When a property manager takes over a new building or portfolio — whether through a management contract change, a property acquisition, or a landlord handing management responsibilities inward — they inherit whatever security decisions were made years or decades before them. Those decisions rarely reflect current risk levels, current technology, or current regulatory expectations. They reflect what was cheapest at the time, what a previous contractor recommended, or what came with the building when it was constructed.
This inherited security infrastructure creates liability exposure for the property manager and the property owner. Cameras that haven't been recording properly for months. Access codes that haven't been changed since the previous owner. A monitoring contract that lapsed and was never renewed. A system that was designed for a previous use of the building that no longer reflects what actually happens there.
The Most Common Inherited Security Problems
Stale access credentials. This is the most consistently found problem in any new property management engagement. The previous management company, maintenance contractors, vendors, and former tenants all have credentials that may still be active. In buildings without a disciplined deactivation process, the credential set is effectively open — it includes everyone who has ever worked in or occupied the building, not just current authorized users. The practical risk is that someone with a grievance — a former tenant, a terminated contractor, a previous employee — retains physical access.
Cameras recording to failed or full storage. Many properties have cameras that are powered on and the lights are blinking, but the recording function has failed. Local DVRs fill up when storage is full and stop recording — or overwrite continuously on a 24-hour loop that is nearly useless for investigation. Cloud-managed cameras with alert notifications when recording fails are now standard; most legacy local-DVR systems provide no such alert.
Coverage designed for a different use. A building that was previously a single-tenant commercial property and is now a multi-tenant office has camera coverage designed for one tenant's operations. The new common areas, shared entrances, and multiple dock access points are uncovered. A building that was previously low-security industrial and is now a mixed-use storage facility needs a completely different coverage profile.
Expired or missing monitoring contract. Many buildings have camera systems that were installed with a monitoring contract — which lapsed, was terminated when the previous owner reduced costs, or was simply never renewed. The cameras are present and recording, but no one is watching them. The property manager inherits the cameras without the monitoring layer, and the system provides documentation but no deterrence.
Access control that can't be centrally managed. Older access control systems — particularly those installed before cloud-managed systems became standard — may require physical programming at each controller to add, modify, or remove credentials. In a multi-building portfolio, this is operationally unworkable. A property manager who can't deactivate a credential remotely on the day a tenant leaves can't maintain effective access security.
No intrusion alarm coverage on after-hours zones. Camera coverage and access control don't substitute for intrusion detection. A building with cameras but no motion sensors and door contacts on a monitored alarm system provides no after-hours alert when someone is inside who shouldn't be. Many inherited systems have one or the other but not both integrated.
How to Systematically Fix Inherited Security
Step 1: Security audit before anything else. Before spending money on new equipment, document what exists, what condition it's in, and what it covers. Walk every access point. Test every camera and confirm recording. Pull the credential list and compare it to current authorized users. Check the monitoring contract status. This takes a few hours and prevents spending money on the wrong things.
Step 2: Immediate credential reset. On day one of a new management engagement, change all building access codes and audit all fob credentials. Deactivate every credential that cannot be tied to a current authorized user. Issue new credentials through a documented process. This is the highest-priority inherited security problem because the exposure is immediate.
Step 3: Address camera recording failures. Confirm every camera is actively recording and that retention meets the minimum needed for the building type. For most commercial properties, 30 days is the operational minimum. Replace failed storage or migrate to cloud-managed systems with recording health monitoring.
Step 4: Coverage gap review. Map current camera coverage against current building use. Identify access points, high-value areas, and common zones that aren't covered. Prioritize additions based on risk — parking areas and after-hours entry points first.
Step 5: Reinstate or establish monitoring. If there is no active monitoring contract, this is a gap that cameras alone cannot close. A monitored system with motion-triggered alerts and verified response converts the security infrastructure from a documentation system into a deterrence and response system.
Step 6: Move to cloud-managed access control. Where budget allows, migrating from locally-programmed legacy access control to a cloud-managed system allows credential management from a central interface — add, modify, or deactivate credentials across all properties from a single dashboard. For property management portfolios, this is not optional; it is operationally necessary.
Inherited security problems are not the property manager's fault. Leaving them unaddressed is. The property owner is depending on the property manager to identify and close these gaps — and if an incident occurs at a property where a known gap was not addressed, the liability position is difficult to defend.
For a detailed breakdown of security systems designed for Ontario property management portfolios, see our property management security page.
