What should be included in documenting actions taken in an incident report?

• A. Who, what, where, when, why, how.
• B. Actions taken and outcomes.
• C. Only the date and location.
• D. Who, what, where, when, why, how, actions taken, outcomes, and related evidence or attachments.

Answer: (D)

When documenting actions in an incident report, the goal is to create a complete, auditable record of what happened and how it was addressed. You want to include who was involved, what occurred, where it happened, when it happened, why it happened or why certain decisions were made, and how the situation was addressed. In addition, note the actions taken and their outcomes so you can trace the response from start to finish and assess effectiveness. Attach or reference related evidence or attachments such as photos, logs, or witness statements to support what’s written and to preserve a clear record for investigations, accountability, or future reference. This combination gives the full picture—context, response steps, results, and supporting materials—making the report useful for review and learning. Focusing only on date and location misses essential context, and emphasizing only actions or outcomes leaves gaps in understanding or verification. Including all aspects plus evidence is the best practice.