Security Incident Management and Investigations Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Security Managers, Corporate Investigators and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SM-040

Before you join: Participants should have practical experience in a security, safety, risk, facilities, resilience, compliance or investigative role.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Security incidents can interrupt operations, expose people to harm, compromise assets and information, and create legal, contractual and reputational consequences. Security managers and investigators must make sound decisions while facts are incomplete: preserve a scene, protect people, coordinate responders, document actions, interview witnesses, manage evidence and brief leaders. Weak incident handling can contaminate evidence, delay recovery, miss root causes and leave corrective actions untracked.

This course develops the practical discipline required to manage security incidents from first report to formal closure. Participants apply incident classification, command structures, triage, scene management, evidence control, investigative planning, witness interviewing, CCTV and digital evidence review, root-cause analysis and report writing. The course also addresses liaison with police, regulators, insurers, legal advisers, human resources and senior management. Participants learn how to distinguish fact from inference, test competing explanations and make proportionate recommendations.

Instruction combines short technical briefings with case analysis, incident command simulations, investigation planning, interview preparation and report-review sessions. Cases reflect workplace violence, theft, fraud indicators, access-control failures, sabotage, protest activity, missing property and suspicious events. Participants progressively build an incident management and investigation case file, then complete a capstone investigation package containing an incident action plan, evidence register, interview plan, findings report and corrective-action tracker. Delivery is available in classroom settings in 50+ cities or live online. The 10-day programme runs from 08:30 to 16:30, with approximately 6.5 contact hours each day, and awards a certificate of completion.

The course suits security professionals who already participate in incident response or investigations and now need a repeatable method for managing complex cases, documenting defensible decisions and improving prevention controls.

What you will be able to do

  • Classify security incidents using defined severity, impact and escalation criteria
  • Construct incident action plans using command roles, objectives and operational periods
  • Secure incident scenes and maintain defensible physical and digital evidence chains
  • Develop investigation plans that test allegations, hypotheses, evidence sources and legal constraints
  • Conduct structured witness interviews using the PEACE interviewing model
  • Analyse incident causation using timeline reconstruction, 5 Whys and barrier analysis
  • Write evidence-based investigation reports with findings, recommendations and action ownership
  • Present a complete incident management and investigation case file for management review

Benefits of attending

For you

  • Handle first reports without losing critical facts or contaminating evidence
  • Lead incident briefings with clearer priorities, roles and escalation decisions
  • Prepare witness interviews that produce reliable, relevant accounts
  • Produce investigation reports that separate facts, analysis and recommendations
  • Build a documented portfolio of incident management and investigation work

For your organisation

  • More consistent incident classification, escalation and command arrangements
  • Better preservation of evidence for disciplinary, insurance and legal processes
  • Faster identification of control failures and repeat-incident causes
  • Clearer management reporting on exposure, findings and corrective actions
  • Stronger coordination between security, HSE, legal, HR and operational teams

Course modules

20 modules over 10 days

Participants can define, classify and record security incidents using consistent operational criteria.

  • Security incident definitions, thresholds and classification criteria for operational decision-making
  • Distinguishing incidents, emergencies, crimes, near misses and intelligence reports
  • Incident lifecycle from detection through closure, review and corrective action
  • Roles of incident commander, investigator, security manager and evidence custodian
  • Legal duties, contractual obligations and organisational policy requirements
  • Initial incident register fields supporting consistent management information

Participants can prioritise security incidents according to harm, exposure, urgency and business impact.

  • Risk assessment using likelihood, consequence, vulnerability and exposure factors
  • Threat categories including insider, criminal, activist, malicious and accidental events
  • Severity matrices calibrated against people, assets, operations and reputation
  • Triage decisions based on immediate danger, evidence loss and escalation triggers
  • ISO 31000 principles applied to security incident prioritisation decisions
  • Documenting rationale where incident severity changes during response

Participants can establish a proportionate command structure and incident action plan.

  • Incident command principles, span of control and delegated authority
  • Command roles for operations, planning, logistics, liaison and communications
  • Setting incident objectives, priorities, operational periods and decision checkpoints
  • Incident action plan sections: situation, objectives, assignments and resources
  • Escalation routes to executives, emergency services and specialist advisers
  • ISO 22320 concepts for structured emergency and incident management

Participants can control an incident scene while protecting people, evidence and operations.

  • Life safety priorities before property protection, investigation and recovery
  • Establishing inner, outer and controlled access scene perimeters
  • Scene entry logs recording identity, purpose, time and authorisation
  • Preserving transient evidence including footprints, odours, temperatures and displays
  • Separating witnesses to reduce account contamination and collusion risks
  • Handover briefings between responders using recorded facts and outstanding actions

Participants can coordinate timely, controlled communications with internal and external stakeholders.

  • Stakeholder mapping for executives, employees, contractors, regulators and emergency services
  • Initial notifications distinguishing confirmed facts, assumptions and unverified information
  • Situation reports using incident status, actions, risks and resource needs
  • Media and social-media escalation routed through authorised communications personnel
  • Liaison protocols with police, insurers, legal counsel and human resources
  • Communication logs preserving decision records, commitments and disclosure approvals

Participants can collect, package, record and transfer evidence with defensible continuity.

  • Evidence categories: physical, documentary, digital, testimonial and demonstrative material
  • Chain-of-custody records documenting collection, transfer, storage and access
  • Packaging methods protecting trace, biological, fragile and electronic evidence
  • Exhibit numbering conventions linked to evidence registers and investigation files
  • Secure storage controls, retention schedules and restricted-access arrangements
  • Photographic documentation using overview, mid-range and close-up image sequences

Participants can identify and preserve relevant digital and security-system evidence sources.

  • CCTV retrieval requirements, export formats, timestamps and retention periods
  • Access-control logs analysed for entry, exit, alarm and credential activity
  • Preserving mobile devices, emails, messages and computer-based records appropriately
  • Metadata considerations when copying, exporting and reviewing electronic material
  • Time synchronisation checks across cameras, access systems and incident logs
  • Digital evidence requests coordinated with information technology and legal teams

Participants can prepare an investigation plan that directs evidence gathering and decision-making.

  • Terms of reference defining allegation, scope, authority and reporting requirements
  • Investigation plans linking issues, hypotheses, evidence sources and responsible owners
  • Lines of enquiry ordered by urgency, evidential value and preservation risk
  • Hypothesis testing to avoid confirmation bias and premature conclusions
  • Investigation timelines showing milestones, dependencies, interviews and review points
  • Legal, privacy and employment considerations affecting investigative actions

Participants can separate facts from assumptions and develop a defensible account of events.

  • Fact, inference, opinion and allegation distinguished within investigation records
  • Chronologies built from logs, witness accounts, records and system data
  • Source evaluation using reliability, credibility, corroboration and relevance criteria
  • Competing explanations tested against available evidence and known constraints
  • Link analysis connecting people, locations, events, assets and communications
  • Decision logs recording rationale for significant investigative choices

Participants can identify interviewees and prepare structured, proportionate interview plans.

  • Witness mapping based on proximity, knowledge, role and potential bias
  • Interview objectives derived from allegations, timelines and evidential gaps
  • Question plans using topic funnels, open prompts and clarification questions
  • Support requirements for vulnerable, distressed or traumatised interviewees
  • Interpreters, representatives and confidentiality arrangements planned before interviews
  • Interview documentation methods: notes, statements, recordings and consent records

Participants can conduct ethical, structured interviews using the PEACE model.

  • PEACE stages: planning, engage, account, closure and evaluation
  • Rapport-building techniques that establish purpose, process and interview boundaries
  • Open questioning before probing chronology, detail, inconsistency and corroboration
  • Cognitive interview prompts supporting recall without introducing suggested information
  • Challenge strategies based on evidence disclosure and fair procedural treatment
  • Post-interview evaluation identifying new leads, risks and evidential gaps

Participants can manage internal misconduct investigations within fair process boundaries.

  • Allegation assessment before commencing disciplinary or criminal investigation pathways
  • Procedural fairness, confidentiality and need-to-know information handling requirements
  • Interviewing subjects while preserving dignity, rights and organisational policy compliance
  • Suspension, access restriction and safeguarding decisions based on assessed risk
  • Coordination with human resources during employee misconduct investigations
  • Referral thresholds where suspected criminal conduct requires police involvement

Participants can identify contributing factors and specify corrective actions that address control failures.

  • 5 Whys analysis applied beyond immediate error and individual blame
  • Barrier analysis identifying failed, absent, bypassed and degraded controls
  • Swiss Cheese model used to examine multiple control weaknesses
  • Human factors including workload, supervision, competence and procedural design
  • Corrective actions matched to root causes, owners, deadlines and verification
  • Distinguishing corrective, preventive and improvement actions within action registers

Participants can write clear incident reports and brief decision-makers on material findings.

  • Incident report structure: purpose, scope, facts, findings and recommendations
  • Writing factual narratives using chronology, attribution and precise source references
  • Findings framed against policy, procedure, law and evidential standards
  • Recommendation quality tested for feasibility, ownership, priority and measurable completion
  • Executive briefings focused on exposure, decisions required and residual risk
  • Report quality assurance for accuracy, confidentiality, grammar and evidential traceability

Participants can convert investigation findings into tracked improvements and organisational learning.

  • Action registers capturing ownership, due dates, status and verification evidence
  • Prioritising actions through risk reduction, cost, urgency and operational feasibility
  • Lessons-learned reviews separating systemic improvements from individual accountability
  • Control testing after implementation to confirm action effectiveness
  • Trend analysis across incidents, locations, categories and recurring failure modes
  • Management review packs showing overdue actions and residual exposure

Participants can adapt incident management arrangements for high-consequence security events.

  • Major incident thresholds involving casualties, disruption, public attention and criminality
  • Multi-agency coordination principles for police, emergency services and site management
  • Strategic, tactical and operational decision levels during prolonged incidents
  • Family assistance, employee welfare and post-incident support considerations
  • Business continuity interfaces for alternate sites, communications and recovery priorities
  • Transitioning from emergency response to formal investigation and recovery governance

Participants can recognise legal and ethical constraints affecting incident decisions and investigations.

  • Privacy principles governing personal data, surveillance records and disclosure
  • Confidentiality limits where safety, legal reporting or criminal concerns arise
  • Defamation, retaliation and discrimination risks within investigation communications
  • Document retention requirements, legal holds and defensible disposal practices
  • Proportionality tests for surveillance, searches and monitoring activities
  • Seeking specialist legal advice where jurisdictional obligations remain uncertain

Participants can measure incident performance and assess whether response controls are working.

  • Incident metrics for frequency, severity, response time and closure quality
  • Leading indicators including training completion, patrol findings and control testing
  • Dashboards linking incident trends to risk registers and management actions
  • Quality reviews of case files, evidence records and investigation reports
  • Audit trails demonstrating policy compliance, authorisation and decision accountability
  • Assurance sampling methods for closed incidents and corrective-action verification

Participants can adapt course methods into a practical improvement plan for their security function.

  • Gap assessment against current incident procedures, forms and escalation arrangements
  • Selecting priority improvements based on recurring events and control weaknesses
  • Adapting templates for local policy, legal requirements and reporting lines
  • Implementation milestones for training, approval, testing and operational release
  • Stakeholder engagement plan for security, HSE, HR and legal teams
  • Measures for monitoring adoption, case quality and action completion

Participants can build, review and present a complete security incident management and investigation case file.

  • Case intake, classification, immediate actions and escalation decision record
  • Incident action plan with command roles, objectives and communications arrangements
  • Investigation plan linking allegations, hypotheses, evidence and interview priorities
  • Evidence register, chain-of-custody documentation and chronology of material events
  • Findings report with root causes, recommendations and corrective-action ownership
  • Management presentation defending decisions, findings, residual risks and implementation priorities

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Security incident classification matrix
  2. Incident action plan template
  3. Investigation plan and evidence register
  4. PEACE interview planning checklist
  5. Investigation report template
  6. Corrective-action tracking model

Who should attend

  • Security Managers — responsible for incident governance, response performance and assurance
  • Corporate Investigators — required to plan, conduct and document defensible investigations
  • Security Supervisors — expected to control first response and preserve evidence
  • Loss Prevention Managers — investigating theft, fraud indicators and asset-control failures
  • HSE and Risk Professionals — coordinating security events with wider incident processes
  • Business Continuity Coordinators — aligning security response with operational recovery arrangements

Skills and tools covered

Incident commandEvidence managementInvestigative interviewingRoot-cause analysisSecurity reportingCorrective-action tracking

Tools and standards

ISO 31000, ISO 22320, PEACE interviewing model, 5 Whys

How the course runs

Training methodology

The course uses short instructor briefings to introduce methods, standards and decision points, followed by case work using realistic security scenarios. Participants work in groups to classify incidents, establish command arrangements, prepare investigation plans, assess evidence and draft reports. Simulations test initial response, scene control, stakeholder briefings and interview preparation under time pressure. Facilitated reviews compare alternative decisions against evidence, policy and legal constraints. Individual application planning links the course methods to each participant’s reporting procedures, escalation routes and recurring incident risks.

Requirements and prerequisites

Participants should have practical experience in a security, safety, risk, facilities, resilience, compliance or investigative role. They should understand their organisation’s basic reporting lines, access-control arrangements and emergency procedures, and be comfortable reading policies and writing short operational records. Prior exposure to incidents, loss prevention, workplace investigations or control-room operations is useful. No formal investigation qualification, policing background, forensic science training or legal degree is required. The course teaches the required investigation methods, evidence controls and reporting structure from first principles at an intermediate professional level.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should already work in security, safety, risk, facilities, resilience, compliance or a related operational function. No policing background, forensic qualification or formal legal training is required.

Bring a laptop if possible, along with non-sensitive examples of your current incident forms, reporting procedures or escalation charts. Do not bring confidential case files, personal data or restricted evidence.

It is designed for practitioners who manage, supervise, investigate or support security incidents. It is particularly relevant for security managers, corporate investigators, supervisors, loss prevention staff and HSE professionals with security responsibilities.

Emergency response training focuses primarily on immediate life safety and operational control, while business continuity training concentrates on sustaining critical services. This course covers initial response but places greater emphasis on evidence, investigation, findings, reporting and corrective actions.

Participants can adapt the incident classification matrix, action plan, evidence register, interview checklist and report structure for their own procedures. The application-planning module identifies priority changes, stakeholders and implementation milestones.

Each day runs from 08:30 to 16:30 with approximately 6.5 contact hours. The first part establishes incident management, evidence and investigation methods; the later part applies them to interviews, analysis, reporting, assurance and the capstone case file.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Security Management

Security Management Crowd Management and Control Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Facilities Safety and Security Management Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Hostile Environment Awareness Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Physical Security Management Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Security Leadership Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Management and Asset Protection Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Management for Oil and Gas Facilities Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Operations Supervision Training Course 10 days · from USD 2,200 · next 16 Nov