SIA CCTV Incident Management 1 — Questions and Answers
Question 1: What is the correct priority order when a CCTV operator identifies a serious incident in progress on camera?
- Record the incident, then inform security staff, then call the emergency services
- Immediately alert the emergency services (999), then notify on-site security, then continue monitoring and recording (Correct answer)
- Zoom in to obtain the best possible image before taking any other action
- Complete the incident log entry first to ensure accurate records are maintained
Correct answer: Immediately alert the emergency services (999), then notify on-site security, then continue monitoring and recording
Life safety is always the first priority. Alerting emergency services immediately ensures the fastest professional response. Notifying on-site security allows an immediate local response, while the operator continues monitoring and recording to support responders.
When a CCTV operator identifies a serious incident such as an assault, fire, or medical emergency, the overriding priority is human safety. This means calling 999 immediately to summon the appropriate emergency service, providing precise location details, and describing what the cameras are showing. Simultaneously or immediately after, the operator should alert on-site security or first aiders who can respond while waiting for emergency services. The operator should then maintain camera coverage of the incident to guide responders and preserve evidence. Documentation (the incident log) is important but must not delay life-safety actions.
Question 2: When providing information to emergency services over the phone during an incident, what is the most effective communication style for a CCTV operator to use?
- Provide a detailed narrative covering all background information about the location first
- Use clear, concise, factual language - stating what you see, where it is, and how many people are involved (Correct answer)
- Use internal CCTV camera reference codes to precisely identify the location
- Wait for the operator to ask specific questions and answer only what is asked
Correct answer: Use clear, concise, factual language - stating what you see, where it is, and how many people are involved
Emergency services need fast, accurate information. Clear, factual statements about what is happening, the exact location, and the number of people involved enable them to dispatch the correct resources without delay.
Effective communication during emergencies requires clarity and brevity. CCTV operators should describe what they can see in plain language: 'I am calling from [location] at [address]. I can see on camera a fight involving approximately four males outside the main entrance. One male appears to be on the ground injured.' This gives the call-taker the essentials immediately. Avoid internal jargon (camera numbers mean nothing to police), lengthy background explanations, or uncertain language. After the initial report, remain on the line, continue watching the cameras, and update emergency services with developments such as additional subjects, weapons visible, or direction of travel.
Question 3: During a major incident, a CCTV operator is asked by a senior manager to delete footage of an area that the manager claims is 'not relevant'. What should the operator do?
- Delete the footage immediately as instructed by a senior manager
- Refuse to delete the footage and escalate the instruction to a higher authority or document the instruction formally (Correct answer)
- Archive the footage under a different file name to preserve a copy
- Ask a colleague to review the footage first and then decide whether to delete it
Correct answer: Refuse to delete the footage and escalate the instruction to a higher authority or document the instruction formally
Deleting footage during or after a major incident that may be subject to investigation could constitute perverting the course of justice. Any instruction to destroy potential evidence must be refused and formally escalated.
During and after a major incident, all relevant CCTV footage must be preserved as potential evidence. Deleting footage, even if a manager claims it is irrelevant, could constitute perverting the course of justice under the Criminal Law Act 1967 or contempt of court. Operators must refuse such instructions and immediately escalate to the duty security manager, the data protection officer, or if necessary directly to the police. The instruction itself should be documented in writing, including who gave it, when, and in what form. Any pressure to destroy evidence should be treated as a serious safeguarding concern. The operator has a professional and legal duty to preserve footage, and senior management authority does not override criminal law.
Question 4: What information should be captured in an incident log entry for a serious event observed on CCTV?
- Only the time, camera number, and a one-word description of the incident type
- Date, time, location (camera number and site area), nature of incident, description of subjects involved, actions taken, and the operator's identity (Correct answer)
- A written transcription of all radio communications during the incident
- The names and badge numbers of all security staff who responded to the incident
Correct answer: Date, time, location (camera number and site area), nature of incident, description of subjects involved, actions taken, and the operator's identity
A comprehensive incident log entry creates an official record that may be relied upon in subsequent investigations or court proceedings. It must be accurate, detailed, objective, and completed as close to the event as possible.
The incident log is a contemporaneous record with potential legal significance. A complete entry for a serious incident should include: the date and time the incident was first observed; the camera number(s) and site location; a factual description of what was observed; actions taken by the operator (called 999, alerted security, preserved footage); any reference numbers given by police or other agencies; and the operator's name and identification. Entries should be written objectively in factual terms, avoiding opinion or assumptions. If there is a delay in making the entry, note the actual time of the observation and the time the log was completed.
Question 5: A CCTV operator observes a vehicle parked in a fire lane blocking emergency vehicle access. There is no immediate incident. What is the appropriate response?
- Ignore it as there is no active emergency
- Log the observation, notify on-site security or the relevant authority to address the obstruction, and monitor the situation (Correct answer)
- Call 999 immediately to report the obstruction
- Zoom in to record the number plate and wait to see if an incident occurs
Correct answer: Log the observation, notify on-site security or the relevant authority to address the obstruction, and monitor the situation
A blocked fire lane is a potential safety hazard that should be addressed proactively before an emergency arises. The operator should log the observation and notify the appropriate person to resolve it, typically on-site security or a warden.
Proactive safety management is a key function of CCTV operations. A vehicle blocking a fire lane may not constitute an immediate emergency, but it poses a significant risk if a fire or other emergency occurs while the obstruction is present. The proportionate response is to: log the observation with time, location, and vehicle description or number plate; notify on-site security, a parking warden, or the facilities team who have authority to deal with the obstruction; continue to monitor and record the situation; and update the log when the obstruction is removed. This demonstrates proactive safety management and creates a record should the obstruction later become relevant to an incident.
Question 6: After an incident has concluded, why is it important for the CCTV operator to conduct a post-incident review of the footage?
- To assess the operator's own performance and identify whether procedures were followed correctly
- To identify additional suspects, vehicles, or activities not apparent during the live incident, and to confirm the footage has been preserved correctly (Correct answer)
- To provide entertainment content for security team briefings
- To calculate an estimate of financial losses for insurance claims
Correct answer: To identify additional suspects, vehicles, or activities not apparent during the live incident, and to confirm the footage has been preserved correctly
A post-incident review of footage may reveal suspects who were not identified during the live event, confirm that all relevant footage has been preserved, and identify any system failures that affected coverage of the incident.
During a live incident, the CCTV operator is focused on directing cameras and communicating with responders, which may mean secondary activities are missed. A methodical post-incident review of all relevant camera footage, including cameras covering approaches, exits, and areas peripheral to the main incident, can: identify additional suspects or vehicles that left before police arrived; establish a fuller timeline of events; identify witnesses; confirm the integrity and completeness of preserved footage; and detect any system failures. The review should be conducted by the operator or a supervisor, documented in the incident log, and any findings reported to the investigating officers.
SIA CCTV Incident Management 1
What is the correct priority order when a CCTV operator identifies a serious incident in progress on camera?