The investigator needs to thoroughly describe the incident in terms of what happened, who was involved, when and where. This describes the incident documentation as:

• A. What happened and who was involved
• B. What happened, who was involved, when and where
• C. Who was involved only
• D. Why it happened

Answer: (B)

Accurate incident documentation should capture what happened, who was involved, when it occurred, and where it happened. Including all four elements creates a complete, traceable record that supports understanding the sequence of events, accountability, and future prevention efforts. Knowing what occurred and who took part establishes the event scope, while specifying when and where anchors the report in time and space, enabling alignment with logs, witnesses, and evidence. If any of these are missing, the description becomes incomplete: omitting when or where makes it hard to place the incident on a timeline or locate evidence; describing only who was involved lacks actions and context; describing why it happened shifts into causal analysis, which belongs in the investigation findings rather than the incident description.