Why a Notebook Isn't Enough: The Problem with Traditional Incident Logs

In every venue I work with, the documentation process is the same: something happens, a door supervisor writes it in a notebook or texts a note to themselves, and then at the end of the shift — if they have the energy — they type it up. Sometimes it ends up in a proper incident log. Often it does not.

I spent 14 years in the Metropolitan Police. I have seen what happens to incident reports in court. I know what defence barristers look for. And I can tell you with certainty that the notebook-and-type-up process fails the moment it faces serious legal scrutiny.

The Four Failures of Paper Documentation

1. No proof of contemporaneity

The single most important quality of an incident report is that it was written close to the time of the incident. A contemporaneous record carries far more evidential weight than a retrospective one. But a notebook entry proves nothing about when it was written. You could have written it the next day. Defence barristers raise this constantly — and there is no answer to it when the documentation is paper-based.

2. No tamper detection

A paper report can be altered. Words can be added or changed. Dates can be modified. Even with the best intentions, a report written in two stages — first notes, then typed-up — is vulnerable to the accusation that details were added or changed between the two versions. When that accusation is made, how do you disprove it?

3. No location verification

A paper report cannot prove where you were when the incident occurred. GPS coordinates locked at the time of reporting can. This matters more than most security professionals realise. If a subject claims an incident occurred in a different location — or that you were not present — GPS-locked documentation ends that argument immediately.

4. No audit trail

Who wrote the report? When was it accessed? Was it changed after initial submission? Paper has no audit trail. Digital systems can have one — but only if they are built for it. A Word document emailed to a manager has no audit trail either.

What Court-Ready Documentation Looks Like

When I built Original Note, I was thinking about what a report needs to survive legal scrutiny — not just what it needs to satisfy a shift manager.

Court-ready documentation has:

• Server-side timestamps that cannot be altered by the reporting officer
• Cryptographic sealing (HMAC-SHA256) that makes any post-submission alteration detectable
• GPS coordinates locked at the time of reporting
• An immutable audit trail of who accessed and modified the record
• A structured narrative that follows the 5-part framework courts and investigators expect

The Practical Impact

Security professionals who document properly are not just protecting themselves from complaints — they are also demonstrating the professionalism that distinguishes a credible witness from an unreliable one. When your report is timestamped, GPS-locked, and cryptographically sealed, the question of whether you're telling the truth about when and where something happened becomes unanswerable. The documentation answers it.

That is the standard your documentation deserves.

Download our free SIA incident report template, or start a 7-day free trial of Original Note to see what automated, tamper-proof documentation looks like in practice.