Incident Report Writing Flashcards

A report that contains hearsay without proper attribution can:

Answer: Result in the report being inadmissible or challenged

Unattributed hearsay undermines report credibility and may render findings legally challengeable.

Which element should be included in the header of every incident report page?

Answer: Case number, date, and investigator name

Headers with case number, date, and investigator name ensure each page can be identified and attributed if separated.

In documenting a theft incident, the investigator notes the approximate value of stolen goods. This estimate should be:

Answer: Attributed to the victim or another identified source

Value estimates must be sourced and attributed to avoid appearing as speculation by the investigator.

When writing a supplement report, its primary purpose is to:

Answer: Add new information discovered after the original report was filed

Supplement reports capture new investigative findings while the original report remains unchanged.

The term 'MO' (modus operandi) in an incident report refers to:

Answer: The method or pattern of behavior used by the offender

MO describes the distinctive methods an offender uses, which can link incidents and aid in suspect identification.

Which of the following best describes a 'narrative' section in a security incident report?

Answer: A chronological, detailed account of the incident and investigation

The narrative provides a flowing, chronological account that tells the story of the incident and investigation steps.

Why should investigators avoid using abbreviations in incident reports unless they are defined?

Answer: Undefined abbreviations may confuse readers unfamiliar with the terminology

Undefined abbreviations can be misinterpreted by attorneys, courts, or others reviewing the report outside the investigator's organization.