Introduction
A security guard's real product is information — accurate observation, clearly documented, delivered to the people who need it. The camera does not testify; you do. A theft, an assault, a slip-and-fall, a use of force: months later, the only reliable record of what happened is the report you wrote and the notes behind it. A vague, editorial, or contradictory report loses cases; a specific, factual, chronological one wins them. This chapter teaches you to see deliberately, note contemporaneously, and write in a way that would satisfy a judge reading it five years from now.
It covers patrol technique and situational awareness, the discipline of note-taking and the 5W + H report structure, systematic suspect and vehicle descriptions, and the legal limits on photography and audio recording in a two-party-consent state.
Learning objectives
After working through this chapter you should be able to:
- Patrol with varied patterns and situational awareness (Cooper's color codes; the OODA loop), using all your senses.
- Take contemporaneous notes and write a report answering Who, What, When, Where, Why, How with facts, not conclusions.
- Give a systematic head-to-toe suspect description and a CYMBALS vehicle description.
- Apply the two-party consent rule for audio (Penal Code §632) and the privacy limits on recording (Penal Code §647(j)), and treat images as evidence.
- Explain how contemporaneous notes refresh recollection for later testimony (Evidence Code §771).
Part A — Patrol patterns and situational awareness
Good patrols are neither random wandering nor predictable loops. A predictable patrol teaches a hostile actor exactly when you will be at the back dock; a varied patrol — changing direction, timing, and route, with deliberate pauses to listen — denies them that. Practical habits: walk against vehicle traffic so you can see drivers; use your nose (smoke, fuel, marijuana often register before anything is visible) and your ears (breaking glass, raised voices, alarms) as much as your eyes.
Two mental models anchor awareness:
- Cooper's color codes. White = oblivious (never acceptable on duty); Yellow = relaxed alert (your normal on-duty baseline); Orange = a specific possible threat identified, plan forming; Red = acting on the threat. Live in Yellow.
- The OODA loop. Observe, Orient, Decide, Act — cycle continuously so you keep updating on fresh information instead of locking onto your first guess.
Your post orders define the patrol path; your awareness determines whether the patrol accomplishes anything.
Part B — Notes and reports: the 5W + H, written contemporaneously
Every incident report answers six questions:
- Who — everyone involved, with full names where available, detailed descriptions where not, witness contact information, and your own name and post.
- What — what happened, in plain chronological order, with concrete facts ("the man swung his right fist at the cashier"), not conclusions ("he became aggressive").
- When — specific times from your watch or radio log, for each step.
- Where — the exact location on the property, detailed enough that a stranger could find it.
- Why — the hardest box: stick to facts and reported statements; do not guess at motive unless the subject told you.
- How — how the events unfolded and how they were resolved.
Take notes during the incident if it is safe, or immediately after while it is fresh. The bridge from raw notes to clean report to courtroom testimony months later is California Evidence Code §771, which allows a witness to refresh recollection from a writing made when the events were fresh. Two rules make a report defensible: write facts over conclusions ("the subject said he had three beers," not "the subject was drunk"), and apply the stranger test — could someone who was not there reconstruct what happened from your report alone? If not, rewrite it.
Part C — Suspect and vehicle descriptions that hold up
Build a suspect description head to toe so a responding officer can broadcast it without gaps: gender and approximate age; race/ethnicity if discernible; height and build; hair (color, length, style); eyes; facial hair, glasses, scars, tattoos; hat; shirt and outerwear with colors; pants; shoes; anything in the hands; and direction of travel. Practice the sequence out loud on slow shifts — the time to learn the script is not while someone is running away.
For vehicles, a common California mnemonic is CYMBALS: Color, Year, Make, Body style, All other (damage, decals, distinguishing marks), License, State. The license plate beats every other identifier — get it first if you can; if you cannot, get a partial plate and the state. For weapons, describe what you actually saw ("a black semi-automatic pistol with a stainless slide"), rather than guessing make and model. Use compass directions for travel, not "that way."
Part D — Photography, recording, and privacy
Phones make documentation easy and legally complicated at once.
- Video without sound, in a public space or your employer's premises where there is no reasonable expectation of privacy, is generally allowed.
- Audio is the harder line. California is a two-party (all-party) consent state under Penal Code §632: it is a crime to record a confidential communication without the consent of all parties. Body cameras that capture audio in private areas implicate §632 — know whether your company policy or a posted written notice supplies the needed consent.
- Privacy crimes. Penal Code §647(j) makes it a crime to photograph or record a person in a place where they have a reasonable expectation of privacy — restrooms, dressing rooms, hotel rooms — even with no audio.
- Treat images as evidence. Do not edit them, do not post them to social media, and turn them over to your supervisor with a clear chain of custody.
Write and photograph as if a judge will read and view it tomorrow — because one might.
California worked example
At 9:42 p.m. a guard hears glass break near the loading dock, moves to Yellow-to-Orange, and sees a man throw a laptop bag over a fence and run west toward Elm Street in a gray hooded sweatshirt.
The report writes itself if the observation was disciplined. When: 9:42 p.m. (from the radio log). Where: northeast loading dock, exterior. Who/What (facts): "I heard glass breaking; I observed a male adult, approximately 20–30, ~5'10", medium build, gray hooded sweatshirt, dark pants, throw a dark laptop bag over the north fence and run west on Elm Street." Suspect description head-to-toe, finishing with direction of travel (west). Vehicle, if one was used, in CYMBALS order with the plate captured first. The guard does not write "the burglar" (a conclusion) but "a male adult who threw a bag and fled." If the guard used a phone to photograph the broken window, those images are evidence — unedited, handed to the supervisor, not posted anywhere. Notes taken now let the guard refresh recollection (Evidence Code §771) if called to testify next year.
Key numbers & deadlines
Awareness models: Cooper's color codes (White / Yellow / Orange / Red — operate in Yellow); OODA loop (Observe, Orient, Decide, Act). Vary patrol patterns; use all senses. Report structure: 5W + H (Who, What, When, Where, Why, How); chronological, specific times/names/locations, facts over conclusions. Descriptions: suspect head-to-toe, ending with direction of travel; vehicle CYMBALS (Color, Year, Make, Body, All-other, License, State). Plate beats all other IDs. Recording law: audio = two-party consent, Penal Code §632 (crime to record a confidential communication without all-party consent). Penal Code §647(j) — criminal invasion of privacy (restrooms, dressing rooms, etc.). Treat images as evidence (no edits, chain of custody). Testimony: contemporaneous notes refresh recollection — Evidence Code §771.
Named exam traps
- "A good patrol follows the same reliable route every time." No — predictable patrols are exploitable. Vary route and timing.
- "Write your conclusion so it's clear ('he was drunk / he was the thief')." No — write facts ("said he had three beers"; "threw a bag and fled"). Conclusions belong to others.
- "Guess the make and model of the gun so the report looks complete." No — describe what you saw. Guessing invents evidence.
- "You can record any conversation on duty." No — audio needs all-party consent (§632); recording a confidential conversation without it is a crime.
- "A photo is just a photo — edit or share it freely." No — images are evidence; no edits, no social media, keep a chain of custody. Recording in restrooms/dressing rooms violates §647(j).
- "Notes don't matter once you file the report." No — contemporaneous notes are what let you refresh recollection (Evidence Code §771) in court months later.
Key takeaways
- Patrol with varied patterns and stay in Cooper's Yellow; run the OODA loop and use every sense.
- Write 5W + H, chronological, specific, and factual — pass the stranger test.
- Describe suspects head-to-toe (end with direction of travel) and vehicles by CYMBALS, capturing the plate first.
- Audio recording needs all-party consent (§632); respect privacy (§647(j)); treat images as evidence.
- Contemporaneous notes refresh recollection at trial (Evidence Code §771).
Sources
Cited to leginfo.legislature.ca.gov (Penal Code, Evidence Code). Awareness models (Cooper's color codes, OODA, CYMBALS) are standard security-training frameworks, not statutes.
- Cal. Penal Code §632 — recording of confidential communications (two-party consent).
- Cal. Penal Code §647(j) — invasion of privacy by recording/photography.
- Cal. Evidence Code §771 — refreshing recollection from a writing.
- Security-training frameworks: Cooper's color codes; the OODA loop (J. Boyd); CYMBALS vehicle- description mnemonic; the 5W + H report standard.