What should a security guard do when they observe suspicious behavior? Document and report it.

Spotting something off in a hallway, at a loading dock, or near a entrances door can throw you for a moment. You’re trained to notice, to watch, to react calmly when something doesn’t sit right. In Ontario, guards operate under strict guidelines that emphasize responsibility, accuracy, and reporting over quick judgments. Here’s the practical, no-nonsense approach you can rely on when you spot suspicious behavior.

The right move is clear: document and report it

If you’re ever debating how to respond to suspicious activity, the simplest answer is often the right one. The correct choice is B: document and report it. Why? Because a written record creates a reliable account of what you observed, when you observed it, and what happened next. It’s not about building a case on a hunch; it’s about creating evidence that investigators or supervisors can use to decide the best next steps.

Let me break this down with the practical mindset that keeps security teams effective and people safe. Ignoring something, confronting someone, or broadcasting it to everyone in the building rarely ends well. Confrontation can escalate risk. Broadcasting to the media is not a security measure. And ignoring it leaves you exposed to danger and possible liability. Documenting and reporting, on the other hand, creates a traceable, auditable path that protects you, your client, and the public.

What “document and report” actually looks like in the field

Documenting is more than jotting a sentence on a sticky note. It’s about clarity, objectivity, and consistency. Here are the core elements to capture:

• Time and location: Note when you observed the behavior and the exact spot. Was it near a loading dock, a stairwell, or the main entrance? Time stamps help place the event in context.

• Description of the behavior: Write down what you saw in concrete terms. Was someone loitering near a restricted area? Did a package look out of place, or did a person try to bypass a door with a wristband or badge that didn’t belong to them?

• People involved: Document who was observed, including physical descriptors if you can do so safely (clothes, approximate height, marks, carrying items).

• Your actions: Record what you did, step by step. Did you maintain distance? Did you issue a verbal warning or request assistance? If you used a camera, note that as well.

• Evidence and evidence handling: If you captured video or photos (in line with privacy rules and your policy), note the file names or locations, and preserve the originals. Do not modify or delete anything unless your policy allows it and you have explicit instructions.

• Safety considerations: If there’s an immediate risk, your priority is to protect people. Document the risk, but don’t put yourself in harm’s way to obtain more details.

Short, precise notes work best. You’re aiming for a clear narrative that another trained professional can read and understand quickly. Think of it as leaving a breadcrumb trail that someone else can follow without needing you present to explain every detail.

Where to report and who should hear it

Ontario security teams operate with a clear chain of reporting. After you’ve documented the observation, your next step is to report it through the proper channels. Typically:

• Inform your supervisor or the building security lead first. They’re your immediate point of contact and will guide the next steps in line with the site’s policy.

• If the situation involves a potential threat to people or property, escalate promptly to the appropriate authorities. Dial 911 if there’s an immediate danger or you believe someone could be harmed right away.

• If there’s a need to contact non-emergency services, your supervisor can advise which municipal or provincial channels apply to the scenario.

In many Ontario settings, you’ll also follow a standardized incident report process. That might mean filling out a formal incident report form, submitting a digital record, or updating a logbook. The important thing is to keep the report consistent with your organization’s format and the PSISA requirements. The act of documenting and reporting isn’t just about the moment; it’s about building a coherent history that can help with ongoing security decisions.

A quick note on legal and ethical guardrails

Security work in Ontario is not the same as street-level vigilante activity. You’re operating under the Private Security and Investigative Services Act (PSISA) and related regulations. That means:

• You have a duty to protect people and property without escalating risk.

• Your reporting should be accurate, unbiased, and timely.

• You should respect privacy and avoid recording or disseminating information beyond what your site policy allows.

• You must cooperate with investigations and provide your notes when requested by supervisors or authorities.

These rules aren’t there to cramp your style; they’re there to keep everyone safe and to ensure you have solid footing if anything ever goes to court or to an inquiry.

Tools of the trade that help you document well

You don’t need a fancy toolkit to document well, but a few practical items make a big difference:

• A reliable pocket notebook or a quick-composition form on a mobile device. The goal is legible, organized notes you can translate into a formal report later.

• A concise incident log template. A standard template reduces room for confusion and makes it easier when someone else reviews the case.

• A simple photo or video record-keeping method, aligned with privacy rules. If your site allows photos or video, save copies in a designated folder and reference them in your report.

• A checklist for suspicious behavior patterns. This isn’t a substitute for on-the-spot judgment, but it helps you recognize common red flags (loitering near restricted zones, attempting to bypass access controls, unusual posture, or questions that try to mislead staff).

• A direct line to your supervisor or incident commander. Having one clear point of contact cuts down on delays.

The practical mindset: when to escalate versus when to observe

There’s a rhythm to this work. Not every odd behavior is a red alert, and not every suspicious act demands legal action. The balance comes from training, the site’s policies, and your judgment, exercised within a safe framework. A few guiding questions can keep you on track:

• Is there an immediate threat to life or property? If yes, call 911 and report details as you see them.

• Is the person in a restricted area or behaving in a way that could lead to a security breach? Document and report; provide a factual account to your supervisor.

• Are you able to observe without risking your safety or the safety of bystanders? If you feel unsafe, step back, then report through the proper channels.

• Could the behavior be accidental or misinterpreted? If so, note the context and observe further, but still document what you saw.

Real-world vibes: a couple of scenarios to anchor the guidance

Let’s ground this with a couple of everyday examples you might encounter.

• Scenario 1: A visitor repeatedly tries to tailgate through a secured door. They don’t show a badge, and they seem to be avoiding staff attention. Document the time, the door, the person’s appearance, and their actions. Report to your supervisor and, if necessary, notify the front desk or facilities team. If security CCTV confirms a pattern, flag it for a formal review.

• Scenario 2: An unattended bag sits near a high-traffic area with no owner in sight. You observe a person standing nearby, looking around nervously and moving away when approached. Again, you document, note any conversations you overheard (without speculating), and report. This helps ensure a quick, coordinated response if the bag becomes a health risk.

• Scenario 3: Someone tries to access a restricted area using a badge that isn’t theirs. The person doesn’t leave when politely challenged. You maintain a safe distance, document the badge attempt, and alert your supervisor to initiate the standard access-control protocol.

A few practical tips to stay steady under pressure

The moment you spot something off, a few habits can help you stay effective:

• Keep your notes crisp and objective. Avoid adjectives that inject guesswork; stick to observable facts.

• Speak up early. The sooner your supervisor knows, the better the potential response.

• Maintain a calm, respectful tone if you must engage. A confrontational stance tends to escalate risk.

• Protect yourself and others. If you think an individual might become violent, give yourself space and rely on the reporting chain.

• Review after-action notes with your team. Debriefs are where you turn a single incident into smarter prevention.

Common misconceptions worth clearing up

• “If I’m not sure, I should just confront.” Not necessarily. Your first obligation is safety, followed by reporting through proper channels.

• “I should handle this myself to save time.” Time saved now can translate into bigger risk later. Use the system that’s in place—your structure is there for a reason.

• “Documenting is enough.” Documentation is essential, but it’s part of a broader process that includes reporting, coordination, and sometimes police involvement.

A calm, confident finish

Security work often feels like a balance act—watchful enough to notice the small things, measured enough to respond responsibly. In Ontario, the right move when you observe suspicious behavior is to document and report. It creates a dependable trail that supports quick, organized action by supervisors, authorities, and the broader security team. It also protects you by giving you a clear, professional course of action to follow.

If you’re ever unsure, remember this simple rule: safety first, facts second, and follow your site’s procedures. The next time you’re patrolling, you’ll move with more confidence, knowing your notes are precise, your reports are timely, and your decisions are grounded in the training that keeps everyone safer.

And that’s the core of it. The moment you switch from judgment to documentation, you’re doing something powerful: you’re turning observation into action, and action into protection for the people and places you’re responsible for. It’s not glamorous, but it’s essential—and that’s what good security is all about.