Incident reports that hold up: writing retail loss reports investigators can actually use

Write the timeline first

Start with a minute by minute timeline built from the camera system clock, noting entry, selection, concealment if observed, passing the last point of payment, and exit. Gaps should be stated as gaps. A report that admits a two minute loss of observation is more credible than one that invents continuity, because investigators and defence lawyers both check timelines against the footage.

Record the camera clock offset if there is one. Many systems drift minutes from real time, and a report that notes the system ran three minutes fast saves confusion when footage is compared with till records or police logs. Small accuracy notes like that are what separate a professional report from a story written after a stressful shift.

Describe people and property precisely

Describe clothing, build, and distinguishing features in plain physical terms, and note changes such as a jacket removed or a bag swapped. Avoid labels and guesses about intent or identity. For property, list items with sizes, colours, and prices from the stock system, and state how the value was verified. Totals in a report should be traceable to a receipt or inventory record, not estimated at the door.

Vehicle details, direction of travel, and companions belong in the report when observed, clearly marked as observed rather than inferred. The discipline is simple: if it was seen, say who saw it and from where. If it was concluded, say what it was concluded from. Mixing the two is how good cases develop avoidable arguments.

Preserve evidence like it will be challenged

Export the relevant footage promptly, in native format where possible, and keep a copy untouched alongside any working clips. Note who exported it, when, and where the copies are stored. Screenshots help a reader navigate, but they are not a substitute for the moving footage, and cropped clips without the wider context invite questions the full export answers easily.

Keep the paper trail together: till records, fitting room counts, damaged packaging or removed tags if retained, and the names of staff on duty. Evidence rooms and shared drives both work if the naming is consistent. What fails is evidence scattered across personal phones and memory, which is where most small retailers lose cases they had already won on the facts.

Close with actions and a clean handover

End the report with what was done: police reference if reported, insurer notified, footage requested by whom, and any safety actions taken. If the subject is known from prior incidents, link those report numbers rather than retelling them. A chain of short, consistent reports builds the pattern file that repeat offender cases and civil recovery both depend on.

Finally, review the report the next day with fresh eyes, or have a manager read it cold. If a reader who was not there cannot follow what happened and where the proof sits, the report is not finished. The test is not whether the writer remembers the incident. It is whether a stranger can reconstruct it in six months.

Keep reading: Return receipt fraud: fake proofs, switched items, and the desk checks that work, Friendly fraud and first party misuse: when the real customer files the chargeback, and Wardrobing and rental fraud: the returns problem retailers undercount cover the nearby cases in this series.

Frequently asked questions