How to Write a Consulting Incident Report

A consulting incident report is not only for dramatic events. It may document a missed access control, an interview note sent to the wrong recipient, a client workshop that exposed confidential material, a site visit injury or a disruption that affected promised deliverables. The report should make the event understandable to someone who was not there, while avoiding speculation that could distort the follow-up.

This guide uses a realistic consulting scenario: a strategy consulting team is running discovery interviews for a regional distributor. During analysis, a junior consultant uploads a workbook containing client sales data and named interview comments to the wrong project folder. A subcontractor on another engagement briefly has access before the error is noticed. No public disclosure is known, but the client sponsor must be told, access must be checked and the team needs a record of what happened.

The same structure works for many consulting incidents: start with facts, record immediate response, preserve evidence and witness accounts, assign follow-up actions and close only after review.

Start with incident facts

The first section should answer the basic questions without turning the report into a narrative argument. Record what happened, when it was identified, where it happened, who was involved and what information or service was affected. If you do not know something yet, say so.

For a consulting incident, the facts often sit across several systems: the statement of work, file access logs, email threads, calendar invites, interview notes and client communication records. Link the report to those sources rather than copying more sensitive detail than necessary into the report itself.

Useful fact fields include:

• Date and time discovered
• Date and time the event appears to have occurred
• Engagement name and client contact
• Reporter and report owner
• Systems, files or work products affected
• Known impact and unknowns
• Source of each key fact

Draft language:

On 14 September 2026 at 09:20, [Name], consultant, reported that the file "Distributor discovery workbook v0.3" had been saved to the shared "Retail benchmarking" folder instead of the restricted "Northstar strategy review" folder. The file contained draft sales analysis and interview comments from the Northstar engagement. Access logs show that [subcontractor name] opened the folder at 08:47. At the time of this report, there is no evidence that the file was downloaded or forwarded. Log review is continuing.

That wording does three useful things. It names the event, gives the evidence basis and keeps uncertainty visible. It does not say the subcontractor "misused" the file unless there is evidence for that.

For incidents involving worker injury or safety conditions in the United States, OSHA encourages employers to investigate incidents and close calls so they can identify hazards and corrective actions, and to focus on root causes rather than blame (OSHA incident investigation overview). Even when your consulting incident is mostly about information handling, the same discipline helps: write what is known, then ask what allowed it to happen.

Record the immediate response

The immediate response section shows what the team did to contain the issue and protect the client, staff or project. Keep it chronological and operational.

In the scenario, immediate response could include moving the file, restricting folder permissions, preserving access logs, notifying the engagement lead, checking whether the subcontractor accessed or copied the file, and preparing a client notice for approval. If the incident involves safety, medical, cyber or regulated data issues, follow the organization's emergency, legal and notification processes before treating the report as finished.

Draft language:

Immediate response completed by 10:15: the workbook was moved to the restricted engagement folder; the incorrect folder permissions were changed to remove cross-engagement access; the original access logs were exported by IT and stored at [location]; the subcontractor was instructed not to access, copy or discuss the file; and the engagement lead opened a client notification draft for legal and account director review.

Avoid vague phrases such as "handled internally" or "permissions fixed". Name the action, owner and evidence. If the action has not yet happened, put it in follow-up actions rather than pretending it is complete.

OSHA's hazard identification guidance says incident investigation plans should cover who is involved, lines of communication, supplies, reporting forms and templates, and should begin promptly when an incident occurs (OSHA hazard identification and assessment). For consulting firms, translate that into a simple response map: engagement lead, client sponsor, legal or privacy contact, IT owner and document owner.

Preserve evidence and witness accounts

Evidence is where many consulting incident reports become fragile. People remember events differently, file metadata changes, and project teams keep working while the report is being drafted. Your report should preserve the trail without spreading sensitive material.

For this scenario, relevant evidence might include:

• Folder permission screenshots or exports
• Audit logs showing access time and user identity
• The statement of work and confidentiality obligations
• The email or chat message where the issue was reported
• Interview notes showing why the workbook was sensitive
• A statement from the consultant who saved the file
• A statement from the subcontractor who had access

Witness notes should stay factual. Ask people to describe what they saw, did and understood at the time. Do not ask leading questions such as "Why did you ignore the procedure?" The report can later analyze whether the procedure was unclear, the folder names were confusing or the onboarding for subcontractors was incomplete.

Draft language:

Evidence retained: IT access log export dated 14 September 2026; screenshot of folder membership before permission change; email from [reporter] to [engagement lead] at 09:20; subcontractor written confirmation at 10:05 that the file was not downloaded, copied or used; and current statement of work confidentiality clause reference [section]. Evidence is stored in [restricted location]. Access is limited to [roles].

If the incident involves a construction site visit or workplace safety event, include photographs, inspection records, witness locations and equipment details, but do not alter the scene unless needed for safety. OSHA's enforcement guidance for reportable incidents describes witness interviews as fact-finding rather than fault-finding and recommends asking clarifying questions and reflecting facts back to the interviewee (OSHA 29 CFR 1904.39 reporting procedures memo).

Analyze causes without overreaching

The analysis section should explain contributing conditions, not just the last human action. In the workbook scenario, "consultant saved file in wrong folder" is only the visible event. Better questions are: why were folders similarly named, why did the subcontractor have cross-engagement visibility, why was the workbook not labeled, and why was there no pre-share check for sensitive discovery files?

Keep conclusions tied to evidence:

• Supported finding: Two project folders had similar names and appeared next to each other in the document library.
• Supported finding: The subcontractor retained access to a folder from a prior benchmarking engagement.
• Open question: Whether project setup checks were completed before discovery interviews began.
• Do not write: "The consultant was careless" unless a formal disciplinary process has reached that conclusion and it belongs in this report.

Draft language:

Preliminary contributing factors are: similar folder names in the shared document library; inherited subcontractor access not removed after the prior engagement; and no documented sensitivity label check before the workbook was uploaded. The reviewer has not determined whether the engagement setup checklist was completed because the checklist record has not yet been located.

That wording gives management something to fix. It also protects the report from becoming a pile of unsupported judgments.

Assign follow-up actions

Follow-up actions should be specific enough to close. Each action needs an owner, due date, evidence of completion and reviewer. For consulting incidents, actions usually fall into four groups: client communication, access control, project procedure and training.

A weak action says, "Remind team to be careful." A stronger action says, "Engagement operations will rename active client folders using the approved naming convention and remove dormant subcontractor access from the document library by 21 September; evidence is the access review export and updated folder list."

Include actions such as:

• Notify the client sponsor using approved wording
• Complete the access log review
• Confirm whether any copied file exists outside the restricted folder
• Remove unnecessary cross-engagement access
• Update the project setup checklist
• Add a pre-share check for sensitive client data
• Review subcontractor onboarding and offboarding

Draft language:

Action 3: Project operations will review access for all active strategy engagements and remove users without a current need to know. Owner: [Name]. Due: [date]. Evidence required: exported access list before and after update, stored with this report. Closure reviewer: [engagement lead].

Do not close an action because someone said it was done. Close it when the agreed evidence exists and the reviewer accepts it.

Add approval and closure checks

The approval section should answer two questions: who accepts the report as an accurate record, and who accepts the follow-up actions as adequate? In a consulting engagement, that may involve internal approval before client sharing, then a separate client acknowledgement or instruction.

Use review criteria such as:

• Facts are separated from assumptions.
• The client, engagement, file or service affected is clearly identified.
• Immediate containment steps are dated and evidenced.
• Witnesses and evidence are listed without unnecessary sensitive detail.
• Follow-up actions have owners, dates and closure evidence.
• Any legal, privacy, safety or contractual reporting question has been routed to the right reviewer.
• The report states what remains unknown.

Approval language:

Approval check: The engagement lead confirms the incident facts are supported by the listed evidence. The account director confirms the client communication plan. Legal/privacy reviewer confirms whether any contractual or regulatory notice is required. The report may close only after Actions 1-4 have evidence attached or an authorized reviewer records why an action is no longer required.

For a reusable starting structure, the consulting incident report template includes editable sections for facts and immediate response, impact and evidence, investigation, actions and approval. Use it as a Word drafting aid, then adapt the completed report to your contract, jurisdiction and internal reporting process.

The finished report should leave a clear record: what happened, what was done immediately, what evidence supports the account, what still needs attention and who approved closure. That is the standard that makes the report useful after the pressure of the incident has passed.