The New Incident screen is used to create new incidents in Incident Xpress. Let's look at the process of creating a new incident record.

Task: Create a New Incident

Select New Incident in the Main Menu to open the New Incident screen. 

Figure: NEW INCIDENT screen 

An incident is broken down into the following options:

1. WHEN was the incident reported and when did it occur?
   
2. WHAT happened?
   
3. WHERE did it happen?
   
4. WHY did it happen?
   
5. SUMMARY text field for information not otherwise included.
   
6. PERSONS involved?
   
7. LEGAL ENTITIES involved?
   
8. VEHICLES involved?
   
9. ITEMS involved?
   
10. ATTACHMENTS notes, drawings, statements, photos.
    
11. CORRECTIVE ACTION to mitigate probability of reoccurrence. 
    

Not all of these options will be used in every incident record. They are all present to help capture as much relevant information about the incident as possible.

NOTE: The WHAT and WHEN items are the only mandatory fields in Incident Xpress and must be completed before an incident record can be saved or closed. 

Use the following steps to guide you through the incident record creation process. As noted above, while it's possible some options won't be used as part of the incident record, all of the available options are described in the process that follows.

NOTE: An incident is automatically saved by the system as a draft until formally saved or deleted. Formally refers to using the [SAVE] button at the bottom of the New Incident screen. Draft incidents are only visible to the user creating them and cannot be searched. Saved or Open incidents are visible to all users with the proper user privileges. 

These are the steps to follow once you have opened the New Incident screen:

1. The "Entered By" field at the top of the record will automatically prepopulate with the logged in user's name. Next to this field is the "Incident Investigator" field. This is where you can select an investigator’s name if the incident needs to be reassigned.

2. Select the WHEN option. 

Figure: NEW INCIDENT – WHEN option 

3. The "Date reported" field uses the current date and time as its default setting. Or, you can select “Date reported” and use the calendar dialog box to select a new date and time.

4. The "Date occurred" field also uses the current date and time as its default setting. Or, you can select the “Date occurred” and use the calendar dialog box to select a new date and time. If you are unsure when the incident occurred, you can enter a 'best guess' for the date and then select the "Uncertain" checkbox. This will remove the time from the “Date occurred” field and will indicate to other users that this date is uncertain with a question mark where the time would normally appear.

NOTE: You must select the [OK] button at the bottom of the calendar dialog box to post the date and time to the "Date" and "Time" fields. 

 

Figure: NEW INCIDENT – Date/Time dialog box

5. Select the WHAT option. 

Figure: NEW INCIDENT – WHAT option 

This option contains a hierarchical left-to-right set of incident classifications. By default, these classifications are labeled Class/Category/ Sub-Category/Type. These labels can be edited by the System Administrator.

6. Select the "CLASS" field and choose the appropriate item from the list.

7. If the "CLASS" selection opens a list of items in the "CATEGORY" field, choose the appropriate item from that list.

8. If the "CATEGORY" selection opens a list of "SUB-CATEGORY" items, choose the appropriate item from that list.

9. If the "SUB-CATEGORY" selection opens a list of "TYPE" items, choose the appropriate item from that list to complete the WHAT happened category.

Figure: NEW INCIDENT – WHAT option using all levels of classification.

10. Select the WHERE option. 

Figure: NEW INCIDENT – WHERE option 

This section is for recording the location details for where the incident occurred. This option also contains a hierarchical left-to-right set of location details. The location levels are setup by the SA during configuration.

If the incident took place on site, use the hierarchical dropdown lists to indicate the location. If the incident took place off site, type the location information into the address fields provided.

11. Select the "Level 1" field and choose the appropriate location from the list. 

12. If the "Level 1" selection opens a list of locations in the "Level 2" field, choose the appropriate location from that list.

13. If the "Level 2" selection opens a list of "Level 3" items, choose the appropriate location from that list. 

NOTE: A location description can have up to 5 levels; for example, State, City, Campus, Building, Room number. 

14. Select the WHY option.

Figure: NEW INCIDENT – WHY option

15. Select the "Root Cause" field and choose the most appropriate item from the displayed dropdown list.

TIP: The "Five Whys" process is a proven method of identifying the root cause of a given problem. Using the "Five Whys" process helps to reverse engineer an incident until the core issue is uncovered. For more information, visit the Five Whys page on Wikipedia. 

16. Select the SUMMARY option.

Figure: NEW INCIDENT – SUMMARY option 

17. Type a summary of the incident in the text box. You can format the text using the toolbar at the bottom of the box. 

TIP: The summary should contain the information that doesn't get entered in the other parts of the incident record. Be thorough, descriptive, and objective. There is no need to enter information such as day or date which is already recorded elsewhere in the incident details. 

18. Select the PERSONS option.

Figure: NEW INCIDENT – PERSONS option 

This option is used to enter the names and personal details including photos of any persons involved in the incident. Multiple persons can be added to an incident. 

19. To see if a person already exists in the Incident Xpress database, select the [SEARCH PERSON] button. Enter the first, last, or first and last name of the person and select the magnifying glass icon. If the person is in the database, they can be selected in the search list by clicking on the [ADD] button next to the appropriate person record. Their personal details will be automatically entered in the PERSONS option. 

  Figure: NEW INCIDENT – Select Person dialog box

NOTE: To avoid duplication, it is good to do a partial search when searching by first name to catch any variations of the name in the system e.g. Jen vs. Jennifer.

20. If the person is not in the database, select the [ADD] button to open the "Add Person" dialog box.

Figure: NEW INCIDENT – Add Person type dialog box

21. Select whether the person is an employee or not. If they are an employee, the information form loaded will be simpler as there is not a requirement for such information as address, etc. 

Figure: NEW INCIDENT – Add Person employee option

22. Select the relevant toggle switches and fill in the fields with as much information as possible. For example, if the reporter is also a witness, select both toggle switches. If a person gives a name that is obviously an abbreviation or a nick name such as Jen, ask them if this is their proper name. If Jennifer is their proper name, enter Jen in the Alias field.

TIP: Use the [CHECK DUPLICATION] button after entering both the first and last name of the person as one last failsafe action to avoid duplication in your system. If the person exists, a dialog box will come up with that person’s information and a [SELECT] button. 

Figure: NEW INCIDENT – Check Duplication dialog box

23. If you have a digital picture of the person, you can add it to the record by selecting the 'person icon' in the frame on the right-side of the screen and following the upload instructions. The maximum image upload size is 10 MB.

TIP: It is critical to get the names of involved persons correct. Use government-issued ID whenever possible as these documents usually have the correct legal name. In the absence of government-issued ID, ask the person if the name they are giving is their proper name as it appears on their driver's license or passport. 

24. If there is more than one person involved in the incident, select the [ADD] button in the bottom-right corner to add another person’s details. Repeat this step for every person you wish to add to the incident.

If you want to delete a Person entry in progress and start over, select the [DELETE] button located under the Comments text box. The entry will close without being saved in the PERSONS option.

25. Select the LEGAL ENTITIES option.

Figure: NEW INCIDENT – LEGAL ENTITIES option 

This option is for any legal entities such as the owner organization or another corporation or private business which are related to, or involved in, the incident. You can add multiple legal entities to an incident record. 

TIP: Use the legal entities section for all instances when the application owner is the victim, for example, property was stolen from the organization or the organization’s property was vandalized.

26. You can search the Incident Xpress database for an existing legal entity by selecting the [SEARCH LEGAL ENTITY] button.

27. To manually enter a legal entity, select the [ADD] button. On the information form that opens, select the relevant toggle switch or switches and fill in the fields with as much information as possible. 

TIP: Use the [CHECK DUPLICATION] button after entering the name of the entity as one last failsafe to avoid duplication in your system. If the entity exists, a dialog box will come up with that entity’s information and a [SELECT] button. If the entity involved in the incident is the owner of the application, select the Owner toggle switch.

28. To add another legal entity, select the [ADD] button in the bottom-right corner and repeat. 

 Figure: NEW INCIDENT – Add Legal Entities option

If you want to delete an entry in progress and start over, select the [DELETE] button located under the Comments text box. The entry will close without being saved in the LEGAL ENTITIES option.

29. Select the VEHICLES option. 

Figure: NEW INCIDENT – VEHICLES add option 

30. Select the [ADD] button to add a vehicle description to the incident. Fill in the available fields and enter any additional details into the Comments box.

Figure: NEW INCIDENT – VEHICLES option 

31. To add images of the vehicle or other applicable files, select the [ADD ATTACHMENT] button. Use the "Choose File" option to locate and select the file from your PC or mobile device. You can enter a unique name for the file. Select the [OK] button to upload the file. This upload may take some time based on the file size. 

Figure: NEW INCIDENT – VEHICLES option adding attachments

 

32. To add another vehicle to the incident record, select the [ADD] button in the bottom-right corner of the option. 

If you want to delete a vehicle entry in progress and start over, select the [DELETE] button located under the Comments text box. The entry will close without being saved in the VEHICLES option.

NOTE: The “Property of” dropdown list is pulled from any persons or entities added to the incident record. 

33. Select the ITEMS option. 

Figure: NEW INCIDENT – ITEMS add option 

34. Select the [ADD] button to add an item description to the incident. Fill in the available fields. More details can be entered into the Comments box.

Figure: NEW INCIDENT – ITEMS option 

35. To add images of the item or other applicable files, select the [ADD ATTACHMENT] button. Use the "Choose File" option to locate and select the file from your PC or mobile device. You can enter a unique name for the file. Select the [OK] button to upload the file. This upload may take some time based on the file size. 

Figure: NEW INCIDENT – ITEMS add an attachment

36. To add another item to the incident record, select the [ADD] button in the bottom-right corner of the option.

37. If you want to delete an item entry in progress and start over, select the [DELETE] button located under the Comments text box. The entry will close without being saved in the ITEMS option.

NOTE:    The “Property of” dropdown list is pulled from any persons or entities added to the incident record. 

38. Select the ATTACHMENTS option. 

Figure: NEW INCIDENT – ATTACHMENTS add option 

This option is for any digital files you want to attach to the incident.

39. Select the [ADD] button to add a file attachment to the record. Use the "Choose File" option to locate and select the file from your PC or mobile device. You can enter a unique name for the file. Select the [OK] button to upload the file. This upload may take some time based on the file size. 

Figure: NEW INCIDENT – ATTACHMENTS option 

40. Repeat this step for every file you want to add to the incident record.

NOTE:  Examples of attachments may include witness and victim statements, photos of injuries or damages, or a police report.

TIP:  An investigator can document the progress of his or her investigation and attach their notes in the ATTACHMENT section. These notes can be saved as progress is made and edited as new information becomes available. 

41. Select the CORRECTIVE ACTIONS option. 

Figure: NEW INCIDENT – CORRECTIVE ACTIONS add option

This option is for adding a description of any/all actions which were taken to mitigate the probability of a similar incident happening again. This can include disciplinary measures, policy changes, etc.

41. Select the [ADD] button to add a corrective action.

Figure: NEW INCIDENT – CORRECTIVE ACTIONS option

42. Use the "Corrective Action Type" dropdown list to select an action type.

43. Use the [REFERRED] toggle switch if the corrective action is the responsibility of someone outside of the security function. Use the [INTERNAL] or [EXTERNAL] toggle switches to indicate if the corrective action is being referred to an internal party like Human Resources, or an external third-party like a corporate vendor or a government agency. 

If you select the [INTERNAL] toggle switch, select the appropriate department from the dropdown list. Next fill in the contact details of the person in the department handling the corrective action.

If you select the [EXTERNAL] toggle switch, you will get a dropdown list of external agencies to select from that the incident will be referred to. Next fill in the contact details of the person in the external agency handling the corrective action.

Figure: NEW INCIDENT – CORRECTIVE ACTIONS option

NOTE:  Whether the incident is referred or not, all of the persons and legal entities added to the incident will appear under the contact details with checkboxes. This is so you can associate the corrective action with one, all, or none of these persons or entities.

44. Type additional information into the "Comments" text box.

45. When completed, select the [ADD] button in the bottom-right corner to add another Corrective Action to the incident record, or select another option to automatically save the item information to the incident record. 

If you want to delete a corrective action entry in progress and start over, select the [DELETE] button located under the Comments text box. The entry will close without being saved in the CORRECTIVE ACTION option.

46. To complete your work on the incident record, select one of the buttons at the bottom of the New Incident screen:

1. Select [SAVE] to save the incident as an open record in the Incident Xpress database. This option should be used when an investigation is still active or there is additional information to add to the record.
   
2. Select [CLOSE INCIDENT] to save and close the incident in the Incident Xpress database. This option is typically used when everything has been documented and there is nothing left to add to the incident.
   
3. Select [DELETE DRAFT] to delete the draft version of the incident record. 
   

NOTE: A closed incident can only be reopened by a user with that privilege.