What Happens to Commercial Locks When an Employee Leaves?
When an employee leaves — whether on good terms or not — any key they held becomes a security risk the moment they walk out the door. Keys are easy to copy and difficult to account for. The practical response is to rekey or replace the cylinders they had access to, or to update the access control system to remove their credentials. The timing matters: this is a same-day or next-day task, not something to schedule for next month.
Most businesses handle employee departures well enough when it comes to IT. Passwords get reset. Email access gets revoked. Laptops get returned. But physical access — the front door key, the back entry, the office suite — often doesn't get the same attention, and the gap can stay open for weeks or months without anyone noticing.
The honest reason is that rekeying feels like an inconvenience and an expense, and most departures are fine. Former employees generally don't come back. But "generally" isn't the same as "always," and the cost of a rekey is minor compared to a break-in, a theft of equipment, or an after-hours incident that traces back to a key that should have been revoked.
What Actually Happens to the Keys
When an employee hands back a key, you know about that key. What you don't know is how many copies they made during their time with you. Key cutting machines at hardware stores and kiosks don't verify employment or authorisation — they cut what's presented to them. A key kept for two years at a business with any degree of foot traffic has had ample opportunity to be duplicated.

This isn't about assuming the worst of departing employees. It's about acknowledging that key control is difficult once keys leave the building. Handed-back keys give you a false sense of completeness. You have the original, but you don't know the copies.
Rekeying the relevant cylinders renders all keys — originals and copies — useless. It's the only way to be certain.
Which Access Points Need Attention
Not every lock on the premises needs to be rekeyed after every departure. The question is which locks the departing employee actually had keys for, and whether those keys opened anything that matters.
Primary entry and exit points. Front door, rear entry, and any doors the employee used regularly. These are the minimum.
Any areas they had specific access to. Server rooms, storage areas, offices with sensitive equipment or documents, cash handling areas, areas holding personal data. If they had a key for it, that access point needs to be addressed.
Common areas that may have been accessed using a master or grand master key. If the employee held a master key in a system that covered multiple areas, all of those areas are affected.
Any keys that weren't returned. If an employee leaves and a key isn't handed back, that is an immediate rekey situation. No exceptions.
The access points that don't need attention are ones the employee genuinely never had keys for. But be honest about this — it's easy to underestimate what a staff member accessed over time, particularly in smaller businesses where keys get shared informally.
CTA: Ask about restricted key systems — Malvern Lock Service installs restricted key systems for homes and rental properties across Malvern, Toorak, South Yarra, Hawthorn, Armadale, and surrounding suburbs. Call 0477-615-507 to discuss options.
The Case for a Restricted Key System
If your business goes through regular staff turnover — seasonal workers, high-rotation retail, hospitality, property management — a standard commercial lock creates an ongoing key control problem. Every departure is a potential unaccounted copy in circulation, and rekeying after every departure adds up in cost and disruption.
A restricted key system changes the equation. Because the key blanks are only available through authorised dealers with identity verification, copies can't be made without your knowledge. When someone leaves, you still rekey — but you do it knowing that the key they had wasn't quietly duplicated three times during their first month.

For businesses that haven't considered a restricted system, a staff departure is a reasonable time to have that conversation with your locksmith. The rekey that needs to happen anyway can be done with restricted cylinders, giving you better control going forward.
What About Electronic Access Control?
Businesses using key cards, fobs, or PIN systems have an advantage here: access can be revoked instantly from a central system without any physical intervention at the door. That's a real benefit. But electronic access control doesn't eliminate the problem entirely if the premises also has physical key access — a back door on a mechanical lock, a fire exit, a loading bay.
Many businesses run hybrid systems: electronic access on the main entry and key-operated locks on secondary access points. When an employee leaves, both need to be addressed. Revoking the card without rekeying the physical locks leaves a gap.
And electronic systems have their own version of the problem: if a staff member shared their PIN with someone else, revoking the card or fob doesn't help.
When to Do It
For planned departures — a resignation with notice, a contract end — the rekey should be scheduled to coincide with the employee's last day, or the day after at the latest. The risk sits in the window between when someone leaves and when the lock is changed.
For unplanned departures — terminations, resignations effective immediately, or any situation where the departure is not amicable — the rekey should happen the same day. This is not overcaution. An employee who leaves in difficult circumstances and retains physical access to the premises is a straightforward security liability.
If an employee leaves and a key isn't returned and can't be accounted for, treat it as an immediate rekey regardless of the circumstances of the departure or your relationship with the individual.
How Much Does It Cost to Rekey a Commercial Property?
The cost depends on the number of cylinders being rekeyed and the type of lock system in place. For a small office or retail space with two to four entry points, a rekey typically costs between $150 and $400 in labour, with parts if any cylinders need replacing rather than just rekeying.
For larger commercial premises, the cost scales with the number of access points. A locksmith who works with commercial properties regularly can usually give you an accurate quote once they know the number and type of cylinders involved.

The cost of not rekeying — a break-in, equipment theft, or access to sensitive data — is harder to put a number on, but it's invariably higher.
Frequently Asked Questions
Do I need to rekey if the employee left on good terms?
Good terms or bad terms, the key control issue is the same. You don't know whether copies were made. Rekeying isn't a statement about trust — it's a practical measure that closes a gap you can't otherwise verify. Most departing employees understand this.
What if we use a master key system? Do we need to rekey everything?
Not necessarily. In a well-designed master key system, individual keys only open the specific doors they're issued for, and the master key is held only by management. If the departing employee only had an individual key, you only need to rekey the doors their key operated. If they had a sub-master or master key, the scope expands accordingly.
Can we just change the lock rather than rekeying it?
Replacing the lock entirely is a more expensive version of the same outcome — it renders the old keys useless. Rekeying achieves the same result at lower cost by changing only the internal pin configuration rather than the whole lock. Either is a valid approach, but rekeying is usually preferred unless the lock itself needs replacing.
How long does a commercial rekey take?
Most commercial rekeying jobs take between 30 minutes and 2 hours depending on the number of cylinders and the type of lock system. A locksmith who regularly works on commercial properties can usually complete a small office in a single visit with no disruption to trading.
What if we have a lot of staff turnover? Is there a better approach?
Yes. A restricted key system with a clear key issuance register is the standard approach for businesses with frequent turnover. Combined with a policy of rekeying after any departure where key return can't be confirmed, it gives you ongoing control without the guesswork.
Physical Access Is Part of Your Security System
IT security gets updated constantly. Passwords expire. Systems get patched. Physical access security tends to get treated as a set-and-forget — which works fine until it doesn't. An employee departure is a predictable, recurring event in any business. Having a clear policy for what happens to physical access when someone leaves is basic security practice, not paranoia.
At Malvern Lock Service, we handle commercial rekeying, restricted key systems, and physical access security for offices, retail premises, and businesses across Malvern, South Yarra, Hawthorn, Toorak, Armadale, Camberwell, and Melbourne's inner south-east. Call 0477-615-507 to discuss what's appropriate for your premises.