How should an incident timeline be documented?

• A. Record all staff activities in a daily log.
• B. Record key times for actions, decisions, and resource deployments using approved incident documentation.
• C. Write a narrative description after the incident ends.
• D. Copy the incident report from another facility.

Answer: (B)

Documenting the incident timeline requires recording key times for actions, decisions, and resource deployments using approved incident documentation. This creates a precise, auditable sequence of events that shows who did what and when, which supports accountability, coordination, and after-action reviews. Using approved forms and formats also ensures consistency across staff and incidents, making handoffs and reviews more reliable and legally defensible. Logging every staff activity in a daily log is too broad and not focused on critical incident moments; writing a narrative after the incident ends sacrifices exact timing and accuracy; copying a report from another facility can introduce mismatches in context and security concerns.