DAR vs incident report: what goes where, and why it matters
A daily activity report covers an entire shift, including the hours when nothing happened, and is the routine record a client receives. An incident report covers one specific event in depth and is filed in addition to the DAR, not instead of it. Getting the split wrong buries significant events in shift narrative, where nobody finds them until they matter.
· Sayed Qureshi
The distinction in one table
| Daily activity report | Incident report | |
|---|---|---|
| Covers | The whole shift | One specific event |
| Filed | Every shift, always | Only when something happens |
| Purpose | Show the shift was worked | Document what occurred and what was done |
| Detail | Brief per entry, chronological | Thorough: times, people, actions, evidence |
| Typical reader | Client, on a routine schedule | Supervisor now; possibly insurer or counsel later |
| If it is missing | The shift is unevidenced | The event is undefendable |
The mistake almost every operation makes
A guard turns away a trespasser at 02:30, handles it well, and writes a line in the DAR: "0230 hrs, individual asked to leave property, complied." Then the shift ends and nothing more is said.
Six weeks later the same person returns and something serious happens. Now you need the earlier encounter: a description, whether police were called, what was said. What exists is one line with no detail, buried in a shift log nobody has read since. The information that would have mattered was captured in the wrong place, at the wrong depth.
What belongs in the DAR
- Shift start and end, and the guard on post
- Each patrol round with its time
- Doors, gates, alarms, and equipment checked
- Visitors, deliveries, and vehicles logged
- Routine observations, such as a light out or a gate left open and secured
- A one-line pointer to any incident that also has its own report
Note the uneventful hours too. "0200 perimeter round, all doors secure" looks like filler and is not: it is the evidence that the round was walked. A DAR consisting only of exceptions cannot show coverage.
What belongs in an incident report
- What happened, factually and in sequence
- Exact time and location
- People involved, including witnesses and any identifying details observed
- What the guard did, in the order they did it
- Whether police, fire, or medical services were contacted, and when
- Whether anyone was injured
- Photo or video evidence
- Severity, and whether follow-up is required
When a guard is unsure
File the incident report. An unnecessary one costs a few minutes. A missing one costs the ability to prove what happened, at exactly the moment that ability is worth the most.
If your guards are filing too few incident reports, the cause is usually not judgement. It is friction. When filing means a paper form that has to reach the office, guards ration it to events they think are serious enough to justify the effort. Reduce the effort and the reporting rate corrects itself.
How GuardOps separates the two
- DAR entries are submitted from the app during the shift, timestamped and tied to that shift.
- Incident reports are a separate structured form with severity, actions taken, and evidence.
- High-severity incidents notify supervisors immediately rather than waiting for a dashboard check.
- Incidents follow an explicit open → investigating → resolved → closed track, so nothing is silently dropped.
- Both are searchable, so retrieving one specific night is a filter rather than an archaeology project.
See reporting in GuardOps
See reporting in GuardOpsFrequently asked
Should an incident also be mentioned in the DAR?
Yes. Put a one-line pointer in the DAR so the shift record is complete and the chronology holds, and keep the full detail in the incident report.
How detailed should a DAR entry be?
One or two factual lines per entry with a specific time and location. Detail belongs in incident reports; a DAR that tries to be thorough about everything stops being written consistently.
Who should be able to see incident reports?
Supervisors and managers within your company. Whether a specific incident is shared with a client depends on the contract and, where injuries or law enforcement are involved, on advice. Sharing is not automatically the right default.
Prove every shift on your own sites
GPS-verified clock-ins, DAR and incident reports, and client-ready exports. 30-day free trial, no credit card.