Incident Report Writing Flashcards
7 cards from real CSI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Report Writing flashcards as text
A properly written incident report conclusion should:
Answer: Summarize key findings and present supported analytical conclusions
Conclusions must be grounded in documented findings and presented analytically, not based on personal opinion or speculation.
When documenting surveillance footage in a report, the investigator should include:
Answer: Camera location, footage date/time, observed actions, and preservation method
Complete documentation of surveillance evidence includes its source, time scope, content, and how it was preserved.
The '5 W's and H' framework in incident reporting refers to:
Answer: Who, What, When, Where, Why, and How
Who, What, When, Where, Why, and How are the foundational questions every incident report must address.
An investigator is asked to write a report about an incident they did not personally witness. They should:
Answer: Clearly attribute all information to its sources and note they did not personally witness events
Investigators can document secondhand accounts as long as all information is clearly attributed to its identified sources.
In a workplace theft investigation report, recording that 'no forced entry was observed' is significant because:
Answer: It suggests the offender may have had authorized access, narrowing the suspect pool
Absence of forced entry indicates the perpetrator likely had a key or access code, which focuses the investigation internally.
Which of the following practices undermines the integrity of a security incident report?
Answer: Backdating entries to reflect an earlier time than actual completion
Backdating is a form of falsification that can constitute fraud and destroys the document's legal credibility.
When a report references a prior incident involving the same subject, the investigator should:
Answer: Cite the prior case number and date rather than reprinting the full prior report
Citing case numbers and dates keeps the current report concise while allowing readers to retrieve prior records through official channels.