How to write a Daily Occurrence Book: examples, what to record and review checklist

A Daily Occurrence Book (DOB), sometimes called a security occurrence log or shift log, provides a chronological account of relevant activity during a shift. It may include routine patrols and checks, visitors and contractors, faults, security incidents, handover information and actions that still need attention.

The exact requirements will depend on the organisation, contract, assignment instructions and site procedures.

Whatever format is used, a useful test for an entry is simple:

Could someone who was not present understand what happened, what action was taken and whether anything remains unresolved?

That matters because the information may later be needed by the incoming shift, a supervisor, an investigator or somebody trying to understand whether the same problem has happened before.

What does OB mean in security?

OB usually means Occurrence Book. In security operations, the terms Occurrence Book, Daily Occurrence Book (DOB), security occurrence log and shift log may be used for broadly similar forms of chronological operational reporting. The terminology and exact requirements vary between organisations and locations.

What should be recorded in a Daily Occurrence Book?

A DOB normally contains a mixture of routine activity and unexpected events. What needs to be recorded should be defined by the organisation’s assignment instructions, procedures or contractual requirements rather than left entirely to individual judgement.

Routine entries might include patrols, opening and closing duties, contractor or visitor activity, equipment checks, key movements, inspections and shift handovers.

Unexpected entries might include an access-control problem, suspicious behaviour, a building fault, a safety concern, theft, trespass, an alarm activation or an incident involving a visitor, employee or contractor.

There is another part of the entry that is easily missed: what happened afterwards.

If an officer finds a faulty access-controlled door, the fact that the fault occurred is only part of the useful information. A later reader may also need to know who was informed, what action was taken, whether a maintenance request was raised and whether the fault remained open at the end of the shift.

A good DOB therefore records activity, action and status.

 

What information should an individual DOB entry contain?

The amount of detail will depend on the event, but an entry should normally make the important facts easy to establish.

For a significant occurrence, consider whether the entry makes clear:

• when the event happened;
• where it happened;
• what was observed or reported;
• who was involved, where recording their identity is necessary;
• what action was taken;
• who was informed;
• what the outcome or current status is;
• whether another report, CCTV time, maintenance request or other source should be referenced.

If the entry was made significantly later than the event, recording both the event time and the entry time can prevent confusion.

The aim is not to include every possible detail. Where an entry contains personal information, it should be adequate and relevant for the purpose and limited to what is necessary.

Daily Occurrence Book examples

Examples are useful because two entries can describe the same event while leaving the next reader with very different levels of understanding.

Example 1: possible tailgating

Weak entry

08:20 Person tailgated through door. Spoke to him.

This records that something happened but leaves important questions unanswered. It also describes the event as tailgating before establishing exactly what the officer observed.

Improved entry

08:20 Observed an individual enter through the east reception access-controlled door immediately behind an authorised cardholder before the door closed. I stopped the individual at 08:22 before they proceeded beyond reception. The individual stated that they were a contractor attending site. Reception confirmed the visit and completed the normal contractor entry process. No further action required.

The improved version identifies the observation, location, action and outcome. It does not require the reader to assume that unauthorised access occurred.

That distinction may become important if somebody later searches previous reports for repeated access problems at the same entrance.

Example 2: contractor arrival

Weak entry

09:00 Contractors arrived.

Improved entry

09:02 Two electrical contractors arrived at the loading-bay security point for planned work in Plant Room 2. Attendance checked against today’s contractor list and normal site access process completed. Contractors admitted at 09:09.

The second version gives enough information to understand what happened without reproducing all the information held elsewhere in the contractor or permit process.

Example 3: door fault

Weak entry

West stairwell door broken. Maintenance told.

Improved entry

13:40 During patrol, found the west stairwell access-controlled door was not latching when closed. Tested the door twice with the same result. Control room informed at 13:44 and a maintenance request was raised at 13:48. Fault remained unresolved at the time of this entry.

This tells a later reader what the officer actually found, what was done about it and that the matter remained open.

Example 4: shift handover

Weak entry

Door issue still ongoing. Told next shift.

Improved entry

18:00 West stairwell door fault reported at 13:40 remains unresolved. Maintenance attended during the afternoon but repair was not completed. The temporary measure required by the site procedure remains in place. Incoming supervisor briefed at handover.

The second entry lets the incoming shift understand the status without having to reconstruct the afternoon from several separate entries.

Download the Daily Occurrence Book Entry and Supervisor Review Checklist

Use this one-page checklist to help officers record clearer DOB entries and give supervisors a simple way to review their quality.

It covers what happened, where and when it happened, the difference between observed and reported information, actions taken, unresolved matters, handover and supervisor review.

Separate what you observed from what you were told

A useful DOB distinguishes between something the officer observed and information supplied by somebody else.

Compare:

John Smith stole a laptop from Meeting Room 3.

with:

15:10 Receptionist reported that a laptop was missing from Meeting Room 3 and stated that John Smith had been seen in the room shortly beforehand. This had not been verified at the time of entry.

The second version makes the source and status of the information clear.

This is particularly important where an entry contains personal information. Current ICO accuracy guidance says organisations should make the source and status of personal information clear. It also says that matters of opinion should be identifiable as opinions.

An officer can still record relevant suspicions, reports or opinions. The entry should make clear what they are.

When should a Daily Occurrence Book entry be made?

Operational activity comes first. An officer dealing with an incident should not interrupt the response simply to complete the DOB.

Once the situation allows, make the entry while the details are still clear. Where there has been a material delay, record the actual time of the event as well as the later entry time.

For example:

14:35 Entry made at 15:10 following completion of incident response.

This is clearer than creating the impression that the event happened when the entry was written.

Daily Occurrence Book or incident report?

The DOB should not have to contain every detail of a significant incident.

Routine activity and minor occurrences may be adequately covered by the normal shift log. An event requiring formal investigation, escalation, detailed evidence collection or management action may also require an incident report under the organisation’s procedures.

In that situation, the DOB can provide the chronological entry and reference the more detailed report.

For example:

21:12 Unauthorised access incident at west entrance. Initial response completed and Security Incident Report 147 raised. See incident report for full chronology and supporting information.

This avoids trying to squeeze an investigation into a shift log while preserving the connection between the two.

Use the DOB for handover and unresolved actions

A DOB is most useful when the next shift can establish what still requires attention.

Before closing a shift, review whether any entry concerns an unresolved fault, expected contractor, ongoing investigation, temporary security measure, missing equipment, planned activity or other matter that the incoming team needs to know about.

The handover should make the current position visible. Simply recording that something happened several hours earlier may not tell the next officer whether it has been resolved.

For important matters, the incoming officer should not have to read an entire shift’s entries before discovering that action is still required.

Supervisors should review the quality of DOB entries

Completing the log is only part of the process. Periodic review can establish whether expected information is being recorded consistently and whether unresolved or recurring problems are visible.

There is useful evidence of what can go wrong when this does not happen.

A 2021 internal audit of operational security management at the London Borough of Hammersmith & Fulham examined sites manned by security officers where DOBs were used to record activities and incidents. Auditors found that the management team did not periodically check whether DOBs were being completed. They warned that, without review and monitoring, the DOB risked becoming a tick-box exercise rather than an effective monitoring tool.

A separate 2025 Exeter City Council internal audit examined a Daily Occurrence Book used by its community safety team to record antisocial-behaviour activity. Officers were not consistently completing all fields and there were inconsistencies in the way information was recorded. The audit concluded that this reduced the accuracy and reliability of the information and recommended periodic review and more standardised fields. It also found that inconsistent formatting reduced the usefulness of the information for analysis, identifying trends and follow-up.

These are different operational environments, but both illustrate the value of reviewing whether the information being captured is actually usable.

A supervisor review can therefore ask:

• Are the expected fields complete?
• Can the entry be understood without speaking to the officer who wrote it?
• Are observations, reports and assumptions distinguishable?
• Is the action taken clear?
• Is the outcome or current status clear?
• Are significant incidents linked to the appropriate report?
• Are open matters visible to the next shift?
• Are similar faults or incidents appearing repeatedly?

The purpose is not to turn every entry into a lengthy report. It is to ensure that the log contains enough reliable information to be useful.

Personal information in a Daily Occurrence Book

DOBs can contain names, descriptions of individuals, visitor details, allegations, incident information and other personal information.

More detail is not automatically better.

The UK GDPR data minimisation principle requires personal information to be adequate and relevant for its purpose and limited to what is necessary.

An entry about a contractor arriving on site, for example, may need to identify the contractor sufficiently to connect the entry with the access process. It does not follow that every piece of personal information available about that person belongs in the DOB.

Accuracy also matters. Where information about an individual was provided by somebody else, recording its source can help prevent an allegation or unverified report later being mistaken for an established fact.

Personal information held in a DOB should also be protected with appropriate security measures. Organisations should decide and be able to justify how long personal information needs to be retained, rather than assuming that DOB information should be kept indefinitely. There is no single UK GDPR retention period that applies to all DOB entries.

Paper or digital Daily Occurrence Book?

The basic principles of a good entry apply whether the DOB is on paper or digital.

A paper book can provide a chronological site log when it is completed properly, stored appropriately and managed consistently.

Depending on its design, a digital system may make other tasks easier. These can include searching previous entries, applying consistent fields, controlling access, reviewing information across sites and maintaining a traceable history of changes.

The appropriate choice depends on what the organisation needs the information to support.

If a digital system is used, useful questions include whether authorised users can find previous entries when needed, whether changes can be traced, how access permissions work and how information can be retained or deleted in line with organisational requirements.

The value of digitisation can therefore extend beyond replacing handwriting with typing. It can make the information captured during shifts easier to retrieve and use later.

What happens to the information after the shift?

A recurring operational problem is that useful information is captured and then becomes difficult to find when it is needed again.

Consider a report of possible tailgating at an entrance. The immediate occurrence may be minor. If the same behaviour has been reported several times over previous months, the wider picture could be more significant.

Understanding that picture might mean finding previous shift entries and incident reports, checking access-control logs, locating relevant CCTV, reviewing what action was previously taken and finding the applicable procedure.

The effort involved in finding those sources can affect whether previous information is routinely used.

Where an AI system has controlled access to the relevant internal documents and reports, it can be used to reduce some of the effort involved in retrieving and assembling that information. For example, it could help a supervisor find previous tailgating reports at the same entrance and locate the procedure relevant to the current event.

The information still needs to be checked against its source. The appropriate person remains responsible for deciding what the current situation means and what action to take.

This is one way that information captured in daily reports can contribute to retained operational learning rather than simply being stored after the shift.

Daily Occurrence Book entry checklist

Before completing an entry, check that another person could establish:

1. What happened? Describe the activity or event clearly.
2. Where did it happen? Use a meaningful location.
3. When did it happen? Distinguish event time from entry time where necessary.
4. How do you know? Make clear what you observed and what somebody else reported.
5. Who was involved? Include identifying information only where it is relevant and necessary.
6. What action was taken? Record the response rather than just the original event.
7. Who was informed? Record relevant escalation.
8. What is the status now? State whether the matter is resolved or remains open.
9. Is there another source to reference? Link the entry to an incident report, maintenance request, CCTV time or other relevant information where appropriate.
10. Does the next shift need to do anything? Make unresolved action visible.

Want a printable version of this checklist? Download the Daily Occurrence Book Entry and Supervisor Review Checklist

Summary

A Daily Occurrence Book is more useful when it does more than show that entries were made during a shift.

The strongest entries allow another person to understand what happened, what was observed or reported, what action was taken and what remains unresolved. Consistent fields, clear handovers and supervisor review make that information easier to use later.

This becomes particularly important when an organisation needs to reconstruct an incident or establish whether the same issue has happened before. The value of the DOB then depends not only on capturing the original entry, but on being able to retrieve it and connect it with incident reports, procedures and other relevant operational information.