How should I document an urgent first-response decision?¶

An urgent digital first-response decision may later be examined by investigators, specialists, managers, courts or affected organisations. The record must show why the action was reasonable at the time.

Evidential caution: that writing down only what you did is enough. A useful record must also explain what you knew, what risk you were managing and why the chosen action was proportionate.

What this means¶

State the immediate problem. Was there a risk of remote deletion, continuing fraud, victim harm, system compromise, loss of access, battery failure or business disruption? Distinguish confirmed facts from assumptions or reports made by others.

Explain why the chosen option was selected and why alternatives were rejected or could not be obtained in time. If specialist advice was requested, record from whom, when and what advice was given.

Describe each action in sequence. Record who performed it, the exact time and any visible result. Note new screens, warnings, disconnections, notifications, lockouts or other changes.

Where the decision had an evidential cost, record it directly. Do not hide the fact that a session ended, a timestamp changed or a system restarted.

What to check or do next¶

• Record the date, time and location of the decision. Identify the device, account or system involved and describe its condition as found. Include visible screen content, power state, connectivity, logged-in status and any relevant alerts or active activity.
• Record the options considered. This may include leaving the system untouched, photographing the state, isolating a device, changing credentials, contacting a provider, disconnecting equipment or obtaining specialist support.
• If the situation was too urgent for a full contemporaneous note, make a short record immediately and complete the detail as soon as practicable, clearly identifying what was added later.