Security officers are paid to see and to tell. Observation is the foundation; documentation is the proof. Everything else an officer does — patrols, contacts, interventions, arrests — produces value only if it is observed accurately and documented in a way that holds up in front of a client, a supervisor, an insurance adjuster, or a court. Anyone can stand at a gate. Officers earn their post by noticing what others miss and writing it down so someone else can use it.
This is a 4-hour Continuing Education module in California's 32-hour mandatory skills training for security guards. It is delivered fully online and counts toward the hours you must complete after your guard card is issued.
BPC §7583.6 / 16 CCR §643
BSIS Skills Training — Observation & Documentation
Business & Professions Code · California Code of Regulations
This module aligns with the BSIS Skills Training Course for Security Guards and the observation, communication, and documentation topics published under 16 CCR §643: observation and patrol techniques, observing suspects and suspicious activity, asking appropriate questions, English as a second language, and report writing. It is part of the Whitestar Group Security Training Program.
How this module is built
The course is organized into five chapters that move from seeing to telling. The first three sharpen what you observe — running observation-rich patrols, recognizing and describing suspects and suspicious activity, and asking the lawful questions that turn observation into usable information. The last two carry that observation into the record: communicating clearly across a language barrier, and writing reports that answer every question a supervisor or court will ask.
Nothing in this module is legal advice. What an officer may observe, ask, detain, or document is governed by your post orders, your employer's policies, and California law. Officers observe, document, and report — they do not investigate, interrogate, or search. When in doubt, gather the facts and hand the situation to the proper authority.
Welcome · Chapter 2 of 8
Learning Objectives
~4 min read
Learning Objectives
After completing this module you will be able to observe a post with discipline and document what you see defensibly — running observation-rich patrols, recognizing and describing suspicious activity objectively, asking lawful questions, communicating across a language barrier, and writing reports that hold up.
LO-1
Observation & patrol Ch 9
Conduct observation-rich patrols using a post baseline, systematic four-zone and vertical scanning, and anomaly detection to tell the difference between looking and observing.
LO-2
Observing suspects Ch 10
Recognize, describe, and document suspects and suspicious activity using objective, articulable behavioral indicators — never appearance or profiling — with head-to-toe and CYMBALS descriptions.
LO-3
Asking appropriate questions Ch 11
Ask lawful, useful questions that gather information without violating rights or creating liability, using open and closed questions and the contact-versus-detention distinction.
LO-4
English as a second language Ch 12
Communicate effectively with people whose first language is not English using plain-language techniques, translation tools, and professional interpreters.
LO-5
Report writing Ch 13
Write Daily Activity Reports and incident reports that answer the Five W's, One H plus the security-specific questions, separating observation from inference for defensible documentation.
Every learning objective is mapped to the chapter that teaches it and is tested on the assessment. If a question feels unfamiliar, return to the chapter the objective points to before guessing.
Welcome · Chapter 3 of 8
Course Outline
~3 min read
Course Outline
The five chapters of Observation & Documentation move from seeing to telling — observation-rich patrol, recognizing and describing suspicious activity, asking lawful questions, communicating across a language barrier, and writing it all down so it holds up. Each chapter ends with field-ready takeaways and is tested on the assessment.
The difference between looking and observing — building a post baseline, scanning systematically, detecting anomalies, varying patrols, and using all five senses on foot and by vehicle.
Identifying suspicious behavior rather than suspicious people, the articulable standard, pre/during/post-incident indicators, and describing people and vehicles for a report or BOLO.
11
Asking Appropriate Questions Contact vs. detention · open & closed · legal limits
Asking lawful, useful questions — an officer's legal limits, contact versus detention, open and closed questions in sequence, and questioning witnesses and subjects without creating liability.
12
English as a Second Language Plain language · translation tools · interpreters
Communicating across a language barrier — Title VI, plain-language techniques, translation apps versus professional interpreters, common multilingual situations, and cultural awareness.
13
Report Writing Five W's + One H + Four · F.A.C.T. · DAR vs. IR
Writing reports that win cases — the Five W's, One H plus four security-specific questions, F.A.C.T. style, first-person past-tense chronological writing, observation versus inference, and the 60-Minute Rule.
T
Assessment & Certificate 15 T/F + 20 MC · 80% each
A two-section written assessment drawn from the five learning objectives. Pass both sections at 80% to complete the module and issue your verifiable Certificate of Completion.
Observe · Chapter 4 of 8
Observation & Patrol
~30 min read
Observation is not the same as looking. Looking is passive — the eyes are open. Observation is active — the brain is engaged in collecting specific, useful information and comparing it against what is normal for the post. A good officer can walk the same hallway 200 nights in a row and still notice the night the trash bin is two feet out of place. Strong observation is built from three habits: knowing the baseline, scanning systematically, and recognizing anomalies.
Know Your Baseline
A baseline is the normal pattern of the post — what is supposed to be there, when, and in what condition. Without a baseline you cannot tell whether what you are seeing is unusual or routine. The first week on any new post is baseline-building week. Build yours by learning:
Physical layout — every entrance, exit, blind spot, stairwell, restroom, and storage area.
Normal traffic patterns — who is here at 0700 vs. 1500 vs. 0200, and which doors are used by whom.
Equipment positions — where carts, bins, vehicles, and tools are normally kept and locked.
Lighting and sound — which lights are on at which times, and the normal background noise of the property each shift.
People — tenants, employees, regulars, delivery drivers, the cleaning crew.
If you cannot describe what your post looks and sounds like on a quiet Tuesday afternoon, you will not notice the subtle changes that precede serious incidents. If you cannot describe normal, you cannot spot abnormal.
Scan Systematically
Random looking misses things; systematic scanning catches them. Layer your scan on every patrol and every monitor-station shift.
Distance
The Four-Zone Scan
FAR — the horizon, fence line, far end of the lot. Movement, lights, vehicles that shouldn't be there.
MID — the middle distance. Buildings, entrances, vehicle paths.
NEAR — within 20–30 feet. People, objects, surfaces.
SELF — your own footing, hands, equipment, and three-foot bubble. The zone officers neglect most.
Height
Vertical Scanning
DOWN — the ground. Footprints, dropped items, fluids, drag marks, the foot positions of people standing still.
LEVEL — eye level. Faces, hands, what people are carrying.
The 360 habit — every 90 seconds on a stationary post, do a full sweep; head-check behind you on every direction change.
Detect Anomalies
Anomalies are deviations from the baseline. Train yourself to notice four categories: out of place (an unfamiliar vehicle in a reserved spot, a ladder against a wall at 2 a.m., an open door that is normally locked); out of time (a delivery van at 3 a.m., an employee at the property on their day off, lights on in a closed business); out of pattern (a regular tenant entering through a back door for the first time, a car circling the lot, a person walking quickly while looking over their shoulder); and out of condition (a broken window, a damaged lock, fresh tool marks on a door frame, breathing or clothing that does not match the situation).
Patrol With Discipline
Predictable patrols teach criminals when and where you will be. Vary your route, timing, method, and direction of approach — clockwise one round, counter-clockwise the next. Foot patrol is thorough and engages all your senses, best for buildings, corridors, and dense areas; vehicle patrol is broad and fast, best for large lots, perimeters, and multi-building campuses. Use all five senses: sight (the four-zone and vertical scan), hearing (pause and listen for voices, glass, alarms, mechanical noises out of pattern), smell (smoke, fuel, chemicals — smells often precede visible problems), and touch (a warm door handle in a fire, a loose brick, wet where it should be dry).
Patrol safely as you observe: keep your radio accessible without looking down, keep one hand free at all times, walk slightly to the side of doorways, and never enter a stairwell or confined space without scanning and announcing yourself on the radio first. If something feels wrong, it probably is — pause, call dispatch, and document why.
Observe · Chapter 5 of 8
Observing Suspects
~30 min read
The single most important rule in this entire module: officers identify suspicious behavior, not suspicious people. A person is not suspicious because of how they look, where they are from, or what group they appear to belong to. A person becomes worthy of additional attention because of what they do. Stopping, questioning, or documenting someone based on appearance rather than behavior is bias-based policing — illegal, unethical, and a fast path to losing the guard card and creating civil liability for the company.
Anything you write in a report or testify to must be articulable — describable in specific, observable, factual terms. "He looked like he didn't belong" is not articulable. "He walked the perimeter three times in 20 minutes, checked every door handle, and looked over his shoulder before entering the alley" is. Identity alone is never articulable suspicion. Train yourself to articulate.
Indicators of Suspicious Activity
These are behaviors — observable actions — that may indicate criminal intent. Any one alone is rarely conclusive; patterns and combinations are what matter.
Before
Pre-Incident
Loitering with no apparent purpose near entries, ATMs, or restricted areas.
Repeatedly checking the time or watching a specific person, door, or vehicle.
Counter-surveillance — looking for cameras, officers, or witnesses.
Testing security — pulling on locked doors, propping doors, triggering alarms to time the response.
"Casing" — slow passes, photographing the security setup, unusual questions about hours or staffing.
During
During-Incident
Concealing items under clothing, in bags, or under carts.
Switching items between people in a group.
Acting as a lookout while another engages in suspicious activity.
Confronting employees or officers to create a distraction.
Repeatedly entering and exiting in short intervals.
After
Post-Incident
Leaving in haste without normal departure rituals (locking, signing out).
Avoiding eye contact with officers while moving quickly.
Discarding items along an exit route — bags, gloves, clothing.
Returning to the scene to monitor the response.
Describe People and Vehicles
When describing a person — for a radio call, a report, or a BOLO (Be On the Lookout) — use a consistent head-to-toe method so the description is complete and usable by anyone who hears it: General (gender presentation, approximate age, height and weight range, build) → Head (hair, facial hair, head covering) → Face (glasses, scars, tattoos, distinguishing marks, masks) → Upper Body (shirt/jacket color, type, logos, layering) → Lower Body (pants type and color, belt, unusual fit or bulges) → Feet (shoe type and color — shoes often outlast clothing changes during a crime) → Carry items (bags, packages, tools, weapons) → Direction & Speed (travel direction, on foot or vehicle, companions). For vehicles, memorize CYMBALS:
Plate number and state, or partial plate; use the phonetic alphabet for letters.
S
State / Style
State of issue and any distinctive plate style — vanity, dealer, or paper.
Report — Do Not Investigate
Once you have articulable suspicious behavior, the next step is to report, not confront. Radio dispatch with location, behavior observed, and a head-to-toe / CYMBALS description; maintain visual contact from a safe distance if possible; note time, weather, lighting, and witnesses; update dispatch on changes in direction, speed, or additional subjects; then document fully in an Incident Report and DAR once the situation resolves. Security officers are not detectives — your job is to observe, document, and report, never to interrogate, search, or investigate. Trying to play detective compromises evidence, exposes you to legal claims, and can interfere with a police investigation already underway.
Observe · Chapter 6 of 8
Asking Appropriate Questions
~25 min read
A skilled officer can resolve most incidents by asking the right questions in the right way. Done well, questioning gathers information, de-escalates tension, identifies parties, and creates a usable record. Done poorly, it generates complaints, civil-rights lawsuits, and reports that fall apart in court. The skill is asking lawful, useful questions that get information without violating rights or creating liability.
Know Your Legal Limits
Security officers are not police officers. The authority to question is generally limited by a few principles — always consult state law and your post orders for specifics:
Officers can ask questions. Anyone can ask anyone almost any question.
People are generally not required to answer a security officer's questions.
Officers may not detain a person for refusing to answer, unless detention is supported by independent legal grounds (e.g. a crime witnessed by the officer, or citizen's-arrest authority).
Officers may not search persons or property without consent or lawful authority.
Custodial questioning of someone believed to have committed a crime is law-enforcement work — hand the situation off to police.
A contact is a voluntary interaction — the person is free to leave at any time. A detention restricts freedom of movement and requires legal grounds. Default to contact. If a subject asks "Am I free to leave?" in a routine contact, the answer is almost always "Yes, you are free to go." Never bluff legal authority you do not have — "I can detain you" when you cannot is a path to a wrongful-detention lawsuit and loss of the guard card.
Open and Closed Questions — In Sequence
The format of a question shapes the answer. Open questions cannot be answered yes/no — they start with what, how, when, where, who — and are used to gather a narrative and get the person talking ("What happened next?"). Closed questions are answered yes/no or with one item and are used to confirm specifics ("Did he run east?"). Use both, but in order:
01
Open the narrative
Start with open questions to get the full account in the person's own words, without interruption.
02
Confirm specifics
Move to closed questions to nail down times, distances, directions, and identifiers.
03
Catch what was missed
End with one open question — "Is there anything else I should know?" — to capture anything overlooked.
Avoid leading questions that put words in the person's mouth ("He was wearing a red hoodie, right?"); compound questions that ask two things at once; "why" questions early, which sound accusatory — use "what," "how," and "can you tell me" first; questions that demand a legal or medical conclusion ("Was he drunk?" — instead, "What did you see him do?"); and anything that probes a protected characteristic without operational need.
Questioning Witnesses and Subjects
Separate witnesses before questioning them — witnesses who talk to each other contaminate each other's memories. Identify the witness (name, contact, relationship to the parties), get a free narrative first, then clarify with specific questions, and document the exact questions and answers, not just summaries. Questioning a subject is the highest-risk type: default to contact not detention, keep questions short and neutral ("Can you tell me what you're doing here today?"), and if the person refuses to answer or asks to leave, the correct response in most cases is "Yes, you are free to go" — then radio the description and direction. If you do have lawful grounds to detain, call police immediately and minimize your own statements until they arrive.
Document · Chapter 7 of 8
English as a Second Language
~20 min read
Officers regularly interact with people whose first language is not English. Limited English does not mean limited intelligence, limited rights, or limited need for respect. Failing to communicate effectively across a language barrier creates safety risk, civil-rights exposure, and incident reports that fall apart. Two professional realities frame the work: Title VI of the Civil Rights Act prohibits national-origin discrimination — including denial of service or unequal treatment due to limited English proficiency — and effective communication is the officer's responsibility. The burden is on the trained professional, not the member of the public.
Plain-Language Communication
"Slow down and speak clearly" is good advice. Slowing down and shouting is not — volume does not translate vocabulary.
Do
Speak at normal volume and slow down slightly, pausing between sentences.
Use short, simple sentences — one idea each, subject-verb-object.
Use common words: "please leave," "ID," "need" — not "vacate the premises."
Pair words with gestures and visual cues — point to a sign or exit.
Confirm understanding by having the person repeat what they will do.
Don't
Shout — loud speech feels hostile and does not aid understanding.
Exaggerate slowness — it feels condescending.
Use slang, idioms, or jargon — "hang tight," "give me a sec," "step aside."
Ask "Do you understand?" — most people say yes just to end the conversation.
String multiple instructions together at once.
Report
Which language was used.
Who interpreted — interpreter, language line, app.
How communication was done — in person, telephone, app.
Any limits or uncertainty in the exchange.
Translation Tools and Interpreters
Translation apps are acceptable for routine communication — directions, simple instructions, brief exchanges. Use company-issued devices when possible, speak short clear sentences (long sentences translate poorly), and verify the target language first (Spanish, Portuguese, and Italian look similar in apps but are not interchangeable). Professional interpreters are required for any complex matter — incident statements, medical emergencies, anything that will become legal evidence. Request them through dispatch or the client; many clients have 24/7 language-line contracts. Never use a family member, child, or bystander as an interpreter for sensitive matters — confidentiality, accuracy, and impartiality are all compromised. In an emergency, gestures and tone matter more than words: "STOP" with a raised palm, "COME" with a beckoning hand, "DOWN" with a downward palm, paired with the English word and an interpreter when available.
Cultural Awareness Alongside Language
Language and culture are not the same, but they often travel together. Eye-contact norms vary — some cultures consider direct eye contact with authority figures disrespectful, so do not interpret avoidance as deception. Personal-space norms vary, as do greetings, titles, and gender-based address customs, and religious obligations such as prayer times, fasting, or dress may shape behavior.
The working standard is simple: same rules, same enforcement, same respect — a different communication style as needed. Effective communication across a language barrier is a professional skill; train it the same way you train your radio work.
Document · Chapter 8 of 8
Report Writing
~35 min read
Every report an officer writes is a potential exhibit. Reports are read by supervisors, clients, insurance investigators, opposing attorneys, judges, and juries. A great patrol with a sloppy report is a sloppy patrol in the eyes of everyone who reads about it; a routine patrol with a strong report is a defensible asset. Three rules apply to every report: if it is not documented, it did not happen; if it is documented unclearly, it did not happen the way you remember it; and if it is documented inaccurately, it can be used against you.
The Five W's, One H — Plus Four
Every report — a DAR entry or a full Incident Report — should answer the standard journalistic questions plus four security-specific ones. If any is missing, the report is incomplete.
Five W's
+ One H
Who — everyone involved: officer, subject(s), witnesses, victims, responders, with names, descriptions, and contact info.
What — what happened, in sequence; each action by each party.
When — specific times for each event, using the 24-hour clock.
Where — specific location: address, building, floor, room. "In the parking lot" is not specific.
Why — reported reason or stated motive, based on what was said or observed — never speculation.
How — method or means: how it happened, was discovered, and was resolved.
Plus Four
Security-Specific
Action Taken — patrols, contacts, dispatches, notifications, restraints, first aid, evidence preservation.
Notifications — who was notified, when, by whom, by what method, and what they said.
Evidence — physical evidence preserved, photographed, or surrendered; camera footage referenced by timestamp range.
Outcome — final state: arrest, trespass, escort off property, EMS treatment, all clear. Open or closed?
Write in F.A.C.T. Style
Write in first person, past tense, chronological order, using the 24-hour clock (0247, not 2:47 AM) and spelling out full names on first reference. Refer to a person as "the subject," never "the suspect" — officers identify subjects; courts determine suspects. The style standard is F.A.C.T.: Factual (state observations, not opinions — "he smelled of alcohol," not "he was drunk"); Accurate (verify times, distances, names, and plates, and label estimates as estimates — "approximately 200 feet" is fine, made-up precision is not); Complete (answer every question above — a report missing key information is assumed to be hiding something); and Timely (write while memory is fresh).
Observation, Not Inference
The heart of defensible documentation is the line between what you observed and what you inferred. Write the observable facts and let the reader draw the conclusion.
Replace conclusions with observations. "He was drunk" becomes "subject had slurred speech, smelled of alcohol, and was unsteady on his feet." "She seemed nervous" becomes "her hands were shaking, she avoided eye contact, and she repeatedly looked over her shoulder." Never write "I believe he was going to…" — stick to what you saw. Identity alone ("a male, mid-30s, in a hoodie") is not articulable suspicion; pair it with behavior.
DAR vs. Incident Report, and the 60-Minute Rule
A Daily Activity Report (DAR) is a chronological log of the entire shift — short, time-stamped entries, one per shift. An Incident Report (IR) is a full narrative account of a specific notable event — injury, property damage, crime, use of force, EMS, police, eviction, trespass, complaint, equipment failure, or hazard — typically one to several pages. Reference the IR by number in the DAR; the IR holds the detail. Finally, follow the 60-Minute Rule: write critical incident reports within 60 minutes of the event whenever possible, because memory degrades fastest in the first hour. Even when full submission is end-of-shift, take field notes in the first 60 minutes — officers who write while the event is fresh produce reports that hold up.