A monitored alarm does not, by itself, arrange attendance at business premises. Keyholding provides controlled access to the property, whilst alarm response sends a trained officer to assess an activation and take agreed action.
A keyholding alarm response arrangement links controlled access with clear responsibilities, safe attendance procedures and a recorded outcome. Start by separating what each service does, because storing keys, receiving signals and attending an incident are different tasks.
Key takeaways
- Keyholding controls the keys, fobs, codes and instructions needed to access a property; alarm response provides physical attendance after an activation.
- Alarm monitoring receives and assesses signals, but attendance requires a separate instruction or an agreed response arrangement.
- Response times depend on the site, available coverage and contract; a general advertising claim does not establish an attendance guarantee.
- Police response depends on alarm eligibility, confirmation and force policy, and repeated false calls can lead to withdrawal.
- Contracted officers carrying out licensable security duties must hold the appropriate current SIA licence, with training suited to their attendance role.
- A complete response ends with the premises secured or handed over, an incident report, and named responsibility for outstanding repairs.
What is the difference between keyholding and alarm response?
These services are often bought together, but their functions remain separate. A contract should describe both rather than relying on the word “keyholding” to imply attendance.
Keyholding controls access to the premises
A keyholding service stores authorised keys, access fobs and associated instructions so an appointed responder can enter the building when required. Access should be restricted, logged and linked to an identifiable instruction.
Physical key holding is only one part of a wider access plan. The responder may also need gate access, alarm credentials, a route through shared areas and permission to enter particular rooms.
Secure storage does not establish that an officer is available to attend. The scope must connect custody with a defined response service. Our explanation of how business keyholding works covers that relationship between access control and attendance.
Alarm response provides an attending officer
Alarm response means a security officer attends following an instruction, assesses conditions and follows the site’s procedures. That may involve inspecting the perimeter, entering safely, recording damage or arranging further assistance.
Attendance is different from an alarm notification. A message on a manager’s phone establishes that an alert was sent, not that anyone has accepted responsibility for the building.
Alarm response also differs from mobile patrols, which follow an agreed inspection programme. Alarm response is triggered by a particular event.
How alarm monitoring starts the response
An alarm receiving centre, usually called an ARC, receives signals transmitted by the alarm system. Operators assess those signals against the instructions assigned to the premises.
The monitoring centre identifies the event
The operator needs to distinguish an intruder activation from other signals, including system faults, power failures and tamper alerts. Available information may include the affected zone, event sequence and associated verification material.
CCTV monitoring can provide visual context, but it’s separate from alarm monitoring. It doesn’t by itself confirm that an officer has been instructed to attend.
That assessment determines the next action. Depending on the arrangement, the operator may contact nominated people, instruct a response team or request emergency assistance through the appropriate route.
Monitoring infrastructure also has its own standards. Trade reporting on OCS’s National Operations Centre describes its 24/7 monitoring facility built to BS EN 50518:2019 requirements and Category 1 ARC standards. That concerns the receiving centre, not an officer’s travel time.
Separate providers need a clear handover
Monitoring, keyholding and alarm response can be purchased separately or combined within one arrangement. An alarm installer, receiving centre and attending security company may therefore be different organisations.
The operating plan should name each party and describe how an attendance instruction is accepted. A call placed to an unanswered number is an incomplete handover.
Design business alarm systems and response together so the signal reaches someone with both authority and practical access. Include a fallback route if the first response team cannot accept the instruction.
What happens after an alarm activation?
The exact procedure depends on the alarm, premises and agreed service. A typical commercial attendance follows this sequence.
- The receiving centre assesses the signal. The operator identifies the premises, alarm type and affected zones, then reviews available confirmation information against the site’s instructions. A recognised technical fault may require a different escalation from evidence of intrusion.
- The appointed responder receives the instruction. The response team accepts the call, records the relevant times and assigns an officer. Site information should identify the correct entrance, access restrictions and any hazards affecting attendance.
- The officer travels to the premises. The control room maintains contact and manages delays or changes in information. A further activation, report of damage or emergency call may alter the instructions before arrival.
- The officer assesses the exterior. The initial assessment considers visible damage, open access points, signs of intrusion and immediate hazards. Conditions determine whether internal inspection is appropriate. An alarm instruction does not override an unsafe situation.
- The officer enters only where safe and authorised. The responder follows the access plan and investigates within their training and remit. Suspected crime, fire or another emergency requires the relevant escalation rather than an attempt to complete a routine inspection.
- The site is secured and the outcome recorded. Where appropriate, the officer resets and rearms the alarm, locks the premises and reports the findings. Damage, unresolved faults or incomplete protection require a clear handover and further action.
A responder may also provide access for police, firefighters or an approved contractor when conditions and instructions allow. They should not enter a dangerous building simply because emergency access is needed.
The sequence can stop at any safety decision. A suspected intruder inside the building requires a different response from an apparent detector fault.
How quickly should a keyholder attend?
A response time needs a defined starting point, endpoint and set of conditions. Without those details, two apparently similar attendance promises may describe different services.
Understand the historical 20-minute benchmark
Older ACPO guidance commonly cited a primary keyholder being able to attend within 20 minutes following an intruder alarm activation. That benchmark should not be presented as a universal statutory arrival deadline for every commercial security contract.
There is no single legal response time applying to every UK business, location and service model. Contractual commitments remain important, but they must be realistic for the premises and available resources.
A short published average also differs from a guaranteed maximum. An average can conceal longer attendances at individual sites or during busy periods.
Define what starts and stops the clock
The agreement should state whether time begins at the initial alarm signal, receipt of the call by the response provider, acceptance of the instruction or dispatch. These are separate events.
Record arrival clearly too. Reaching the postcode, reaching the site entrance and gaining access to the building are not equivalent, particularly on industrial estates or shared developments.
Require the response target, any guarantee and the applicable exceptions in writing. The service level should also explain delayed attendance, alternative cover and escalation when the first officer is unavailable.
Our guidance on professional alarm response services separates physical attendance from monitoring and describes the importance of a measurable response arrangement.
A clear contract cannot remove traffic, severe weather or competing incidents. It can establish who manages those conditions and what records demonstrate the response.
When will police attend an intruder alarm?
Police response is a separate process from sending a private keyholder. A security company cannot guarantee police attendance simply by including it in a service description.
An alarm activation needs appropriate confirmation
For eligible monitored intruder systems, a single unconfirmed activation is generally insufficient for automatic police response. Confirmation provides additional evidence that the event may involve a genuine intrusion.
Sequential confirmation can involve separate detectors activating in a qualifying sequence. An eyewitness report can also provide evidence, whilst some arrangements use recognised visual or audio confirmation.
Repeated signals from one faulty detector do not automatically establish a confirmed intrusion. The system design and applicable police requirements determine how confirmation is assessed.
The NPCC police requirements for security systems provide the framework for qualifying systems, response levels and false-call management.
Registration does not replace operational judgement
Eligible systems are normally registered with the relevant force using a Unique Reference Number, or URN. This identifies the system within the police response arrangements.
A URN does not mean every activation receives attendance. Confirmation, response status, the information available and operational priorities still affect the decision.
Contacting the keyholder and requesting police assistance are separate actions. The business needs a physical response arrangement even where its alarm qualifies for police response.
Procedures also vary by location and force. West Yorkshire Police’s alarm policy places withdrawal of response within the NPCC framework, illustrating how national requirements sit within local arrangements.
Reports of an immediate crime or threat to life follow emergency reporting procedures. Those circumstances should not be confused with an automatic alarm-system response request.
What happens after repeated false alarms?
False alarms create operational problems beyond attendance charges. Repeated false calls to police can change the response available to the premises.
Two false calls lead to a written warning
Under NPCC policy, two false calls in a rolling 12-month period lead to a written warning to the customer, copied to the maintaining alarm company. The warning provides an opportunity to take corrective action.
The 2024 NPCC security systems requirements describe that threshold. A rolling period is measured backwards over the previous 12 months, rather than restarting each January.
An alarm activation or private visit after a false alarm doesn’t automatically count as a false call to police.
The facilities manager should record the relevant incidents and assign corrective work. Repeated resets without a diagnosis leave the underlying cause in place.
Three false calls can remove routine police response
Following three false calls in a rolling 12-month period, Level 3 status applies and routine police attendance is withdrawn. The policy provides for withdrawal no less than 14 days after the date of the withdrawal letter.
That period concerns notice before withdrawal. It doesn’t promise automatic reinstatement after a 14-day suspension.
During withdrawal, the routine alarm response arrangement must rely on the appointed keyholder or contracted responder rather than automatic police attendance. Evidence of an actual crime or immediate danger still requires appropriate reporting.
Resetting the alarm doesn’t restore withdrawn police response. Corrective work and the policy’s reinstatement requirements remain separate tasks.
Review detector faults, user errors, access arrangements and maintenance records together. An alarm repeatedly triggered by authorised cleaners needs an operational correction as well as a reset.
What do SIA licensing and BS 7984 establish?
Licensing, company approval and operating standards answer different questions. None should be treated as a substitute for the others.
Officers need licences appropriate to their duties
The Security Industry Authority regulates designated private security activities under the Private Security Industry Act 2001. Contracted personnel undertaking licensable keyholding or security guarding duties must hold the appropriate current SIA licence.
GOV.UK’s SIA licence guidance distinguishes keyholding from other regulated activities. Keeping keys and controlling access are different duties from physically guarding premises following an alarm.
A keyholding licence alone does not establish that a person has the training needed for every attendance task. The SIA’s licence application guidance states that a keyholding licence does not require a licence-linked qualification.
Assign appropriately SIA-licensed officers whose training and instructions match the work. A company approval logo does not replace that individual requirement.
BS 7984 concerns how the service operates
BS 7984 is the British Standards framework for keyholding and response services. BS 7984-1:2016 gives recommendations concerning the management, staffing and operation of contracted keyholding and response services.
In practice, the framework concerns matters such as personnel screening, controlled key custody, response arrangements, site information and records. These controls connect the stored key to an accountable attendance process.
Screening and vetting should be supported by records, with BS 7858 relevant to screening individuals working in a security environment. Licensing and screening remain separate controls.
BS 7984 is a code of practice, not a blanket promise of one nationwide arrival time. A service should show how its procedures meet the relevant requirements and how the agreed site response is measured.
Safe attendance requires more than access to keys
A security officer may be trained to attend alarms, but the site can still present serious risks. Instructions should establish where assessment stops and emergency escalation begins.
Manage lone-working and site hazards
The response plan should identify relevant hazards before an incident occurs. Examples include vehicle movements, unprotected edges, machinery, damaged structures, dogs, restricted rooms and areas where communications are unreliable.
The control room needs to know who is attending, where they are and when further contact is expected. A missed welfare contact requires a defined response.
Some incidents require additional personnel or emergency services. The risk assessment should determine those conditions rather than leaving the attending officer to negotiate them alone.
A business security risk assessment should connect threats with practical controls, including access restrictions and out-of-hours attendance arrangements. An accurate hazard record matters as much at night as during normal operations.
Separate investigation from confrontation
An alarm responder should assess and report suspected crime within their training, authority and instructions. Attendance is not an instruction to pursue an intruder or search a visibly dangerous building.
Signs of fire, a suspected gas leak or serious structural damage require emergency procedures. Alarm credentials do not make entry safe.
Where emergency services attend, the officer can provide access information, identify relevant entrances and pass on known hazards. They should avoid disturbing possible evidence unless immediate safety requires action.
Sending an employee instead does not remove these risks. Employers must assess the work, provide suitable arrangements and avoid assuming that familiarity with the building makes lone attendance safe.
What information must be ready before cover starts?
A response plan depends on accurate information supplied during mobilisation. A valid key will be of limited use if the responder cannot pass the gate or identify the alarm panel.
Build a usable site instruction pack
The site pack should identify the premises, authorised entrance, parking arrangements, alarm panel and relevant zones. Include shared access arrangements, restricted areas and hazards that could affect inspection.
Record opening hours and expected out-of-hours activity. Cleaners, delivery teams, maintenance contractors and late-working staff can all affect how an activation is interpreted.
Assign a facilities or operations manager to keep the pack current. Changes to locks, tenants, alarm equipment or building layout should trigger an update before the revised arrangements are needed.
Instructions should remain usable under pressure. Essential access information should not be buried amongst unrelated property documents.
Control keys, credentials and access changes
Key custody should use an auditable system that records issue, use, return and exceptions. Avoid attaching a recognisable property address directly to an unprotected key.
Alarm codes and access permissions should be limited to authorised roles. Where the system permits it, individual credentials provide better accountability than one shared code.
Lost keys, damaged fobs and changed locks require a clear notification and replacement process. Removing a former employee from a contact list does not remove their access rights.
Carry out an agreed mobilisation test with the relevant parties. The exercise should demonstrate that the correct signal reaches the responder, the keys work and the site instructions support a normal report.
Arrange the test in advance. An unplanned activation can create unnecessary dispatches and confusion about whether a real incident is developing.
Who is responsible for decisions during a call-out?
The business retains decisions about its premises, even when attendance is outsourced. The contract should assign enough authority for the responder to act without leaving important choices undefined.
Name contacts and escalation authority
Provide a primary business contact and an alternative who can make decisions outside normal hours. A list of office telephone numbers is inadequate when the building is closed.
Define the fallback when neither contact answers. The responder needs instructions covering emergency escalation, temporary protection and any limits on remaining at the premises.
The monitoring centre should assess and pass on the signal. The response provider should manage attendance and reporting. The business should maintain access information, contacts and decision-making authority.
Where subcontractors attend, the contract should still name the organisation accountable for delivery. The business should not have to resolve responsibility between suppliers during an incident.
Set repair authority before damage occurs
A forced door or damaged shutter may leave the premises exposed after the initial inspection. Security attendance does not automatically include locksmiths, boarding-up, glazing or alarm engineering.
Specify approved contractors, spending limits and who can authorise additional work. State whether the officer remains until repairs are completed or hands over to another authorised person.
A reset may also be inappropriate where the system has a persistent fault. The handover should identify any unprotected area and the temporary arrangements covering it.
Repairs, technical diagnosis and continued guarding are different services. Their availability and charges belong in the agreement.
Which businesses benefit from professional keyholding?
The need depends on exposure, operating hours and who would otherwise attend. Distance, staff availability and the consequences of an unsecured building all affect the decision.
Offices, retail premises and warehouses
Offices may have no authorised employee nearby after closing, so commercial keyholding can provide contracted cover. With agreed hours and tasks in place, this can offer peace of mind without relying on a director or facilities manager to attend each night.
Retail units may need a responder who understands shared entrances, shopping-centre procedures and restrictions on rear access. An activation during a delivery requires different information from one in a fully closed unit.
Warehouses can involve large perimeters, loading bays, vehicle gates and separate alarm zones. The response plan should identify which areas can be inspected safely and how damage affecting operations is escalated.
Keyholding can also support authorised access visits, unlocking and lock-up services where those tasks are included. They should not be assumed to form part of basic alarm attendance.
Vacant buildings, construction sites and portfolios
Vacant premises need a plan for damage, unauthorised entry and faults that might otherwise remain unnoticed. Alarm attendance should sit alongside proportionate vacant property security measures, rather than replacing routine inspections.
Construction sites require frequent updates as boundaries, access routes and hazards change. Instructions prepared during early works may be unsuitable once completed units and stored equipment occupy the site.
For multi-site operations, consistent reporting helps managers compare incidents without assuming every location needs identical instructions. Each site still needs its own access details and hazards.
Where the risk requires a continuous presence, keyholding alone is insufficient. Continuous security cover for businesses addresses a different requirement from attendance after an alarm.
What does keyholding and alarm response cost?
Pricing depends on the premises, location, access complexity and service level. A retained keyholding arrangement with separately charged attendances differs from a package that includes a defined number of call-outs.
Separate the retained service from attendance charges
The retained charge may cover key custody, administration and access to the response arrangement. Physical attendance, extended time on site and emergency assistance may be charged separately.
A useful price schedule separates the main components.
| Charge component | What the agreement should state |
|---|---|
| Mobilisation | Site survey, instruction preparation, key collection and initial testing |
| Retained cover | Key custody, contracted availability and included administration |
| Alarm attendance | Included visits, chargeable call-outs and initial time allowance |
| Extended attendance | Additional time, waiting for contractors and relief arrangements |
| Additional work | Lock-up visits, temporary guarding, repairs and other authorised services |
Compare the complete service against the site’s needs. A lower retained fee may produce a higher total where false alarms or extended attendances are common.
Keep published price examples in context
Priority First reports alarmed response cover for a single residential property in prime central London starting at around £1,000 a year, based on its client contracts. That is a specific residential example, not a national commercial tariff.
Business pricing may differ because of building size, travel requirements, alarm complexity and response obligations. A small office and a warehouse with several gates create different attendance demands.
The commercial schedule should also state VAT treatment, out-of-hours supplements, cancellation terms and charges for missing keys or access failures. Included call-outs need a clear definition.
Police-response alarm costs are separate again. Installation, maintenance, monitoring, registration administration and private keyholder attendance should not be presented as one interchangeable charge.
What should the incident report contain?
Attendance establishes that someone reached the premises. The report should establish what they could inspect, what they found and what remains unresolved.
Record observations and actions precisely
A useful report records alarm receipt, dispatch, arrival and departure times, alongside the inspected areas and any access limitations. It should distinguish observed damage from assumptions about its cause.
Record resets, rearming, contractor involvement and any contact with police or other emergency services. Where photographs are appropriate and permitted, they should support the observations.
“No sign of intrusion” means the inspection found no visible evidence within its scope. It does not prove that every room, concealed area or system was examined.
Similarly, an unexplained activation should not automatically be recorded as a confirmed detector fault. Technical diagnosis may require the maintaining alarm company.
Assign ownership after the officer leaves
The handover should state whether the building is secured, whether the alarm is fully operational and who owns each outstanding action. A report describing damage without assigning follow-up leaves an operational gap.
Agree when routine reports are issued and which incidents require immediate contact. Significant damage or incomplete protection should not wait for the next scheduled email.
Use records to identify recurring faults, access problems and repeated delays. Several activations associated with one entrance may indicate a door, detector or closing procedure that needs attention.
Retain reports under the organisation’s information-handling rules. Names, images and access details should reach authorised recipients rather than broad distribution lists.
What should a business ask before signing?
Ask a prospective security provider how its coverage applies to your premises. A national coverage claim doesn’t identify which team accepts your site’s alarm at night.
Use a short set of questions to expose gaps.
- Who receives the alarm instruction, who accepts it, and which organisation remains accountable if attendance is subcontracted?
- What response commitment applies to the premises, what starts the clock, and what happens when the first officer is delayed?
- How are keys and credentials stored, issued, returned and replaced after a loss or access change?
- What licensing, screening, training and supervision apply to the officers undertaking the contracted duties?
- Which attendances, waiting periods, repairs and additional services are included, excluded or charged separately?
- What report follows each visit, which incidents trigger immediate contact, and who owns unresolved actions?
The answers should form part of the written scope rather than remain sales assurances. A sample report and agreed escalation plan provide more useful evidence than a broad promise of rapid attendance.
Our guide to professional key holder services examines the relationship between custody, access rules and response standards. Apply those controls to each site rather than treating a portfolio as one building.
Check any security conditions in the insurance policy and include them in the operating plan. A keyholding contract doesn’t automatically satisfy every policy condition or guarantee a premium reduction.
Frequently asked questions
Can a business use its own employees as keyholders?
A business can nominate employees, but it must assess the work and provide suitable arrangements. Availability, lone-working risks, training and authority all matter.
Naming a manager does not establish that they can attend safely, respond during leave or deal with a damaged building. Professional attendance can reduce reliance on that informal arrangement.
Does an alarm responder always enter the building?
Entry depends on safety, authority and the incident. Suspected intruders, fire, structural damage or other serious hazards may prevent an internal inspection.
The report should record any restriction and the resulting escalation. Holding keys does not create an obligation to enter unsafe premises.
Can keyholding cover fire alarms and water leaks?
It can support attendance and access where those events are included in the service instructions. The responder’s role remains limited by their training, authority and the conditions found.
An intruder alarm contract does not automatically include fire-alarm response or technical fault investigation. Different signals need appropriate escalation procedures.
Is alarm monitoring enough without a keyholder?
Monitoring can assess a signal and make notifications, but it does not provide physical attendance unless that function is included.
The premises still need an authorised response arrangement. That may involve employees or a contracted service, depending on the risks and operating model.
What happens if the alarm cannot be reset?
The officer should follow the escalation plan, report the fault and identify whether any part of the premises remains unprotected. An alarm engineer may be required.
Temporary arrangements might include additional patrols or guarding where authorised and available. Leaving the system unset should require a documented decision and handover.
Do professional keyholders replace police?
Private responders do not replace police powers or emergency services. Their role is to provide controlled attendance, assess conditions, secure the premises where possible and report or escalate appropriately.
Police involvement depends on the circumstances, alarm eligibility and response policy. The contract should keep those responsibilities distinct.
A working response plan needs a clear handover
Reliable keyholding and alarm response connects controlled access, safe attendance and a documented outcome. The premises should be secured or handed over with named responsibility for anything still unresolved.
Assign a site owner to maintain the instructions, access details and escalation authority. A key in secure storage is useful only when the people, information and decisions needed for attendance are ready alongside it.
0 Comments