The Problem With Returned Keys

When an employee hands back their key on the last day, that's one key accounted for. What it doesn't account for is every copy that may have been made during their time with you.



Key cutting machines at hardware stores and kiosks don't verify employment, authorisation, or identity. They cut whatever key is presented to them. A staff member who held a key for two years had two years of opportunity to have a copy made — with a spare for themselves, a copy given to a family member who drops things off at the office, or a duplicate cut on the first week out of casual habit. None of these require malicious intent. They just require the key having been out of your sight at some point, which is unavoidable once you issue it.

Rekeying the relevant cylinders renders all keys useless — the original you got back and any copies you don't know about. It's the only way to be certain.

Not every lock in the building needs to be rekeyed after every departure. The question is which access points the departing employee actually had keys for, and whether any of them matter.

Primary entry and exit points. The front door, rear entry, and any doors the employee used for regular access. These are the minimum to address.

Any secure areas they had specific access to. Server rooms, storage areas holding equipment or inventory, offices with sensitive documents, cash handling areas, any space containing client data or personal records.

Master or sub-master keys. If the employee held a key in a hierarchical key system that covered multiple areas, all of those areas are affected regardless of which specific doors they used day-to-day.

Keys that weren't returned. If a key can't be accounted for at departure, treat the situation as an immediate rekey. No exceptions, regardless of the circumstances of the departure.

What doesn't need attention: access points the employee genuinely never had keys for. Be honest about this — in smaller businesses especially, key sharing happens informally in ways that aren't always tracked.

CTA: Book a commercial rekey after a staff departure — True Locksmith handles commercial rekeying for offices, retail premises, and businesses across Brighton, Sandringham, Hampton, Cheltenham, Moorabbin, Bentleigh, and surrounding Bayside suburbs. Call 0421-767-767.

Timing Is the Part Most Businesses Get Wrong

The risk isn't theoretical — it sits in the window between when someone leaves and when the lock is changed. A rekey scheduled for "sometime next week" leaves that window open.



For planned departures — resignations with notice, contract ends, redundancies where the person has been given time — the rekey should be scheduled to coincide with their last day. The afternoon they leave is the right time. The following morning is acceptable. Next week is not.

For unplanned departures — terminations effective immediately, resignations that turned acrimonious, situations where the relationship ended on poor terms — the rekey should happen the same day. This isn't overcaution. An employee who leaves in difficult circumstances and retains physical access to the premises is a clear and specific liability.

If a key wasn't returned and can't be located, treat it as an immediate rekey regardless of whether the departure was amicable. The relationship has no bearing on whether the key could be used.

Businesses running key cards, PIN systems, or fobs have an advantage: digital access can be revoked instantly from a system, without any physical work at the door. That's genuinely useful. But electronic access control doesn't close the problem if the premises also has physical key access — a back door on a mechanical lock, a fire exit, a loading bay, a storage room.



Many businesses run hybrid systems: electronic access on the main entry and key-operated locks on secondary access points. When an employee leaves, both need attention. Revoking the card without rekeying the physical locks leaves a gap.

And electronic systems have a version of the same problem: if a staff member shared their PIN with someone — a partner who drops lunch in, a contractor who needed access once — revoking the card doesn't help with that.

What Restricted Key Systems Do for This Problem

If your business goes through regular staff turnover — seasonal workers, rotating retail or hospitality staff, contractors with regular site access — a standard commercial lock creates an ongoing key control problem. Every departure is a potential unaccounted copy in circulation.



A restricted key system changes the equation. The key blanks are only available through authorised dealers with identity verification, which means staff can't have copies made at a hardware store. When someone leaves, you still rekey — but you do it knowing that the key they held wasn't quietly duplicated during their first month.

For businesses with frequent turnover, a restricted system combined with a clear key register is the standard approach. A locksmith who works with commercial properties can advise on which systems are registered in their network and what the setup cost looks like.

IT security gets updated constantly — patches, password rotations, access reviews. Physical access tends to be treated as set-and-forget until something prompts attention. An employee departure is a predictable, recurring event in any business. Having a clear policy for what happens to physical access when someone leaves is basic security practice, not exceptional caution.

True Locksmith handles commercial rekeying, lock changes, and physical access security for offices, retail premises, and businesses across Brighton, Sandringham, Hampton, Cheltenham, Moorabbin, Bentleigh, Beaumaris, and Melbourne's Bayside and southeast suburbs. Call 0421-767-767 to discuss what needs to happen for your premises.