Ask ten officers the difference between an incident report vs daily activity report and you will get ten versions of “one is for when something happens.” That is close enough to be useless. Plenty of things happen on a shift that belong nowhere near an incident report, and a few things that look routine absolutely require one. The distinction is not about drama. It is about who reads the document, how long it lives, and what it will be used to decide.
Two documents with two jobs
The daily activity report is a continuous record of a shift. Its job is to establish presence, sequence and the ordinary condition of the site. It is written across the whole tour, mostly about things that did not go wrong, and its reader is usually the next officer, the supervisor, or the client reviewing service.
The incident report is a standalone narrative of one event. Its job is to preserve the facts of that event in enough detail that someone with no context can evaluate it months or years later. It is written once, about a specific occurrence, and its readers may include your client’s risk manager, an insurance adjuster, law enforcement, and attorneys on both sides of a claim.
The DAR answers “what did our officer do on Tuesday night?” The incident report answers “what exactly happened at 0217 and how do we know?”
They are not competitors. Almost every incident report has a corresponding DAR entry that points to it. What you must never do is choose one instead of the other.
The graduation test
An entry graduates from the daily log into an incident report when any of these are true. Write the list into your post orders so it is not a judgment call at 3 a.m.
Someone was injured, or claimed to be. Any injury to anyone — employee, visitor, contractor, trespasser, officer — regardless of how minor it looks. “Claimed to be” matters as much as “was.” A person who says their ankle hurts and walks away has started a clock you cannot see.
Property was damaged, lost or stolen. Including damage of unknown cause. A scraped bollard nobody saw happen is still an incident report.
Force was used, or physical contact occurred. Any of it, in any direction, including force used against the officer.
Law enforcement, fire or EMS were called or arrived. Even if they did nothing. Especially if they did nothing, because the client will hear that a patrol car was on their property.
Someone was refused entry, removed, or trespassed. A warning given to a person creates a record that matters the second time.
A safety or security system failed. Alarm that did not activate, camera down, fire exit propped, access control bypassed.
A written or verbal complaint was made about the officer, the company, or the client’s staff.
A weapon was seen, mentioned or displayed.
Anything that could reasonably become a claim, a news story, or a question from the client’s legal department.
Everything else — patrols, deliveries, contractor sign-ins, a burned-out light, a car that has sat in the lot for four days — lives in the DAR.
The same event, written both ways
Take a real-shaped event: a delivery driver slips on a wet floor near the freight elevator, says he is fine, and leaves.
The DAR entry:
1442 — Responded to freight lobby, Level 1, after tenant staff reported a fall. Delivery driver (Corridor Freight) reported slipping on wet floor near freight elevator. Water present on tile, approx. 4 ft area. Driver declined medical attention and departed 1458. Area cordoned; notified building engineering at 1447. Incident Report IR-2026-0824-01 completed.
That is all the DAR needs: time, what happened, what you did, and a pointer.
The incident report covers the same event in four or five times the depth: exact time of the fall versus time of your arrival, who reported it and when, the driver’s full name, company, contact number, description of what he said in his own words, whether he was observed limping, the precise location measured against a fixed reference, the size and source of the water, the condition of the floor surface, whether a wet-floor sign was present and where, lighting conditions, the footwear the driver was wearing if you observed it, names and contact details of two tenant employees who saw it, photographs taken before and after the area was cleaned, the time engineering arrived, the time the floor was dried, who you notified in your chain and when, and the client contact notified with the time.
The DAR entry proves your officer was there and responded. The incident report is the document that will actually be read if a claim arrives eight months later, when nobody remembers whether there was a sign on the floor.
What changes the moment you open an incident report
This is the part that gets skipped in training, and it is more consequential than the writing itself.
The audience changes. A DAR is read by people who know the site. An incident report is read by people who do not, and who are looking for what is missing. Everything must be self-contained: full names, not “the tenant”; the site address, not “the building.”
The standard of precision changes. In a DAR, “around 0200” is acceptable. In an incident report, you write the time you actually observed, and if it is an estimate you say so. Never invent precision to look thorough — an invented exact time that contradicts a camera timestamp destroys the credibility of the whole document.
Notification obligations trigger. Most contracts and post orders specify who must be told, and how fast, for defined categories. Injury and law-enforcement involvement usually mean an immediate call, not an email in the morning. That escalation should already be written down with names and phone numbers.
Evidence handling begins. Photographs before the scene changes. Witness names and contact numbers collected while people are still standing there, because in ten minutes they leave and you will never get them. Video preservation requested before the system overwrites it — that request has a deadline set by the recorder’s retention, not by your convenience.
The retention period changes. DARs typically have a defined operational retention. Incident reports usually need to be kept far longer, because claim and limitation periods run for years. Retention requirements vary by state, by contract and by insurer, and you should set your schedule with counsel — this article is operational guidance, not legal advice.
The report becomes final. A DAR entry can be corrected during the shift. An incident report, once submitted, should be amended only by a dated supplemental report that shows what was added and by whom. Silently editing an incident report after the fact is the single worst thing you can do to your own defense.
The failure mode: the incident that lives only in the DAR
The common real-world failure is not an officer writing the wrong document. It is an officer writing a good DAR entry and stopping there — because the person said they were fine, because nothing seemed serious, because the shift was busy.
Two things fix it. The first is the graduation list above, posted where officers work, so the decision is a lookup rather than a judgment. The second is making the incident report easy to start at the moment of the event. An officer who has to go back to the guard shack, find a form and type a page is deciding between the report and the post. An officer who can open a full incident entry on the phone at the scene — with photos, time and location attached as they capture them — files it while the details are still true.
On the operations side, incidents need to leave the site and land somewhere a supervisor sees them in minutes, not at the end of the week. Structured daily activity reports and incident records in one queue let an account manager notice that the same freight lobby has produced three water reports this month — which turns a liability exposure into a maintenance conversation with the client before the claim, instead of after it. And when the client can see the incident in their own portal the same night, you are no longer the last person to tell them bad news.
The short version for the post orders
The DAR is the shift. The incident report is the event. Every incident gets both: a full standalone report, and a DAR line that references it by number. When in doubt, write the incident report — nobody has ever been disciplined for documenting something thoroughly, and plenty of companies have lost a claim because an officer decided it did not seem important.
If you want to see how field-written incidents and daily reports flow into one reviewable record, explore CGuardPro or get in touch.