Security systems are the make good scope that tenants and contractors most often discover they have not planned for. The access control readers, the CCTV cameras, the alarm panels, the cable runs back to a dedicated riser, the integration with the building’s fire system; all of these came in as tenant-added works at the start of the lease and all of them have to come out again at the end. Unlike partitions and paint, they sit outside the make good contractor’s standard trade scope, which means they are usually someone else’s problem until the last few weeks, when they become everyone’s problem at once.
Scoping the security removal at the start of the make good programme, as a distinct line item with its own contractor and its own schedule, is how tenants avoid the late-stage crunch. The work is not technically complex; it is organisationally fiddly, and the coordination is what makes it expensive when it is left to the end.
What Counts as Base-Building Security Versus Tenant Security
The starting point, as with lighting, is the lease and the original handover condition. Most commercial buildings in Sydney provide some base-building security at the tenancy door, typically a reader on the tenancy entry that is integrated with the building’s access control system and operated by the building manager. The reader may be tenant-branded or building-branded depending on the lease.
Inside the tenancy, everything else is almost always tenant-installed. Internal doors with readers, CCTV cameras, alarm panels, duress buttons, security system servers, door controllers, and the cable infrastructure running between them are tenant fitout items, even when the system was installed to landlord-approved specifications. At make good, all of that tenant infrastructure has a lease-end obligation attached, and the obligation is usually full removal rather than hand-over to the landlord.
The one category that sits between tenant and landlord ownership is the integration cabling back to the building’s fire or access control riser. Where a tenant’s system tapped into the base-building fire alarm loop, the tap-off point needs to be decommissioned cleanly, the loop restored to its original continuity, and a certificate of re-compliance issued. This is not a small scope even when the physical work is modest, because the fire contractor has to re-test the affected zone and provide documentation to the certifier.
Cable Removal Back to the Riser
The largest single physical element of security system make good is usually the cable removal. Access control and CCTV systems typically run structured cabling from each device back to a central cabinet or rack, and the cabling runs through ceiling plenums, risers, and wall cavities.
The standard lease obligation on cabling is removal back to the riser, not just removal back to the wall. A tenant who disconnected readers, cameras and panels but left the cable homes running to the rack is not finished. The landlord’s handback inspection will look for cables terminated at the wall plate or ceiling entry point, and in a good percentage of cases the landlord’s building manager will either ask for the cable to be physically removed or for a credit toward the landlord’s later removal cost.
The practical scope of cable removal varies with how the original install was done. A well-installed system used dedicated cable tray or conduit that can be cleared relatively efficiently. A system that ran loose cable through the ceiling plenum, stapled or tie-wrapped to other services, is a slower and more expensive removal, because the cable has to be separated from shared infrastructure without damaging anything still in use. Cable penetrations and coordination usually dictate how clean the original install was, and the removal inherits whatever discipline or lack of discipline the original work had.
Most tenancy leases are specific about this obligation, and the language is rarely negotiable at make good. The time to negotiate was at lease start, when the fitout licence for alterations was being issued. By the time the tenant is moving out, the scope is usually fixed.
Reader and Lock Removal on Internal Doors
Internal door hardware is a surprisingly specific scope inside security make good. When a tenant installed an access control reader on an internal door during the fitout, the work typically involved fitting an electric strike or magnetic lock, running cable through the door and frame, and mounting a reader panel on the wall next to the door.
At make good, the reader comes off the wall, the cable is terminated, and the door reverts to standard mechanical hardware. The electric strike or magnetic lock usually comes out of the door, because it is not a standard product in a base-building door spec, and a replacement mechanical strike or latch goes in. The door face that was cut for cable runs needs to be made good, typically with a filler and paint touch-up, and the frame face needs the same treatment.
None of this is expensive per door, but the cost scales linearly with door count. A tenancy with two dozen internal doors under access control carries two dozen individual reversion items at make good, and the mechanical hardware for each door is a real product cost on top of the labour.
The decision that tenants occasionally negotiate at this point is whether the landlord will accept the doors with the electric hardware left in place, sometimes at a credit from the tenant. The answer is usually no, because base-building condition rarely includes electric door hardware, and the landlord’s next tenant will have no use for it. But it is worth asking when the hardware is modern, when the doors are specific to the tenancy, and when the replacement mechanical hardware will still look new at handover.
Data Retention and Decommissioning of Recording Equipment
CCTV recording equipment raises a consideration that does not apply to most other make good scopes. Any on-site video recording device, whether a dedicated NVR or a server running recording software, is likely to hold recorded footage of the tenancy’s staff, visitors, and operations. The handling of that device at make good is not purely a physical removal scope; it is also an information-handling scope.
Most organisations with any formal information policy will require the recording storage to be wiped, destroyed or securely retained by the organisation before the physical device leaves the tenancy. The make good contractor is generally not the right party to do this work; it sits with the tenant’s IT team or a specialist data destruction provider. The physical removal of the NVR happens after the data handling is complete, and the tenant should not rely on the make good schedule to drive the data timeline.
A modest but real point is that the make good contractor also should not be given access to the recording device while it still holds data. The device is a tenant asset containing tenant-controlled information, and the removal trade’s job is to take a decommissioned unit rather than an active one. Sequencing this cleanly is a programme item rather than a cost item.
Programme and Trade Coordination at Lease End
The logistical point that catches most tenants out is that the security removal trade is usually not the same as the make good contractor. A general fitout contractor running the make good will typically not have the licence, insurance, or expertise to decommission security systems, particularly where the system integrates with the building’s fire alarm. The work is booked separately with the original security installer or a comparable specialist.
The sequencing is tighter than it looks. The security trade needs to be on site after the partition walls have come down enough to expose cable runs, but before the ceiling has been reinstated, because lifting finished ceiling tiles to chase missed cables is an expensive revisit. The fire and compliance re-certification needs to happen after the physical removal but before the landlord’s inspection. The general make good contractor needs the security trade’s work complete before painting and tile replacement finishes.
On a typical medium-sized tenancy, the security trade needs to be booked two to three weeks in advance of its required start date, which means the make good programme has to identify the trade and confirm dates at the scoping stage, not at the execution stage. Tenants who do this well end up with a clean handover. Tenants who leave it to the end find the security trade available only for overtime work at premium rates.
Scoping Security Decommissioning as Its Own Line Item
The quiet piece of advice that saves tenants the most at make good is to treat security decommissioning as a distinct scope in the project documentation, not as a sub-item inside “general electrical” or “miscellaneous removals”. A dedicated line item forces the scope to be priced properly, forces the contractor selection to be made by the right party, and forces the programme dependency to be visible on the schedule.
A properly scoped security line item lists every device by location, identifies its removal method, identifies the cable run and its termination point, identifies any mechanical reversion on doors, identifies the re-certification requirement for integrated services, and specifies the data handling obligation for any recording equipment. The cost picture comes together from there. The programme dependencies slot into the wider make good timeline. The landlord’s inspection has something to verify against.
Without that line item, the security scope usually ends up as an uncosted afterthought, handled in a rushed final week by whichever contractor happens to still be on site, and signed off on by nobody in particular. A structured defit checklist usually has the security line in the right place when it is followed; the problem is that many tenants do not use one until the make good is already underway.
The Reinstatement Side of Security at Make Good
The removal scope is the obvious half of security make good. The reinstatement half is the half that surprises tenants.
Where the tenant fitout modified base-building security infrastructure, the modifications usually need to be reversed at lease end. If the tenant extended the base-building access control system onto an internal door, the extension is removed and the door reverts to its original state. If the tenant relocated a base-building intercom or intercept device, it moves back. If the tenant integrated the base-building fire alarm with a tenant-installed security panel, the integration point is disconnected and the alarm loop restored to the original configuration.
Each of these reinstatements is typically a small physical scope but requires the original installer’s documentation and a re-certification from the relevant trade. If the documentation is missing, which is common on tenancies changing hands across a few years, the reinstatement turns into a diagnostic exercise first, which is the point where schedule and cost both run over.
Tenants who kept their fitout drawings, electrical as-builts, and security system documentation in order usually land cleanly at make good. Tenants who did not keep the paperwork are paying to re-discover what was done in the original fitout, which is almost always more expensive than the reinstatement itself would have been.
If you are planning the end of your lease and the security scope is sitting in the “we will deal with it later” column, we can help you pull it forward into the main make good plan before it becomes the last-minute problem. It belongs alongside the other defit and make good decisions, not bolted on after them.
📞 Call us on 1300 60 93 93