What Should a Business Do If a Key Goes Missing?
August 17, 2026
A business that loses a key should first establish which doors that key opens and whether it can be identified with the premises. If the key opens external doors or is identifiable, the affected cylinders should be rekeyed promptly. If the key is a master key within a hierarchy, the whole system may need rekeying. Interim measures include additional secondary locking and increased monitoring until the rekeying is completed.
A missing key in a business context is different from a missing key at home. More people hold keys, more doors are involved, more assets sit behind those doors, and the business may carry contractual or regulatory obligations around securing client information and property. The response needs to be structured rather than reactive, and it needs to happen quickly.
The First Assessment
Before deciding what to do, establish the facts. Three questions determine the appropriate response.
What does the key open?
A key to a single internal storeroom is a different problem from a key to the main external entry. Identify every door the missing key operates. In a master key system, establish which level of the hierarchy the key sits at — a change key opens one door, a sub-master opens a group, a grand master opens everything.
Can the key be linked to the premises?
A plain key with nothing identifying it, lost in an unknown location, presents lower risk than a key on a fob bearing the business name, lost in the car park outside the building. A key that can be matched to a specific address by whoever finds it is an immediate security exposure.
What are the circumstances of the loss?
A key that went missing from a locked drawer inside the premises raises different questions from one dropped in the street. Loss under circumstances suggesting deliberate removal warrants a more thorough response than genuine accidental loss.
Response by Scenario
Change key to an internal door, lost off-site, not identifiable.
Lower urgency. Rekey the affected cylinder at the next convenient opportunity. Monitor the area in the interim.
Change key to an external door, or any key that can be linked to the premises.
Rekey promptly, ideally the same day. An external door key that can be matched to an address gives direct access to anyone holding it.
Sub-master key.
Rekey every cylinder within that sub-master's group. The exposure covers a defined set of doors, and all of them are affected.
Grand master key.
This is the most serious scenario. A lost grand master compromises every cylinder in the system. Full system rekeying is required, which is significant work and cost, but the alternative is a building where an unknown person may hold universal access. Interim measures — secondary locking on critical doors, additional monitoring, restricted after-hours access — should be implemented immediately while rekeying is arranged.
Key lost following a staff departure or dispute.
Treat as deliberate until established otherwise. Rekey affected cylinders promptly regardless of the key level.
Interim Measures While Rekeying Is Arranged
Rekeying cannot always happen within hours, particularly for larger systems. Measures that reduce exposure in the interim include fitting secondary locks or padlocks to the highest-value or most sensitive doors, restricting after-hours access to the premises, increasing the frequency of security patrols where these are in place, ensuring alarm systems are armed consistently and monitored, and briefing staff to report anything unusual.
These are stopgaps. They reduce risk during the gap between discovering the loss and completing the rekeying, but they are not a substitute for rekeying.
The Documentation Requirement
Businesses should record the incident: when the key was discovered missing, who reported it, what the key opened, what action was taken, and when. This record matters for several reasons.
Insurance.
If a loss occurs subsequently and the insurer investigates, a documented and prompt response to the missing key demonstrates that the business took reasonable steps to secure the premises.
Regulatory and contractual obligations.
Businesses handling client data, controlled substances, or regulated materials may have specific obligations around access control incidents. A documented response supports compliance.
Internal accountability.
A record of key incidents over time reveals patterns — repeated losses by the same individual, or systemic weaknesses in key issue and return procedures.
Preventing the Next One
Maintain a key register.
A simple record of every key issued, to whom, on what date, for which doors, and when returned. Many businesses discover during a key loss incident that they do not actually know how many keys exist or who holds them.
Restricted keys cannot be copied without authorisation, which means a returned key is genuinely the only copy that person held. This does not prevent loss but substantially reduces the risk that copies remain in circulation after a departure.
Collect keys at departure as a formal step.
Key return should be part of the offboarding checklist for every departing staff member, with the return recorded against the key register.
Review access levels periodically.
Staff often accumulate access over time that they no longer need. Periodic review reduces the number of high-level keys in circulation, which reduces the impact when one goes missing.
Frequently Asked Questions
How quickly should a business rekey after a key goes missing?
For external door keys or any key that can be linked to the premises, same day or next business day. For internal change keys with no identifiable link to the building, within a week is reasonable. For a lost master key, immediately, with interim measures in place until the work is complete.
Can rekeying be done outside business hours?
Yes. Most commercial locksmiths offer after-hours attendance for exactly this reason. Rekeying during business hours is possible without significant disruption in most premises, but where operations cannot be interrupted, after-hours scheduling avoids any impact.
Does a lost key need to be reported to police?
A lost key alone is generally not a police matter. If the key was stolen, or if the loss is connected to a suspected offence, a police report is appropriate and may be required by your insurer.
Should the whole system be rekeyed or just the affected cylinders?
This depends on the key level. A change key affects one cylinder. A master key affects everything it opens. Rekeying only what the missing key actually operates is the proportionate response, provided that assessment has been done accurately.
What if the key turns up after we have rekeyed?
The rekeying stands. A key that has been out of your control for a period cannot be assumed not to have been copied, particularly if it was identifiable. Rekeying after a loss is not wasted work simply because the key later reappears.
Contact True Locksmith
on 0421-767-767
for commercial rekeying and access control response across Bayside Melbourne. Neale works with businesses on urgent rekeying following key loss, master key system design, and key register setup to prevent repeat incidents. MLAA member and VIC Police registered. Serving Sandringham, Brighton, Cheltenham, Moorabbin, McKinnon, Highett, Bentleigh, Mentone, Mordialloc, and the surrounding Bayside suburbs.