Closing an Occurrence Book Entry: UK Guide 2026

Last updated: 3 October 2026

---ARTICLE---

Closing an occurrence book entry: what UK security operators need to get right

Closing an occurrence book entry means recording the outcome, time and sign-off that mark an incident or task as resolved, not just noting that it happened. Under BS 7499:2020, occurrences and actions taken must be recorded by time and date — an entry without a documented outcome fails that standard.

Key Takeaways

• An occurrence book entry is only "closed" once it records the outcome, the closing time, and who authorised it — an open entry with no resolution is an incomplete record, not a finished one.
• BS 7499:2020 requires all occurrences, incidents and actions taken to be recorded by time and date, per BSI Standards Publication BS 7499:2020 (2020).
• A supervisor, shift lead, or the officer who raised the entry typically closes it, depending on the site's contract and the severity of the occurrence.
• Closed occurrence book records should be retained for five years, according to Marliz Security (2023).
• Pulse Operations's own audit log is hash-chained (SHA-256) and tamper-evident, so a closed entry cannot be quietly rewritten after the fact (as of August 2026).

What does it mean to close an occurrence book entry?

Closing an occurrence book entry means adding the final details that turn an open, in-progress record into a completed one: the outcome, the time it was resolved, and the name of whoever authorised the closure. An occurrence book — sometimes called a daily occurrence book or DOB — is the chronological log a security team keeps of everything that happens on a shift, from a fire alarm activation to a delivery, a lost key, or a member of the public asking for directions.

Opening an entry is straightforward: an officer notes what happened, when, and who was involved. Closing it is where the record earns its evidential value. An entry that says "alarm activated at zone 3, 02:14" but never says what caused it, who attended, or when it was stood down is not a closed record — it's a loose thread. If that incident later becomes an insurance claim or a police enquiry, an unclosed entry is the first thing a solicitor or loss adjuster will flag.

This distinction matters more than it sounds. BSI Standards Publication BS 7499:2020 states that daily registers must be maintained on all assignments, and that "all occurrences, incidents and actions taken should be recorded, by time and date, in the registers." Actions taken is the operative phrase — a register that only logs the trigger, not the resolution, doesn't meet the standard's intent.

Who is responsible for closing an occurrence book entry?

Responsibility for closing an occurrence book entry usually sits with a supervisor or shift lead, though the officer who raised the entry closes routine, low-risk items themselves. On most static guarding contracts, anything involving an incident, a breach, an injury or police attendance is escalated for a supervisor's sign-off before it's marked closed — the officer on the ground rarely has the authority (or the full picture) to close it alone.

This split exists for a reason: a supervisor checks that the response was proportionate, that any follow-up actions (a maintenance callout, a client notification, an RIDDOR report to the HSE) have actually been arranged, not just promised. On SIA-regulated contracts, this sign-off also forms part of the evidence an Approved Contractor Scheme assessor will want to see when reviewing site documentation and staff practice — closing is where accountability becomes visible on paper.

The earlier BS 7499:2013 standard put it more simply: "A daily register should be maintained of all assignments. All occurrences, incidents and actions taken should be recorded, by time and date." Nothing in either version of the standard names a specific job title as the closer — it's a contractual and operational decision each provider makes, usually set out in the site assignment instructions.

On a digital platform, this responsibility becomes traceable rather than assumed. Pulse Operations's daily occurrence book logs which named user closed each entry and at what timestamp, so "who signed this off" is never a question a client has to ask.

What are the step-by-step actions required to close an entry properly?

Closing an occurrence book entry properly requires five steps: confirm the situation is genuinely resolved, record the outcome in plain language, log the closing time, name who authorised it, and add any follow-up actions still outstanding. Skipping any of these leaves the entry technically open even if nobody says so.

1. Confirm resolution. Check the incident, task or occurrence has actually concluded — not just quietened down. A fire alarm that's been silenced isn't resolved until the cause is known.
2. Record the outcome. State plainly what happened in the end: "false alarm, faulty detector in plant room, engineer notified" — not just "resolved."
3. Log the time. Note the exact closing time, separate from the opening time, so the duration of the occurrence is visible.
4. Name the authoriser. Record who closed the entry — the officer, supervisor, or control room operator — by name, not initials alone where possible.
5. Flag outstanding actions. If a contractor callout, client notification or police reference number is still pending, note it explicitly rather than closing the entry as if nothing remains.

At Priority First — the founding team's own London security and facilities operation, and the site where Pulse was built before being offered to other operators — occurrence entries used to be written up at the end of a shift "by whoever's left standing," in the words of founder Mo Hassan. That's a familiar failure mode across the industry: closing gets rushed into the last ten minutes before handover.

"A paper occurrence book is written at the end of the shift by whoever's left standing. Ours writes itself as the shift happens — every patrol, incident and check call lands in it with a timestamp, and nothing can be quietly rewritten afterwards. That's what an insurer actually wants to see." — Mo Hassan, Founder, Pulse

What information must be included when closing an entry?

A properly closed occurrence book entry must include the closing time, the final outcome, the name of the person authorising closure, and a record of any follow-up actions still open. Missing any one of these turns a "closed" entry into an assumption rather than a fact.

An entry that reads "02:14 alarm, 02:20 closed" tells an assessor or an insurer almost nothing. An entry that reads "02:14 zone 3 alarm activated. 02:18 attended, no signs of intrusion. 02:20 closed by S. Osei, supervisor — engineer booked for 09:00 to check sensor" does the job the standard actually asks for.

Are there legal or regulatory requirements governing occurrence book closure?

No single piece of UK legislation names "closing an occurrence book entry" as a legal requirement, but the practice sits within a framework of standards, contracts and regulators that make sloppy closure a real operational risk. BS 7499:2020 is the current British Standard covering static guarding services, and it's the document most UK security contracts reference when specifying daily register requirements.

Beyond BS 7499, several other frameworks bear on how occurrence entries — and their closure — get scrutinised:

• The Security Industry Authority (SIA) licenses individual operatives under the Private Security Industry Act 2001, and reviews site documentation, including occurrence records, as part of Approved Contractor Scheme assessments. Pulse Operations's own guide, The ACS self-assessment: how to evidence it, sets out how the ACS workbook scores contractors against 78 individual indicators across seven criteria, and notes that assessors review staff files, contracts, duty rotas and site documentation directly rather than taking self-assessment scores at face value.
• BS 7858 governs security screening and vetting, and closed occurrence entries involving staff conduct can feed into that screening trail.
• The Health and Safety at Work etc. Act 1974 and RIDDOR reporting obligations to the HSE mean that some closed entries — particularly those involving injury — carry statutory reporting duties that sit alongside, not instead of, the occurrence record.
• The Terrorism (Protection of Premises) Act 2026, commonly known as Martyn's Law, brings incident logging and response records into scope for many publicly accessible venues; Pulse Operations covers this in its Martyn's Law guide.
• The UK GDPR and Data Protection Act 2018, enforced by the ICO, apply because occurrence entries routinely name individuals — closure practice needs to sit alongside a lawful retention policy, not just an operational one.

None of these bodies audit "closing" as an isolated act. What they do audit is whether the finished record — closed or not — stands up when someone asks to see it.

How soon after an incident should an entry be closed?

An occurrence book entry should be closed as soon as the situation is genuinely resolved and the outcome is known — not delayed to the end of the shift, and not closed prematurely before follow-up actions are confirmed. For routine occurrences (a visitor signing out, a delivery logged), closure happens within minutes. For incidents involving police attendance, injury, or a contractor callout, closure may reasonably wait hours or, in rare cases involving investigations, longer — but the entry should be updated with a note explaining why it remains open, not left silent.

The risk runs in both directions. Close too early and the record misstates what actually happened; leave it open too long and it becomes indistinguishable from a forgotten task. On paper occurrence books, this is almost entirely down to individual discipline and end-of-shift habits. On a digital platform, timestamps are set automatically the moment a status changes, which removes the guesswork about when something was actually closed versus when someone got round to writing it up.

What are the most common mistakes made when closing an entry?

The most common mistake is closing an entry with a vague outcome — "sorted" or "dealt with" — instead of a specific account of what happened and what was done. This single habit undermines more occurrence books than any other factor, because it turns a potentially useful evidential record into a box-ticking exercise.

Other recurring mistakes include:

• Backdating closures. Writing up several hours' worth of entries at the end of a shift and estimating closing times, rather than recording them as they happened.
• No named authoriser. Closing an entry without recording who actually approved it, leaving accountability unclear.
• Ignoring outstanding actions. Marking an entry closed while a contractor callout or client notification is still pending, so it silently drops off the radar.
• Illegible or ambiguous handwriting in paper logs, which becomes a genuine problem months later when a closed entry is needed as evidence.
• No cross-reference to a related incident report, work order or police reference number, leaving related records disconnected.
• Overwriting or tearing pages in a paper occurrence book after the fact — which, beyond being poor practice, can look like tampering if the record is ever challenged.

At a landmark West London mixed-use development where Priority First runs security across 152 checkpoints and 11 officers, the client's original concern wasn't incidents going unrecorded — it was proving which plant room had actually been checked at 3am, with no dispute possible six weeks later. Making every checkpoint photo-mandatory closed that gap: a missed area shows up as a gap in the record immediately, not as an argument after the fact.

How does closing a digital occurrence book entry differ from a paper one?

Closing a digital occurrence book entry differs from closing a paper one mainly in what happens after the closure is saved: a digital entry is timestamped automatically and, on a properly built system, becomes tamper-evident, while a paper entry relies entirely on the writer's honesty and legibility. Pulse Operations's audit log is hash-chained using SHA-256 — a cryptographic technique that links each record to the one before it — so any attempt to alter a closed entry after the fact breaks the chain and is detectable by a built-in integrity check.

This isn't a case of digital being flawless and paper being worthless — paper occurrence books have served the industry for decades and remain contractually acceptable on plenty of sites. But where a closed entry needs to survive scrutiny months later, a system where the officer app works offline-first and syncs itself once connectivity returns closes the gap that paper logs have always struggled with: the temptation, or the simple practical need, to fill in gaps from memory.

Can a closed occurrence book entry be reopened or amended?

Yes, a closed occurrence book entry can be reopened or amended, but any change must be visible as a change — never a silent edit to the original text. On a paper system, this means a dated correction alongside the original entry, never an erasure. On a well-built digital system, it means an audit trail that shows the original entry, who amended it, when, and why, without deleting what was first recorded.

This matters most when new information surfaces after closure — a witness statement, a CCTV review, or a police update that changes the picture. The correct approach is to add a supplementary note referencing the original entry number, rather than rewriting history. Any occurrence book — paper or digital — that allows entries to simply vanish or be overwritten without trace has a credibility problem the moment it's tested in a dispute, an insurance claim, or an SIA audit.

How long should closed entries be retained?

Closed occurrence book entries should be retained for five years, according to Marliz Security (2023). This retention period reflects the practical reality that insurance claims, employment disputes and even criminal proceedings can surface long after an incident closed, and a provider without the original record has no way to substantiate its version of events.

Retention isn't just an operational nicety — it intersects directly with data protection obligations under the UK GDPR, enforced by the ICO. Occurrence entries frequently name staff, visitors, contractors and members of the public, so a retention policy needs a documented lawful basis and a defined deletion point, not an indefinite "keep everything forever" approach. Five years is a sensible default for most static guarding contracts, but site-specific requirements — particularly on regulated premises — can extend that further.

Your occurrence book closure checklist

• Confirm the occurrence is genuinely resolved before marking it closed.
• Record the outcome in specific, plain language — never "sorted" or "dealt with."
• Log the exact closing time, separate from the opening time.
• Name the person who authorised closure, not just their initials.
• Note any outstanding follow-up actions explicitly, rather than letting them disappear.
• Cross-reference related incident reports, work orders or police reference numbers.
• Never overwrite, delete or tear out a closed entry — amend with a dated, visible note instead.
• Retain closed entries for at least five years, per Marliz Security (2023), with a documented deletion policy under UK GDPR.

FAQ

What does closing an occurrence book entry mean?

Closing an occurrence book entry means recording the final outcome, the closing time and the name of whoever authorised the closure, turning an open, in-progress record into a completed one. An entry without a documented outcome is not properly closed, even if no further action is expected.

Who is authorised to close an occurrence book entry?

A supervisor, shift lead, or the officer who raised the entry typically closes it, depending on the severity of the occurrence and the site's assignment instructions. Incidents involving police attendance, injury or contractor callouts are usually escalated for supervisor sign-off rather than closed by the reporting officer alone.

What happens if an occurrence book entry is left open or unclosed?

An unclosed entry leaves the record incomplete, which becomes a problem if the occurrence later forms part of an insurance claim, an employment dispute or an SIA Approved Contractor Scheme audit. BS 7499:2020 requires all occurrences and actions taken to be recorded by time and date, and an open entry doesn't meet that.

Can a closed occurrence book entry be amended after the fact?

Yes, but any amendment must be visible as a distinct change rather than a silent edit — a dated correction on paper, or a logged amendment in an audit trail on a digital system. Deleting or overwriting a closed entry without trace undermines its credibility if it's ever challenged.

How long must closed occurrence book entries be retained?

Closed occurrence book entries should be retained for five years, according to Marliz Security (2023). This retention period needs to sit alongside a documented lawful basis and deletion policy under the UK GDPR, since occurrence entries usually name individuals.

Does closing an occurrence book entry require a supervisor's signature?

Not always — routine, low-risk entries can be closed by the reporting officer, but incidents, breaches or anything involving injury or police attendance typically need supervisor sign-off. This split is a contractual and operational decision each provider sets out in its site assignment instructions, rather than a fixed legal requirement.

How is closing an entry different in a digital occurrence book versus a paper one?

A digital occurrence book timestamps closure automatically and, on systems like Pulse Operations, records it in a hash-chained, tamper-evident audit log, whereas a paper entry relies on the writer recording the time accurately and honestly. The practical difference shows up months later, when a closed digital entry can be verified against an unbroken chain and a paper one cannot.

Closing occurrence book entries properly with Pulse Operations

Getting closure right on paper depends entirely on discipline — a supervisor remembering to check outcomes, an officer resisting the urge to write "resolved" and move on. Pulse Operations's daily occurrence book removes that dependency: every entry carries an automatic timestamp, a named user against every action, and a hash-chained audit trail that makes silent edits to a closed entry technically impossible, not just against policy.

This is the same system Priority First — the founding team's own London security and facilities operation — runs across 24 sites, with more than 4,900 patrols on the record and every checkpoint backed by a watermarked photograph as of July 2026. It was built to answer a client's 7am "was everything OK last night?" call with evidence rather than reassurance, and closing an occurrence entry properly is exactly that same discipline applied to incidents.

If your current occurrence book leaves closure to whoever's writing up the shift, get in touch with Pulse Operations for a demonstration of how the platform handles it, or view published pricing — per operative, unlimited sites, with admin and client portal seats free on every plan.

Related Reading

• Accident Book Requirements UK: 2026 Legal Guide
• QR Code Guard Tour Disadvantages: UK Guide 2026
• Silvertrac Alternative 2026: Best UK Options Compared

★ Add pulse-operations.co.uk as a preferred source on Google