Security management · Incident analysis

An incident report is not intelligence until someone assesses it

The value a security manager adds is in the last two lines: what the incident means, and what it changes for the operation. Everything before that is record-keeping.

Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation.

The reporting structure

  1. 01Incident
  2. 02Location
  3. 03Actor
  4. 04Event type
  5. 05Impact
  6. 06Trend
  7. 07Assessment
  8. 08Operational relevance

Worked examples

ILL-01 · Banadir, Somalia

Explosive incident on an arterial road

Actor
Non-state armed group (claimed)
Event type
Improvised explosive device
Impact
Casualties reported; road closed for several hours; secondary congestion across the district.
Trend
Consistent with a sustained pattern of attacks against fixed, predictable targets on main routes.
Assessment
Assessed as target-of-opportunity proximity risk to humanitarian movement rather than deliberate targeting of aid actors.
Operational relevance
Reinforces timing variation on airport transfers and the case for pre-agreed diversion and shelter points.

ILL-02 · Inter-city corridor, Somalia

Checkpoint dispute delaying a supply convoy

Actor
Local armed actor / unclear authority
Event type
Access constraint · informal taxation
Impact
Convoy delayed beyond the daylight window; goods retained pending payment discussion.
Trend
Rising checkpoint density reported by transporters over successive movements.
Assessment
Indicates contested rather than settled control on the segment; payment pressure is likely to recur.
Operational relevance
Journey plans on this corridor need earlier departure, transporter briefing and a documented no-payment position.

ILL-03 · Urban centre, East Africa

Civil unrest closing central districts

Actor
Protesters and security forces
Event type
Civil unrest
Impact
Commercial closure, movement halted, staff unable to reach the office safely.
Trend
Recurring around announced political and economic decision points.
Assessment
Predictable in timing, unpredictable in intensity; the main risk is staff caught in transit.
Operational relevance
Movement-pause thresholds and remote-working arrangements should be pre-authorised, not decided on the day.