After-hours access, keys and the security risk in a cleaning contract

A cleaning contract is an access contract that happens to include mops. After trade, someone has to open the door, turn off the alarm, push a trolley through a dark floor, and leave the building as if it had not been opened. Clients remember the missed bin. They remember the missing laptop more. The WHS and compliance file that only talks about chemicals and wet floors is only half the job.

Australian commercial buildings still run a mix of metal keys, restricted key systems, swipe cards, mobile credentials and alarm codes. The failure modes are old: too many copies, codes written on a cupboard, a casual who kept last month’s fob, a subcontract nobody briefed. The technology changed. The audit did not get kinder.

Master keys and the least-access rule

A grand master that opens every tenancy is a liability you can hold in two fingers. Some older CBD towers and civic buildings still issue one to the night cleaner because it is how the building has always been cleaned. That is a client decision you should try to unwind, and a register you should keep as if it were cash.

Least access means:

• the person on the floor has the doors they need and no others
• the cleaners’ store and the bin hold are on a separate key where you can
• plant rooms, comms, pharmacies, cash rooms and rooftops are not on the cleaning ring unless the scope honestly includes them
• a true master, if it must exist, sits on a named supervisor issue with a sign-in and a same-night return

Restricted key systems (the stamped “do not duplicate” that a locksmith will actually honour) are worth the conversation at award. Ordinary keys grow in the wild. If the client will not restrict, your register and your retrieval discipline are the only control.

Number the rings. Do not issue “the school bunch” as an idea. A bunch that has grown to include a padlock, a window lock and a gate nobody can name is a bunch that will not come back complete.

Vehicles are part of the key system. A ring left in a van overnight in a suburban street is an unalarmed master. So is a hook on the depot wall with no book. Overnight storage should be a locked cabinet, a sign-in, and a ban on taking masters home unless the contract is a genuine lone-site caretaker arrangement that you have written down.

Swipe cards, fobs and the illusion of control

Electronic access is better than metal when someone actually disables a lost credential the night it goes missing. It is worse than metal when the building manager issues one “cleaner” card and the PIN is 1-2-3-4, or when your supervisor photocopies the request and three people share a lanyard.

Name the credential to a person. Put a photo on it if the system allows. Set the hours to the shift, not to 24 hours because it was easier in the software. Set the doors to the run. Review the access report when a laptop goes missing — and randomly, so the first time you open the log is not a police matter.

Mobile credentials and Bluetooth locks are the same rule with a faster revoke. They are not a reason to skip the register. When a phone is lost, the credential is lost.

Do not tape a card to the inside of the cleaners’ cupboard “for the weekend crew”. That is a published key. Labour-hire fill-ins get a tagged issue for that night and a return at the door — the same discipline as labour hire on the WHS side.

When you lose a site, the off-boarding is a security task: every fob, every metal, every alarm fob, every remote for a roller door, the robot dock account if you ran an autonomous scrubber, and the names on the security contractor’s list. A final invoice without a key return is unfinished work.

Alarm codes, duress and the night

Alarm codes shared among a whole roster are not codes. They are rumours. Individual logins, or a small set with a change when someone leaves, are the minimum. Write the arm-and-disarm sequence in a procedure that does not live as a photo on a group chat. Group chats get forwarded.

False alarms will happen. Your after-hours number, the security contractor’s number, and the rule about who calls whom should be on a card in the store and in the supervisor’s phone. A cleaner who cannot arm a panel will prop a door. A cleaner who is frightened of the keypad will leave the building open. Both are how you meet the client in the morning.

Duress and lone-worker check-in belong with the alarm, not in a separate wellness brochure. Night amenities in a station, a civic car park or a retail loading dock are foreseeable violence and foreseeable medical risk. A robot on the concourse is not a check-in. See autonomous machines and workers compensation.

CCTV is the client’s system and sometimes yours at the depot. Tell workers they are on camera. Do not use the centre’s cameras as your only supervision; they will show you the theft after you did not have a key register. If you record at the depot, the Privacy Act and Australian Privacy Principles can apply to footage that identifies people. Keep it for a purpose, restrict access, and do not post a still of a worker to a group chat.

Police checks, children and the file that has to be current

A National Police Check, obtained through an ACIC-accredited body, is the ordinary commercial host’s request. It is a point-in-time certificate, not a lifetime halo. Set a renewal — many hosts use two or three years — and a rule that a new check is required after a break in service. Do not photocopy a check so old the person has had another birthday and another surname.

Schools, early childhood and some community sites add a Working with Children Check (Blue Card in Queensland, WWCC in New South Wales and Victoria, and the local equivalent elsewhere). These are different instruments. A police check does not substitute. Sending an uncleared person into a holiday program because “they are only doing the hall” is how you lose the education panel.

Some government and critical-infrastructure hosts will want more: an organisational suitability assessment, an ASIC, a specific form of identification. Read the tender. Price the time to keep the file. A check that is “on its way” is not a clearance.

The file should show the check, the expiry, the sites the person may enter, and the date they were inducted on keys, chemicals and sharps. When a host audits, they will ask for a sample, not a speech.

Right-to-work and visa conditions sit next to the police check. After-hours access does not change Fair Work or migration law. A person who is not allowed to work those hours should not hold the fob.

Lost keys, missing laptops and the first hour

Write the loss procedure before the loss:

1. The finder or the last holder tells a named supervisor immediately, not at the end of the run.
2. The supervisor tells the client’s nominated security contact the same hour.
3. Electronic credentials are disabled. Alarm codes are changed if they may have travelled with the loss.
4. Mechanical masters trigger a written decision on rekeying and on temporary extra patrols.
5. You record the last known location, the shift, and who else had access to the ring.
6. You do not advertise the loss on social media, and you do not accuse a worker in the group chat.

Who pays for a rekey should be in the contract. If it is silent, you will pay to keep the client, then argue. Some restricted systems can drop one cylinder. A grand master loss in an old tower can be a building-wide event. That is why least access was the first heading.

Client property missing after your shift is the same hour, not a wait-and-see. Cooperate with CCTV review. Produce the access log and the roster. If your system cannot say who held the fob, you are already in the wrong story.

Do not let a supervisor “handle it quietly” because the tenant is difficult. Quiet is how the second loss happens.

Subcontractors, labour hire and the audit you will get

The people who did not sit in your induction are the people who lose keys. If a specialist glass crew, a heights EWP operator, or a labour-hire cleaner needs access, issue for the task and retrieve at the door. Do not give them the master because you will not be on site.

Clients now audit this. They ask for the key register, the last three issues and returns, the police-check sample, the after-hours contact, and whether your modern slavery questionnaire matches the labour you actually sent. A tidy PDF from the tender and a messy bunch in a Kia is a finding.

Internal audits should include a surprise count. If the book says eight fobs and the box has six, you have a live problem. If the alarm code has not changed since a supervisor left last winter, you have another.

Design the run so the building can close

Access risk drops when the run is designed. A single point of issue at the loading dock. A cleaners’ store that does not need a tenancy master. A machine dock that is not inside a comms room. A sanitary and clinical waste hold that the night crew can reach without a pharmacy key. An autonomous scrubber that does not need the mall unlocked for six hours.

Write those needs into the specification response. A cheap price that depends on every casual holding the master is not cheap. It is an unpriced break-in.

After-hours cleaning is trusted access. Treat the key as the job, and the mop as what you came in to use. The clients on Bourke Street and on a regional high street will both forgive a streak on the glass before they will forgive a fob you cannot name.