What this is
What is a security incident report?
What is a security incident report?
A record of any event involving threat, violence, aggression, intrusion, theft, tampering or breach of access control, capturing what occurred, who was involved, the response, and the potential severity alongside the actual outcome.
Does it cover verbal aggression?
It should. Verbal abuse, threats and intimidation are the highest-volume category and the leading indicator for physical events. Programmes that record only physical incidents have removed most of their data and all of their early warning.
Scope
When is a security incident report required?
This records a security event. Investigation and the prevention plan sit alongside it.
Use this template when
- Threats, verbal aggression, intimidation and physical violence, whoever is involved
- Intrusion, trespass, tampering and breach of access control
- Theft, including product, equipment, data and personal property
- Events involving former employees, domestic situations brought into the workplace, and customers or visitors
- Near misses, including situations that escalated and were defused
Do not use it for
- The workplace violence prevention plan, which this record supports
- Investigation and root cause analysis for significant events
- Injury reporting, which follows where someone was hurt
- Human resources processes concerning employee conduct
- Information security incidents, which follow a separate regime
Compliance mapping
Which ISO 45001 cl.8.2 requirements does this satisfy?
Workplace violence obligations are emerging in specific jurisdictions and otherwise sit under general duties.
| Clause | Requirement | Where it lands |
|---|---|---|
| California Labor Code 6401.9 | Workplace violence prevention plan, violent incident log with defined fields, training and record retention | Nature of the incident |
| Labor Code 6401.9(f) | Violent incident log recording date, time, location, type, circumstances and consequences | Event |
| OSHA General Duty Clause | US route for recognised workplace violence hazards absent a specific federal standard | Event |
| ISO 45001 cl.6.1.2 | Hazard identification including human factors and behaviour, and hazards from outside the organisation | Nature of the incident |
| ISO 45001 cl.8.2 | Emergency preparedness and response, including security scenarios | Response |
| ISO 45001 cl.10.2 | Incident investigation and corrective action | Follow up |
| ISO 45001 cl.5.4 | Worker consultation, required in developing violence prevention arrangements | Follow up |
| Privacy law | Personal data restrictions where incidents involve named individuals and health information | Severity and potential |
What it does not cover
- The workplace violence prevention plan, which this record supports.
- Investigation and root cause analysis, for significant events.
- Injury reporting, where someone was hurt.
- Human resources conduct processes, which run separately.
- Information security incident reporting, a separate regime.
How to complete it
How to complete a security incident report, step by step
Capture verbal events, record the circumstances, and aggregate before drawing conclusions about people.
These are the highest-volume category and the leading indicator for physical violence. In customer-facing, healthcare and enforcement roles they are frequently regarded as an unavoidable feature of the work, which is exactly why they go unrecorded and why the escalation pattern is invisible until something physical happens.
What preceded it: a refused request, a delay, a decision communicated, an intoxicated person, a dispute over a bill, a dismissal. Circumstances are what make incidents preventable, because they identify the interactions that generate aggression and the ones that can be redesigned.
An encounter where someone was threatened and one where they were pushed frequently differ by chance rather than by anything either party controlled. Ranking by physical outcome systematically under-weights the events that came closest to serious harm, which is the same failure as in injury reporting.
Incidents concentrate at specific counters, entrances, times and transaction types. That clustering is a design finding: the layout of a reception, the position of a barrier, the lone hour before closing, the point at which a decision is communicated. It is invisible in individual reports and obvious in aggregate.
What auditors find
Most common security incident report findings
Security findings concentrate on what gets reported and where events cluster.
| Finding | Clause | What fixes it |
|---|---|---|
| Only physical incidents recorded, with verbal aggression excluded. | Labor Code 6401.9(f) | Verbal events are the leading indicator and the largest category. |
| Programme built around perimeter security with no internal risk assessment. | ISO 45001 cl.6.1.2 | Most events involve people with legitimate access. |
| Circumstances preceding the event not recorded. | Labor Code 6401.9(f) | Circumstances identify the interactions that can be redesigned. |
| Potential severity not recorded. | ISO 45001 cl.10.2 | Threatened and pushed frequently differ by chance rather than by kind. |
| Domestic violence risk not addressed in the prevention plan. | ISO 45001 cl.6.1.2 | The workplace is a predictable location; perimeter measures address it least well. |
| Verbal abuse treated as part of the job in customer-facing roles. | ISO 45001 cl.5.4 | Where it is normalised, reporting collapses and the warning signal disappears. |
| No aggregation by location, time or interaction type. | ISO 45001 cl.9.1 | Clustering is the design finding; individual reports are noise. |
| Former employee access not removed promptly on departure. | ISO 45001 cl.8.2 | Access, keys, codes and credentials, on the day rather than in the next cycle. |
| Lone and out-of-hours workers not covered by the arrangements. | ISO 45001 cl.6.1.2 | They face the same events with the slowest response available. |
| No feedback to reporters, so reporting declines. | ISO 45001 cl.5.4 | Reporting persists only where people see something happen as a result. |
Case in point
Case in point: the counter and the hour
A service operation recorded security incidents when they involved physical contact or police attendance, which amounted to a handful a year. Verbal abuse was frequent and unrecorded, on the understanding that it came with the role.
A three-month trial recording every instance of aggression, including verbal, produced a different picture. Events concentrated overwhelmingly at one counter position, in the final ninety minutes before closing, and in a specific interaction: telling someone their request could not be completed that day.
Two changes followed. The cut-off for that request type moved earlier so the conversation happened when the area was staffed and calm, and the counter layout was altered to remove a position where a member of staff could be approached from two sides. Reported aggression at that point fell substantially.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- SAF-008
- Archetype
- Record
- Record ID
- CASE-2026-000
- Scoring
- Severity band
- Direction
- High is bad
- Singleton
- No
- Basis
- ISO 45001 cl.8.2
- Links
- Feeds RCA, KnowHealth support
- Tags
- Incident, Security
- Sections
- 6
- Fields
- 36
- Follow up fields
- 10
- Repeating sections
- 0
- Links out
- 5
Event
7 fieldsCase ID*
Auto sequence. Format CASE-2026-00000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Handling Note
Access to this record is restricted. Record what happened factually and support the people involved before anything else.
Date and Time of Event*
Date Reported*
Reported By*
Person ID*
Format PER-0000.
Links to FDN-003 Person ID
Where
4 fieldsSite*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Area*
The area within the site.
Exact Location
Drop a pin for anything hard to find.
Nature of the incident
9 fieldsIncident Category*
Theft, trespass, threat, physical violence, harassment or damage.
Description*
Persons Involved Known*
External Party Involved*
Worker Affected*
- No2 pts
- Yes0 pts
Affected Worker
Person ID
Format PER-0000.
Links to FDN-003 Person ID
Support Offered
Support is offered before any investigation begins.
- Yes3 pts
- No0 pts
Support Referral ID
Links to HLT-026 Referral ID
Response
4 fieldsPolice Contacted*
Police Reference
Access Controls Reviewed
CCTV Secured
Footage overwrites quickly. Secure it the same day.
Severity and potential
6 fieldsSeverity Guidance
Rate the potential for physical harm, not the property value. A confrontation that ended in words could have ended differently.
Actual Severity*
- No injury4 pts
- First aid3 pts
- Medical treatment2 pts
- Lost time1 pt
- Fatality0 pts
Maximum Potential Loss*
The worst credible outcome had circumstances been slightly different.
- Minor4 pts
- Moderate3 pts
- Serious2 pts
- Fatal or catastrophic0 pts
Investigation Required*
Set by potential outcome, not by what actually happened.
- No3 pts
- Yes0 pts
Investigation Level
RCA ID
Format RCA-2026-00000.
Links to FDN-013 RCA ID
Follow up
6 fieldsAction Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Manager*
Signature*
SAF-008 · record IDs look like CASE-2026-000 · Feeds RCA, KnowHealth support
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The report captures a security event. What fails is the verbal category nobody recorded and the counter nobody aggregated.
Captures verbal and physical events with circumstances and potential severity, and holds the violent incident log fields where required.
Aggregates by location, hour and interaction type, converting individual events into layout and scheduling findings.
Connects incidents to support for those involved, since psychological effects follow threats as well as contact.
Delivers de-escalation and response training targeted at the interactions the data shows generate aggression.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Glossary
Security Incident Report definitions and key terms
- Workplace violence
- Acts or threats of physical violence, harassment, intimidation or threatening disruptive behaviour occurring at the workplace.
- Violent incident log
- The record required under California Labor Code 6401.9 with defined fields including circumstances and consequences.
- Type of violence
- Classification by relationship: criminal intent, customer or client, worker on worker, and personal relationship.
- Verbal aggression
- Threats, abuse and intimidation without physical contact, the highest-volume category and leading indicator.
- Circumstances
- What preceded the event, which identifies the interactions that generate aggression.
- Potential severity
- How serious the event could have been, recorded alongside the physical outcome.
- Prevention plan
- The written plan required in some jurisdictions, covering hazard identification, response, training and review.
- Clustering
- Concentration of incidents by location, time or interaction type, which converts events into design findings.
FAQ
Frequently asked questions about security incident report
Where does workplace violence actually come from?+
Predominantly from people with a relationship to the workplace: customers, clients, patients, colleagues, former employees and domestic partners. Perimeter security, access control and visitor management are designed around a stranger gaining entry, which is the smallest of the categories and the one most heavily addressed.
Should verbal aggression be recorded?+
Yes, and it is the most important category to record. It is the highest-volume data and the leading indicator for physical events. In customer-facing, healthcare and enforcement roles it is frequently regarded as an unavoidable part of the work, which is precisely why it goes unrecorded and why escalation patterns are invisible until something physical occurs.
What does California require?+
Under Labor Code 6401.9, covered employers must maintain a written workplace violence prevention plan, keep a violent incident log recording date, time, location, type, circumstances and consequences, provide annual training, and retain records. It is currently the most prescriptive workplace violence requirement in the US and there is no equivalent federal standard.
Why record circumstances?+
Because they are what make incidents preventable. Knowing that an assault occurred tells you little; knowing it followed a refused request, a delay, a bill dispute or a decision being communicated identifies an interaction that can be redesigned, rescheduled or moved to a different setting.
What happens to reporting when we start recording verbal events?+
Reported figures rise sharply, usually in the first year, because a category previously treated as normal begins to appear. That needs explaining to leadership before the change rather than afterwards, since a rising security incident count looks like a deteriorating situation when it reflects a widening lens.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Incident and Investigation
Root Cause Analysis
Finds out why something happened rather than who was involved
Corrective and Preventive Action
The single action record used everywhere
Finding
Records a single deficiency picked up during an audit, inspection or check
Effectiveness Verification
Checks whether an action actually worked, some time after it was put in place
Just Culture Determination
Separates a system problem from a genuine choice to take a risk, using a consistent set of questions
Extent of Condition Review
Asks two questions after an investigation: where else does this same condition exist, and where else could this same cause bite us
More in Incidents
Incident Report
Records any unplanned event that caused harm, damage or loss
Near Miss Report
Records something that could have caused harm but did not
First Aid Report
Records a minor injury treated on site with no further medical care needed
Medical Treatment Report
Records an injury needing treatment beyond first aid
Lost Time Report
Records an injury that keeps a worker away from work beyond the day it happened
Property Damage Report
Records damage to equipment, buildings or stock where nobody was hurt
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- California Labor Code 6401.9, workplace violence prevention
- OSHA guidance on preventing workplace violence, including for healthcare and social service workers
- ISO 45001:2018 clauses 6.1.2, 8.2 and 10.2
- NIOSH occupational violence research and typology of workplace violence
- Cal/OSHA workplace violence prevention in general industry resources
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.