A timeline is an argument about sequence. Make it possible for another authorized person to follow the sources without accepting every interpretation in the narrative.
The idea in view · Planning diagram
Sequence the evidence with its source
- Observed occurrence
- System receipt
- Contact attempt
- Timestamp source
- Known uncertainty
- Acknowledged action
Preserve source references
Use the camera alias, clip reference or call-log identifier for each row. Keep the original file and restrict access to evidence. A timeline should help locate the record, not replace it with a paraphrase that loses context.
State uncertainty
Record an estimated time as estimated. If two clocks differ, note the offset and the basis for aligning them. Do not fill gaps with a confident narrative or describe an action as completed when only an attempt is recorded.
Review the sequence
Ask an authorized reviewer to compare important entries with their sources. Include open questions and the next owner. A clean chronological table can still contain contradictory records; keep those contradictions visible until resolved.
Keep facts and interpretations in different lanes
Write what a source shows, which record contains it and how certain the time is. “Vehicle leaves the frame” is narrower than “vehicle leaves the property”. If the latter cannot be seen, preserve the limit. Where a report is secondhand, identify it as a report instead of promoting it to an observed event.
Cross-check important entries against the original records through the authorized process. GOV.UK retrieval guidance emphasizes source integrity and native footage context; a timeline should point back to that evidence. Keep any correction as a new explanation with an owner rather than rewriting the source. Unresolved gaps are part of an honest reconstruction, not formatting defects to smooth away.
Build a sequence from attributed observations
An incident timeline should show where each event came from. Camera footage, a platform receipt, a telephone attempt and a person's later account are different sources. Record the source and distinguish direct observation from interpretation. A timeline becomes less reliable when every entry is written with the same certainty despite different evidence quality.
Start with known anchors and add events around them. Keep approximate times approximate. If a person recalls an action but no system timestamp exists, record that limitation rather than assigning a precise second. The reader needs to understand what is known, what is inferred and what remains unresolved. A tidy sequence is useful only if it preserves those distinctions.
Preserve the meaning of each timestamp
Identify the time source, zone and any known discrepancy. Event occurrence, recording timestamp, system receipt and review action are not interchangeable. A delay between two values may be meaningful, or it may reflect different representations of time. Check the sources before attributing the difference to the network or a person.
Retain original video and records through the approved process. The timeline is a guide to the evidence, not a replacement for it. Where a corrected interpretation is needed, preserve the original value and explain the adjustment or uncertainty according to the record policy. Avoid silently editing the underlying sequence to make it agree with a preferred narrative.
Reference context: GOV.UK: Recovery and Acquisition of Video Evidence v3.0 (2022)
Show actions, ownership and unfinished work
For each response action, record the attempt and observed result. A call placed is different from a role accepting a task; attendance is different from resolution. Keep those events separate so the timeline can explain who owned the next step. If an action has no acknowledgement, the absence belongs in the record rather than being filled with an assumed result.
End with the current status, not an automatic conclusion. Some incidents close with an accepted outcome; others need a technical investigation, evidence transfer or site decision. Assign the remaining work and link its reference. The timeline should help review how the process behaved, including useful decisions and gaps, without inventing causation or individual fault beyond the available evidence.
A fictional timeline with an uncertain start
A reviewer receives an event at 23:14, calls the duty manager at 23:16 and records acknowledgement at 23:18. Local footage appears to show activity earlier, but the camera's historical time offset has not been confirmed. The timeline can reliably show the receipt and action sequence while qualifying the apparent occurrence time.
The report should not calculate a precise event-to-review interval from the uncertain camera value. It can identify the missing time check as a follow-up and preserve the relevant recordings. If the offset is later established, an attributed update can explain the relationship. This makes the timeline more useful than a superficially precise table whose earliest timestamp cannot be supported.
Make the call
How should this entry be described?
| Situation | Decision to make | What to ask for |
|---|---|---|
| The clip shows a person entering | What the source directly establishes | An observed action with the clip reference |
| A colleague reports an earlier sound | Whether the time and event are confirmed | A separately labeled reported account |
| Two systems use different clocks | Whether the sequence can be aligned | Original times and a documented offset |
Before you move on
- Collect authorized evidence references.
- Enter time, zone, observed fact and source for each event.
- Review discrepancies and keep interpretations labeled.
A worksheet you can actually use
Start with the blank sheet. Add one row per item, assign an owner and mark anything unresolved as pending. The completed example shows the level of detail to aim for.
Keep completed security plans private. Use aliases; keep passwords, access codes, personal contacts and footage links in your approved systems.
How to fill the worksheet
- Time
- Keep the original value and distinguish exact, approximate and inferred times instead of forcing uniform precision.
- Zone or offset
- Record the supported time context for each source and retain uncertainty where a historical setting cannot be confirmed.
- Observed fact
- Describe what the evidence actually shows, separating observations from interpretation or statements supplied by another person.
- Source reference
- Use controlled references to footage, platform records or attributed accounts so the sequence can be examined later.
- Certainty
- State the confidence or limitation relevant to the entry without manufacturing a numerical certainty score.
- Open question
- Record the unresolved fact, responsible investigator and next evidence needed rather than filling the gap with a convenient assumption.
A worked example
Fictional entry: “01:14Z: person visible inside gate, clip G01-TEST.” A separate row records an attempted call; acknowledgement is added only when confirmed.
| Time | Zone or offset | Observed fact | Source reference | Certainty | Open question |
|---|---|---|---|---|---|
| 01:14 | UTC | Person visible inside gate | G01-TEST | Observed in fictional clip | Identity unknown |
Questions readers bring to this task
What else should you know?
Can the timeline include conclusions?
Yes, if they are clearly labeled and their basis is stated. Keep the observations, source references and uncertainty visible so a reviewer can disagree with the interpretation without losing the underlying record. Obtain qualified advice for formal evidential or legal conclusions.
Link to this answer ↗Should a timeline include assumptions?
It can include clearly labeled interpretations or working hypotheses where they help the investigation, but separate them from observed facts. State the source and uncertainty. Do not present an inferred action as completed simply because it would normally occur between two recorded events.
Link to this answer ↗Is an incident timeline the same as an incident report?
The timeline is the ordered sequence. The wider report can include purpose, observations, decisions, evidence references, outcome and follow-up. Link them so the narrative is traceable, but do not require one table to carry every operational and evidential detail.
Link to this answer ↗Can the template prove response performance?
Only the intervals supported by reliable, consistently defined timestamps can be measured. A fictional example demonstrates fields, not a benchmark. Missing or incompatible times should remain unmeasured rather than being used to produce an attractive response figure.
Link to this answer ↗Notes & sources
This worksheet is not a forensic opinion or proof of identity. Follow your organization’s evidence handling procedure.
Reviewed October 27, 2026. The examples and worksheets are planning aids, not customer results or a statement of contracted service.
- GOV.UK: Recovery and Acquisition of Video Evidence v3.0 (2022)
Native retrieval, playback and source context. A formal forensic procedure requires appropriate expertise.
- ICO: surveillance data protection principles
UK surveillance guidance on purpose, retention, secure access and transparency. Guidance is under review; check it when making a decision.
- NIST: digital video exchange standards
Video export interoperability research, not a certification of this website or a customer system.