How Often Should a Business Change Its Locks?
Most businesses should change or rekey locks when a trigger event occurs rather than on a fixed schedule. The main triggers are staff departures with key access, a lost or unaccounted key, a lease changeover, a break-in or attempted break-in, and any change to who holds master keys. Beyond triggers, an annual access review and full lock replacement every seven to ten years, or sooner where hardware is worn, keeps commercial premises secure.

Businesses tend to think about locks twice: when they move in, and after something goes wrong. In between, keys are issued, staff come and go, contractors are given temporary access, and the number of working keys in circulation quietly grows beyond what anyone has recorded. The question of how often to change locks is really a question of what should prompt the change, and most of those prompts are events rather than dates.
The Trigger Events
A staff member with key access leaves.
This is the most frequent and most commonly ignored trigger. Collecting the key back does not restore access control, because there is no way to know whether a copy was made during their employment. For departures at management level, or anyone holding a master key, rekeying should be treated as part of the offboarding process rather than an optional extra.
A key cannot be accounted for.
Not necessarily lost in a dramatic way. A key that was issued three years ago to someone nobody can now identify is an unaccounted key. If your key register does not match the keys physically in existence, the difference is your exposure.
Taking on new premises means inheriting whatever key situation the previous tenant left behind. The outgoing business may have issued keys to staff, cleaners, and contractors over years of occupancy, and none of those people have any obligation to return them to you. Rekeying before occupation is standard practice.
A break-in or attempted break-in.
Even where entry was not achieved, an attempt may have damaged the cylinder in ways that compromise it. Where entry was achieved, the assumption must be that any keys on the premises were compromised.
A dispute or termination under difficult circumstances.
Where a departure was contentious, the risk profile is different from a routine resignation. Rekeying promptly is the proportionate response.
Beyond Triggers: The Periodic Review
Trigger-based rekeying handles the acute risks. A periodic review handles the slow accumulation of problems that no single event causes.
Annual access review.
Once a year, compare the key register against current staff and their actual access needs. Two things usually emerge: keys issued to people who have left without the register being updated, and staff holding higher-level access than their current role requires. Both are correctable without rekeying if the register is accurate, and both indicate a rekey if it is not.
Hardware condition review.
Locks wear. Commercial doors see far more cycles than residential ones, and a cylinder on a main entry used two hundred times a day accumulates wear quickly. Cylinders that are stiff, inconsistent, or showing visible wear should be replaced regardless of whether access control is a concern.
Security standard review.
Hardware that was adequate five years ago may no longer meet the standard your insurer requires or the risk your business now carries. A business that has grown, changed premises use, or started holding higher-value stock should reassess.
Full Replacement vs Rekeying
Rekeying changes the internal pin configuration so existing keys stop working, while retaining the lock hardware. It is faster and less expensive and handles the majority of trigger events.
Full lock replacement makes sense when the hardware is worn or below the standard the premises now requires, when the cylinder has been damaged in a forced entry attempt, or when the existing key platform is not restricted and you want to move to one that is.
As a general guide, commercial locks are worth replacing every seven to ten years even where they still function, because internal wear reduces both reliability and attack resistance well before outright failure.
Frequently Asked Questions
Do we need to rekey every time any staff member leaves?
Not necessarily every departure. The proportionate approach defines which roles trigger an immediate rekey — typically anyone with master key access, keys to cash or stock areas, or after-hours access — and handles lower-level departures at the next scheduled review, provided the key is returned and the register is accurate.
How much does commercial rekeying cost?
It depends on the number of keyed points and cylinder grade. A small premises with four to eight cylinders is usually a simple job completed in a single visit. A locksmith can quote accurately after reviewing the doors on site.
Can rekeying happen without closing the business?
Yes. Cylinders are changed one at a time and the work fits around normal operations in most premises. Where operations genuinely cannot be interrupted, after-hours attendance is available.
Does our insurance require a particular lock standard?
Many commercial policies specify minimum lock standards as a condition of cover, and some name particular Australian Standards. Check the policy schedule and have a locksmith confirm the installed hardware meets it. Documentation from the locksmith supports any future claim.
What is a key register and do we need one?
A key register is a simple record of every key issued, to whom, for which doors, on what date, and when returned. Most businesses discover during an incident that they do not have one. Setting one up costs nothing and makes every future decision about rekeying far easier.
Contact Malvern Lock Service on 0477-615-507 for commercial rekeying, lock changes, and access reviews across Melbourne's inner south-east. Neale works with retail, office, and mixed-use premises on trigger-based rekeying and key register setup. Over 35 years of experience. MLAA member and VIC Police registered. Serving Malvern, Malvern East, Armadale, Toorak, Prahran, South Yarra, Glen Iris, Camberwell, Glen Huntly, Hawthorn, Kooyong, St Kilda, St Kilda East, and Surrey Hills.