Category: Security Operations

Types of security guards: the different categories of guard deployment — armed vs unarmed, static vs mobile patrol, in-house vs contract, and event or specialist coverage — each suited to a different risk profile and site.

“Security guard” covers a wide range of roles, and the types of security guards behave very differently on the ground. A static post officer at a warehouse gate, an armed guard at a cash facility and a mobile patrol covering a business park are not doing the same job, and a site that hires the wrong type ends up with either gaps in coverage or wasted spend. Here is how the main categories break down, and what actually needs to be tracked for each once they are deployed.

Why the distinction matters

Each guard type carries a different set of obligations: an armed guard needs licensing and use-of-force documentation a static unarmed officer does not; a mobile patrol officer needs GPS/checkpoint proof an in-house fixed-post guard does not; a contract guard’s hours and coverage need to be verifiable back to the client in a way an in-house employee’s do not. Picking the right type — and then managing it correctly — is a coverage decision as much as a cost one.

The Main Types of Security Guards

• Static / fixed-post guards — stationed at one location such as a gate, lobby or checkpoint. Focus is access control and visible presence rather than movement.
• Mobile / patrol guards — cover multiple checkpoints or a wider site (or multiple sites) on a moving route, usually with scheduled checkpoint visits.
• Armed guards — licensed to carry a weapon, typically deployed for high-risk sites such as cash-in-transit, banks or critical infrastructure. Comes with stricter reporting requirements.
• Unarmed guards — the majority of commercial and residential deployments: access control, visitor management, patrol and incident reporting without a weapon.
• In-house guards — employed directly by the organisation they protect, usually for a single site with long-term familiarity.
• Contract / outsourced guards — supplied by a security company under a service agreement, often covering multiple client sites; coverage and hours need to be independently verifiable.
• Event security — short-term deployment for a specific event: crowd management, access control and incident response for a defined window.
• Specialist guards — roles such as K9 units, close-protection officers or lone workers covering remote or single-officer sites, each with its own risk profile.

What has to be tracked once a guard type is deployed

Whatever the category, the operational gap is the same: proving a guard was where they were supposed to be, doing what they were supposed to do. AVES covers this across guard types rather than building a separate tool for each:

• Patrol handles mobile and multi-site guards — QR-checkpoint patrols with GPS location, scan timestamps and an optional selfie, so a moving guard’s route is provable rather than assumed.
• Daily Briefing covers static and shift-based deployments — per-shift briefing with officer attendance, a live property overview and follow-up items, so a fixed-post team stays coordinated across shift changes.
• Attendance (geofenced) applies to in-house and contract guards alike — location-verified clock-in/out, which matters most for contract guards whose hours need to be checked independently of the vendor’s own timesheet.

None of this changes the category of guard a site needs — that is a risk assessment, not a software decision — but once the type is chosen, the record-keeping requirement is the same across all of them: proof of presence, proof of activity and a shift-level audit trail.

Common Mistakes When Choosing Types of Security Guards

• Defaulting to unarmed everywhere without a real risk assessment for high-value or high-risk sites.
• Treating contract guards like in-house staff — without independent attendance verification, a client has no way to confirm the hours a vendor bills.
• No patrol proof for mobile officers — a static log entry (“did a round, all clear”) without checkpoint or GPS data is not verifiable after the fact.
• Mixing static and mobile expectations — assigning patrol-level checkpoint coverage to a single fixed-post guard, or vice versa, creates coverage gaps.

FAQ

What are the main types of security guards?
Static/fixed-post, mobile/patrol, armed, unarmed, in-house, contract, event and specialist (K9, close-protection, lone worker) guards — categorised by deployment style, licensing and employment relationship.

What’s the difference between in-house and contract security guards?
In-house guards are employed directly by the site they protect; contract guards are supplied by an outside security company under a service agreement, often covering several client sites, which means their hours need independent verification.

Do all types of security guards need the same reporting?
No — armed guards carry stricter use-of-force and licensing reporting, mobile guards need patrol/checkpoint proof, and contract guards need attendance that the client can verify independently of the vendor.

Choosing the Right Type of Security Guard for Your Site

Matching the right type of security guard to a site starts with a risk assessment, not a budget line. A retail store with high foot traffic usually needs a visible static or unarmed guard focused on deterrence and customer interaction. A cash-in-transit route or a facility holding high-value assets needs an armed guard with the licensing and reporting that role requires. A large logistics yard or a multi-building campus is better served by mobile patrol guards on a checkpoint route than by a single fixed post that cannot see the whole perimeter.

Budget and headcount matter too: a contract guarding company can flex the types of security guards deployed across a client’s sites as risk changes, while an in-house team is usually fixed in size and needs cross-training so static and mobile duties can be covered by the same staff during shortfalls. Whichever mix of types of security guards a site settles on, the deployment only works if attendance, patrol and incident activity are actually recorded — otherwise the coverage decision cannot be verified after the fact.

Follow AVES Security on Instagram for more security operations tips.

---

Managing a mix of static, mobile and contract guards across sites? Book a 30-minute demo and we’ll show how Patrol, Daily Briefing and geofenced Attendance track each deployment type. Prefer to explore first? Start a free trial.

Related reading: security guard duties and responsibilities, guard tour system, geofence attendance, and security patrol report: 7 things every report must record.

Security guard report writing is the practice of recording what an officer saw, did and handed over in plain, factual, time-stamped language that another person can rely on months later. The examples below show the same event written badly and then written well, so the difference is visible rather than theoretical.

The best security guard report writing examples are not the longest ones. Most report writing goes wrong in the same small way. The officer was there, the officer dealt with it, and then the officer wrote “checked area, all ok.” Nothing in that line is untrue. It is also worth nothing when a client asks what happened at 03:40 on the fourteenth, or when a manager is trying to work out why a door was unlocked for six hours.

Report writing is not about longer reports. It is about writing entries that still answer questions after everyone has forgotten the shift. This guide gives security guard report writing examples – weak entries rewritten into strong ones – the six rules behind each rewrite, and the mistakes that make an otherwise diligent officer look careless on paper.

Why report writing quality matters more than report volume

Before the security guard report writing examples themselves, it is worth being clear who a report is actually for. A shift report has three audiences and the officer writing it is none of them.

The first is the incoming officer, who needs to know what is still open. The second is the supervisor or client, who reads a week of entries looking for patterns. The third is whoever reads it under pressure – an insurer, a lawyer, an investigator – usually long after the event, with no way to ask a follow-up question.

That third audience is why vague entries are expensive. “Dealt with intruder” cannot be defended, explained or built on.

Compare it with this. “23:14 – observed male, approx 30s, dark jacket, attempting rear fire door. Challenged from 5m. Male left north towards car park. Door checked and secure at 23:19. Photographed door. Control informed 23:20.” can be. Same event, same officer, same amount of time to write. One holds up and one does not.

The six rules behind every good entry

Every rewrite in the security guard report writing examples below applies the same six rules.

1. Time everything. Every observation and every action gets a clock time, not “later” or “during the shift.”
2. Write what you observed, not what you concluded. “Male appeared intoxicated” is a conclusion. “Male unsteady on feet, slurred speech, smell of alcohol” is an observation. Record the observation and let the conclusion follow from it.
3. Be specific about people, places and things. A location name, a door number, a vehicle colour and partial plate, a description. “Rear car park, bay 14” beats “outside.”
4. Record the action you took, not just the event. What you did, when you did it, who you told.
5. Close the loop or say it is open. Either the matter was resolved and how, or it was handed over and to whom.
6. Keep it plain. Short sentences, no jargon, no attempt at formal register. “I proceeded to the aforementioned location” is not more professional than “I went to the loading bay.”

Security guard report writing examples

Each of the security guard report writing examples below shows the same event twice: the entry an officer typically writes at the end of a long shift, and the entry that still answers questions a year later. Read the weak line first and note what a reader would have to guess.

Example 1: a routine patrol entry

Weak: Patrolled building, all clear.

Strong: 02:00 to 02:26 – patrol of levels 1 to 3 completed, all nine checkpoints scanned. Level 2 east stairwell light out, reported as a defect. All other doors and windows secure. No persons encountered.

What changed: a time span, what was actually covered, a checkpoint count, one specific defect with a follow-up, and a clear statement that nothing else was found. The weak version cannot prove the patrol happened. The strong version can. This is the failure most security guard report writing examples are meant to cure: an entry that reads fine and proves nothing.

Example 2: an unsecured door

Weak: Found door open, secured it.

Strong: 04:12 – loading bay door 3 found unlocked and closed, not forced. No signs of entry, stock area checked and appears undisturbed. Door locked at 04:15. Photographed. Control informed 04:17. Handed to day supervisor for check against yesterday’s delivery sign-out.

What changed: which door, its exact state, what was checked as a result, the time of the fix, who was told, and what remains open for the next shift.

Example 3: an aggressive visitor

Weak: Man became aggressive at reception, was asked to leave.

Strong: 16:40 – male visitor, approx 40s, 1.8m, grey coat, refused to sign in at reception and raised his voice at the receptionist. No physical contact. Asked to leave at 16:42, left through main entrance at 16:44 on foot towards High Street. Description circulated to shift. Receptionist declined first aid, statement taken. Incident report raised 16:55.

What changed: a description, what was actually said and done, the explicit absence of physical contact, exact times for the request and the departure, and the record that followed.

Example 4: a slip on a wet floor

Weak: Someone slipped near the entrance, they were ok.

Strong: 11:05 – cleaner reported water on main lobby floor near entrance mat. 11:08 – member of public, female, approx 60s, slipped and fell on the same area. Assisted to a seat, no visible injury, declined first aid and declined ambulance. Details taken. Area coned at 11:12, cleaned and dry at 11:25. Photographs taken before and after. Medical report raised 11:30.

What changed: the hazard is recorded before the fall, the refusal of treatment is explicit, and the correction is timed and photographed. “They were ok” is exactly the sentence that causes trouble a year later.

Example 5: a handover note

Weak: Nothing much to report, see you tomorrow.

Strong: Handover 07:00 to incoming officer. Open items: level 2 stairwell light still out, defect logged, contractor due today. Loading bay door 3 under review by day supervisor. Radio 4 intermittent, swapped for spare, fault logged. All keys returned except server room key, signed out to facilities at 06:30, due back 09:00.

What changed: a handover that lists what is open, what is already logged, and what is outstanding with a name and a due time.

Where these entries actually live

Good security guard report writing examples are only half the job. The rules above are the same whether the entry goes in a paper book or an app. What changes is whether the entry can be trusted afterwards.

AVES holds the free-text half in a pocket book – a timestamped running log an officer writes through the shift, exactly where entries like examples 1 and 2 belong. Structured events go into their own forms: an incident form for example 3, with the 6-sided photo capture plus video and audio, the findings and the actions taken.

Patrol records carry the checkpoint scans, the GPS location and time of each scan, the waypoint start and end times and the distance covered, so an entry like example 1 is backed by scan data rather than by the officer’s word alone.

The daily briefing carries the shift’s officers and attendance, the discussion topics and a follow-up list where each item has a status and a remark – which is where the open items in example 5 belong so they survive the handover.

The practical effect is that a well-written entry is no longer just well written. It is timestamped, attributed to a named user, attached to photographs, and impossible to quietly rewrite three weeks later.

One honest note on sign-off: AVES has no signature image field. A report is signed off by an accept, decline or submit action tied to a named user with a date and time, which is an audit trail rather than a scrawl.

Common report writing mistakes

These are the errors supervisors find most often when they read a month of entries against good security guard report writing examples.

Copying last night’s entry. Duplicated wording across shifts is the fastest way to destroy the credibility of an entire logbook. If two nights genuinely looked identical, the times and checkpoint counts will still differ.

Writing opinions as facts. “He was clearly lying” is unusable. What he said and what you observed are usable.

Leaving out what you did not find. “No signs of forced entry” is information. Silence is not.

Writing up at the end of the shift. Detail decays fast. Entries written six hours later lose the times, and times are the part that matters most.

Using vague quantities. “Several people,” “a while later,” “near the back.” Replace each one with a number, a time or a place name.

Never re-reading. One pass to check that every entry has a time, an action and either a resolution or a handover catches most of the above.

Frequently asked questions

What should a security guard report include?

The time of each observation and action, the location, factual descriptions of any people or vehicles involved, what the officer did, who was informed, and whether the matter was resolved or handed over. Conclusions should follow from recorded observations rather than replace them.

How do you write a good security guard report?

Write in plain language, time-stamp everything, describe what you observed rather than what you assumed, be specific about places and descriptions, record the action you took, and state clearly whether the matter is closed or still open. Working from security guard report writing examples like the five above is the quickest way to calibrate.

Where can I find good security guard report writing examples?

The five security guard report writing examples above cover a patrol, an unsecured door, an aggressive visitor, a slip and a handover. A short one: “04:12 – loading bay door 3 found unlocked and closed, not forced. Stock area checked and appears undisturbed. Door locked at 04:15. Photographed. Control informed 04:17. Handed to day supervisor.” It gives a time, a specific location, an observed state, an action, a notification and a handover.

How long should a security guard report be?

Long enough to answer who, what, where, when and what was done. A routine patrol entry may be two lines. An incident may take a paragraph plus a separate incident form. Length is not the measure – answerability is.

Should reports record things that did not happen?

Yes, where it matters. “No signs of forced entry,” “no persons encountered,” “declined first aid” are all meaningful records. Absence noted at the time is evidence. Absence left unwritten is a gap.

See how a pocket-book entry, a patrol scan and an incident report link together on the real screens. Book a 30-minute AVES demo and we will walk you through the actual guard-app and admin screens, not a mock-up. Book a demo or start a free trial.

Internal links: Security Reporting Software (hub) · Security Daily Activity Report · Pocket Book · Daily Briefing · Incident Reporting Software (related hub) · Security Guard Logbook. External: AVES on Instagram (DoFollow).

A workplace violence prevention plan is a written document that sets out how an organisation identifies the risk of violence at its sites, what staff must do when a threat appears, how every incident and near miss is recorded, and who reviews the record afterwards. It is a prevention and response system, not a policy statement filed in a drawer.

Most organisations discover the gaps in their workplace violence prevention plan on the worst possible day. A contractor becomes aggressive at the gate. A dismissed employee comes back to the car park. A customer escalates at a reception desk and a lone officer has to decide, in about four seconds, whether this is a de-escalation or a code call.

What separates a plan that works from a plan that exists is whether the answers were decided in advance and whether the record holds up afterwards. This guide covers the seven parts a workplace violence prevention plan needs, the mistakes that hollow one out, and where a security platform fits – which is not writing your policy, but proving what actually happened.

Why a workplace violence prevention plan matters

Violence at work is rarely a single unexpected event. It is usually the end of a sequence: a complaint nobody logged, a threat somebody mentioned verbally, an aggressive visitor who was turned away but never recorded, a door fault that let someone into a controlled area. Each one on its own looks minor. Together they are a pattern – and a pattern is only visible if the individual events were written down.

That is the first reason a plan matters. It forces the low-level events into a record where the pattern can be seen before it escalates.

The second reason is legal exposure. Where an incident goes to an insurer, a regulator or a court, the questions are predictable. Did you assess the risk. Did staff know what to do. Was the earlier warning reported. What did you do about it. An organisation that can answer those with dated records is in a very different position from one answering from memory.

The third reason is the people on shift. Guards, receptionists and lone workers are the ones who meet the threat first. A plan tells them what is expected of them, which is the difference between a considered response and an improvised one.

How a workplace violence prevention plan works

A plan runs as a loop, not a document. It has four moving parts.

Assess. Identify where violence is plausible at each site – the gate, reception, cash handling, night shifts, lone-worker posts, car parks – and what makes each one riskier.

Prevent. Put the controls in place that lower that risk: access control at entry points, working panic buttons and intercoms, defined lone-worker posts, and briefings that tell the shift what to watch for today.

Respond. Define what happens the moment a threat appears. Who is called, what code is activated, who takes command, who meets the emergency services, and what the person on the spot does while that is happening.

Record and review. Capture the event while the detail is fresh, investigate it, decide the corrective action, and close it with a named reviewer. This is the half that most plans skip and the half that determines whether anything improves.

The first three are written by your organisation. The fourth is where a system earns its place, because it is the part that depends on a record being made consistently, under pressure, by whoever happened to be on duty.

The 7 parts every workplace violence prevention plan needs

Use this as a checklist against your current plan. Each part maps to what AVES actually records.

1. A site-by-site risk assessment. Not a corporate statement – a list of the specific posts and situations where violence is plausible, and the control applied to each. A plan that does not name locations cannot be acted on by the people standing in them.
2. Definitions and a reporting threshold. Staff need to know what counts. Verbal abuse, threats, intimidation, physical contact and property damage should each be named, with a clear instruction that the low-end events get reported too. If only assaults get reported, you have deleted your own early-warning data.
3. A reporting channel that works on shift. A form the guard can complete on the phone at the post, not a template on an office PC. In AVES, a violent or threatening event is captured on an incident form, with the 6-sided photo capture plus video and audio for evidence, the findings, the actions taken and a police-report reference where one exists. A verbal account that never becomes a record is a gap in the plan.
4. Witness and statement capture. The account of the person who was there, taken while it is fresh. AVES has a dedicated security and witness statement form for exactly this, so the bystander’s version sits alongside the officer’s rather than being lost. Two independent accounts recorded on the day are worth far more than one recollection three weeks later.
5. Near-miss and hazard reporting. The threat that did not land, and the physical condition that makes violence easier – a jammed door, a broken intercom, a dead panic button, an unlit car park. AVES records these as safety and defect reports, each carrying a hazard reference, photos, resolved-state photos and a reviewer sign-off, so the fix is evidenced rather than assumed. The six equipment checklists cover the emergency telephone, electro-magnetic door, emergency door, intercom, panic button and radio on a fault to action to review cycle. If your panic buttons are not on a checked cycle, your escalation path is a hope.
6. An emergency code and escalation path. One agreed trigger, one command point, one set of roles. AVES models this as a code activation record: the command centre, the emergency response and crisis management team rosters, the arrival of ambulance, police or fire, and a narration of how the event unfolded. Recording arrivals and timings matters because after a serious event the timeline is the first thing anybody asks for.
7. Briefing, follow-up and review. The plan has to reach the shift that is standing on site now. The AVES daily briefing carries the shift’s officers and attendance, discussion topics and a follow-up list where each item has a status and a remark – so “watch the east gate, we had an aggressive visitor last night” is a tracked item rather than a passing comment. Review then closes the loop: incidents and near misses are read together, and the controls in part 1 are changed when the record says they should be.

A plan with parts 1, 2 and 6 is common. A plan with all seven is rare, and it is the reporting and review parts – 3, 4, 5 and 7 – that make the difference in practice.

Common mistakes that hollow out a plan

Writing a policy instead of a procedure. A document that states the organisation does not tolerate violence commits to a value but tells nobody what to do at 02:00. Every section should end in an action by a named role.

Setting the reporting threshold too high. If staff only report incidents that result in injury, the near misses and verbal threats vanish, and with them the pattern that would have predicted the serious event.

Keeping the record on paper. A paper incident book at a post has no photographs, no timestamps that cannot be rewritten, and no way for a supervisor at another site to see it. It also tends to be the item that goes missing after a contested event.

Never closing an item. Reports go in, nothing visibly comes back, and staff stop reporting. Follow-up with a status and a named reviewer is what keeps the channel alive.

Reviewing annually and nowhere else. A plan reviewed once a year is a plan that stays wrong for up to twelve months. Incidents and defect reports should feed the review continuously.

Where AVES fits

To be direct about scope: AVES does not write your workplace violence prevention plan and does not author policy. What it does is hold the operational half – the part that has to happen on shift, under pressure, and survive scrutiny afterwards.

That means incident and witness statements captured at the post with photo, video and audio evidence attached. Safety and defect reports that carry a hazard through to a photographed resolution with a reviewer’s sign-off. Equipment checklists that keep panic buttons, intercoms and emergency doors on a fault to action to review cycle. Code activation records that capture command, the response-team roster, emergency-service arrivals and the narration. Daily briefings that push the day’s risk to the shift and track the follow-up.

One honest note on how sign-off works: there is no signature image anywhere in AVES. Sign-off is an accept, decline or submit action tied to a named user with a date and time – an audit trail rather than a scrawl, which is both harder to dispute and easier to search when someone asks who reviewed what.

Frequently asked questions

What is a workplace violence prevention plan?

It is a written plan setting out how an organisation identifies the risk of violence at its sites, prevents it, responds when it occurs, and records and reviews every incident and near miss. It covers prevention, response and the record, not just a statement of policy.

What should a workplace violence prevention plan include?

A site-by-site risk assessment, clear definitions and a low reporting threshold, a reporting channel staff can use on shift, witness statement capture, near-miss and hazard reporting, an emergency code and escalation path with named roles, and a briefing, follow-up and review cycle.

What is the difference between a workplace violence prevention plan and a policy?

A policy states the organisation’s position on violence. A plan tells named roles what to do, in what order, and how the event gets recorded. A policy without a plan gives staff nothing to act on.

How often should the plan be reviewed?

At a fixed interval and after every reported incident or significant near miss. A plan reviewed only on an annual cycle can stay wrong for a year, which is why the incident and defect record should feed the review continuously.

Does AVES write the plan for us?

No. AVES is the record and response layer around the plan. It captures incidents, witness statements, near misses, equipment faults, code activations and briefings, so the plan you write is actually executed and evidenced on site.

See how an incident, a witness statement and a code activation are recorded on the real screens. Book a 30-minute AVES demo and we will walk you through the actual guard-app and admin screens, not a mock-up. Book a demo or start a free trial.

Internal links: Incident Reporting Software (hub) · Incident Report Form · Near Miss Report Form · Use of Force Report · Witness Statement Form · Security Guard Logbook (related hub). External: AVES on Instagram (DoFollow).

A key sign out sheet is a running log that records who took a key, when they took it, when it is due back, and whether it was returned. It turns shared keys into an accountable custody trail instead of a set of guesses about who last held the master.

Every site runs on keys. A master set, a server-room key, a gate padlock key, a store cupboard, a set of spares in the guardhouse drawer. The moment more than one person can pick up a key, someone has to be able to answer a simple question: who has it now, and who had it last. A key sign out sheet is how that question gets a real answer instead of a shrug.

Done well, a key sign out sheet is the difference between “the server-room key is missing and nobody knows who touched it” and “the key went out to Officer Rai at 19:04, was due back at 07:00, and was returned to the incoming supervisor at 06:52.” This guide covers the eight columns a key log actually needs, the mistakes that make one useless, and how AVES turns the paper version into a system that will not let a key quietly disappear.

Why a key sign out sheet matters

Keys are cheap to cut and expensive to lose. A single lost master key can force a lock change across a whole floor or site, and the replacement cost is the smallest part of the bill. The real exposure is accountability. When a client asks who had access to the plant room on Tuesday night, “we think it was the night team” is not an answer, it is a liability.

A proper key sign out sheet does three things at once. It fixes responsibility, so the person holding a key is on record by name. It surfaces problems early, because an overdue key shows up before it becomes a lost key. And it creates a defensible record, so when a key goes missing you can show exactly when it left, who signed for it, and what happened next. That record is what protects the guard, the supervisor and the company when a dispute lands.

How a key sign out sheet works

The flow is simple and it is the same on paper or in an app. A key is requested, it is issued to a named person, the issue is stamped with the time, and the entry stays open until the key is returned and checked back in. At any moment a key is either out or in, and every change of hands is tied to a person and a timestamp.

Paper handles the first half of that well enough. Where it falls down is the second half, the return. A paper sheet has no way to flag a key that never came back, no way to tie a loss to a recorded fine, and no way to stop a row being quietly rewritten. That is the gap a system closes, and it is worth understanding the columns first because the columns are the same either way.

The 8 columns every key sign out sheet needs

A key log is only as good as the fields it forces people to fill in. These are the eight that matter, mapped to how AVES records them in its key control workflow.

1. Key identifier or type. Which key is going out, named so it cannot be confused with another. AVES records a key type against each key so “master B” and “store cupboard 3” are never mixed up. Vague entries like “the key” are useless when there are twenty on the board.
2. Availability status. Whether the key is on the board and free to issue, or already out. AVES tracks key availability so a supervisor can see at a glance what is in and what is out before promising a key to anyone.
3. Issued to. The named person the key is going to. AVES captures who the key is requested to, so a key is tied to an individual and not to a shift or a team.
4. Accepted by, with date and time. Who actually took the key and when. AVES stamps the handover with the accepting person plus the accepted date and time, so the moment a key changes hands is on record to the minute, not just to the day.
5. Returned by. Who brought the key back and closed the loop. AVES records the returning person against the entry, so the return is a named action rather than an assumption that it must have come back.
6. Expected return, and overdue flag. When the key is due and whether it has passed that point. This is what lets a supervisor chase an overdue key before it becomes a lost key, which is the whole point of a log rather than a list.
7. Loss trail. What happens when a key does not come back. AVES records a lost date and, through the same workflow, a recorded fine amount, the person who issued the fine, and a receipt number, so a loss is documented and closed rather than noted and forgotten.
8. Status. Whether the entry is open, returned or lost. AVES carries a status on every key entry so the log always shows the true state of each key, and an open entry is a live question, not a stale row.

Those eight columns are the spine of any template, whether you build it in Excel, print it as a PDF, or run it in an app. If your current sheet is missing the return column and the status column, it is a sign out sheet in name only, because it can tell you what left but never what came back.

Common mistakes that make a key sign out sheet useless

The most common failure is no return column. Plenty of sheets record beautifully who took which key and then have nowhere to record that it came back, so every key looks permanently checked out and the log tells you nothing.

The second is no expected-return or overdue view. If nothing flags a key as late, a missing key is only discovered when someone needs it, which is always the worst possible moment. An overdue flag turns a lost key into an overdue key you can still chase.

The third is an editable, unstamped record. A paper row can be rewritten and a shared spreadsheet can be quietly changed, which is exactly the wrong property for a custody record. Entries need to be stamped with who and when, and they need to be hard to alter after the fact.

The fourth is treating a signature scribble as proof. A signature on paper proves very little six months later. It is worth being clear here: AVES does not capture a signature image. Instead, sign-off is an accept, decline or submitted action tied to a named user with a date and time, an audit trail rather than a scrawl, which is both harder to forge and easier to search.

How AVES turns the key sign out sheet into a system

AVES runs keys through a dedicated key control workflow rather than a loose form. A key is requested, issued to a named person, and returned, with each step tied to a user and a timestamp. When a key is not returned, the same workflow records the lost date, a fine amount, the person issuing the fine and a receipt number, so the loss is handled as a closed process rather than a note in a margin.

The point is not the individual field names. It is that every key movement is tied to a named person and a timestamp, the return half of the loop is enforced rather than optional, and the record cannot be quietly rewritten. That is what a paper sheet can never give you: not a prettier form, but a log you can actually stand behind when a client asks who had the key.

One honest note on scope. AVES records these key movements as they happen through the guard app, with the request, issue, return and lost-key trail described above. It records each key as it moves rather than presenting a single self-reconciling asset register of every key on site. What ships today is the accountable trail for each key as it is issued and returned.

Key sign out sheet vs a key control policy

A key sign out sheet is the running sheet you fill in every time a key changes hands. A key control policy is the rulebook behind it – who may hold which keys, who authorises an issue, how long a key can be held and how often the board is audited. This page is the sheet itself: the columns and a filled example you can copy. For the policy, authorisation levels and audit cadence that sit around it, see our full guide to key control.

Key sign out sheet template: a worked example

Here is how the eight columns look filled in for a single day on one board. Notice the second row: the key is out past its expected return with no return time, so it should flag as overdue – the one thing a paper sheet can never do for you.

Key	Availability	Issued to	Accepted (date / time)	Expected return	Returned by (time)	Status
Master B	Out	Officer Rai	22 Sep, 07:04	22 Sep, 15:00	Officer Rai, 14:52	Returned
Server room	Out	Officer Lee	22 Sep, 19:04	23 Sep, 07:00	—	Open (overdue)
Store cupboard 3	Lost	Officer Chan	20 Sep, 09:10	20 Sep, 17:00	—	Lost (fine issued, receipt 0142)

Copy these columns into a printable or Excel sheet and it will do the job on a small, single-site board. The moment keys move across shifts or sites – or you need an overdue key flagged automatically and a lost key tied to a recorded fine – a static sheet stops keeping up, which is where a system that stamps and locks each row earns its place.

FAQ

What is a key sign out sheet?
It is a log that records who took a key, when they took it, when it is due back, and when it was returned. It exists to fix responsibility for shared keys and to create a record you can rely on if a key is lost.

What columns should a key sign out sheet have?
At minimum: key identifier, availability status, who took it, accepted date and time, who returned it, expected return, a loss trail for keys that do not come back, and a status column. Missing the return and status columns is the most common reason a key sheet fails.

Is an Excel or PDF key sign out sheet good enough?
A printable or Excel template is fine for a small, single-site setup and it is a good starting point. It breaks down when keys move often, across shifts or sites, because a spreadsheet cannot flag an overdue key, cannot tie a loss to a recorded fine, and can be edited after the fact. At that point a system that stamps and locks each entry is worth the switch.

How does AVES handle a lost key?
The key control workflow records a lost date against the entry, then a fine amount, the person issuing the fine and a receipt number, so the loss is documented and closed. Sign-off throughout is a recorded accept or submit action rather than a signature image.

---

See the key trail on the real screen. Book a 30-minute AVES demo and we will walk you through how a key is requested, issued, returned and, if lost, fined and closed, with the actual guard-app screens, not a mock-up. Book a demo or start a free trial.

Related reading: Key Control · Key Control Software · Shift Handover Checklist. Follow AVES on Instagram.

An equipment sign out sheet is a running log that records who took a piece of kit, when they took it, the condition it was in, and whether it came back. It turns shared gear — radios, torches, keys, body cameras, first-aid bags — into an accountable trail instead of a guessing game.

Every security operation runs on shared equipment. A handful of radios, a set of master keys, a thermal torch, a body-worn camera, a first-aid kit that has to be complete when the next shift needs it. The moment two guards share one radio across a shift change, someone has to know who has it now — and who had it when it stopped working. An equipment sign out sheet is how that question gets answered.

Done well, it is the difference between “the radio is missing and nobody knows who touched it last” and “the radio went out to Officer Rai at 19:04, came back at 07:12 with a cracked antenna, logged by the incoming supervisor.” This guide covers the eight columns a checkout log actually needs, the mistakes that make one useless, and how AVES turns the paper version into a system that will not let an item quietly disappear.

Why an equipment sign out sheet matters

Shared kit is expensive and it is easy to lose. A single lost radio or master key set is a direct replacement cost, and a lost key can force a lock change across a whole site. But the bigger cost is accountability. When a client asks “who had access to the server-room key on Tuesday night,” a shrug is not an answer — it is a liability.

A proper sign out sheet does three things at once. It fixes responsibility, so the person holding an item is on record. It surfaces damage early, because condition is checked at issue and return rather than discovered later. And it creates a defensible record, so when something is lost or broken you can show exactly when it left, who signed for it, and what state it was in. That record is what protects the guard, the supervisor and the company when a dispute lands.

How an equipment sign out sheet works

The flow is simple and it is the same whether you run it on paper or in an app. An item is issued to a named person, its condition and identifiers are recorded, and the entry stays open until the item is returned and checked back in. The item is either out or in at any moment, and every change of hands is stamped with who did it and when.

Paper handles the first half of that well enough. Where it falls down is the second half — the return. A paper sheet has no way to flag an item that never came back, no way to attach a photo of the damage, and no way to stop the row being quietly rewritten. That is the gap a system closes, and it is worth understanding the columns first because the columns are the same either way.

The 8 columns every equipment sign out sheet needs

A checkout log is only as good as the fields it forces people to fill in. These are the eight that matter, mapped to how AVES records them.

1. Item name or description. What is going out — “Motorola handheld radio,” “master key set B,” “first-aid grab bag.” In AVES this is the item line on a Gate Pass or the item name in a shift handover’s equipment list. Vague entries like “radio” are useless when there are six of them.
2. Serial or asset number. The unique identifier that ties the row to one physical object. AVES stores a serial number against issued items so “radio 4” and “radio 5” never get confused, and a returned item can be matched to the exact one that left.
3. Quantity and condition at issue. How many, and what state they are in. Shift handover records a count and a condition per item so the person receiving kit is signing for its condition, not just its existence — a scratched torch noted at issue is not a dispute at return.
4. Issued to (collected by). The named person taking the item. AVES captures this as the collected-by field on a Gate Pass, so the item is tied to an individual, not to “the night team.”
5. Date and time out, and who issued it. When the item left and which supervisor released it. AVES stamps the checkout with the issuing user and a checked-by record, so there are two names on every issue — the person taking it and the person releasing it.
6. Expected return. When the item is due back. This is what lets a supervisor spot an overdue item before it becomes a lost item, rather than finding out at the end of the week.
7. Returned date, by whom, and return condition. The other half of the loop. AVES records the return date and the returning person, and — importantly — supports a photo of the item as it comes back so “it was already cracked” can be checked against how it went out.
8. Status and loss trail. Whether the entry is open, returned, or lost — and if lost, the follow-up. AVES carries a status on every item and, through its key control workflow, a lost-item trail with a recorded fine amount and receipt number so a loss is documented and closed, not just noted and forgotten.

Those eight columns are the spine of any template — whether you build it in Excel, print it as a PDF, or run it in an app. If your current sheet is missing the return condition and the status column, it is a sign out sheet in name only.

Common mistakes that make a sign out sheet useless

The most common failure is no return column. Plenty of sheets record beautifully who took what, and then have nowhere to record that it came back — so every item looks permanently checked out and the log tells you nothing.

The second is skipping condition at issue. If you only note condition on return, every bit of damage becomes an argument. Recording it at both ends removes the dispute entirely.

The third is an editable, unstamped record. A paper row can be rewritten and a shared spreadsheet can be quietly changed, which is exactly the wrong property for an accountability record. Entries need to be stamped with who and when, and they need to be hard to alter after the fact.

The fourth is relying on a signature scribble as proof. A signature on paper proves very little six months later. It is worth being clear here: AVES does not capture a signature image. Instead, sign-off is an accept, decline or submitted action tied to a named user with a date and time — an audit trail rather than a scrawl, which is both harder to forge and easier to search.

How AVES turns the equipment sign out sheet into a system

AVES records equipment movement across a few connected workflows rather than one loose form. Items going out through a controlled point are logged as a Gate Pass, with the item list, serial numbers, photos at issue, the person collecting, the person checking, and a return record with a return photo and status. Kit passed between shifts is captured in the shift handover, where each item carries its count and condition and the incoming guard acknowledges it. Keys run through a dedicated key control workflow with request, issue, return, and a lost-key trail that records a fine amount and receipt number.

The point is not the individual field names — it is that every movement is tied to a named person and a timestamp, the return half of the loop is enforced rather than optional, and the record cannot be quietly rewritten. That is what a paper sheet can never give you: not a prettier form, but a log you can actually stand behind when a client asks who had the key.

One honest note on scope: AVES records these movements as they happen through the guard app. It does not auto-reconcile a full equipment register on its own — that roll-up view is on the roadmap, not shipped today. What ships today is the accountable trail for each item as it moves.

Frequently asked questions

What is an equipment sign out sheet?

It is a log that records who took a piece of shared equipment, when they took it, the condition it was in, and when it was returned. It exists to fix responsibility for shared kit and to create a record you can rely on if something is lost or damaged.

What columns should an equipment sign out sheet have?

At minimum: item name, serial or asset number, quantity and condition at issue, who took it, date and time out, expected return, actual return date and condition, and a status column. Missing the return and status columns is the most common reason a sheet fails.

Is an Excel or PDF equipment sign out sheet good enough?

An Excel or PDF template is fine for a low-volume, single-site setup and it is a good starting point. It breaks down when items move often, across shifts or sites, because a spreadsheet cannot flag an overdue item, cannot attach a photo of damage, and can be edited after the fact. At that point a system that stamps and locks each entry is worth the switch.

How does AVES prove an item was returned?

Each return is recorded against a named person with a date and time, a status change, and — for gate-pass items — a photo of the item as it came back, so its return condition can be checked against how it left. Sign-off is a recorded accept or submit action rather than a signature image.

See the equipment trail on the real screen

Book a 30-minute AVES demo and we will walk you through how a gate pass, a shift handover and a key issue are logged, returned and closed — with the actual guard-app screens, not a mock-up. Book a demo or start a free trial. Follow AVES on Instagram for more guard-ops guides.

An employee write up form is the written record that documents each step of progressive discipline, from a first verbal conversation to a final warning before dismissal. Its value is not in the form itself but in the process behind it: a defensible write-up shows that the employee was told what went wrong, given a chance to respond and moved through fair, escalating stages by a named manager on a recorded date.

Most security supervisors reach for an employee write up form only when a situation has already gone wrong. A guard has been late four times, a client has complained twice, and now someone needs to be removed from site. The write-up gets filled in that afternoon, backdated in spirit if not on paper, and filed. Months later a dismissal is challenged and the same question always lands: where is the trail that shows this was fair?

The form is the easy part. Downloading a template and typing “poor performance” takes two minutes. The hard part is that an employee write up form has to prove a process happened, and a single sheet produced at the end proves nothing except that someone wanted the employee gone.

This guide walks through the six steps of a defensible write-up process, from the first verbal warning to the final notice, and what each stage has to record to hold up when someone reads it who was not there.

Why a single write-up form is not enough

Discipline that stands up to challenge is progressive. It gives an employee fair warning and a real chance to correct course before the consequences become serious. An employee write up form produced in isolation, with no earlier stages behind it, looks exactly like what it often is: a decision made first and documented afterwards.

Progressive discipline protects two people at once. A complete employee write up form tells the employee precisely what to stop doing and by when, and it tells your future self why the decision that followed was reasonable. When only the final form exists, both of those break down.

Three failures show up again and again:

• The write-up appears from nowhere. There is no record of the verbal conversation that should have come first, so the written warning reads as the opening move rather than an escalation.
• The steps are not dated or linked. A verbal note lives in one place, the written warning in another, the incident that triggered it in a third. Nobody can reconstruct the sequence in order.
• The employee never acknowledged it. A form sits on file with no sign the employee saw it, read it or had the chance to add their side.

Each of these is a recording failure, not a judgement failure. The supervisor usually made the right call. The employee write up form simply did not capture the process that made it fair.

The 6-step employee write up process

A fair write-up process moves through escalating stages. Not every issue travels the full distance; a serious safety breach can start further along. But the stages, and the record each one leaves, stay the same.

Step 1 — Verbal warning

The first conversation is informal but it should not be invisible. A supervisor raises the issue directly, states the standard that was missed and confirms what needs to change. Even though it is spoken, log a short dated note: who spoke to whom, about what and when. This note is what turns a later written warning into a genuine second step rather than a first strike.

Step 2 — Written warning

If the behaviour continues, the issue moves to a formal written warning. This is where a structured employee write up form earns its place. It records the staff member, the department and designation, the date and time, the specific conduct or performance standard that was missed, and the improvement expected. This is the fields-heavy stage, and the fields matter enough to cover on their own: see our guide to the employee warning notice for the nine details every written warning has to carry.

Step 3 — Employee response

A defensible process gives the employee a chance to respond before the record is closed. They may accept the account, dispute it or add context you did not have. Capturing that response, and the fact it was invited, is what separates a fair notice from a one-sided one. In AVES this is handled through the acknowledgement trail rather than a signature image, which we cover below.

Step 4 — Final written warning

When earlier stages have not corrected the behaviour, a final warning states plainly that the next step is dismissal. It references the earlier stages by date so the escalation is visible in one place, restates the standard and sets a clear review point. The value here is entirely in the linkage: a final warning that cannot point back to its predecessors is just another first warning wearing a serious title.

Step 5 — Review and decision

Before any dismissal, the sequence is reviewed as a whole. Were the stages fair, dated and acknowledged? Was the employee given a real opportunity to improve? A complete, ordered trail makes this review quick and the decision confident. A scattered one turns it into a reconstruction exercise nobody has time for.

Step 6 — Outcome record

Whatever the decision, the employee write up form is recorded and tied to the trail that led to it. If the employee corrected course, that closes the loop and protects them from an unfair reference to old issues. If the outcome is dismissal, the record shows a fair process was followed from the first verbal note onward.

What each write-up record must capture

Across those six steps, the details that make an employee write up form defensible stay consistent. A record at any stage should capture:

• The employee’s full name, identification number, department and designation
• The exact date and time the issue occurred and the write-up was issued
• A specific, factual account of what happened, not a label like “bad attitude”
• The standard, rule or post order that was not met
• Any supporting evidence, such as a photo attached at the time
• The improvement required and the review date
• Who issued the write-up, with their name, date and time
• Confirmation the employee was notified and given the chance to respond

The AVES Staff Show Cause module records these directly. It captures the staff name, staff identification number, department and designation, the date and time, the show-cause account itself, a photo taken at the point of issue, the flag confirming the employee was notified, and the name, date and time of the person who issued it. One honest note on how sign-off works: AVES has no signature-image field. Acknowledgement is a structured accept, decline or submitted state with a name, date and time attached, which is more useful in a later review than a scanned squiggle because it timestamps who acted and when.

Common mistakes that make a write-up worthless

• Starting in writing. Skipping the verbal step and issuing a formal warning first makes the whole process look punitive. Log the early conversation, even briefly.
• Recording conclusions instead of facts. “Insubordinate” is a judgement. “Refused a direct instruction to cover the north gate at 22:15” is a fact that survives scrutiny.
• Leaving the form undated or unsigned by the issuer. A write-up with no author and no date proves only that a page exists, not when or by whom it was created.
• Never linking the stages. When the verbal note, the written warning and the final warning cannot be seen in one ordered trail, each looks like a standalone first step.
• Filing it and forgetting the review date. A write-up sets an expectation to improve by a point in time. If nobody checks on that date, the process stalls and the record loses its purpose.

Frequently asked questions

What is an employee write up form?

It is the written record used to document a step in progressive discipline, from a verbal warning through to a final written warning. It sets out what the employee did, the standard they missed, what must change and who issued it, so the decision that follows can be shown to be fair.

How many warnings before termination?

There is no fixed number, and it depends on your policy and the seriousness of the conduct. A typical progression is verbal, written, then final written warning before dismissal, but a serious breach can begin at a later stage. What matters is that each stage was fair, recorded and acknowledged.

Does an employee have to sign an employee write up form?

A signature is one way to show the employee saw the write-up, but it is not the only one and refusal to sign does not void it. What counts is a record that the employee was notified and given a chance to respond. AVES captures this as a dated accept, decline or submitted acknowledgement rather than a signature image.

What should you avoid writing on an employee write up form?

Avoid labels and opinions such as “lazy” or “bad attitude”. Record specific, dated facts: what happened, when, which standard it breached and what was said. Facts survive a later review; judgements invite dispute.

Can a verbal warning be part of the record?

Yes, and it should be. A short dated note of the verbal conversation is what makes a later written warning a genuine escalation rather than a first strike.

Turn a scattered paper trail into one ordered record

An employee write up form is only as strong as the process behind it. If your verbal notes, written warnings and final notices live in different files, drawers and inboxes, the trail that proves fairness is the first thing to fall apart when it is challenged.

AVES keeps every stage in one place, dated, attributed and acknowledged, so a disciplinary decision can be shown to be fair from the first conversation onward.

Book a 30-minute demo and we will show you the actual Staff Show Cause screen and how the acknowledgement trail records who was notified and when: avessecurity.com/book-demo

Prefer to explore it yourself first? Start a free AVES account and set up your first show-cause record in minutes.

Follow AVES on Instagram for more security operations guidance.

An employee warning notice is a formal written record that tells a member of staff which rule or standard they fell short of, when it happened and what must change. It sits between a verbal conversation and a termination decision, and its value depends entirely on whether the facts, the date and the person who issued it were recorded at the time.

Most security teams only discover the weakness in their employee warning notice process at the worst possible moment: a dismissal is challenged, a client asks why a guard was removed from site, or a tribunal asks for the paper trail. The notice exists, somewhere. Nobody can find it, the copy on file has no date, and the supervisor who issued it left the company in March.

The notice itself is not the hard part. Writing “you were late three times” takes a minute. The hard part is that an employee warning notice has to survive being read months later by somebody who was not there, and that only happens when the right fields were captured at the moment it was issued.

This guide sets out the nine fields a defensible employee warning notice must carry, why each one matters and the mistakes that quietly make a notice worthless.

Why a vague employee warning notice protects nobody

A warning serves two people. It tells the employee exactly what to stop doing, and it tells your future self why the decision that followed was fair.

A vague notice fails both. “Attitude problem, spoken to” gives the guard nothing to correct, so the behaviour repeats. Then, when the behaviour repeats and you act on it, there is no record showing the employee was warned, told what to change, given a chance to respond and issued the notice by a named manager on a specific date.

Three failures show up again and again:

• The notice is verbal only. A conversation happened. There is no document, so as far as any later review is concerned, no warning was ever given.
• The notice has no date or no author. A signed page in a drawer proves somebody wrote something. It does not prove when, or by whom, or that the employee ever saw it.
• The notice is never linked to what happened next. The warning sits in one file, the incident in another, the eventual dismissal letter in a third. Nobody can reconstruct the sequence.

Each of these is a recording failure, not a judgement failure. The manager usually made the right call. The employee warning notice simply did not capture enough to show it.

The 9 fields every employee warning notice must include

These are the fields to capture at the moment the notice is issued. Skip one and you create a gap somebody else will have to explain later.

1. Staff name. Full legal name as it appears on the employment record, not a nickname or a radio callsign. If two guards share a surname on the same site, a first initial is not enough.
2. Staff ID number. The name identifies a person to you. The ID number identifies them to the system, to payroll and to whoever reads the file in two years. It is what lets you pull every notice attached to one individual instead of searching by a name that may be spelled three ways.
3. Department. A warning for a control-room operator and a warning for a mobile patrol officer sit in different operational contexts. Recording the department also lets you see whether an issue is one person or one team.
4. Designation. The role held at the time of the warning, which is not always the role held today. Somebody promoted from guard to supervisor six months later must have their notice read against the standard that applied when it was issued.
5. Date. The calendar date the notice was issued. This is the single most commonly missing field and the one that does the most damage, because without it no sequence can be established. A first warning that cannot be dated cannot be shown to precede a second.
6. Time. More precision than most templates bother with, and worth it. When a warning and an incident happen on the same day, the time is what shows which came first. It also tells you whether the notice was issued while the facts were fresh or three weeks later.
7. The show-cause statement. The substance: what the employee did or failed to do, which standard or instruction it breached, and what is required now. Write it as facts rather than characterisation. “Left post at gate 2 from 02:10 to 02:45 without informing the supervisor, contrary to the post orders issued on 3 June” is a statement somebody can respond to. “Unreliable” is not.
8. Notice photo. An image of the physical notice, or of the document as it was presented and acknowledged. Where a paper notice is still used on site, this is what stops the only copy living in a folder in a guard hut.
9. Issued by, with date and time. The named manager who raised the notice, stamped automatically. Accountability runs both ways here: it protects the employee from an anonymous warning appearing in their file, and it protects the manager by showing the notice was raised through a proper channel rather than invented after the fact.

A tenth item is not a field but a flag: a record that the employee was notified. Knowing a notice was issued is not the same as knowing it reached the person it concerns.

How AVES records an employee warning notice

AVES handles this through the Staff Show Cause module, which is the formal disciplinary notice inside the platform rather than a free-text note.

The form captures staff name, staff ID number, department and designation, the date and time, and the show-cause text itself. A photo of the notice can be attached. A notified flag records that the staff member was informed. Every notice carries an issued-by value together with the date and time it was raised, so the author and the moment are part of the record rather than something reconstructed later.

It is worth being precise about one thing, because plenty of software in this space is not. AVES has no signature-image field anywhere in the product. Acknowledgement is handled as an audit trail of accept, decline and submitted states with the associated user, date and time, not as a captured handwritten signature. If a scanned signature is a hard requirement for your legal team, attach the signed page as the notice photo and treat the system record as the index to it.

The practical gain is retrieval. Because every employee warning notice is stored against a staff ID rather than in a folder, the full disciplinary history for one person is one lookup, with dates intact and authors named. That is the thing paper cannot do, and it is the thing you need on the day somebody asks.

For the wider picture of how notices, actions and outcomes connect, see our guide to disciplinary action tracking. Where the issue is capability rather than conduct, a performance development plan is usually the more appropriate route, and a signed policy acknowledgement form is what establishes the rule existed before the breach.

Common mistakes when issuing an employee warning notice

• Writing character judgements instead of conduct. “Lazy”, “difficult”, “bad attitude”. None of these can be evidenced or corrected. Describe the behaviour, the date and the standard it breached.
• Backdating the notice. Recording a warning as issued on the day of the incident when it was actually written a fortnight later is the fastest way to lose credibility with everyone. Record the real issue date. A gap is explainable. A falsified date is not.
• Issuing a first warning that is actually a final one. If an employee warning notice says nothing about what happens if the behaviour continues, escalation later looks arbitrary. State the next step.
• Leaving no evidence the employee saw it. An employee warning notice nobody received is not a warning. Use the notified flag, and where a paper copy is handed over, capture it as the notice photo.
• Keeping the notice separate from the incident it concerns. A warning about a missed patrol and the patrol record that shows it were both created in your systems. If they cannot be read together, half the value is lost.
• Letting each supervisor use their own template. Five formats across five sites means five sets of missing fields. One structured employee warning notice form is what makes the records comparable.

Employee warning notice FAQ

What should an employee warning notice include?

Staff name, staff ID number, department, designation, the date and time of issue, a factual show-cause statement describing the conduct and the standard breached, a photo of the notice where one exists, confirmation the employee was notified, and the name of the manager who issued it with the date and time.

Does a warning notice have to be in writing?

A verbal warning may be a legitimate first step, but only a written employee warning notice creates a record you can rely on later. If it matters enough to escalate, it matters enough to write down.

How long should a warning notice stay on file?

That depends on your jurisdiction and your own policy, and it is a question for your HR or legal adviser rather than a software vendor. What software should do is make sure the notice can still be found, with its original date and author intact, for as long as your policy requires.

Can an employee respond to an employee warning notice?

They should be able to. A show-cause notice is by definition an invitation to explain. Record the response alongside the notice so the file shows both sides.

What is the difference between a warning notice and a performance development plan?

A warning addresses conduct that breached a standard. A development plan addresses capability that needs to improve. Using one where the other belongs is a common and expensive mistake.

Get the record right the first time

Every employee warning notice you issue is a bet that you will still be able to explain the decision months from now. Structured fields, a real timestamp and a named author are what let you win that bet.

Book a 30-minute demo and we will show you the actual Staff Show Cause screen, the fields it captures and how a full disciplinary history pulls up against a single staff ID.

Prefer to look around first? Start a free AVES account and set up your own notice workflow.

Follow AVES on Instagram for more security operations guidance.

A near miss report form is the record a security guard completes after a hazard almost causes harm but does not. An unlocked fire exit found on patrol, a spill left on a stairwell, a contractor working without a permit, a vehicle that nearly struck someone at a gate: none of these caused an injury this time, but each one could have. The near miss report form captures what happened, where and why, so the hazard is fixed before it turns into a real incident. This guide sets out the eight fields every near miss report form must include, the mistakes that weaken it and how to keep the record consistent across every shift and site.

Near misses are the cheapest lessons a site will ever get. They carry all the warning of a serious incident and none of the cost, but only if they are written down and acted on. A hazard that is spotted, reported and closed out is a claim that never happens. A hazard that is noticed and then forgotten is an incident waiting for its turn. The goal of a good near miss report form is simple: make reporting quick enough that guards actually do it, and structured enough that someone can act on what they report.

Why a near miss report form matters

Every serious incident is usually preceded by several near misses that went unrecorded. The value of catching them is that you fix the cause while it is still harmless, rather than after someone is hurt or something is damaged. A near miss report form is what turns a fleeting observation on a night shift into an action a supervisor can take the next morning.

Without a proper form, a site is exposed on three fronts. There is safety exposure, because hazards that are never logged are never fixed, and they recur until one of them lands. There is client exposure, because sites increasingly want proof that their security team is spotting and closing risks proactively, not just reacting after the fact. And there is operational exposure, because patterns, the same loose railing, the same blocked exit, the same blind corner, stay invisible when reports are thin or scattered. A consistent form makes near misses countable, and what gets counted gets fixed.

How a near miss report form works

A good near miss report form is completed at the moment the hazard is spotted, not remembered at the end of a shift. The guard records the facts in a fixed set of fields, attaches a photo of the hazard and submits it for review, so the right person sees it and owns the fix.

In AVES, a near miss is logged through the safety and defect reporting forms, which capture the complaint or defect against a reference and let the guard attach photos of the hazard as it was found. Where the near miss involves something more serious, such as a near-collision or an equipment failure, the incident forms add structured fields for date, time, location and type, six-sided photo capture so a hazard can be photographed from front, back, left, right, top and bottom, and attached video and audio. Both routes carry a reviewer sign-off, so once a hazard is fixed the resolution can be photographed and the record closed out by a named reviewer. Every submission carries a review trail, so it is clear who reported the near miss, who acted on it and when.

The value of that structure is that a near miss does not depend on a guard remembering to mention it. It is captured where it is seen, with the evidence attached, and it lands in front of someone who can close it.

The 8 fields every near miss report form must include

These are the fields a useful near miss report form needs. Each one closes a question a reviewer will otherwise be left asking.

1. Date, time and location. Exactly when and where the hazard was found. Precise location lets the same recurring risk at one spot be spotted across many reports.
2. Who reported it. The guard who observed the near miss, recorded clearly so the report can be followed up and so reporting is credited rather than discouraged.
3. What the hazard was. A plain description of the condition or event: a wet floor, a propped fire door, an unguarded edge, a vehicle that came too close. Facts, not labels.
4. What could have happened. The potential consequence had it not been caught: a fall, a fire that could not be escaped, a collision. This is what separates a near miss from a trivial note and sets the urgency.
5. Immediate action taken. What the guard did on the spot, such as coning off a spill, closing a door or warning a contractor. This shows the risk was contained while a permanent fix was arranged.
6. Photos of the hazard. An image of the condition as it was found, so the reviewer sees the real risk rather than a description of it. Six-sided capture is available where the hazard needs it from more than one angle.
7. Reference and category. A reference number and the type of hazard, so near misses can be grouped, counted and trended rather than sitting as one-off notes.
8. Resolution and review. What was done to fix the cause, a photo of the resolved condition where relevant, and the named reviewer sign-off that closes the record.

Common mistakes that weaken a near miss report form

The most common failure is under-reporting. Guards skip near misses because the form is slow, because nothing seemed to happen, or because reporting feels like creating work for themselves. A near miss report form that takes seconds on a phone, with the photo captured on the spot, is the single biggest fix for this.

The second is vague description. “Nearly had an accident” tells a reviewer nothing. “A pallet was left blocking the north fire exit; a person leaving in a hurry would not get through” tells them exactly what to fix and why it matters. A form should record what was seen and what could have followed, not a feeling that something was unsafe.

The third is no photo. A near miss described in words is easy to dismiss and hard to act on. A photo of the blocked exit or the spill removes the argument and gives whoever owns the fix a clear picture of the real condition.

The fourth is inconsistency between guards and sites. When everyone reports near misses differently, or some report and some do not, the numbers mean nothing and no pattern is visible. A fixed set of fields, used the same way every time, makes near misses comparable across a whole portfolio. The same discipline that makes a plain incident report form reliable applies to near misses, with the advantage that here nobody has been hurt yet.

The fifth, and the most costly, is no closeout. A near miss that is reported and never resolved is worse than useless, because it records that the site knew about a hazard and did nothing. The reviewer sign-off and the resolved photo, the same closeout discipline behind defect and damage reporting, are what turn a report into a fix.

Frequently asked questions

What is a near miss report form?
It is the record a security guard completes when a hazard almost causes harm but does not. It sets out what the hazard was, where and when it was found, what could have happened and what was done about it, supported by a photo, so the cause can be fixed before it leads to a real incident.

When should a near miss report form be completed?
As soon as the hazard is spotted, ideally on the spot while the guard is still there. Completing it immediately preserves the detail, captures the photo of the real condition and means the hazard is contained rather than left for the next person.

What is the difference between a near miss and an incident?
A near miss is an event that could have caused injury or damage but did not. An incident is one that did. The near miss report is the more valuable of the two because it lets you fix the cause at no cost, before anyone is hurt.

Who reviews a near miss report form?
A supervisor or manager reviews it through a documented review trail that records who reported it, who acted on it and when. That sign-off, together with a photo of the resolved condition, is what closes the record and proves the hazard was fixed.

What evidence should a near miss report form include?
A photo of the hazard as it was found is the most important. Where the near miss is more serious, six-sided photos, video and audio can be attached, along with a photo of the resolved condition once the fix is done.

Turn near misses into fixes, not paperwork

A near miss report form is only as strong as the structure behind it, and only as useful as the number of guards who actually bother to fill it in. Keep the eight fields the same every time, make the photo quick to capture, and route every report through a documented review with a resolved photo, and you turn the hazards your guards spot into the incidents that never happen.

Book a 30-minute demo and we will show you the actual AVES safety and incident forms, including hazard photo capture and the reviewer sign-off, on screen: book a demo. Prefer to try it first? Start free.

Follow AVES on Instagram for more security operations guidance.

A use of force report is the written record a security guard completes after using physical force during an incident. It captures what happened, why force was necessary and what followed, so the event can be reviewed fairly and defended later if it is challenged. When a guard restrains a trespasser, breaks up a fight or removes an aggressive person from a site, the report is the difference between a defensible account and a costly dispute. This guide sets out the eight fields every use of force report must include, the mistakes that weaken it and how to keep the record consistent across every shift and site.

Force incidents are rare, but they carry more legal and reputational risk than almost anything else a guard does. A vague or late report is the first thing a claimant, a regulator or an insurer will attack. The goal is simple: a report so complete and so clearly evidenced that it stands on its own months after the incident, when memories have faded and the only thing left is the record.

Why a use of force report matters

Every use of force by a security officer can be questioned. Was the force reasonable, was it proportionate to the threat and did the guard have the authority to use it. A use of force report answers those questions while the detail is still fresh, and it does so in a fixed structure that a reviewer, a client or a court can follow.

Without a proper report, a firm is exposed on three fronts. There is legal exposure, because an incomplete account is hard to defend if a complaint or a claim follows. There is client exposure, because sites want proof that their guards act within policy. And there is operational exposure, because patterns of force at a particular site or with a particular officer go unnoticed when reports are thin or missing. A consistent report turns a stressful, contested event into a documented one.

How a use of force report works

A good report is built at the point of the incident, not reconstructed from memory hours later. The guard records the facts in a fixed set of fields, attaches evidence and submits it for supervisor review. Because the structure is the same every time, nothing important is left to chance, and reviewers compare like with like.

In AVES, a use of force event is logged through the incident forms, which capture structured details such as the date, time, location and type of incident alongside the guard’s account of what happened. The forms support six-sided photo capture, so an injury, a damaged door or a recovered weapon can be photographed from front, back, left, right, top and bottom rather than from a single angle that leaves gaps. Video and audio can be attached to the same record, and the findings and actions are recorded in their own fields. Every submission carries a review trail, so it is clear who logged the report, who reviewed it and when.

The value of that structure is that the record is complete and time-stamped at source. There is no gap between the incident and the paperwork for details to slip, and there is no loose photo sitting on a personal phone with no link to the event.

The 8 fields every use of force report must include

These are the fields a defensible use of force report needs. Each one closes a question a reviewer will otherwise be left asking.

1. Date, time and location. Exactly when and where the force was used. Precise timing lets the report be matched against patrol logs, CCTV and access records.
2. Officer and people involved. The reporting guard, the subject or subjects and any other staff who took part or witnessed the event, recorded clearly enough to identify each person later.
3. Type of incident. What the event was: a trespass, an assault, a theft in progress, an ejection. This frames why force came into play at all.
4. What led to the force. The sequence of events before the guard acted, including any warnings given and any attempt to de-escalate. This is where proportionality is judged.
5. The force used and for how long. A plain description of the physical action taken, its duration and when it stopped. Restraint held for thirty seconds is a different account from restraint held for ten minutes.
6. Injuries and damage. Any injury to the subject, the guard or a third party, and any property damage, each supported by six-sided photos so the extent is visible from every angle.
7. Evidence attached. Photos, video and audio tied to the record, plus references to CCTV or other sources. Evidence held inside the report, not scattered across devices, is what makes it hold up.
8. Findings, actions and review. What was concluded, what was done next, whether police or medical services were called, and the supervisor sign-off through the review trail.

Common mistakes that weaken a use of force report

The most common failure is delay. A report written the next day loses the small details that make it credible, and a late report looks defensive. Capturing the account at the point of the incident avoids this.

The second is opinion in place of fact. “The man was aggressive” is a conclusion. “The man raised his fist and stepped towards me twice after I asked him to leave” is an observation, and observations are what survive scrutiny. A report should record what the guard saw and did, not how the guard felt about it.

The third is thin evidence. A single photo of an injury, taken from one angle, leaves room for dispute. Six-sided capture, video and audio close that gap, and keeping them inside the incident record rather than on a phone means nothing goes missing.

The fourth is inconsistency between guards and sites. When everyone writes force reports differently, reviewers cannot compare them and clients cannot trust them. A fixed set of fields, used the same way every time, removes that variation. The same discipline that makes a plain incident report form reliable applies with more force here, because the stakes are higher.

The fifth is treating the report as the whole record. A use of force event often needs a supporting witness statement form from anyone who saw it, so the guard’s account is corroborated rather than standing alone. Teams that log these consistently through incident reporting software keep every report and its evidence in one defensible place.

Frequently asked questions

What is a use of force report?

It is the written record a security guard completes after using physical force in an incident. It sets out what happened, why force was necessary, what force was used and what followed, supported by photos, video and audio, so the event can be reviewed and defended.

When should a use of force report be completed?

As soon as possible after the incident, ideally at the point it happens and while the guard is still on site. Completing it immediately preserves detail and avoids the credibility problem that comes with a late or reconstructed account.

What evidence should be attached to a use of force report?

Six-sided photos of any injury or damage, video and audio of the scene where available, and references to CCTV or other sources. Keeping the evidence inside the incident record, tied to the report, is what makes it defensible.

Who reviews a use of force report?

A supervisor or manager reviews it through a documented review trail that records who logged the report, who reviewed it and when. That sign-off is part of what makes the report stand up to later challenge.

How is a use of force report different from a general incident report?

A use of force report is a specific type of incident report focused on an event where a guard used physical force. It carries the same structured fields as a general report but places extra weight on proportionality, the force used and the evidence, because the legal exposure is higher.

Keep every use of force report defensible

A use of force report is only as strong as the structure behind it. Capture the eight fields the same way every time, attach real evidence at the point of the incident and route each report through a documented review, and you turn your most contested events into your best-documented ones.

Book a 30-minute demo and we will show you the actual AVES incident forms, including six-sided photo capture and the review trail, on screen: book a demo. Prefer to try it first? Start free.

Follow AVES on Instagram for more security operations guidance.

Most guards are never taught how a strong report reads until a claim, a complaint or a court date puts theirs under the microscope. This worked example shows you exactly what a complete, defensible entry looks like, and breaks down the eight parts that make it hold up. Copy the sample, adapt the fields to your site and you will log cleaner proof from your very next shift.

An incident report is the written record of something that went wrong on your watch: a theft, an injury, a trespass, a fire alarm, an altercation. Written well, it protects the guard, the client and the guarding company. Written badly, it becomes the weakest link in an investigation.

Why the incident report example for security guard beats a blank form

A good worked example does something a blank form cannot. A blank form tells you which boxes exist. It does not tell you how to fill them so the record survives scrutiny weeks later. That is why a worked example is worth more than any empty template: it shows the level of detail, the neutral tone and the sequencing that separate a usable record from a vague one.

Three things go wrong most often. Guards write what they concluded (“the man was clearly drunk”) instead of what they observed. They leave time gaps, so nobody can reconstruct the sequence. And they describe damage or injury in words alone, with no supporting evidence. A good example fixes all three by design.

A complete incident report example for a security guard

The sample below is a realistic, filled-out report for a common scenario: an after-hours intruder at a warehouse gate. Adapt the names, times and site details to your own.

Incident report — sample

Report number: IR-2026-0417
Date of incident: 14 September 2026
Time of incident: 02:18
Location: North goods gate, Unit 4, Riverside Distribution Park
Reporting guard: J. Okafor, badge 3391, night shift 22:00-06:00
Incident type: Unauthorised entry attempt

What happened (factual account): At 02:18 during a routine patrol of the north perimeter, I heard the sound of the goods gate chain being moved. I walked to the gate and saw one male attempting to climb the pedestrian side rail. I called out and identified myself as security. The male stopped, stepped down on the outer side and ran north along the fence line towards the canal path. I did not pursue beyond the boundary.

Description of person: Male, approximately 1.8 metres, medium build, dark hooded top, light trousers, carrying a small dark bag. Face not clearly seen.

Actions taken: Secured and rechecked the gate chain and padlock at 02:21. Radioed the control room at 02:22 to log the event. Reviewed the north gate camera and confirmed footage exists for 02:16-02:20. Increased patrol frequency of the north perimeter for the remainder of the shift.

Evidence attached: Six-sided photo set of the gate and rail, short video walk-through of the entry point, camera reference NGC-02 clip 02:16-02:20.

Witnesses: None on site. Control room operator M. Devi confirmed radio log.

Injuries or damage: No injuries. Minor scuff to the pedestrian rail paint, photographed.

Police or client notified: Client duty manager notified at 02:35. Police non-emergency reference PR-88214 logged at 02:41.

Follow-up required: Client to review whether the pedestrian rail needs a higher anti-climb section. Camera coverage of the canal path to be assessed.

This sample is worth reading back closely. Notice what it does: it records observations rather than opinions, it timestamps every action, and it points to attached evidence rather than relying on memory. That is the standard every guard report should set, and it is the bar this sample is built to.

The 8 parts every incident report includes

Whatever your site format, a defensible report covers these eight parts, and a good example hits all of them. The sample above does.

1. Report and reference details — a unique number, the guard’s name and badge, the shift.
2. When — date and exact time of the incident, not the time you sat down to write it.
3. Where — the specific location, precise enough to place on a site map.
4. What happened — a plain, chronological, factual account in the guard’s own words.
5. Who was involved — descriptions of people and any vehicles, kept observational.
6. Actions taken — what the guard did, in order, with times.
7. Evidence — photos, video, audio and any camera references that back the account.
8. Notifications and follow-up — who was told, when, and what still needs doing.

How AVES turns the example into a clean digital record

Writing a strong report on paper is hard at 02:18 in the rain. The AVES incident forms are built so the eight parts above are captured in order, on a phone, at the scene.

Every incident is logged against a report record with the date, time, location and type set as structured fields, so nothing is left to a guard’s handwriting. Evidence is not an afterthought: the form uses a six-sided photo capture, so the guard records the scene from front, back, left, right, top and bottom, and can add a short video and an audio note alongside. Findings and actions are recorded on the same record, and the report carries a review trail showing who checked it and when. Because the capture happens at the scene, the timestamps are real rather than reconstructed later.

The result is a digital record, the same as the sample above: a complete, evidence-backed record that a client, an investigator or a court can rely on, without depending on a tired guard remembering to write everything down at the end of a shift.

Common mistakes that weaken a report

• Opinions instead of observations. “He was aggressive” is a judgement. “He raised his voice and stepped towards me twice” is an observation. Stick to what you saw and heard.
• Missing or vague times. “Early hours” helps nobody. Log exact times for the incident and for each action.
• No supporting evidence. A description of damage with no photo is far easier to dispute. Capture the scene before it changes.
• Writing hours later. Memory fades and details blur. Record at or near the scene while it is fresh.
• Editing the story to look better. Never soften or embellish. An accurate record protects you; an altered one destroys your credibility.

How to adapt this example to your site

No two sites report the same way, so treat this example as a base to shape, not a form to copy word for word. Start by matching the incident types you actually see. A retail site logs shoplifting and refused-entry cases far more than perimeter breaches, while a warehouse or distribution park sees more gate and loading-bay events. Rename the incident type list so guards pick from options that fit the site rather than forcing every event into a generic label.

Next, fix the location detail to your layout. “North goods gate, Unit 4” only works if your gates are named and mapped. Agree a simple, shared naming scheme for gates, doors, floors and zones, and make sure every guard uses the same names. Vague locations are one of the fastest ways to weaken an otherwise solid report.

Finally, decide your escalation and notification rules up front. The sample notified a client duty manager and logged a police reference. Your site may need a different order: control room first, then client, then emergency services. Writing those steps into the report structure means the guard records who was told and when, every time, without having to remember the sequence under pressure.

Frequently asked questions

What should an incident report for a security guard include?

A complete incident report should include the report reference and guard details, the exact date, time and location, a factual account of what happened, descriptions of anyone involved, the actions taken with times, the supporting evidence, and any notifications and follow-up. The sample above shows each part filled in.

How detailed should a security incident report be?

Detailed enough that someone who was not there can reconstruct the sequence without asking you questions. Prioritise exact times, specific locations and observed facts over general impressions.

Should a guard write what they think happened or only what they saw?

Only what they directly saw, heard or did. Conclusions and opinions weaken a report because they can be challenged. Record the observations and let the facts speak.

How soon after an incident should the report be written?

As soon as it is safe to do so, ideally at or near the scene, which is why good training stresses speed. The longer the delay, the more detail is lost and the easier the account is to dispute.

Can photos and video be part of the report?

Yes, and they should be. Evidence captured at the scene, such as a six-sided photo set with a short video, makes a report far harder to dispute than words alone.

Ready to see it on the real screen?

Book a 30-minute AVES demo and we will show you the real six-sided evidence capture and review trail in the incident form: Book a demo. Prefer to explore first? Start free. See also our incident reporting software, the security incident report format and the witness statement form, or follow AVES on Instagram.