An Employee Just Left. Here Is Your 24-Hour Security Checklist.

The most frequent security event at any business is not a break-in. It is a resignation. And the most common mistake is assuming that a returned key means returned access.

A key can be copied at any hardware store for a few dollars. What was handed back is a key, not the access it represents. Here is what to do in the first twenty-four hours.

1. List what they actually had access to

Write it down. This list is why key registers exist — the businesses that struggle here are the ones reconstructing access from memory.

• Exterior door keys, including back and side entrances
• Interior keys — offices, storage, records, mechanical rooms
• Access control fobs, cards or mobile credentials
• Safe combinations and till or drawer keys
• Alarm system codes
• Padlock keys for gates, yards, sheds and equipment
• Cabinet, desk and locker keys

2. Revoke everything electronic immediately

This is the free part and it takes minutes. Disable access control credentials, change alarm codes, and remove them from any door schedule or user group. Do it before you do anything else, because it costs nothing and closes the largest hole instantly.

3. Decide whether to rekey, and be honest about it

Rekeying costs money, so the decision should be proportionate — but 'they seemed fine about it' is not a security assessment. Rekey without hesitation if any of the following apply:

• The departure was involuntary or acrimonious
• They held a master key, or keys to cash, inventory or records
• Keys were not returned, or were returned incomplete
• You cannot say with confidence how many copies existed
• They had access to a safe, a pharmacy cabinet or controlled inventory

4. Change safe combinations

Safe combinations are forgotten in almost every departure we are called about afterwards. If the person knew the combination, it is compromised — a combination cannot be handed back. Changing it is quick and inexpensive, and on most electronic safe locks we can add separate user codes so the next change affects one person rather than everyone.

5. Update the register

Record what was returned, what was not, what was rekeyed and what was revoked. Ninety seconds of administration now is the difference between a confident answer and a guess the next time this happens — and it will happen again.

The cheaper long-term answer

If you are rekeying more than once or twice a year, you are paying repeatedly for a problem that access control solves once. Revoking a credential is free and instant. For businesses with meaningful turnover — restaurants, retail, warehousing, healthcare — the arithmetic usually favours electronic access on the high-traffic doors within the first two years.