If an employee was terminated under hostile circumstances and their keys weren’t returned, rekey every affected lock today. No deliberation needed. For every other departure scenario, there’s a risk-tiered decision to make. The key question isn’t whether they handed the keys back. It’s whether you can guarantee no copies exist.
The short answer: you can’t. A key returned proves nothing about duplicates made at a hardware kiosk weeks ago. That reality should anchor every rekeying decision you make.
The departure decision framework
Not every employee exit carries the same risk level. The table below maps departure type to a sensible response.
| Departure type | Keys returned? | Risk level | Recommended action | Urgency |
|---|---|---|---|---|
| Termination, hostile or contentious | No | Critical | Rekey same day | Immediate |
| Termination, hostile or contentious | Yes | High | Rekey same day | Immediate |
| Resignation, acrimonious split | No | High | Rekey same day | Immediate |
| Resignation, acrimonious split | Yes | High | Rekey within 48 hours | Urgent |
| Amicable exit, keys returned | Yes | Moderate | Rekey before next hire | Within one week |
| Amicable exit, short tenure | Yes | Lower | Judgment call | Within two weeks |
| Layoff, keys returned, no grievance | Yes | Moderate | Rekey before building changes | Within one week |
One note on the “keys returned” column: that status tells you what the physical key did in the moment. It tells you nothing about whether a copy exists. Medeco and Mul-T-Lock restricted keyways are the only mechanism that actually controls copying, because hardware kiosks cannot duplicate them. Standard Kwikset and Schlage keys can be copied at any grocery store self-serve kiosk in under two minutes.
What a same-day commercial rekey involves and costs
A same-day rekey isn’t complicated from your side. A licensed locksmith comes to your location, removes the cylinder from each lock, re-pins the internal mechanism so the old keys no longer work, and hands you fresh keys that operate the same hardware. Your doors, frames, and hardware stay exactly as they are.
For a small San Diego business, typical cost ranges fall between $150 and $400 for the full job. That figure reflects a service call plus per-cylinder pricing, which generally runs $25 to $40 per standard commercial cylinder. Mortise locks, high-security cylinders, or locks that feed into a master key system will cost more per cylinder, typically $50 to $80, because the pinning work is more precise and the locksmith needs to maintain the system’s key hierarchy.
A few variables that affect your total:
- Number of doors. Front entry, rear entry, server room, storage, interior offices. A small retail space with three exterior doors is a different job than a 20-door office suite.
- Lock grade. Grade 1 commercial hardware takes longer to pin than residential-grade locks.
- Master key involvement. If any departing employee had access to a tier in your master key system, the math changes (covered below).
- Time of day. Standard business hours carry standard rates. After-hours or weekend calls will add a premium.
For most small San Diego businesses, same-day commercial rekeying is a $150 to $300 job. Call for a firm quote before the appointment so there are no surprises.
Master key systems change the math
If your building runs a master key system, an employee departure isn’t just about one key. It’s about which tier of the hierarchy that person held.
A change key (individual user key) compromise affects one lock. That’s a simple rekey of that single cylinder.
A sub-master or departmental master key compromise affects every lock in that group. A floor manager with a sub-master key that opens all third-floor offices means every cylinder on that tier needs to be rekeyed when they leave, not just their assigned office.
A grand master key compromise is the worst case. If the departing employee had or potentially had access to the grand master, every lock in the building needs to be rekeyed. No exceptions.
This is the structural reason that restricted keyways matter so much in master key systems. Standard keyways can be duplicated without authorization. Restricted keyways like Medeco or Mul-T-Lock are protected by patent law, meaning copies can only be cut by the locksmith of record with verified authorization from the building owner. If a sub-master goes missing in a restricted-keyway system, you know with certainty no unauthorized copies exist. That’s a different exposure than a standard key system.
If you’re running a master key system on standard keyways and an employee with mid-tier access has departed, budget your rekey accordingly. A locksmith can audit which tier was compromised and scope the work correctly.
Beyond the front door: the full checklist
The building key is the obvious concern. It’s often not the only one. Before you close the book on an employee departure, work through this list.
Alarm codes. If your security system uses shared codes or if the departing employee had their own code, change or delete it today. Most modern alarm systems let you delete individual user codes without resetting the master. If yours doesn’t, change the master code.
Gate remotes and fobs. Parking garage remotes, loading dock fobs, and key fob entry systems all need to be deactivated. Key fob and access control systems generally let you revoke a credential in 30 seconds from a web dashboard. Standard remotes with no management system need to be reprogrammed, which usually means all remotes get new codes.
Server room and IT access. If the employee had physical access to server rooms, network closets, or IT infrastructure, those locks need to be addressed. This is also the moment to revoke digital credentials: VPN access, admin passwords, shared login information. Physical and digital access go together.
Safes and cash drawers. If your business uses a combination safe and the departing employee knew the combination, change it. Most electronic safes allow combination changes without a locksmith. Mechanical combination locks require a locksmith to change the combination. If you’re not sure who else knows the combination, this is the moment to find out.
Vehicle keys. Company vehicle keys, key cards for fleet vehicles, and any building vehicles need to be accounted for. If the key wasn’t returned, contact your fleet manager and document it.
Key tracking going forward. If you don’t have a written key issuance log, start one now. Every key issued gets logged: who received it, what it opens, the date issued, and a signature. This eliminates ambiguity for every future departure and gives you a clear picture of your exposure when someone leaves.
The structural fixes
Rekeying after a departure is a reactive solution. It works, and it’s always the right call in the moment. But two upgrades eliminate the cycle entirely.
Access control systems. An electronic access control system lets you revoke a credential in 30 seconds from a computer or phone. No rekeying, no locksmith visit, no wait. The employee’s badge or fob stops working immediately. These systems also produce an audit trail, so you know exactly when someone entered a space and when they were last active. The upfront cost is higher than rekeying, but for businesses with meaningful employee turnover or multiple access tiers, the math shifts quickly. San Diego businesses interested in this upgrade can read more in our overview of access control systems.
Restricted keyways. If you want to stay on traditional keys, restricted keyways are the closest thing to copy-proof available. Medeco, Mul-T-Lock, and similar high-security cylinders are cut on keyways that aren’t available at retail. Copies can only be made by the locksmith of record, with authorization verified in writing. A returned key from a restricted-keyway system is actually evidence that no unauthorized copy exists. That’s a meaningfully different security posture than standard keys. It costs more per cylinder upfront, but eliminates the “did they make a copy?” question permanently.
The combination of access control for primary entry points and restricted keyways for sensitive areas like server rooms and executive offices gives most small businesses a security foundation that survives employee turnover without a locksmith visit every time.
Documentation and compliance
Some businesses are required to maintain records of access control changes. Healthcare organizations with HIPAA obligations, financial services firms, and businesses operating under specific client contracts or insurance requirements often have documentation standards tied to employee access.
Even if you’re not in a regulated industry, documentation protects you. If something goes wrong after a departure and you need to demonstrate that reasonable security steps were taken, a dated work order from a licensed locksmith showing rekeying was completed within a defined timeframe is exactly the kind of record that supports your position.
Ask your locksmith for a written invoice that includes the date of service, the specific locks rekeyed, and the number of new keys issued. Keep that alongside your key issuance log and the employee’s departure paperwork.
Frequently asked questions
Should I rekey after firing an employee?
Yes, in almost every case. If the termination was hostile or the employee didn’t return keys, rekey the same day. Even in an amicable departure with keys returned, you can’t verify no copies were made. Rekeying before the next hire is the standard practice. The cost is low relative to the risk, typically $150 to $300 for a small business.
How fast can a business be rekeyed in San Diego?
Most small businesses in San Diego can be rekeyed in a single visit, usually two to four hours for a standard office or retail space. Same-day appointments are available for urgent situations. A locksmith can typically rekey a standard commercial cylinder in 10 to 20 minutes, so a business with five to eight doors is a half-morning job.
How much does it cost to rekey a small business in San Diego?
Most small San Diego businesses pay $150 to $400 for a full commercial rekey. Standard commercial cylinders run $25 to $40 per cylinder plus a service call. Mortise locks, high-security cylinders, or master key system work runs $50 to $80 per cylinder. The total depends on the number of locks, the hardware grade, and whether a master key system is involved. Call for a firm estimate before the appointment.
Does it matter if the employee returned their keys?
It matters to your key tracking log, but not to your exposure analysis. A returned key confirms the physical original is back in your hands. It tells you nothing about whether a copy was made at any point during their employment. For sensitive access points, rekey regardless.
What if the employee had a master key?
That depends on which tier. A change key means rekey one lock. A sub-master means rekey every lock in that group. A grand master means rekey the entire building. A licensed locksmith can audit which tier was compromised and scope the job correctly. If your master key system uses restricted keyways, the risk is lower because unauthorized copies can’t be made.
What else should I change besides the locks?
At minimum: alarm codes, gate fobs, any electronic access credentials, and safe combinations if the employee knew them. If they had server room or IT access, digital credentials should be revoked at the same time. Run through the full checklist before you consider the departure closed from a security standpoint.
Ready to rekey?
If an employee has recently left your San Diego business, don’t let the key question stay open. A commercial rekey is fast, affordable, and closes the exposure for good. For businesses ready to move beyond the rekey cycle, our commercial locksmith team can also assess access control and restricted keyway options.
Call (858) 925-5546 for a same-day appointment or a quick estimate over the phone.