Incident Report Format: Template and Sample Reports for Malls

This guide gives mall security, facility and duty managers an incident report format to copy into a register, form or digital checklist.

It adds two illustrative samples (names and details invented), fire fields and the steps after filing.

What Is an Incident Report?

An incident report is a written, factual record of an unplanned event that caused, or could have caused, injury, loss, damage or a security breach. It lets the event be investigated, corrected and defended in any claim.

In a mall, the first person on scene, usually a guard or supervisor, writes the initial report that shift; it is one of the core security guard duties and responsibilities.

When a Mall Needs an Incident Report

Report every event below, including near misses, noting who to inform and what extra to capture.

• Injury or medical emergency: duty manager, first aider, ambulance if needed; first aid given, hospital, condition when leaving.
• Slip, trip or fall: housekeeping or engineering, insurer if a claim is likely; floor condition, signage, last cleaning time.
• Theft or shoplifting: tenant, police; items, stated value, CCTV clip reference.
• Fire or alarm, including false alarms: fire service, engineering, duty manager; alarm zone, extinguishers used, evacuation extent.
• Lift or escalator incident: lift contractor, and the lift inspectorate where the state Act requires; lift number, rescue times, contractor response time.
• Fight or disturbance: police, duty manager; persons involved, injuries, witnesses, CCTV.
• Property damage: engineering, tenant, insurer; extent, photos, responsible party.
• Lost or found child: police if not found quickly; description, times, to whom the child was handed.
• Security breach (after-hours entry, unattended bag, door found open): Security Manager, police if needed; how entry happened, what was checked.
• CCTV or data request: Security Manager, legal team; who asked, their authority, what was released and on whose approval.

Incident Report Format (Template)

The reporting guard or supervisor fills sections A to E during the shift; the investigating manager fills F and G.

Sample Incident Report: Slip and Fall in a Mall

• Report number, type, severity: IR-2026-0417; slip and fall; severity 2.
• Date and time: Saturday 22 August 2026, approx. 17:40; reported 17:42 by store staff to the patrolling guard.
• Location: Level 2, corridor outside the ladies' washroom, near camera C2-14.
• Persons: female shopper, approx. 60 years, name and phone recorded. Witness, store staff member (name, phone recorded): "She slipped near the washroom door. The floor was wet."
• Description: Guard reached the spot at 17:43. Shopper seated on the floor holding her right wrist. Floor wet for about 2 metres outside the washroom door; no wet floor sign in place.
• Injury: pain and swelling in right wrist. Cold pack by trained first aider at 17:50. Shopper declined an ambulance; family took her to a hospital at 18:15.
• Immediate action: area cordoned 17:44; floor dried 17:52; basin pipe leak reported to engineering 17:55.
• Informed: shift supervisor 17:43; housekeeping supervisor 17:44; duty manager 17:46; engineering 17:55.
• Evidence: 4 photos of floor and pipe; CCTV C2-14 clip 17:30 to 18:00 saved as IR-2026-0417-C2-14.
• Reported by: patrolling guard, name, agency, signature.
• Investigation: leaking basin pipe; last washroom check logged at 16:30; no wet floor sign stocked on level 2.
• Corrective action: replace pipe (MEP lead, by 24 August); stock signs on every floor (housekeeping manager, by 25 August); add "floor outside door dry" to the washroom checklist.
• Closure: by facility manager after a follow-up call and completed actions.

Sample Incident Report: Lift Entrapment

• Report number, type, severity: IR-2026-0422; lift entrapment, no injury; severity 2.
• Date and time: Wednesday 26 August 2026, 13:12 (alarm received).
• Location: passenger lift L3, stopped between levels 1 and 2.
• Persons: 3 shoppers (2 adults, 1 child), names and phones recorded.
• Description: intercom contact 13:13; passengers calm, lights and fan working.
• Immediate action: contractor's technician called 13:14; guard at landing doors 13:15; rescue by trained technician 13:41; lift barricaded.
• Informed: shift supervisor 13:13; lift contractor 13:14; duty manager 13:15; engineering 13:16.
• Entrapment duration: 29 minutes (13:12 to 13:41).
• Investigation: contractor report: door lock contact fault. Lift log book updated.
• Corrective action: replace door contact and file a service report before return to service; review contractor response time.
• Closure: by facility manager once the lift is back in service.

Lift incidents can be statutory too. In Maharashtra, Section 15 of the Maharashtra Lifts, Escalators and Moving Walks Act, 2017 requires the owner to report an accident that results, or was likely to result, in injury or loss of life to the Electrical Inspector (Lifts), and the lift may not be used again without the inspector's written permission. Section 24 requires a log book recording each breakdown and accident. Check your state's law, and file the report with your lift licence renewal papers.

Fire Incident Report Format

For a fire, smoke or alarm incident, add these fields to the main template:

• How the fire was detected: detector, sprinkler flow, manual call point, staff or shopper
• Alarm zone and panel time; time the fire service was called and time it arrived
• Extinguishers or hose reels used: type, number, by whom
• Systems that operated: sprinklers, smoke extraction, lift homing, fire doors released
• Evacuation: none, partial or full; zones evacuated; time to clear; headcount at assembly point, compared with the times in your fire evacuation plan
• Injuries, including smoke inhalation
• Damage, and areas closed
• When systems were reset and re-armed, and by whom
• Fire service report or reference number, if issued

For a false alarm, still record the cause (cooking smoke, fit-out dust, faulty detector). Repeated false alarms from one zone teach people to ignore them, so add those detectors to your preventive maintenance checklist.

How to Write an Incident Report

1. Write it the same shift, with notes made at the scene if possible.
2. Facts, not opinions. Write "the floor was wet for about 2 metres", not "housekeeping was careless".
3. Exact times for every step: incident, report, arrival, each call, each action.
4. Exact location: floor, zone, nearest store, camera number.
5. Witnesses' own words in quotation marks, with their contact details.
6. Photos before anything is moved, unless moving it is needed for safety.
7. Preserve CCTV immediately: export the clip and record its reference before the recorder overwrites it.
8. Do not admit fault or promise compensation; record what the person said, and leave liability to the manager and insurer.

What Happens After an Incident Report

1. Review: the Security or Facility Manager checks the report, normally within one working day.
2. Notify: inform the insurer, tenant, police or a statutory authority where needed; internal levels follow your escalation matrix format.
3. Investigate: find the immediate and underlying cause, such as a missed check (a guard tour system shows skipped checkpoints), a design fault or a contractor's delay.
4. Act: assign each corrective action to a named owner with a due date.
5. Close: only when actions are complete, recording who closed it.
6. Learn: review incidents monthly, and update checklists (such as your washroom cleaning checklist after a slip), SOPs and training.

Retaining CCTV footage and records

No single national rule sets how long a mall must keep CCTV footage or incident records; requirements can come from state laws, police directions, insurers and lease terms. Footage of identifiable people is personal data under the Digital Personal Data Protection Act, 2023; the DPDP Rules, 2025, notified on 14 November 2025, give organisations an eighteen-month phased compliance period. Agree retention periods and a footage request procedure with your legal team; see our security SOPs guide.

Tracking Incidents and Follow-Ups with LazyMonkey

With LazyMonkey QR Feedback, a shopper scans the QR code at a wet floor or broken fixture and reports it with a photo; it goes to staff on duty there and escalates if no one acts.

In LazyMonkey Checklists, a failed item on a round, or a directly raised issue, is assigned, tracked and resolved with a full activity log, so each corrective action has an owner.

Conclusion

A good incident report is short enough to complete on the shift and complete enough to stand up in an investigation or a claim. Write facts with exact times and places, preserve photos and CCTV at once, and close it only when corrective actions are done.

Frequently Asked Questions