A call from an alarm company at 2.15 am is not the time to work out who has the keys, whether they are still employed, or who is authorised to enter the building. A clear business keyholder security guide gives your team a calm, safe plan for securing the premises after hours, without putting keys, staff or stock at unnecessary risk.
For Canberra businesses, keyholder arrangements matter whether you run a small retail shop, a medical practice, an office, warehouse, strata complex or multi-site operation. The right approach is not simply handing spare keys to a trusted person. It is controlling access from the day a key is issued through to the day it is returned, replaced or cancelled.
Start with the real risks after hours
A keyholder is usually the person an alarm monitoring provider, manager or emergency service contacts when an alarm is triggered, a break-in is reported or a door has been left unsecured. They may need to attend the site, meet police, arrange repairs and decide whether the business can safely reopen.
That responsibility should be planned around the risks your business actually faces. A café with daily cash takings has different concerns from a warehouse with high-value tools, while a medical clinic may need tighter controls around records, medicines and restricted areas. The number of people with keys should reflect operational needs, not convenience.
A common mistake is relying on one owner or manager. If that person is interstate, unwell, asleep with a flat mobile or involved in the incident, the business needs another authorised contact. Two or three carefully chosen keyholders is often more practical than a long, poorly controlled list.
Build a business keyholder security guide your staff can follow
Your policy does not need to be complicated, but it does need to be written down and kept current. Every keyholder should understand what they are authorised to do, when they should call for assistance and when they should not enter the premises.
Start by naming a primary keyholder and at least one backup. Record full names, current mobile numbers and the order in which they should be contacted. Give the alarm monitoring provider the same current list and update it immediately after any staffing or role change.
Clarify the response procedure in plain language. If an alarm activates, the keyholder should confirm the address and the nature of the alert, then follow the agreed escalation process. That may include contacting police, notifying the business owner, arranging a locksmith or waiting for an authorised security patrol.
Most importantly, staff should not enter a property alone if there are signs of forced entry, an open door, broken glass, suspicious vehicles or a person inside. Move to a safe position, contact police if required and wait for direction. A damaged lock can be repaired. A staff member’s safety comes first.
Keep an accurate key register
A key register is the foundation of key control. It creates accountability without making day-to-day access difficult. The register can be paper-based or digital, provided it is secure, accessible to the right managers and reviewed regularly.
For each key or credential, record:
- a unique key or fob number, rather than labelling it with the business address
- the person it has been issued to and the date issued
- which doors, gates, cabinets or areas it opens
- whether it is a master key, restricted key, alarm fob or access card
- the return date, replacement details and approval for any extra copy.
Avoid writing the business name, address or alarm code on a key tag. If keys are lost in a car park, on public transport or at home, that information can make them much more useful to the wrong person.
Match access levels to the job
Not every employee needs access to every door. A well-designed master key system lets staff open only the areas required for their role, while a manager or facilities contact has broader access. This is particularly useful in offices, schools, strata properties and warehouses where contractors, cleaners and shift supervisors may require limited entry.
Restricted key systems add another layer of control. They are designed to limit unauthorised duplication, so copies can only be made through approved channels. They are a sensible option where keys protect valuable equipment, sensitive information or areas used by multiple tenants.
Electronic access control can be a better fit for businesses with frequent staff turnover or changing rosters. Cards, fobs and mobile credentials can generally be cancelled without changing the physical locks. The trade-off is that electronic systems still need administration, maintenance and a plan for power, network or hardware faults. Physical keys should not be treated as obsolete simply because a site has keyless entry.
Make key issue and return part of every staff change
Lost keys are not always the biggest problem. Unreturned keys after a resignation, tenancy change or contractor job can leave a business exposed for months without anyone noticing.
Make key return a standard part of offboarding. Before final pay or access is signed off, check the key register, collect all physical keys, fobs and remote controls, and disable electronic credentials. This process should include casual employees, cleaners, tradespeople and temporary managers, not only permanent staff.
If a key is missing, assess what it can open and whether it can be linked to the premises. A missing key to a low-risk storeroom may call for a different response than a missing master key or a restricted key with the company name attached. In higher-risk cases, rekeying affected locks promptly is usually the safer decision.
Rekeying changes the internal configuration of an existing compatible lock so old keys no longer work. It is often a cost-effective option after staff turnover, lost keys or a change of tenant. If locks are worn, outdated or have been forced during a break-in, replacement may provide better value and security.
Secure the keyholder, not just the keys
Keyholders should know how to store keys responsibly away from work. Keys should not be left in an unattended vehicle, under a desk, in an unlocked letterbox or in a bag accessible to others at home. Alarm remotes and access cards deserve the same care.
It is also wise to separate high-risk access items where practical. For example, do not keep a labelled site key, alarm instructions and alarm code together. If a keyholder needs codes or response information, provide it through a controlled method and change details when their role changes.
Personal circumstances can change too. A keyholder moving house, changing mobile numbers or taking extended leave may affect the plan. A quick quarterly check of contacts, issued keys and alarm instructions prevents small gaps becoming an after-hours emergency.
Prepare for alarms, lockouts and break-ins
A practical keyholder plan should name the services to call when something goes wrong. Keep details for your alarm monitoring provider, insurer, building manager, security patrol and a licensed local locksmith available to authorised contacts. Confirm who can approve emergency work outside normal business hours, especially if the keyholder is not the owner.
After a break-in, preserve the scene where possible and follow police advice. Do not rush to clean up or repeatedly handle damaged doors and locks. Once the site is cleared, temporary securing work may be needed straight away, followed by a review of how entry was gained. Sometimes the answer is a lock repair; other times it is better lighting, a stronger door, restricted keys, access control or a revised keyholder process.
Night & Day Locksmiths has supported Canberra businesses with emergency lock repairs, rekeying, restricted key systems and commercial access solutions since 1979. For an after-hours issue, clear authority and a current keyholder plan help the right work happen without delay.
The best time to test your arrangements is during an ordinary workday. Call the listed contacts, check the key register, ask what each person would do after an alarm and fix any uncertainty before a real call comes through at 2.15 am.
