A break-in at a commercial property creates two immediate risks: the possibility that someone is still on site, and the pressure to get the business operating again quickly. Knowing how to respond to break-ins before an incident occurs helps protect your people, preserve evidence and prevent a difficult situation becoming more costly.
For business owners, facilities managers and property managers, the correct response is not simply to attend, assess damage and replace a lock. It requires a controlled process that puts personal safety first, gives the police the information they need and restores the premises to a secure condition.
Put people before property
If an alarm has activated or there are signs of forced entry, do not ask an employee to enter the building alone. A smashed window, damaged shutter, forced door or unexpected movement inside should be treated as a potential ongoing threat.
Move staff, visitors and contractors away from the entrance and keep them at a safe distance. Do not touch doors, windows, tools, discarded items or anything that may have been moved. Even well-intended actions can compromise evidence or create uncertainty about what has happened.
If there is an immediate threat, a person is injured, or you believe intruders remain on the premises, call 999. In other circumstances, report the crime through the appropriate police channel and obtain a crime reference number. This will usually be needed for insurers and can support later investigations.
A designated key holder should coordinate communication, but that does not mean they should take unnecessary risks. Key holding and alarm response arrangements exist for precisely this reason: they reduce the chance of a director, manager or member of staff arriving alone at an insecure site in the early hours.
How to respond to break-ins without disturbing evidence
Once the police have confirmed it is appropriate to do so, record what you can see without entering areas unnecessarily. Take photographs or video from a safe position, noting points of entry, visible damage and any items that appear disturbed. Record the time the alarm activated, when the site was discovered and who has attended.
Avoid beginning a clear-up before the police have given permission. This includes sweeping broken glass, repairing access points, moving stock or resetting equipment. A rushed attempt to get back to normal can remove fingerprints, footwear marks, tool marks and other useful evidence.
Your records should cover more than the visible damage. Note which keys, access fobs, laptops, stock, tools, vehicles, cash, documents or controlled items may be missing. Where possible, compare the site with stock records, asset registers and key logs rather than relying on memory during a stressful incident.
Preserve CCTV and access-control records
CCTV footage can be overwritten quickly, particularly on systems with limited storage. Secure relevant recordings as soon as possible, including footage from the hours before and after the apparent break-in. Do not edit original files. Keep a copy for the police, insurer and internal investigation, while retaining the original where your system allows.
Access-control data may be equally valuable. Review door events, fob activity, alarm logs and visitor records to establish whether the intrusion occurred through forced entry, compromised credentials or an unsecured area. This is not about assigning blame before the facts are known. It is about identifying the route of entry and reducing the chance of a repeat incident.
Make the premises safe and secure again
After police attendance, the next priority is temporary security. A damaged door, window, gate or roller shutter can leave the site exposed to further theft, weather damage or unauthorised access. Arrange suitable emergency boarding, glazing, locksmith or shutter repairs, depending on the nature of the damage.
Temporary measures are not a replacement for a permanent repair, but they can protect the property while parts are sourced or contractors are scheduled. Consider whether a mobile patrol or manned guarding presence is necessary overnight. This depends on the value of assets on site, the extent of damage, local risk, insurance requirements and whether the building remains occupied.
If keys, fobs or alarm codes may have been compromised, change them promptly. Re-key external doors where physical keys are unaccounted for, deactivate missing fobs and reset alarm and access-control credentials. Do not overlook shared gates, outbuildings, plant rooms, delivery entrances or communal access routes.
For vacant properties, the response should be especially careful. An empty building can attract repeat intrusion if damage remains visible or security weaknesses are not addressed. Regular vacant property inspections, clear escalation procedures and a reliable response provider give owners a documented method of protecting an unoccupied site.
Notify insurers and maintain a clear incident file
Contact your insurer as early as practical and follow its claims process. Provide the crime reference number, photographs, initial loss information and details of steps taken to secure the premises. Insurers may require approved contractors for repairs or may need to assess damage before work begins, so check your policy terms before authorising non-emergency remedial work.
Maintain one incident file containing the alarm record, police reference, CCTV preservation details, photographs, repair invoices, communications and an inventory of losses. A central record makes it easier to manage the claim, respond to follow-up questions and demonstrate that the organisation acted responsibly.
You may also need to notify landlords, managing agents, neighbouring occupiers, clients or regulators. The correct approach depends on the property arrangement and the type of information or materials held on site. For example, a break-in affecting personal data, medicines, hazardous substances or controlled stock may trigger additional reporting obligations.
Review what allowed the break-in to happen
Every incident should lead to a proportionate security review. The goal is not to spend money on every available measure. It is to address the weaknesses that matter most for your building, operating hours and risk profile.
Start with the physical perimeter. Check fencing, gates, lighting, external doors, windows, shutters and roof access. Then examine daily routines: were doors left unsecured, were keys signed out correctly, did contractors have unrestricted access, and was the alarm set when the building closed?
A practical review may identify several improvements:
- stronger locks, door hardware, shutters or window protection at vulnerable points;
- improved external lighting and CCTV coverage, particularly at approaches and delivery areas;
- clearer key control, including documented issue and return procedures;
- revised alarm response instructions and up-to-date emergency contacts;
- scheduled lock-up checks, mobile patrols or guarding at higher-risk times.
The right measures depend on the site. A retail unit with high-value stock may need a different response from an industrial estate warehouse or a small office containing sensitive records. A multi-site operator may benefit most from consistent key holding, alarm response and reporting across locations, rather than relying on individual managers to make decisions out of hours.
Test the response plan, not just the alarm
An alarm system is only one part of effective protection. Your response plan should state who receives activation calls, who can authorise police contact and repairs, where key records are held, and how staff are kept informed. Check it at least annually and whenever personnel, premises, alarm providers or access arrangements change.
It is also worth confirming that contact numbers are current and that the people listed understand their role. A plan that depends on one unavailable key holder is not a dependable plan. Professional key holding and alarm response can provide continuity where internal coverage is limited, while helping keep employees out of harm’s way.
KCS supports commercial clients with 24/7 key holding, alarm response, mobile patrols and property protection services, giving businesses a controlled route from alarm activation to a secure, documented outcome.
A break-in is disruptive, but the response does not have to be improvised. Clear responsibilities, safe attendance procedures and prompt security repairs give your business the best chance of protecting people, evidence and operations when it matters most.
