In brief
- Incident reports should record facts, not blame, opinions, guesses, or legal conclusions.
- Prompt reporting helps preserve evidence before memories fade, photos disappear, logs rotate, or damaged items are thrown away.
- Many insurance policies require prompt notice of claims, potential claims, lawsuits, cyber incidents, property losses, or injury events.
- Incident reporting supports insurance, operations, customer communication, safety review, vendor management, and risk mitigation.
- Near-miss reports are valuable because they reveal weak controls before a more serious event happens.
What an incident is
An incident is an event that causes harm, disruption, damage, loss, complaint, claim potential, data exposure, safety concern, or near miss. In business risk management, an incident does not have to be catastrophic to be worth recording.
Examples include:
- a customer injury or alleged injury at a business location;
- damage to customer property;
- an employee injury or workplace safety event;
- a vehicle accident during business activity;
- a cyber incident, suspicious login, phishing event, ransomware alert, or data exposure;
- equipment failure that causes service disruption, safety concern, or property damage;
- a vendor failure that disrupts customers or revenue;
- a delivery, installation, service, or project error that may create a claim;
- a near miss where harm almost occurred;
- a customer complaint involving safety, damage, missing property, data, or serious financial loss.
Incident reporting connects directly with Business Insurance Claim Process Explained, Risk Mitigation Strategies Explained, and Risk Register Explained.
Simple incident reporting flow
The reporting process should be simple enough that staff can use it under pressure.
Simple incident reporting process
When to write an incident report
A business should write an incident report whenever an event could reasonably lead to a claim, complaint, insurance notice, legal dispute, customer issue, workplace safety concern, vendor dispute, data issue, property damage, or repeated operational problem.
| Incident type | Examples | Related guide |
|---|---|---|
| Customer injury or property damage | Slip, fall, damaged customer item, alleged service damage, visitor injury, premises issue. | General Liability Insurance Explained |
| Employee injury or workplace event | Workplace injury, unsafe condition, equipment issue, near miss, safety concern. | Workers’ Compensation Insurance Explained |
| Cyber or data incident | Phishing, suspicious login, ransomware alert, exposed records, lost device, account takeover. | Cyber Liability Insurance Explained |
| Professional service problem | Missed requirement, service error, failed deliverable, client alleges financial loss. | Errors and Omissions Insurance Explained |
| Property or equipment loss | Theft, fire, water damage, damaged tools, broken equipment, damaged inventory. | Commercial Property Insurance Explained |
| Vendor or supply disruption | Critical supplier failure, platform outage, subcontractor issue, delivery failure. | Vendor Risk Explained |
| Near miss | A situation that almost caused harm, damage, data exposure, service failure, or safety concern. | Risk Mitigation Strategies Explained |
What to capture
The best incident reports are factual and specific. They do not need dramatic language. They need enough detail that someone who was not present can understand what happened.
- Date and time of the incident.
- Exact location, including address, room, job site, vehicle, software system, or account involved.
- Names and contact information for people involved.
- Names and contact information for witnesses.
- Clear timeline of what happened before, during, and after the event.
- Photos, video, screenshots, logs, emails, messages, invoices, receipts, repair records, or other evidence.
- Weather, lighting, surface condition, equipment status, or relevant environmental details if applicable.
- Immediate actions taken to secure the area, protect people, stop damage, or preserve systems.
- Who was notified, when they were notified, and how they were notified.
- Follow-up actions assigned, owner, and review date.
Use neutral language. “Customer stated that they slipped near the front entrance” is better than “customer fell because the floor was unsafe.” The first records what was reported. The second reaches a conclusion that may not be fully supported yet.
Who to notify
Notification depends on the type of incident, the contract, insurance policy, severity, location, and applicable requirements. The business should not guess when an incident could become a claim.
| Incident | Possible notification path | Why timing matters |
|---|---|---|
| Customer injury or property damage | Manager, owner, broker or insurer, landlord or client if contract requires it. | General liability policies often require prompt notice of claims or potential claims. |
| Employee injury | Supervisor, owner, safety contact, workers’ compensation process, payroll/HR provider where applicable. | Employee injury reporting may have specific timing and documentation rules. |
| Cyber incident | IT provider, owner, cyber insurer or breach-response contact, legal/privacy professionals where needed. | Fast containment, log preservation, and insurer-approved response steps can matter. |
| Vehicle incident | Manager, commercial auto insurer, client or project owner if contract requires it. | Vehicle claims may involve third parties, police reports, repairs, and liability investigation. |
| Professional service dispute | Owner, project lead, E&O insurer or broker if a claim or potential claim exists. | Claims-made policies may have strict reporting rules. |
| Vendor failure | Owner, operations lead, vendor contact, affected customers, insurer if covered interruption or liability may apply. | Documenting vendor failure helps with contracts, customer communication, and continuity review. |
For claim reporting context, see Business Insurance Claim Process Explained and Insurance Exclusions in Commercial Policies Explained.
What evidence to preserve
Evidence can disappear quickly. Video may be overwritten, logs may rotate, damaged items may be discarded, and witnesses may forget details. A business should preserve relevant information early.
| Evidence type | Examples | Preservation concern |
|---|---|---|
| Photos and video | Area photos, equipment photos, vehicle photos, product photos, CCTV clips, screenshots. | Save originals where possible and record date/time. |
| Physical items | Damaged product, broken part, packaging, tool, sign, ladder, fixture, equipment. | Do not discard items that may matter to a claim or investigation. |
| Digital logs | Access logs, website logs, email headers, security alerts, payment records, cloud audit logs. | Export or preserve before rotation or deletion. |
| Business records | Invoices, work orders, contracts, inspection records, maintenance logs, job notes, change orders. | Keep the version that existed at the time of the incident. |
| People records | Witness names, employee notes, customer statements, vendor communications. | Record contact details and avoid pressuring witnesses to agree with a conclusion. |
| Response records | Cleanup notes, repair invoices, shutdown times, customer communications, notification records. | Show what was done to reduce harm and restore operations. |
How reporting supports insurance claims
Insurance claims often depend on facts, timing, documentation, policy wording, and prompt notice. Incident reports help by giving the business and insurer a starting record.
A useful report can support:
- claim notice timing;
- coverage review;
- liability investigation;
- property damage estimates;
- defense preparation;
- business interruption timelines;
- cyber incident response;
- vendor or subcontractor recovery efforts;
- root-cause review and corrective action.
Incident reporting should be coordinated with the correct policy type. See General Liability Insurance Explained, Commercial Property Insurance Explained, Business Interruption Insurance Explained, Cyber Liability Insurance Explained, and Errors and Omissions Insurance Explained.
Cyber and data incidents
Cyber incident reporting needs extra care because early actions can affect evidence, recovery, privacy duties, insurer involvement, and vendor response. A cyber incident may involve business email compromise, ransomware, suspicious account access, lost devices, exposed customer records, website compromise, malicious redirects, payment instruction fraud, or cloud-account misuse.
- Record the time the issue was discovered and who discovered it.
- Identify affected systems, accounts, devices, email addresses, domains, websites, or vendors.
- Preserve alerts, screenshots, logs, messages, email headers, and suspicious files where safe to do so.
- Notify the responsible owner, IT provider, and cyber insurer or breach-response contact if coverage may apply.
- Document containment steps, such as disabling accounts, changing access, or isolating affected systems.
- Do not make public statements, customer notices, or legal conclusions without qualified guidance where required.
Cyber incidents also connect with Vendor Risk Explained, Business Continuity Planning Explained, and Risk Register Explained.
Near misses and lessons learned
A near miss is an incident that almost caused harm, damage, data exposure, claim potential, downtime, or loss. Near misses are valuable because they reveal weak controls before a worse event occurs.
Examples:
- a customer nearly trips over an unsecured mat;
- a staff member almost sends payment to a fake vendor email;
- a backup fails during a test but no live data is lost;
- a subcontractor arrives without required insurance proof before work begins;
- a delivery error is caught before the wrong goods reach a customer;
- a suspicious login is blocked before account takeover occurs.
Near-miss reporting should feed into the risk register. The question is simple: what control failed, what control was missing, and what small improvement would reduce the chance of a repeat event?
Simple incident report template
A small business can use this as a simple internal template. It can be copied into a form, document, spreadsheet, help desk ticket, or shared drive record.
Common review mistakes
- Waiting too long: Memories fade, video is overwritten, damaged items disappear, and claim reporting deadlines may matter.
- Writing opinions instead of facts: Early reports should avoid blame, assumptions, legal conclusions, or unsupported cause statements.
- Missing witness information: Witnesses may be hard to find later.
- Throwing away damaged items: Physical evidence may matter to claim review or defense.
- Not preserving digital logs: Logs, alerts, and email evidence may rotate or be deleted quickly.
- Forgetting contract notice requirements: Some contracts require notification to clients, landlords, vendors, or project owners.
- Not learning from the incident: A report should lead to corrective action, not just paperwork.
FAQ
Does every small incident need a formal report?
Not every minor inconvenience needs a long report, but any incident that could involve injury, property damage, cyber exposure, customer dispute, insurance notice, employment issue, vendor failure, or repeat risk should be documented.
Should the report say who was at fault?
Usually the first report should stick to facts: what happened, what was observed, what was said, who was present, what was preserved, and what was done. Fault, legal responsibility, and coverage questions should be handled carefully with qualified professionals where needed.
How fast should insurance be notified?
Many policies require prompt notice of claims or potential claims. Timing depends on the policy and incident type. When an incident could become a claim, early broker or insurer notice is often safer than waiting.
Should near misses be reported?
Yes, at least for meaningful near misses. They are one of the cheapest ways to find weak controls before a more expensive incident occurs.
Where should incident reports be stored?
Store them somewhere secure, backed up, and easy to retrieve. Reports may contain personal information, claim details, customer information, or security information, so access should be limited to people who need it.