safety events too, not just criminal (a).

Chain of custody is the unbroken, documented chronology of who possessed, handled, transported, or analyzed an item of evidence from discovery to presentation in court. Gaps invite challenges that the evidence may have been tampered with, swapped, or contaminated, potentially excluding it under Evidence Code §1400 et seq. Guards should secure the item promptly (gloves to avoid contamination), record discovery details (time, location, finder), bag/tag/seal with identifying information, store securely, and document each subsequent handler and time of transfer. Photograph (a) is appropriate but does not replace preservation. Unsecured storage (b) and free handling (c) break the chain.

First-responder duties at a likely crime scene, in order: (1) ensure safety — your own, then others, rendering first aid if trained; (2) call 911 and notify supervisor/dispatch; (3) secure the perimeter with whatever materials are available; (4) prevent entry by anyone unauthorized — including coworkers and curious bystanders; (5) avoid touching or moving anything unless required for life safety; (6) note witnesses and ask them to remain; (7) brief arriving officers on what you saw, did, and where. Forensic search (a) is the detectives' role. Cleaning (c) destroys evidence. Suspect interviews (d) are best left to police given Miranda and §841 considerations.

A disciplined briefing/debrief cycle is one of the highest-leverage operational practices in protective services. Pre-shift briefings communicate BOLOs, recent incidents, expected high-traffic or VIP events, known hazards, special instructions, and post assignments — putting every guard on the same page. Post-incident debriefs (after a major event or end-of-shift for significant developments) capture lessons learned (what went well, what didn't, what would we change), identify training and equipment gaps, and create an institutional memory. Briefings do not replace reports (c) — they often precede the formal report — and they support, rather than eliminate, individual judgment (d).

Witness preparation for security personnel: (1) review the original incident report and contemporaneous notes — Evidence Code §771 expressly allows using writings to refresh recollection; (2) re-walk the scene mentally to anchor sequence and detail; (3) coordinate with PPO counsel; (4) dress professionally, arrive early, and identify the case room; (5) on the stand, listen carefully, answer the question asked (don't volunteer), tell the truth, and acknowledge gaps in memory honestly. Memorization (a) reads as scripted under cross. Avoiding the report (b) sacrifices accuracy without benefit. Coordinating stories with other witnesses (d) is unethical and potentially obstruction (PC §136.1).

PC §118 makes willful false statement under oath about a material matter a felony, punishable under PC §126 by 2, 3, or 4 years in state prison. The statute reaches court testimony, deposition testimony, and any document signed 'under penalty of perjury.' For guards, perjury convictions are career-ending: BSIS may revoke the guard card and registration (BPC §7583.22, §7583.33), and the conviction follows the guard's record. The defense is simple: tell the truth, and when memory fails, say so. Qualified privilege (d) does not protect knowing false statements, which are made with malice. Perjury applies to all persons under oath (a), not just peace officers.