Writing incident reports: structure and narrative

By 4:30 on the morning of the Lakeshore Hardware break-in, the probationary officer riding with Constable Malhotra has eleven pages of notes, a dozen photographs, a seized crowbar, a backpack full of power tools and a man in a cell. None of that is yet a case. It becomes one when she sits down at the computer in the report room and writes the incident report, the formal record that will carry the investigation forward. Dev Malhotra pulls up a chair beside her. 'Your notes are for you,' she says. 'This is for everyone else. Tell it so that someone who was not there can see it.'

This lesson explains what police reports are for, the main types of report, how they are structured and how to write the narrative, the part of the report that tells the story in the officer's own words. Lesson 5 then concentrates on the language of reports: plain words, accuracy and objectivity. Lesson 6 covers the description of people, vehicles, property and scenes. Together they form the core of police writing.

What a report does

A police report has several jobs at once. It is the official record that an incident occurred and of what police did about it. It starts or continues an investigation by recording leads, witnesses and evidence. It supports decisions about charges: a prosecutor will rely on it to decide whether to file charges, and in many places a judge or magistrate will read a sworn summary of it to decide whether there is probable cause. It provides data for crime statistics, analysis and planning. It may be used by victims for insurance claims or applications for compensation. And it is a record of the officer's own conduct, read by supervisors and, if there is a complaint, by those who investigate it.

Because reports do so many jobs, agencies use a combination of structured fields and free text. The structured fields, completed through drop-down menus and forms in the records management system, capture the information that must be counted and searched: the type of offense, the date, time and location, the people involved and their roles, the property taken and its value, and the outcome. The narrative, written in full sentences, captures everything that does not fit in a box: what happened, in what order, what the officer observed and why the officer acted. In the United States, the structured fields feed the FBI's National Incident-Based Reporting System (NIBRS), which records details of every offense in an incident, not only the most serious one.

Types of police reports

Agencies use many types of report, and names vary from one service to another, but most fall into a few families. New officers should learn their own agency's forms and policies, which specify when each report is required and what it must contain.

For the Lakeshore Hardware call, the probationary officer will write the main incident report, an arrest report and a property report for the crowbar and the tools. Constable Okoro, who found the crowbar, will write a supplementary report. Later, a detective will add supplementary reports about the suspect's interview and about a second break-in that may be linked. Each report stands on its own, but each refers to the others by number so that a reader can follow the whole file.

The structure of a report

Most agencies' report formats follow a similar structure, even when the headings differ. The report opens with a short summary that tells the reader at once what the incident was and how it ended. It then sets out the details in chronological order, followed by the investigation, the evidence and the outcome. Some services prescribe headings; others leave the officer to organize the narrative. Either way, a reader should be able to find the key facts quickly and follow the story from start to finish without having to guess.

• Summary: one or two sentences giving the type of incident, the date, time and place, and the outcome. 'On Saturday, March 14, at about 0214 hrs, Lakeshore Hardware at 412 Harbor Street was broken into. A suspect was arrested at 0229 hrs on Pine Street with property taken from the store.'
• Background and dispatch: how police learned of the incident and what information the officer had on arrival. This matters because it explains why the officer acted as he or she did.
• Chronological narrative: what happened, in the order it happened, from the officer's arrival to the end of the officer's involvement, including observations, conversations, actions and the grounds for each decision.
• Investigation and evidence: interviews conducted, evidence collected and its handling, photographs taken, database checks and any other steps.
• Outcome and follow-up: arrests, charges or recommended charges, release conditions, notifications, referrals to victim services and any work still to be done.

The summary is often the only part read by busy people, such as a duty inspector scanning the night's reports or an analyst looking for patterns, so it must be accurate on its own. The narrative is read by those who need the full story. A common mistake is to put conclusions in the summary that the narrative does not support. If the summary says the suspect was 'caught in the act' but the narrative shows he was found three blocks away twelve minutes later, a defense lawyer will notice.

Writing the narrative

The narrative is the heart of the report. Professor Desjardins calls it 'the movie in words': a reader should be able to see the events as they unfolded. Most agencies now ask officers to follow a few basic conventions, which lesson 5 develops further.

• Write in the first person. 'I arrived at 0219 hrs' is clearer and more honest than 'the writer arrived' or 'this officer arrived', older conventions that some agencies have dropped.
• Write in the past tense, because the report describes events that have already happened.
• Use the active voice. 'Osei told me she saw a man run east' says who did what. 'It was reported that a man was seen running east' hides both the witness and the observer.
• Write in chronological order. Jumping back and forth in time confuses readers. If something learned later explains something earlier, say so explicitly: 'I later learned from the owner that the display had held cordless drills.'
• Use short paragraphs, one for each step or topic, so that the report is easy to follow and to quote.
• Name people consistently. Introduce each person with full name and role, then refer to them the same way throughout: 'the witness Mira Osei', then 'Osei'. Avoid switching between 'the complainant', 'the female' and 'Ms. Osei'.

The narrative must also show the officer's reasoning. Every significant decision, to detain, to search, to arrest, to use force, to release, requires legal grounds, and the report is where those grounds are recorded. A warrantless arrest requires probable cause, and a court will look for the facts that supported it in the report. A brief investigative stop under Terry v. Ohio requires reasonable suspicion, and the report should set out the specific facts that gave rise to it. It is not enough to write 'I had grounds to arrest the suspect.' The report must set out the facts that made up those grounds, so that a reader can judge them: the description broadcast, the time and distance from the store, what the man was wearing, what he was carrying and what he said.

Proving the elements

An experienced officer writes with the elements of the offense in mind. Every criminal offense is made up of elements that the prosecution must prove, and a report that leaves an element out may leave the prosecutor unable to proceed. For breaking and entering under section 2911.13 of the Ohio Revised Code, the state must prove, among other things, that the accused trespassed in an unoccupied structure by force, stealth or deception, with purpose to commit a theft offense or a felony there. Identity, date and place must always be proved too.

The probationary officer's first draft describes the broken door, the neighbor's account and the arrest, but it says nothing about who owns the store or whether anyone gave the man permission to be there, and it does not describe the property found on the man in enough detail to link it to the store. Dev Malhotra points this out. The owner, Ruth Lindqvist, must be named as the owner, and the report must record that she gave no one permission to enter. The tools must be described by brand, model and, where possible, serial number, and the report must say how they were identified as the store's: the owner recognized the price labels and the serial numbers matched the store's inventory. Without those facts, the prosecutor would have a man with some tools and a broken door, but not a break-in.

Building the timeline

Times are among the most important facts in any report, and they come from several sources that rarely agree to the minute: the officer's notes, the computer-aided dispatch system, the alarm company's records, body-worn camera time stamps, phone records and witnesses' own estimates. A good report gives times precisely and says where they came from when it matters. The probationary officer assembles the main times for the Lakeshore Hardware call from three sources and uses a short program to merge them in order and calculate the intervals between key events.

# Merge time stamps from three sources into one timeline
events = [
    ("CAD", "02:14:05", "alarm call received from monitoring company"),
    ("CAD", "02:14:40", "unit 12 dispatched"),
    ("alarm log", "02:13:51", "front door contact opened"),
    ("alarm log", "02:13:58", "glass-break sensor triggered"),
    ("BWC", "02:19:12", "unit 12 arrives, door glass broken"),
    ("notes", "02:21", "witness Osei describes male running east"),
    ("CAD", "02:22:30", "description broadcast to all units"),
    ("CAD", "02:29:15", "unit 14: male detained on Pine Street"),
    ("BWC", "02:29:40", "arrest by unit 12"),
]
def secs(t):
    parts = [int(p) for p in t.split(":")] + [0]
    return parts[0] * 3600 + parts[1] * 60 + parts[2]
events.sort(key=lambda e: secs(e[1]))
start = secs(events[0][1])
for src, t, what in events:
    m, s = divmod(secs(t) - start, 60)
    print(f"{t:8s} +{m:2d}:{s:02d}  [{src:9s}] {what}")
alarm = secs("02:13:58"); arrive = secs("02:19:12"); arrest = secs("02:29:40")
print(f"break-in to arrival: {(arrive - alarm) / 60:.1f} min")
print(f"break-in to arrest:  {(arrest - alarm) / 60:.1f} min")

02:13:51 + 0:00  [alarm log] front door contact opened
02:13:58 + 0:07  [alarm log] glass-break sensor triggered
02:14:05 + 0:14  [CAD      ] alarm call received from monitoring company
02:14:40 + 0:49  [CAD      ] unit 12 dispatched
02:19:12 + 5:21  [BWC      ] unit 12 arrives, door glass broken
02:21    + 7:09  [notes    ] witness Osei describes male running east
02:22:30 + 8:39  [CAD      ] description broadcast to all units
02:29:15 +15:24  [CAD      ] unit 14: male detained on Pine Street
02:29:40 +15:49  [BWC      ] arrest by unit 12
break-in to arrival: 5.2 min
break-in to arrest:  15.7 min

The merged timeline shows that the door opened at 2:13:51 and the glass-break sensor triggered seven seconds later, before the alarm company had even called police. The first unit arrived just over five minutes after the break-in and the arrest followed about fifteen and a half minutes after it. These intervals matter in court. The shorter the time between the break-in and the arrest, and the closer the man was found to the store, the stronger the inference that he is the person the neighbor saw. The report should therefore give the exact times and their sources, rather than writing 'shortly after' or 'a few minutes later.'

Note also that the alarm log shows the door contact opening seven seconds before the glass-break sensor triggered. That detail might mean the door was forced open and the glass broke as it swung, or it might reflect a small difference between the two sensors' clocks. The officer should not guess. The report should record both times and the source, and leave the interpretation to investigators, who may ask the alarm company about the sensors.

Before you submit

Every report should be reviewed before it is submitted, first by the officer and then, in most agencies, by a supervisor. Dev Malhotra teaches her trainees to read a report three times. The first reading checks completeness: are the five Ws and H answered, are all the elements of the offense covered, are all people, times and evidence recorded? The second checks accuracy: does every fact match the notes, the photographs and the time stamps? The third checks clarity: would a reader who was not there understand it? Reading the report aloud, or asking a colleague to read it, catches problems that the writer's eye skips over.

Supervisors return reports that are incomplete, unclear or inconsistent with other records, and new officers sometimes take this personally. Sergeant Haddad tells them it is the cheapest correction they will ever receive. A weakness found by a supervisor costs an hour of rewriting. The same weakness found by a defense lawyer in cross-examination can cost a case and an officer's reputation.