A surveillance report becomes dangerous when it sounds more certain than the evidence.
The department’s job is often to preserve observations, timelines, video references, system records and relevant context so that authorized management can decide what the evidence supports. A strong report makes that review easier. A weak report quietly turns observation into accusation.
The difference is usually visible in the language.
Describe what the review established
Compare these two statements:
Dealer intentionally overpaid the player.
and:
At 22:14:36 the dealer placed five red chips in the player payout area after the hand result. The approved payout for the recorded wager requires four red chips. The floor supervisor was notified at 22:19. Intent was not determined by the video review.
The second statement is more useful because it separates observable fact, procedural comparison, notification and unresolved interpretation.
A surveillance report should normally make clear whether a point is:
- directly observed;
- derived from another controlled record;
- reported by another person;
- an unresolved inconsistency;
- a management question;
- outside the scope of the review.
The Surveillance Review suite is organized around that evidence-first distinction.
Build the timeline before writing the narrative
Incident narratives can become distorted when the writer starts with a conclusion and then selects details that support it.
A safer method is to establish the timeline first.
Depending on the incident, the timeline can include:
- event start and end times;
- camera references;
- table, cage window, machine, entrance, office or other location;
- relevant system-event times;
- employee or guest movement visible on video;
- supervisor notifications;
- transaction or rating references;
- points where visibility was blocked or incomplete;
- when another department took control of the response.
Once the timeline is stable, the report can summarize what matters.
This also makes cross-department reconciliation easier. If a cage transaction shows 02:11 and the video event appears at 02:14, the difference needs to be understood before anyone assumes the records describe the same moment.
Video is evidence, not omniscience
Surveillance systems have limits.
A camera may not show a chip denomination clearly. A person may move behind another guest. A microphone may not exist. A system clock may be offset. A camera can show what somebody did without showing why they did it. A transaction record may establish an amount without showing the surrounding conversation.
A professional report should state material limitations instead of hiding them.
Examples:
- “The chip denomination is not reliably visible from the available angle.”
- “Audio is not available.”
- “The player’s hand blocks the relevant area for approximately six seconds.”
- “CMS time and video time were reconciled using the department’s approved offset.”
- “The video shows the transfer but does not establish who authorized it.”
These statements make the report stronger, not weaker, because they define what management can safely conclude.
Operational example: a timeline with a gap that must stay a gap
Illustrative scenario—not a client result.
At 00:18, surveillance receives a report about chip handling at a live table. Two cameras cover the sequence, but one hand is obscured for several seconds and no usable audio is part of the available evidence.
A weak draft says the employee “attempted to conceal a chip” because that explanation appears to fit what happened before and after the obscured moment.
A controlled report builds the timeline, cites the cameras and time codes, describes exactly what is visible, and explicitly states what cannot be seen. It can identify the operational question that remains open without inventing the missing action. Any conclusion about intent belongs to the authorized decision-maker after all available evidence and applicable procedure have been reviewed.
A defensible report preserves uncertainty. If the camera does not establish a fact, the narrative should not manufacture certainty merely to make the incident read more cleanly.
Reference evidence so another reviewer can reproduce the work
A report should allow an authorized second reviewer to locate the same evidence without repeating the entire search.
Useful references can include:
- camera and clip identifiers;
- date/time range;
- incident or review-request number;
- table, machine or location;
- transaction, rating, fill/credit, cage, access, or alarm reference as applicable;
- still-image references when permitted;
- related supervisor or department report;
- retention or export reference according to local procedure.
The report should not unnecessarily reproduce sensitive information that already exists in a controlled system. A reference is often safer and more useful than copying the entire record into another document.
Separate incident review from employee decision
Surveillance may establish facts relevant to an employee issue, but employment action normally belongs to authorized management under property policy.
The report can state that a dealer deviated from the documented procedure, that an employee entered an area at a certain time, or that a transaction sequence is inconsistent with the expected process. It should not quietly decide disciplinary intent unless the department has that specific authority and the evidence supports the wording.
The same principle applies to guests. An unusual betting pattern or transaction sequence may justify further review without justifying an accusation.
My Career Evidence on surveillance management and game protection explains the operating background behind this separation of observation, review and management decision.
Handover is part of incident control
Many surveillance reviews cross shifts.
A good handover tells the incoming team:
- what request or incident is open;
- what evidence has already been reviewed;
- what remains to be checked;
- whether any evidence-preservation action is pending;
- which department or manager is waiting for an answer;
- whether the issue has a reporting or operational deadline;
- who owns the next step.
“Continue reviewing footage” is not enough when the next operator does not know which cameras, time window or question remains unresolved.
This is why incident reporting and shift handover should use compatible identifiers.
Management summaries should preserve uncertainty
Senior management may need a concise briefing rather than a technical surveillance report. Compression is useful, but it must not remove uncertainty.
A management summary can state:
Issue: payout discrepancy reported at BJ-4.
Established: wager and hand result confirmed; video shows payout sequence inconsistent with approved amount.
Not established: intent; whether the error was noticed before supervisor intervention.
Action: table-games manager reviewing dealer follow-up; surveillance clip preserved under incident reference.
Status: operational issue contained; management follow-up open.
That summary is short, but the factual boundaries remain visible.
Measure the review process, not just incident volume
A rise in incident reports does not automatically mean the casino is becoming less controlled. It may mean detection or documentation improved.
More useful process measures can include:
- age of open surveillance requests;
- percentage with complete source references;
- requests returned because the question was unclear;
- repeat incident categories;
- evidence-preservation failures;
- reports requiring material correction;
- handover items without an owner;
- average time to complete defined request classes, where meaningful;
- cases waiting on another department.
The purpose is to improve review quality and response discipline.
A strong report answers a narrow question
Surveillance requests become inefficient when they ask the department to “check everything.” A better request defines:
- event or concern;
- location;
- time window;
- relevant person, table, machine, transaction or system reference where permitted;
- exact question management needs answered;
- urgency and reason;
- requesting role.
The resulting report can then say whether that question was answered, partially answered, or could not be answered from the available evidence.
The broader CasinoOpsAI methodology follows the same principle: tools can organize evidence, but the authorized reviewer remains responsible for the conclusion.
The report should be defensible after the shift is forgotten
Weeks or months later, nobody should need the original writer’s memory to understand what happened.
A defensible surveillance report shows the timeline, source references, material observations, known limitations, notifications, ownership and final status. It avoids dramatic language and unsupported motives.
The operating standard is straightforward: write what the evidence shows, identify what it does not show, and make the next management decision traceable.